)]}' { "log": [ { "commit": "98b9f8a4549909c6ba2117dfc09404989e6d8710", "tree": "7316de9ca9b37a5bbfe02b512ce4df9430285f9e", "parents": [ "eec3b80fb1ccc6320e0dae85c0dfb2666bc898e1", "32aaf194201e98db4235b7b71ac62a22e2ac355f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Aug 22 21:30:52 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Aug 22 21:30:52 2017 -0700" }, "message": "Merge tag \u0027ext4_for_linus_stable\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4\n\nPull ext4 fixes from Ted Ts\u0027o:\n \"Fix a clang build regression and an potential xattr corruption bug\"\n\n* tag \u0027ext4_for_linus_stable\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:\n ext4: add missing xattr hash update\n ext4: fix clang build regression\n" }, { "commit": "eec3b80fb1ccc6320e0dae85c0dfb2666bc898e1", "tree": "483390f63aa0c7ec4abe0a42e1f17c8e294097a3", "parents": [ "6470812e22261d2342ef1597be62e63a0423d691", "0f0fc5c090055983163ed8e7b3a73980e128048c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Aug 22 10:21:05 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Aug 22 10:21:05 2017 -0700" }, "message": "Merge tag \u0027mfd-fixes-4.13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd\n\nPull MFD fix from Lee Jones:\n \"Revert duplicate commit in da9062-core\"\n\n* tag \u0027mfd-fixes-4.13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd:\n Revert \"mfd: da9061: Fix to remove BBAT_CONT register from chip model\"\n" }, { "commit": "0f0fc5c090055983163ed8e7b3a73980e128048c", "tree": "a1d993066ccf6581ece951c7ffe7966879373c38", "parents": [ "520eccdfe187591a51ea9ab4c1a024ae4d0f68d9" ], "author": { "name": "Lee Jones", "email": "lee.jones@linaro.org", "time": "Tue Aug 15 09:30:05 2017 +0100" }, "committer": { "name": "Lee Jones", "email": "lee.jones@linaro.org", "time": "Tue Aug 22 09:03:00 2017 +0100" }, "message": "Revert \"mfd: da9061: Fix to remove BBAT_CONT register from chip model\"\n\nThis patch was applied to the MFD twice, causing unwanted behavour.\n\nThis reverts commit b77eb79acca3203883e8d8dbc7f2b842def1bff8.\n\nFixes: b77eb79acca3 (\"mfd: da9061: Fix to remove BBAT_CONT register from chip model\")\nReported-by: Steve Twiss \u003cstwiss.opensource@diasemi.com\u003e\nReviewed-by: Steve Twiss \u003cstwiss.opensource@diasemi.com\u003e\nSigned-off-by: Lee Jones \u003clee.jones@linaro.org\u003e\n" }, { "commit": "6470812e22261d2342ef1597be62e63a0423d691", "tree": "79c1a0079b409f203407f4cb63a4b8f10f86909a", "parents": [ "05ab303b4f9e7121b120c08081546a25e067b4f4", "2dc77533f1e495788d73ffa4bee4323b2646d2bb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Aug 21 14:07:48 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Aug 21 14:07:48 2017 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc\n\nPull sparc fixes from David Miller:\n \"Just a couple small fixes, two of which have to do with gcc-7:\n\n 1) Don\u0027t clobber kernel fixed registers in __multi4 libgcc helper.\n\n 2) Fix a new uninitialized variable warning on sparc32 with gcc-7,\n from Thomas Petazzoni.\n\n 3) Adjust pmd_t initializer on sparc32 to make gcc happy.\n\n 4) If ATU isn\u0027t available, don\u0027t bark in the logs. From Tushar Dave\"\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:\n sparc: kernel/pcic: silence gcc 7.x warning in pcibios_fixup_bus()\n sparc64: remove unnecessary log message\n sparc64: Don\u0027t clibber fixed registers in __multi4.\n mm: add pmd_t initializer __pmd() to work around a GCC bug.\n" }, { "commit": "2dc77533f1e495788d73ffa4bee4323b2646d2bb", "tree": "8fbb76a90bf78ed0f2f02135ba523d8fb0ffca44", "parents": [ "6170a506899aee3dd4934c928426505e47b1b466" ], "author": { "name": "Thomas Petazzoni", "email": "thomas.petazzoni@free-electrons.com", "time": "Sun Aug 13 23:14:58 2017 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Aug 21 13:57:22 2017 -0700" }, "message": "sparc: kernel/pcic: silence gcc 7.x warning in pcibios_fixup_bus()\n\nWhen building the kernel for Sparc using gcc 7.x, the build fails\nwith:\n\narch/sparc/kernel/pcic.c: In function ‘pcibios_fixup_bus’:\narch/sparc/kernel/pcic.c:647:8: error: ‘cmd’ may be used uninitialized in this function [-Werror\u003dmaybe-uninitialized]\n cmd |\u003d PCI_COMMAND_IO;\n ^~\n\nThe simplified code looks like this:\n\nunsigned int cmd;\n[...]\npcic_read_config(dev-\u003ebus, dev-\u003edevfn, PCI_COMMAND, 2, \u0026cmd);\n[...]\ncmd |\u003d PCI_COMMAND_IO;\n\nI.e, the code assumes that pcic_read_config() will always initialize\ncmd. But it\u0027s not the case. Looking at pcic_read_config(), if\nbus-\u003enumber is !\u003d 0 or if the size is not one of 1, 2 or 4, *val will\nnot be initialized.\n\nAs a simple fix, we initialize cmd to zero at the beginning of\npcibios_fixup_bus.\n\nSigned-off-by: Thomas Petazzoni \u003cthomas.petazzoni@free-electrons.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "05ab303b4f9e7121b120c08081546a25e067b4f4", "tree": "b7e393fce74ff7028e9f67c07a14f1bf41c71322", "parents": [ "0b3baec853d1de731d2e984f26b92c54842c6ff7", "a8ec3ee861b6e4e6b82a98777c65510ae63766c1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Aug 21 13:30:36 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Aug 21 13:30:36 2017 -0700" }, "message": "Merge tag \u0027arc-4.13-rc7-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc\n\nPull ARC fixes from Vineet Gupta:\n\n - PAE40 related updates\n\n - SLC errata for region ops\n\n - intc line masking by default\n\n* tag \u0027arc-4.13-rc7-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:\n arc: Mask individual IRQ lines during core INTC init\n ARCv2: PAE40: set MSB even if !CONFIG_ARC_HAS_PAE40 but PAE exists in SoC\n ARCv2: PAE40: Explicitly set MSB counterpart of SLC region ops addresses\n ARC: dma: implement dma_unmap_page and sg variant\n ARCv2: SLC: Make sure busy bit is set properly for region ops\n ARC: [plat-sim] Include this platform unconditionally\n ARC: [plat-axs10x]: prepare dts files for enabling PAE40 on axs103\n ARC: defconfig: Cleanup from old Kconfig options\n" }, { "commit": "0b3baec853d1de731d2e984f26b92c54842c6ff7", "tree": "5398e6dfb0049f686f1eed82390ba7652467731a", "parents": [ "e3181f2c0c1bd1c066e9359998131eb524309a8e", "03619844d81d7459874e88034f0f36d959f0e2df" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Aug 21 13:27:51 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Aug 21 13:27:51 2017 -0700" }, "message": "Merge tag \u0027rtc-4.13-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux\n\nPull RTC fix from Alexandre Belloni:\n \"Fix regmap configuration for ds1307\"\n\n* tag \u0027rtc-4.13-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux:\n rtc: ds1307: fix regmap config\n" }, { "commit": "e3181f2c0c1bd1c066e9359998131eb524309a8e", "tree": "f61d3325c86f73163a29759061ea186e86c41a2d", "parents": [ "dd1c1f2f2028a7b851f701fc6a8ebe39dcb95e7c", "348a4002729ccab8b888b38cbc099efa2f2a2036" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Aug 21 13:16:27 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Aug 21 13:16:27 2017 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net\n\nPull networking fixes from David Miller:\n\n 1) Fix IGMP handling wrt VRF, from David Ahern.\n\n 2) Fix timer access to freed object in dccp, from Eric Dumazet.\n\n 3) Use kmalloc_array() in ptr_ring to avoid overflow cases which are\n triggerable by userspace. Also from Eric Dumazet.\n\n 4) Fix infinite loop in unmapping cleanup of nfp driver, from Colin Ian\n King.\n\n 5) Correct datagram peek handling of empty SKBs, from Matthew Dawson.\n\n 6) Fix use after free in TIPC, from Eric Dumazet.\n\n 7) When replacing a route in ipv6 we need to reset the round robin\n pointer, from Wei Wang.\n\n 8) Fix bug in pci_find_pcie_root_port() which was unearthed by the\n relaxed ordering changes, from Thierry Redding. I made sure to get\n an explicit ACK from Bjorn this time around :-)\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (27 commits)\n ipv6: repair fib6 tree in failure case\n net_sched: fix order of queue length updates in qdisc_replace()\n tools lib bpf: improve warning\n switchdev: documentation: minor typo fixes\n bpf, doc: also add s390x as arch to sysctl description\n net: sched: fix NULL pointer dereference when action calls some targets\n rxrpc: Fix oops when discarding a preallocated service call\n irda: do not leak initialized list.dev to userspace\n net/mlx4_core: Enable 4K UAR if SRIOV module parameter is not enabled\n PCI: Allow PCI express root ports to find themselves\n tcp: when rearming RTO, if RTO time is in past then fire RTO ASAP\n net: check and errout if res-\u003efi is NULL when RTM_F_FIB_MATCH is set\n ipv6: reset fn-\u003err_ptr when replacing route\n sctp: fully initialize the IPv6 address in sctp_v6_to_addr()\n tipc: fix use-after-free\n tun: handle register_netdevice() failures properly\n datagram: When peeking datagrams with offset \u003c 0 don\u0027t skip empty skbs\n bpf, doc: improve sysctl knob description\n netxen: fix incorrect loop counter decrement\n nfp: fix infinite loop on umapping cleanup\n ...\n" }, { "commit": "dd1c1f2f2028a7b851f701fc6a8ebe39dcb95e7c", "tree": "96b5e5466504cc8c88b0f0435e80f70f0c627c58", "parents": [ "14ccee78fc82f5512908f4424f541549a5705b89" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Mon Aug 21 17:35:02 2017 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Aug 21 12:47:31 2017 -0700" }, "message": "pids: make task_tgid_nr_ns() safe\n\nThis was reported many times, and this was even mentioned in commit\n52ee2dfdd4f5 (\"pids: refactor vnr/nr_ns helpers to make them safe\") but\nsomehow nobody bothered to fix the obvious problem: task_tgid_nr_ns() is\nnot safe because task-\u003egroup_leader points to nowhere after the exiting\ntask passes exit_notify(), rcu_read_lock() can not help.\n\nWe really need to change __unhash_process() to nullify group_leader,\nparent, and real_parent, but this needs some cleanups. Until then we\ncan turn task_tgid_nr_ns() into another user of __task_pid_nr_ns() and\nfix the problem.\n\nReported-by: Troy Kensinger \u003ctkensinger@google.com\u003e\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "03619844d81d7459874e88034f0f36d959f0e2df", "tree": "c2c3cfa85d161976b6ccb11c2acf6d01fa96694d", "parents": [ "5771a8c08880cdca3bfb4a3fc6d309d6bba20877" ], "author": { "name": "Heiner Kallweit", "email": "hkallweit1@gmail.com", "time": "Tue Jul 25 18:44:04 2017 +0200" }, "committer": { "name": "Alexandre Belloni", "email": "alexandre.belloni@free-electrons.com", "time": "Mon Aug 21 11:08:03 2017 +0200" }, "message": "rtc: ds1307: fix regmap config\n\nCurrent max_register setting breaks reading nvram on certain chips and\nalso reading the standard registers on RX8130 where register map starts\nat 0x10.\n\nSigned-off-by: Heiner Kallweit \u003chkallweit1@gmail.com\u003e\nFixes: 11e5890b5342 \"rtc: ds1307: convert driver to regmap\"\nSigned-off-by: Alexandre Belloni \u003calexandre.belloni@free-electrons.com\u003e\n" }, { "commit": "348a4002729ccab8b888b38cbc099efa2f2a2036", "tree": "e8de091cbebf985312669b999d1ba04668453d1c", "parents": [ "68a66d149a8c78ec6720f268597302883e48e9fa" ], "author": { "name": "Wei Wang", "email": "weiwan@google.com", "time": "Fri Aug 18 17:14:49 2017 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Aug 20 20:06:56 2017 -0700" }, "message": "ipv6: repair fib6 tree in failure case\n\nIn fib6_add(), it is possible that fib6_add_1() picks an intermediate\nnode and sets the node\u0027s fn-\u003eleaf to NULL in order to add this new\nroute. However, if fib6_add_rt2node() fails to add the new\nroute for some reason, fn-\u003eleaf will be left as NULL and could\npotentially cause crash when fn-\u003eleaf is accessed in fib6_locate().\nThis patch makes sure fib6_repair_tree() is called to properly repair\nfn-\u003eleaf in the above failure case.\n\nHere is the syzkaller reported general protection fault in fib6_locate:\nkasan: CONFIG_KASAN_INLINE enabled\nkasan: GPF could be caused by NULL-ptr deref or user memory access\ngeneral protection fault: 0000 [#1] SMP KASAN\nModules linked in:\nCPU: 0 PID: 40937 Comm: syz-executor3 Not tainted\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\ntask: ffff8801d7d64100 ti: ffff8801d01a0000 task.ti: ffff8801d01a0000\nRIP: 0010:[\u003cffffffff82a3e0e1\u003e] [\u003cffffffff82a3e0e1\u003e] __ipv6_prefix_equal64_half include/net/ipv6.h:475 [inline]\nRIP: 0010:[\u003cffffffff82a3e0e1\u003e] [\u003cffffffff82a3e0e1\u003e] ipv6_prefix_equal include/net/ipv6.h:492 [inline]\nRIP: 0010:[\u003cffffffff82a3e0e1\u003e] [\u003cffffffff82a3e0e1\u003e] fib6_locate_1 net/ipv6/ip6_fib.c:1210 [inline]\nRIP: 0010:[\u003cffffffff82a3e0e1\u003e] [\u003cffffffff82a3e0e1\u003e] fib6_locate+0x281/0x3c0 net/ipv6/ip6_fib.c:1233\nRSP: 0018:ffff8801d01a36a8 EFLAGS: 00010202\nRAX: 0000000000000020 RBX: ffff8801bc790e00 RCX: ffffc90002983000\nRDX: 0000000000001219 RSI: ffff8801d01a37a0 RDI: 0000000000000100\nRBP: ffff8801d01a36f0 R08: 00000000000000ff R09: 0000000000000000\nR10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000001\nR13: dffffc0000000000 R14: ffff8801d01a37a0 R15: 0000000000000000\nFS: 00007f6afd68c700(0000) GS:ffff8801db400000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000004c6340 CR3: 00000000ba41f000 CR4: 00000000001426f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nStack:\n ffff8801d01a37a8 ffff8801d01a3780 ffffed003a0346f5 0000000c82a23ea0\n ffff8800b7bd7700 ffff8801d01a3780 ffff8800b6a1c940 ffffffff82a23ea0\n ffff8801d01a3920 ffff8801d01a3748 ffffffff82a223d6 ffff8801d7d64988\nCall Trace:\n [\u003cffffffff82a223d6\u003e] ip6_route_del+0x106/0x570 net/ipv6/route.c:2109\n [\u003cffffffff82a23f9d\u003e] inet6_rtm_delroute+0xfd/0x100 net/ipv6/route.c:3075\n [\u003cffffffff82621359\u003e] rtnetlink_rcv_msg+0x549/0x7a0 net/core/rtnetlink.c:3450\n [\u003cffffffff8274c1d1\u003e] netlink_rcv_skb+0x141/0x370 net/netlink/af_netlink.c:2281\n [\u003cffffffff82613ddf\u003e] rtnetlink_rcv+0x2f/0x40 net/core/rtnetlink.c:3456\n [\u003cffffffff8274ad38\u003e] netlink_unicast_kernel net/netlink/af_netlink.c:1206 [inline]\n [\u003cffffffff8274ad38\u003e] netlink_unicast+0x518/0x750 net/netlink/af_netlink.c:1232\n [\u003cffffffff8274b83e\u003e] netlink_sendmsg+0x8ce/0xc30 net/netlink/af_netlink.c:1778\n [\u003cffffffff82564aff\u003e] sock_sendmsg_nosec net/socket.c:609 [inline]\n [\u003cffffffff82564aff\u003e] sock_sendmsg+0xcf/0x110 net/socket.c:619\n [\u003cffffffff82564d62\u003e] sock_write_iter+0x222/0x3a0 net/socket.c:834\n [\u003cffffffff8178523d\u003e] new_sync_write+0x1dd/0x2b0 fs/read_write.c:478\n [\u003cffffffff817853f4\u003e] __vfs_write+0xe4/0x110 fs/read_write.c:491\n [\u003cffffffff81786c38\u003e] vfs_write+0x178/0x4b0 fs/read_write.c:538\n [\u003cffffffff817892a9\u003e] SYSC_write fs/read_write.c:585 [inline]\n [\u003cffffffff817892a9\u003e] SyS_write+0xd9/0x1b0 fs/read_write.c:577\n [\u003cffffffff82c71e32\u003e] entry_SYSCALL_64_fastpath+0x12/0x17\n\nNote: there is no \"Fixes\" tag as this seems to be a bug introduced\nvery early.\n\nSigned-off-by: Wei Wang \u003cweiwan@google.com\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "68a66d149a8c78ec6720f268597302883e48e9fa", "tree": "f387dd6f84d75bb14d89584ba7246cc8be245aed", "parents": [ "49bf4b36fdee4db3c8bc0507a8413a93a8c711cf" ], "author": { "name": "Konstantin Khlebnikov", "email": "khlebnikov@yandex-team.ru", "time": "Sat Aug 19 15:37:07 2017 +0300" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Aug 20 20:02:00 2017 -0700" }, "message": "net_sched: fix order of queue length updates in qdisc_replace()\n\nThis important to call qdisc_tree_reduce_backlog() after changing queue\nlength. Parent qdisc should deactivate class in -\u003eqlen_notify() called from\nqdisc_tree_reduce_backlog() but this happens only if qdisc-\u003eq.qlen in zero.\n\nMissed class deactivations leads to crashes/warnings at picking packets\nfrom empty qdisc and corrupting state at reactivating this class in future.\n\nSigned-off-by: Konstantin Khlebnikov \u003ckhlebnikov@yandex-team.ru\u003e\nFixes: 86a7996cc8a0 (\"net_sched: introduce qdisc_replace() helper\")\nAcked-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "49bf4b36fdee4db3c8bc0507a8413a93a8c711cf", "tree": "407ac979e80000a4b7d76140269d8ad4e32c8f7c", "parents": [ "5a78449810b06c3bc5fcd002d52e1a64f9bb397e" ], "author": { "name": "Eric Leblond", "email": "eric@regit.org", "time": "Sun Aug 20 21:48:14 2017 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Aug 20 19:49:51 2017 -0700" }, "message": "tools lib bpf: improve warning\n\nSigned-off-by: Eric Leblond \u003ceric@regit.org\u003e\nAcked-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nAcked-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5a78449810b06c3bc5fcd002d52e1a64f9bb397e", "tree": "6a406ad9f2b26ae4a42bc579c5758838a9d09cab", "parents": [ "d4dd2d75a26ef07cadc2949efeea9fabc2a5c299" ], "author": { "name": "Chris Packham", "email": "chris.packham@alliedtelesis.co.nz", "time": "Mon Aug 21 08:52:54 2017 +1200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Aug 20 19:49:10 2017 -0700" }, "message": "switchdev: documentation: minor typo fixes\n\nTwo typos in switchdev.txt\n\nSigned-off-by: Chris Packham \u003cchris.packham@alliedtelesis.co.nz\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "d4dd2d75a26ef07cadc2949efeea9fabc2a5c299", "tree": "47e2bab8d0bee86f6b09dc608c742023cd6353e1", "parents": [ "4f8a881acc9d1adaf1e552349a0b1df28933a04c" ], "author": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Mon Aug 21 00:26:03 2017 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Aug 20 19:45:09 2017 -0700" }, "message": "bpf, doc: also add s390x as arch to sysctl description\n\nLooks like this was accidentally missed, so still add s390x\nas supported eBPF JIT arch to bpf_jit_enable.\n\nFixes: 014cd0a368dc (\"bpf: Update sysctl documentation to list all supported architectures\")\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nAcked-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "14ccee78fc82f5512908f4424f541549a5705b89", "tree": "a227171b7e07bdb7f4bd14818b361577464487bd", "parents": [ "197e7e521384a23b9e585178f3f11c9fa08274b9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 20 14:13:52 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 20 14:13:52 2017 -0700" }, "message": "Linux 4.13-rc6\n" }, { "commit": "197e7e521384a23b9e585178f3f11c9fa08274b9", "tree": "920791387f88f49b969b36cdb722f5f2c951d673", "parents": [ "7f680d7ec3153dffc4d37aea517ead2b9fb9b8e9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 20 13:26:27 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 20 13:26:27 2017 -0700" }, "message": "Sanitize \u0027move_pages()\u0027 permission checks\n\nThe \u0027move_paghes()\u0027 system call was introduced long long ago with the\nsame permission checks as for sending a signal (except using\nCAP_SYS_NICE instead of CAP_SYS_KILL for the overriding capability).\n\nThat turns out to not be a great choice - while the system call really\nonly moves physical page allocations around (and you need other\ncapabilities to do a lot of it), you can check the return value to map\nout some the virtual address choices and defeat ASLR of a binary that\nstill shares your uid.\n\nSo change the access checks to the more common \u0027ptrace_may_access()\u0027\nmodel instead.\n\nThis tightens the access checks for the uid, and also effectively\nchanges the CAP_SYS_NICE check to CAP_SYS_PTRACE, but it\u0027s unlikely that\nanybody really _uses_ this legacy system call any more (we hav ebetter\nNUMA placement models these days), so I expect nobody to notice.\n\nFamous last words.\n\nReported-by: Otto Ebeling \u003cotto.ebeling@iki.fi\u003e\nAcked-by: Eric W. Biederman \u003cebiederm@xmission.com\u003e\nCc: Willy Tarreau \u003cw@1wt.eu\u003e\nCc: stable@kernel.org\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "7f680d7ec3153dffc4d37aea517ead2b9fb9b8e9", "tree": "b2e253a3cd025130610147f343bfb23024234a33", "parents": [ "2615a38f142ffda863dece40120d7fe69af46490", "45bd07ad82622fb7c8dd7504d976b7dd11568965" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 20 09:36:52 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 20 09:36:52 2017 -0700" }, "message": "Merge branch \u0027x86-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Thomas Gleixner:\n \"Another pile of small fixes and updates for x86:\n\n - Plug a hole in the SMAP implementation which misses to clear AC on\n NMI entry\n\n - Fix the norandmaps/ADDR_NO_RANDOMIZE logic so the command line\n parameter works correctly again\n\n - Use the proper accessor in the startup64 code for next_early_pgt to\n prevent accessing of invalid addresses and faulting in the early\n boot code.\n\n - Prevent CPU hotplug lock recursion in the MTRR code\n\n - Unbreak CPU0 hotplugging\n\n - Rename overly long CPUID bits which got introduced in this cycle\n\n - Two commits which mark data \u0027const\u0027 and restrict the scope of data\n and functions to file scope by making them \u0027static\u0027\"\n\n* \u0027x86-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86: Constify attribute_group structures\n x86/boot/64/clang: Use fixup_pointer() to access \u0027next_early_pgt\u0027\n x86/elf: Remove the unnecessary ADDR_NO_RANDOMIZE checks\n x86: Fix norandmaps/ADDR_NO_RANDOMIZE\n x86/mtrr: Prevent CPU hotplug lock recursion\n x86: Mark various structures and functions as \u0027static\u0027\n x86/cpufeature, kvm/svm: Rename (shorten) the new \"virtualized VMSAVE/VMLOAD\" CPUID flag\n x86/smpboot: Unbreak CPU0 hotplug\n x86/asm/64: Clear AC on NMI entries\n" }, { "commit": "2615a38f142ffda863dece40120d7fe69af46490", "tree": "dc8007bf28a1d91d74fc76f20fe8cad64672df41", "parents": [ "e46db8d2ef58f9b515f83be4608cef90ff9ae2c6", "b60bf53abc0323f91ac59b08a7642216281e662e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 20 09:34:24 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 20 09:34:24 2017 -0700" }, "message": "Merge branch \u0027timers-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull timer fixes from Thomas Gleixner:\n \"A few small fixes for timer drivers:\n\n - Prevent infinite recursion in the arm architected timer driver with\n ftrace\n\n - Propagate error codes to the caller in case of failure in EM STI\n driver\n\n - Adjust a bogus loop iteration in the arm architected timer driver\n\n - Add a missing Kconfig dependency to the pistachio clocksource to\n prevent build failures\n\n - Correctly check for IS_ERR() instead of NULL in the shared timer-of\n code\"\n\n* \u0027timers-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n clocksource/drivers/arm_arch_timer: Avoid infinite recursion when ftrace is enabled\n clocksource/drivers/Kconfig: Fix CLKSRC_PISTACHIO dependencies\n clocksource/drivers/timer-of: Checking for IS_ERR() instead of NULL\n clocksource/drivers/em_sti: Fix error return codes in em_sti_probe()\n clocksource/drivers/arm_arch_timer: Fix mem frame loop initialization\n" }, { "commit": "e46db8d2ef58f9b515f83be4608cef90ff9ae2c6", "tree": "a06fb90781963e956c964da12e7cc3aabd33af72", "parents": [ "9dae41a238a952eb65c8aa8a59d8aa39058a7bcf", "9b231d9f47c6114d317ce28cff92a74ad80547f5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 20 09:20:57 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 20 09:20:57 2017 -0700" }, "message": "Merge branch \u0027perf-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf fixes from Thomas Gleixner:\n \"Two fixes for the perf subsystem:\n\n - Fix an inconsistency of RDPMC mm struct tagging across exec() which\n causes RDPMC to fault.\n\n - Correct the timestamp mechanics across IOC_DISABLE/ENABLE which\n causes incorrect timestamps and total time calculations\"\n\n* \u0027perf-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf/core: Fix time on IOC_ENABLE\n perf/x86: Fix RDPMC vs. mm_struct tracking\n" }, { "commit": "9dae41a238a952eb65c8aa8a59d8aa39058a7bcf", "tree": "19a6382bdef8db85c7dac475ed524f7e78803b2a", "parents": [ "e18a5ebc2d507f42ca724581a1039ba058fa12da", "8fbbe2d7cc478d1544f41f2271787c993c23a4f6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 20 09:07:56 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 20 09:07:56 2017 -0700" }, "message": "Merge branch \u0027irq-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull irq fixes from Thomas Gleixner:\n \"A pile of smallish changes all over the place:\n\n - Add a missing ISB in the GIC V1 driver\n\n - Remove an ACPI version check in the GIC V3 ITS driver\n\n - Add the missing irq_pm_shutdown function for BRCMSTB-L2 to avoid\n spurious wakeups\n\n - Remove the artifical limitation of ITS instances to the number of\n NUMA nodes which prevents utilizing the ITS hardware correctly\n\n - Prevent a infinite parsing loop in the GIC-V3 ITS/MSI code\n\n - Honour the force affinity argument in the GIC-V3 driver which is\n required to make perf work correctly\n\n - Correctly report allocation failures in GIC-V2/V3 to avoid using\n half allocated and initialized interrupts.\n\n - Fixup checks against nr_cpu_ids in the generic IPI code\"\n\n* \u0027irq-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n genirq/ipi: Fixup checks against nr_cpu_ids\n genirq: Restore trigger settings in irq_modify_status()\n MAINTAINERS: Remove Jason Cooper\u0027s irqchip git tree\n irqchip/gic-v3-its-platform-msi: Fix msi-parent parsing loop\n irqchip/gic-v3-its: Allow GIC ITS number more than MAX_NUMNODES\n irqchip: brcmstb-l2: Define an irq_pm_shutdown function\n irqchip/gic: Ensure we have an ISB between ack and -\u003ehandle_irq\n irqchip/gic-v3-its: Remove ACPICA version check for ACPI NUMA\n irqchip/gic-v3: Honor forced affinity setting\n irqchip/gic-v3: Report failures in gic_irq_domain_alloc\n irqchip/gic-v2: Report failures in gic_irq_domain_alloc\n irqchip/atmel-aic: Remove root argument from -\u003efixup() prototype\n irqchip/atmel-aic: Fix unbalanced refcount in aic_common_rtc_irq_fixup()\n irqchip/atmel-aic: Fix unbalanced of_node_put() in aic_common_irq_fixup()\n" }, { "commit": "e18a5ebc2d507f42ca724581a1039ba058fa12da", "tree": "9c2378623f5b97f82e1ed31ffb66f21924f35e32", "parents": [ "58d4e450a490d5f02183f6834c12550ba26d3b47", "7edaeb6841dfb27e362288ab8466ebdc4972e867" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 20 08:54:30 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 20 08:54:30 2017 -0700" }, "message": "Merge branch \u0027core-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull watchdog fix from Thomas Gleixner:\n \"A fix for the hardlockup watchdog to prevent false positives with\n extreme Turbo-Modes which make the perf/NMI watchdog fire faster than\n the hrtimer which is used to verify.\n\n Slightly larger than the minimal fix, which just would increase the\n hrtimer frequency, but comes with extra overhead of more watchdog\n timer interrupts and thread wakeups for all users.\n\n With this change we restrict the overhead to the extreme Turbo-Mode\n systems\"\n\n* \u0027core-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n kernel/watchdog: Prevent false positives with turbo modes\n" }, { "commit": "8fbbe2d7cc478d1544f41f2271787c993c23a4f6", "tree": "5216664c8a0de1fab6a27d5400042efc132d6901", "parents": [ "e8f241893dfbbebe2813c01eac54f263e6a5e59c" ], "author": { "name": "Alexey Dobriyan", "email": "adobriyan@gmail.com", "time": "Sat Aug 19 12:57:51 2017 +0300" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Sun Aug 20 10:49:05 2017 +0200" }, "message": "genirq/ipi: Fixup checks against nr_cpu_ids\n\nValid CPU ids are [0, nr_cpu_ids-1] inclusive.\n\nFixes: 3b8e29a82dd1 (\"genirq: Implement ipi_send_mask/single()\")\nFixes: f9bce791ae2a (\"genirq: Add a new function to get IPI reverse mapping\")\nSigned-off-by: Alexey Dobriyan \u003cadobriyan@gmail.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: stable@vger.kernel.org\nLink: http://lkml.kernel.org/r/20170819095751.GB27864@avx2\n\n" }, { "commit": "4f8a881acc9d1adaf1e552349a0b1df28933a04c", "tree": "7592786a35a3e33c69e79c462fb9ad85b3004acc", "parents": [ "9a19bad70cf16b0cdf3576efda7deb490e7aa529" ], "author": { "name": "Xin Long", "email": "lucien.xin@gmail.com", "time": "Fri Aug 18 11:01:36 2017 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Aug 18 16:25:49 2017 -0700" }, "message": "net: sched: fix NULL pointer dereference when action calls some targets\n\nAs we know in some target\u0027s checkentry it may dereference par.entryinfo\nto check entry stuff inside. But when sched action calls xt_check_target,\npar.entryinfo is set with NULL. It would cause kernel panic when calling\nsome targets.\n\nIt can be reproduce with:\n # tc qd add dev eth1 ingress handle ffff:\n # tc filter add dev eth1 parent ffff: u32 match u32 0 0 action xt \\\n -j ECN --ecn-tcp-remove\n\nIt could also crash kernel when using target CLUSTERIP or TPROXY.\n\nBy now there\u0027s no proper value for par.entryinfo in ipt_init_target,\nbut it can not be set with NULL. This patch is to void all these\npanics by setting it with an ipt_entry obj with all members \u003d 0.\n\nNote that this issue has been there since the very beginning.\n\nSigned-off-by: Xin Long \u003clucien.xin@gmail.com\u003e\nAcked-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "9a19bad70cf16b0cdf3576efda7deb490e7aa529", "tree": "a8d36862dae81b010cd8bc41c9cf996d66829124", "parents": [ "b024d949a3c24255a7ef1a470420eb478949aa4c" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Aug 18 00:19:42 2017 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Aug 18 16:23:23 2017 -0700" }, "message": "rxrpc: Fix oops when discarding a preallocated service call\n\nrxrpc_service_prealloc_one() doesn\u0027t set the socket pointer on any new call\nit preallocates, but does add it to the rxrpc net namespace call list.\nThis, however, causes rxrpc_put_call() to oops when the call is discarded\nwhen the socket is closed. rxrpc_put_call() needs the socket to be able to\nreach the namespace so that it can use a lock held therein.\n\nFix this by setting a call\u0027s socket pointer immediately before discarding\nit.\n\nThis can be triggered by unloading the kafs module, resulting in an oops\nlike the following:\n\nBUG: unable to handle kernel NULL pointer dereference at 0000000000000030\nIP: rxrpc_put_call+0x1e2/0x32d\nPGD 0\nP4D 0\nOops: 0000 [#1] SMP\nModules linked in: kafs(E-)\nCPU: 3 PID: 3037 Comm: rmmod Tainted: G E 4.12.0-fscache+ #213\nHardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014\ntask: ffff8803fc92e2c0 task.stack: ffff8803fef74000\nRIP: 0010:rxrpc_put_call+0x1e2/0x32d\nRSP: 0018:ffff8803fef77e08 EFLAGS: 00010282\nRAX: 0000000000000000 RBX: ffff8803fab99ac0 RCX: 000000000000000f\nRDX: ffffffff81c50a40 RSI: 000000000000000c RDI: ffff8803fc92ea88\nRBP: ffff8803fef77e30 R08: ffff8803fc87b941 R09: ffffffff82946d20\nR10: ffff8803fef77d10 R11: 00000000000076fc R12: 0000000000000005\nR13: ffff8803fab99c20 R14: 0000000000000001 R15: ffffffff816c6aee\nFS: 00007f915a059700(0000) GS:ffff88041fb80000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000030 CR3: 00000003fef39000 CR4: 00000000001406e0\nCall Trace:\n rxrpc_discard_prealloc+0x325/0x341\n rxrpc_listen+0xf9/0x146\n kernel_listen+0xb/0xd\n afs_close_socket+0x3e/0x173 [kafs]\n afs_exit+0x1f/0x57 [kafs]\n SyS_delete_module+0x10f/0x19a\n do_syscall_64+0x8a/0x149\n entry_SYSCALL64_slow_path+0x25/0x25\n\nFixes: 2baec2c3f854 (\"rxrpc: Support network namespacing\")\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "b024d949a3c24255a7ef1a470420eb478949aa4c", "tree": "9b66d1d97db2e83f862ce392422899e596b6f0a2", "parents": [ "ca3d89a3ebe79367bd41b6b8ba37664478ae2dba" ], "author": { "name": "Colin Ian King", "email": "colin.king@canonical.com", "time": "Thu Aug 17 23:14:58 2017 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Aug 18 16:21:51 2017 -0700" }, "message": "irda: do not leak initialized list.dev to userspace\n\nlist.dev has not been initialized and so the copy_to_user is copying\ndata from the stack back to user space which is a potential\ninformation leak. Fix this ensuring all of list is initialized to\nzero.\n\nDetected by CoverityScan, CID#1357894 (\"Uninitialized scalar variable\")\n\nSigned-off-by: Colin Ian King \u003ccolin.king@canonical.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "ca3d89a3ebe79367bd41b6b8ba37664478ae2dba", "tree": "9002fac3828db98098415e2761eea302309cabee", "parents": [ "b6f6d56c91f5261c55edef2df300698c4486b669" ], "author": { "name": "Huy Nguyen", "email": "huyn@mellanox.com", "time": "Thu Aug 17 18:29:52 2017 +0300" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Aug 18 16:15:37 2017 -0700" }, "message": "net/mlx4_core: Enable 4K UAR if SRIOV module parameter is not enabled\n\nenable_4k_uar module parameter was added in patch cited below to\naddress the backward compatibility issue in SRIOV when the VM has\nsystem\u0027s PAGE_SIZE uar implementation and the Hypervisor has 4k uar\nimplementation.\n\nThe above compatibility issue does not exist in the non SRIOV case.\nIn this patch, we always enable 4k uar implementation if SRIOV\nis not enabled on mlx4\u0027s supported cards.\n\nFixes: 76e39ccf9c36 (\"net/mlx4_core: Fix backward compatibility on VFs\")\nSigned-off-by: Huy Nguyen \u003chuyn@mellanox.com\u003e\nReviewed-by: Daniel Jurgens \u003cdanielj@mellanox.com\u003e\nSigned-off-by: Saeed Mahameed \u003csaeedm@mellanox.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "b6f6d56c91f5261c55edef2df300698c4486b669", "tree": "29d44f8bdb6e0e9fd844b975bab9d2f6144c0aff", "parents": [ "cdbeb633ca71a02b7b63bfeb94994bf4e1a0b894" ], "author": { "name": "Thierry Reding", "email": "treding@nvidia.com", "time": "Thu Aug 17 13:06:14 2017 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Aug 18 16:14:37 2017 -0700" }, "message": "PCI: Allow PCI express root ports to find themselves\n\nIf the pci_find_pcie_root_port() function is called on a root port\nitself, return the root port rather than NULL.\n\nThis effectively reverts commit 0e405232871d6 (\"PCI: fix oops when\ntry to find Root Port for a PCI device\") which added an extra check\nthat would now be redundant.\n\nFixes: a99b646afa8a (\"PCI: Disable PCIe Relaxed Ordering if unsupported\")\nFixes: c56d4450eb68 (\"PCI: Turn off Request Attributes to avoid Chelsio T5 Completion erratum\")\nSigned-off-by: Thierry Reding \u003ctreding@nvidia.com\u003e\nAcked-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nTested-by: Shawn Lin \u003cshawn.lin@rock-chips.com\u003e\nTested-by: Michael Ellerman \u003cmpe@ellerman.id.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "cdbeb633ca71a02b7b63bfeb94994bf4e1a0b894", "tree": "96d187e3d5f38c8fcb9045fb1ff323ad8164b021", "parents": [ "bc3aae2bbac46dd894c89db5d5e98f7f0ef9e205" ], "author": { "name": "Neal Cardwell", "email": "ncardwell@google.com", "time": "Wed Aug 16 17:53:36 2017 -0400" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Aug 18 16:07:43 2017 -0700" }, "message": "tcp: when rearming RTO, if RTO time is in past then fire RTO ASAP\n\nIn some situations tcp_send_loss_probe() can realize that it\u0027s unable\nto send a loss probe (TLP), and falls back to calling tcp_rearm_rto()\nto schedule an RTO timer. In such cases, sometimes tcp_rearm_rto()\nrealizes that the RTO was eligible to fire immediately or at some\npoint in the past (delta_us \u003c\u003d 0). Previously in such cases\ntcp_rearm_rto() was scheduling such \"overdue\" RTOs to happen at now +\nicsk_rto, which caused needless delays of hundreds of milliseconds\n(and non-linear behavior that made reproducible testing\ndifficult). This commit changes the logic to schedule \"overdue\" RTOs\nASAP, rather than at now + icsk_rto.\n\nFixes: 6ba8a3b19e76 (\"tcp: Tail loss probe (TLP)\")\nSuggested-by: Yuchung Cheng \u003cycheng@google.com\u003e\nSigned-off-by: Neal Cardwell \u003cncardwell@google.com\u003e\nSigned-off-by: Yuchung Cheng \u003cycheng@google.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "58d4e450a490d5f02183f6834c12550ba26d3b47", "tree": "4c1ada2d3cb98f5fb8c546a0c95fc28a3f733b83", "parents": [ "cc28fcdc017e553375c999ca12107ceb27f34ab3", "c715b72c1ba406f133217b509044c38d8e714a37" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 16:06:33 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 16:06:33 2017 -0700" }, "message": "Merge branch \u0027akpm\u0027 (patches from Andrew)\n\nMerge misc fixes from Andrew Morton:\n \"14 fixes\"\n\n* emailed patches from Andrew Morton \u003cakpm@linux-foundation.org\u003e:\n mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base changes\n mm/vmalloc.c: don\u0027t unconditonally use __GFP_HIGHMEM\n mm/mempolicy: fix use after free when calling get_mempolicy\n mm/cma_debug.c: fix stack corruption due to sprintf usage\n signal: don\u0027t remove SIGNAL_UNKILLABLE for traced tasks.\n mm, oom: fix potential data corruption when oom_reaper races with writer\n mm: fix double mmap_sem unlock on MMF_UNSTABLE enforced SIGBUS\n slub: fix per memcg cache leak on css offline\n mm: discard memblock data later\n test_kmod: fix description for -s -and -c parameters\n kmod: fix wait on recursive loop\n wait: add wait_event_killable_timeout()\n kernel/watchdog: fix Kconfig constraints for perf hardlockup watchdog\n mm: memcontrol: fix NULL pointer crash in test_clear_page_writeback()\n" }, { "commit": "bc3aae2bbac46dd894c89db5d5e98f7f0ef9e205", "tree": "a648fe67822cbb1f69081d1686e5397c60169e78", "parents": [ "383143f31d7d3525a1dbff733d52fff917f82f15" ], "author": { "name": "Roopa Prabhu", "email": "roopa@cumulusnetworks.com", "time": "Wed Aug 16 12:38:52 2017 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Aug 18 16:05:46 2017 -0700" }, "message": "net: check and errout if res-\u003efi is NULL when RTM_F_FIB_MATCH is set\n\nSyzkaller hit \u0027general protection fault in fib_dump_info\u0027 bug on\ncommit 4.13-rc5..\n\nGuilty file: net/ipv4/fib_semantics.c\n\nkasan: GPF could be caused by NULL-ptr deref or user memory access\ngeneral protection fault: 0000 [#1] SMP KASAN\nModules linked in:\nCPU: 0 PID: 2808 Comm: syz-executor0 Not tainted 4.13.0-rc5 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\nUbuntu-1.8.2-1ubuntu1 04/01/2014\ntask: ffff880078562700 task.stack: ffff880078110000\nRIP: 0010:fib_dump_info+0x388/0x1170 net/ipv4/fib_semantics.c:1314\nRSP: 0018:ffff880078117010 EFLAGS: 00010206\nRAX: dffffc0000000000 RBX: 00000000000000fe RCX: 0000000000000002\nRDX: 0000000000000006 RSI: ffff880078117084 RDI: 0000000000000030\nRBP: ffff880078117268 R08: 000000000000000c R09: ffff8800780d80c8\nR10: 0000000058d629b4 R11: 0000000067fce681 R12: 0000000000000000\nR13: ffff8800784bd540 R14: ffff8800780d80b5 R15: ffff8800780d80a4\nFS: 00000000022fa940(0000) GS:ffff88007fc00000(0000)\nknlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000004387d0 CR3: 0000000079135000 CR4: 00000000000006f0\nCall Trace:\n inet_rtm_getroute+0xc89/0x1f50 net/ipv4/route.c:2766\n rtnetlink_rcv_msg+0x288/0x680 net/core/rtnetlink.c:4217\n netlink_rcv_skb+0x340/0x470 net/netlink/af_netlink.c:2397\n rtnetlink_rcv+0x28/0x30 net/core/rtnetlink.c:4223\n netlink_unicast_kernel net/netlink/af_netlink.c:1265 [inline]\n netlink_unicast+0x4c4/0x6e0 net/netlink/af_netlink.c:1291\n netlink_sendmsg+0x8c4/0xca0 net/netlink/af_netlink.c:1854\n sock_sendmsg_nosec net/socket.c:633 [inline]\n sock_sendmsg+0xca/0x110 net/socket.c:643\n ___sys_sendmsg+0x779/0x8d0 net/socket.c:2035\n __sys_sendmsg+0xd1/0x170 net/socket.c:2069\n SYSC_sendmsg net/socket.c:2080 [inline]\n SyS_sendmsg+0x2d/0x50 net/socket.c:2076\n entry_SYSCALL_64_fastpath+0x1a/0xa5\n RIP: 0033:0x4512e9\n RSP: 002b:00007ffc75584cc8 EFLAGS: 00000216 ORIG_RAX:\n 000000000000002e\n RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00000000004512e9\n RDX: 0000000000000000 RSI: 0000000020f2cfc8 RDI: 0000000000000003\n RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000216 R12: fffffffffffffffe\n R13: 0000000000718000 R14: 0000000020c44ff0 R15: 0000000000000000\n Code: 00 0f b6 8d ec fd ff ff 48 8b 85 f0 fd ff ff 88 48 17 48 8b 45\n 28 48 8d 78 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03\n \u003c0f\u003e\n b6 04 02 84 c0 74 08 3c 03 0f 8e cb 0c 00 00 48 8b 45 28 44\n RIP: fib_dump_info+0x388/0x1170 net/ipv4/fib_semantics.c:1314 RSP:\n ffff880078117010\n---[ end trace 254a7af28348f88b ]---\n\nThis patch adds a res-\u003efi NULL check.\n\nexample run:\n$ip route get 0.0.0.0 iif virt1-0\nbroadcast 0.0.0.0 dev lo\n cache \u003clocal,brd\u003e iif virt1-0\n\n$ip route get 0.0.0.0 iif virt1-0 fibmatch\nRTNETLINK answers: No route to host\n\nReported-by: idaifish \u003cidaifish@gmail.com\u003e\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nFixes: b61798130f1b (\"net: ipv4: RTM_GETROUTE: return matched fib result when requested\")\nSigned-off-by: Roopa Prabhu \u003croopa@cumulusnetworks.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "383143f31d7d3525a1dbff733d52fff917f82f15", "tree": "69ae905960c1f3f240e9feab81975267d7344fa2", "parents": [ "15339e441ec46fbc3bf3486bb1ae4845b0f1bb8d" ], "author": { "name": "Wei Wang", "email": "weiwan@google.com", "time": "Wed Aug 16 11:18:09 2017 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Aug 18 16:02:22 2017 -0700" }, "message": "ipv6: reset fn-\u003err_ptr when replacing route\n\nsyzcaller reported the following use-after-free issue in rt6_select():\nBUG: KASAN: use-after-free in rt6_select net/ipv6/route.c:755 [inline] at addr ffff8800bc6994e8\nBUG: KASAN: use-after-free in ip6_pol_route.isra.46+0x1429/0x1470 net/ipv6/route.c:1084 at addr ffff8800bc6994e8\nRead of size 4 by task syz-executor1/439628\nCPU: 0 PID: 439628 Comm: syz-executor1 Not tainted 4.3.5+ #8\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\n 0000000000000000 ffff88018fe435b0 ffffffff81ca384d ffff8801d3588c00\n ffff8800bc699380 ffff8800bc699500 dffffc0000000000 ffff8801d40a47c0\n ffff88018fe435d8 ffffffff81735751 ffff88018fe43660 ffff8800bc699380\nCall Trace:\n [\u003cffffffff81ca384d\u003e] __dump_stack lib/dump_stack.c:15 [inline]\n [\u003cffffffff81ca384d\u003e] dump_stack+0xc1/0x124 lib/dump_stack.c:51\nsctp: [Deprecated]: syz-executor0 (pid 439615) Use of struct sctp_assoc_value in delayed_ack socket option.\nUse struct sctp_sack_info instead\n [\u003cffffffff81735751\u003e] kasan_object_err+0x21/0x70 mm/kasan/report.c:158\n [\u003cffffffff817359c4\u003e] print_address_description mm/kasan/report.c:196 [inline]\n [\u003cffffffff817359c4\u003e] kasan_report_error+0x1b4/0x4a0 mm/kasan/report.c:285\n [\u003cffffffff81735d93\u003e] kasan_report mm/kasan/report.c:305 [inline]\n [\u003cffffffff81735d93\u003e] __asan_report_load4_noabort+0x43/0x50 mm/kasan/report.c:325\n [\u003cffffffff82a28e39\u003e] rt6_select net/ipv6/route.c:755 [inline]\n [\u003cffffffff82a28e39\u003e] ip6_pol_route.isra.46+0x1429/0x1470 net/ipv6/route.c:1084\n [\u003cffffffff82a28fb1\u003e] ip6_pol_route_output+0x81/0xb0 net/ipv6/route.c:1203\n [\u003cffffffff82ab0a50\u003e] fib6_rule_action+0x1f0/0x680 net/ipv6/fib6_rules.c:95\n [\u003cffffffff8265cbb6\u003e] fib_rules_lookup+0x2a6/0x7a0 net/core/fib_rules.c:223\n [\u003cffffffff82ab1430\u003e] fib6_rule_lookup+0xd0/0x250 net/ipv6/fib6_rules.c:41\n [\u003cffffffff82a22006\u003e] ip6_route_output+0x1d6/0x2c0 net/ipv6/route.c:1224\n [\u003cffffffff829e83d2\u003e] ip6_dst_lookup_tail+0x4d2/0x890 net/ipv6/ip6_output.c:943\n [\u003cffffffff829e889a\u003e] ip6_dst_lookup_flow+0x9a/0x250 net/ipv6/ip6_output.c:1079\n [\u003cffffffff82a9f7d8\u003e] ip6_datagram_dst_update+0x538/0xd40 net/ipv6/datagram.c:91\n [\u003cffffffff82aa0978\u003e] __ip6_datagram_connect net/ipv6/datagram.c:251 [inline]\n [\u003cffffffff82aa0978\u003e] ip6_datagram_connect+0x518/0xe50 net/ipv6/datagram.c:272\n [\u003cffffffff82aa1313\u003e] ip6_datagram_connect_v6_only+0x63/0x90 net/ipv6/datagram.c:284\n [\u003cffffffff8292f790\u003e] inet_dgram_connect+0x170/0x1f0 net/ipv4/af_inet.c:564\n [\u003cffffffff82565547\u003e] SYSC_connect+0x1a7/0x2f0 net/socket.c:1582\n [\u003cffffffff8256a649\u003e] SyS_connect+0x29/0x30 net/socket.c:1563\n [\u003cffffffff82c72032\u003e] entry_SYSCALL_64_fastpath+0x12/0x17\nObject at ffff8800bc699380, in cache ip6_dst_cache size: 384\n\nThe root cause of it is that in fib6_add_rt2node(), when it replaces an\nexisting route with the new one, it does not update fn-\u003err_ptr.\nThis commit resets fn-\u003err_ptr to NULL when it points to a route which is\nreplaced in fib6_add_rt2node().\n\nFixes: 27596472473a (\"ipv6: fix ECMP route replacement\")\nSigned-off-by: Wei Wang \u003cweiwan@google.com\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "15339e441ec46fbc3bf3486bb1ae4845b0f1bb8d", "tree": "5e1e609616538d5718fbaeda1c7fa075d431feee", "parents": [ "5bfd37b4de5c98e86b12bd13be5aa46c7484a125" ], "author": { "name": "Alexander Potapenko", "email": "glider@google.com", "time": "Wed Aug 16 20:16:40 2017 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Aug 18 16:00:47 2017 -0700" }, "message": "sctp: fully initialize the IPv6 address in sctp_v6_to_addr()\n\nKMSAN reported use of uninitialized sctp_addr-\u003ev4.sin_addr.s_addr and\nsctp_addr-\u003ev6.sin6_scope_id in sctp_v6_cmp_addr() (see below).\nMake sure all fields of an IPv6 address are initialized, which\nguarantees that the IPv4 fields are also initialized.\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n BUG: KMSAN: use of uninitialized memory in sctp_v6_cmp_addr+0x8d4/0x9f0\n net/sctp/ipv6.c:517\n CPU: 2 PID: 31056 Comm: syz-executor1 Not tainted 4.11.0-rc5+ #2944\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs\n 01/01/2011\n Call Trace:\n dump_stack+0x172/0x1c0 lib/dump_stack.c:42\n is_logbuf_locked mm/kmsan/kmsan.c:59 [inline]\n kmsan_report+0x12a/0x180 mm/kmsan/kmsan.c:938\n native_save_fl arch/x86/include/asm/irqflags.h:18 [inline]\n arch_local_save_flags arch/x86/include/asm/irqflags.h:72 [inline]\n arch_local_irq_save arch/x86/include/asm/irqflags.h:113 [inline]\n __msan_warning_32+0x61/0xb0 mm/kmsan/kmsan_instr.c:467\n sctp_v6_cmp_addr+0x8d4/0x9f0 net/sctp/ipv6.c:517\n sctp_v6_get_dst+0x8c7/0x1630 net/sctp/ipv6.c:290\n sctp_transport_route+0x101/0x570 net/sctp/transport.c:292\n sctp_assoc_add_peer+0x66d/0x16f0 net/sctp/associola.c:651\n sctp_sendmsg+0x35a5/0x4f90 net/sctp/socket.c:1871\n inet_sendmsg+0x498/0x670 net/ipv4/af_inet.c:762\n sock_sendmsg_nosec net/socket.c:633 [inline]\n sock_sendmsg net/socket.c:643 [inline]\n SYSC_sendto+0x608/0x710 net/socket.c:1696\n SyS_sendto+0x8a/0xb0 net/socket.c:1664\n entry_SYSCALL_64_fastpath+0x13/0x94\n RIP: 0033:0x44b479\n RSP: 002b:00007f6213f21c08 EFLAGS: 00000286 ORIG_RAX: 000000000000002c\n RAX: ffffffffffffffda RBX: 0000000020000000 RCX: 000000000044b479\n RDX: 0000000000000041 RSI: 0000000020edd000 RDI: 0000000000000006\n RBP: 00000000007080a8 R08: 0000000020b85fe4 R09: 000000000000001c\n R10: 0000000000040005 R11: 0000000000000286 R12: 00000000ffffffff\n R13: 0000000000003760 R14: 00000000006e5820 R15: 0000000000ff8000\n origin description: ----dst_saddr@sctp_v6_get_dst\n local variable created at:\n sk_fullsock include/net/sock.h:2321 [inline]\n inet6_sk include/linux/ipv6.h:309 [inline]\n sctp_v6_get_dst+0x91/0x1630 net/sctp/ipv6.c:241\n sctp_transport_route+0x101/0x570 net/sctp/transport.c:292\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n BUG: KMSAN: use of uninitialized memory in sctp_v6_cmp_addr+0x8d4/0x9f0\n net/sctp/ipv6.c:517\n CPU: 2 PID: 31056 Comm: syz-executor1 Not tainted 4.11.0-rc5+ #2944\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs\n 01/01/2011\n Call Trace:\n dump_stack+0x172/0x1c0 lib/dump_stack.c:42\n is_logbuf_locked mm/kmsan/kmsan.c:59 [inline]\n kmsan_report+0x12a/0x180 mm/kmsan/kmsan.c:938\n native_save_fl arch/x86/include/asm/irqflags.h:18 [inline]\n arch_local_save_flags arch/x86/include/asm/irqflags.h:72 [inline]\n arch_local_irq_save arch/x86/include/asm/irqflags.h:113 [inline]\n __msan_warning_32+0x61/0xb0 mm/kmsan/kmsan_instr.c:467\n sctp_v6_cmp_addr+0x8d4/0x9f0 net/sctp/ipv6.c:517\n sctp_v6_get_dst+0x8c7/0x1630 net/sctp/ipv6.c:290\n sctp_transport_route+0x101/0x570 net/sctp/transport.c:292\n sctp_assoc_add_peer+0x66d/0x16f0 net/sctp/associola.c:651\n sctp_sendmsg+0x35a5/0x4f90 net/sctp/socket.c:1871\n inet_sendmsg+0x498/0x670 net/ipv4/af_inet.c:762\n sock_sendmsg_nosec net/socket.c:633 [inline]\n sock_sendmsg net/socket.c:643 [inline]\n SYSC_sendto+0x608/0x710 net/socket.c:1696\n SyS_sendto+0x8a/0xb0 net/socket.c:1664\n entry_SYSCALL_64_fastpath+0x13/0x94\n RIP: 0033:0x44b479\n RSP: 002b:00007f6213f21c08 EFLAGS: 00000286 ORIG_RAX: 000000000000002c\n RAX: ffffffffffffffda RBX: 0000000020000000 RCX: 000000000044b479\n RDX: 0000000000000041 RSI: 0000000020edd000 RDI: 0000000000000006\n RBP: 00000000007080a8 R08: 0000000020b85fe4 R09: 000000000000001c\n R10: 0000000000040005 R11: 0000000000000286 R12: 00000000ffffffff\n R13: 0000000000003760 R14: 00000000006e5820 R15: 0000000000ff8000\n origin description: ----dst_saddr@sctp_v6_get_dst\n local variable created at:\n sk_fullsock include/net/sock.h:2321 [inline]\n inet6_sk include/linux/ipv6.h:309 [inline]\n sctp_v6_get_dst+0x91/0x1630 net/sctp/ipv6.c:241\n sctp_transport_route+0x101/0x570 net/sctp/transport.c:292\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: Alexander Potapenko \u003cglider@google.com\u003e\nReviewed-by: Xin Long \u003clucien.xin@gmail.com\u003e\nAcked-by: Marcelo Ricardo Leitner \u003cmarcelo.leitner@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5bfd37b4de5c98e86b12bd13be5aa46c7484a125", "tree": "2ba83d1ca9461a26f92b7f921c78c3d229875ca0", "parents": [ "ff244c6b29b176f3f448bc75e55df297225e1b3a" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Aug 16 09:41:54 2017 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Aug 18 15:59:29 2017 -0700" }, "message": "tipc: fix use-after-free\n\nsyszkaller reported use-after-free in tipc [1]\n\nWhen msg-\u003erep skb is freed, set the pointer to NULL,\nso that caller does not free it again.\n\n[1]\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nBUG: KASAN: use-after-free in skb_push+0xd4/0xe0 net/core/skbuff.c:1466\nRead of size 8 at addr ffff8801c6e71e90 by task syz-executor5/4115\n\nCPU: 1 PID: 4115 Comm: syz-executor5 Not tainted 4.13.0-rc4+ #32\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:16 [inline]\n dump_stack+0x194/0x257 lib/dump_stack.c:52\n print_address_description+0x73/0x250 mm/kasan/report.c:252\n kasan_report_error mm/kasan/report.c:351 [inline]\n kasan_report+0x24e/0x340 mm/kasan/report.c:409\n __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:430\n skb_push+0xd4/0xe0 net/core/skbuff.c:1466\n tipc_nl_compat_recv+0x833/0x18f0 net/tipc/netlink_compat.c:1209\n genl_family_rcv_msg+0x7b7/0xfb0 net/netlink/genetlink.c:598\n genl_rcv_msg+0xb2/0x140 net/netlink/genetlink.c:623\n netlink_rcv_skb+0x216/0x440 net/netlink/af_netlink.c:2397\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:634\n netlink_unicast_kernel net/netlink/af_netlink.c:1265 [inline]\n netlink_unicast+0x4e8/0x6f0 net/netlink/af_netlink.c:1291\n netlink_sendmsg+0xa4a/0xe60 net/netlink/af_netlink.c:1854\n sock_sendmsg_nosec net/socket.c:633 [inline]\n sock_sendmsg+0xca/0x110 net/socket.c:643\n sock_write_iter+0x31a/0x5d0 net/socket.c:898\n call_write_iter include/linux/fs.h:1743 [inline]\n new_sync_write fs/read_write.c:457 [inline]\n __vfs_write+0x684/0x970 fs/read_write.c:470\n vfs_write+0x189/0x510 fs/read_write.c:518\n SYSC_write fs/read_write.c:565 [inline]\n SyS_write+0xef/0x220 fs/read_write.c:557\n entry_SYSCALL_64_fastpath+0x1f/0xbe\nRIP: 0033:0x4512e9\nRSP: 002b:00007f3bc8184c08 EFLAGS: 00000216 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 0000000000718000 RCX: 00000000004512e9\nRDX: 0000000000000020 RSI: 0000000020fdb000 RDI: 0000000000000006\nRBP: 0000000000000086 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000216 R12: 00000000004b5e76\nR13: 00007f3bc8184b48 R14: 00000000004b5e86 R15: 0000000000000000\n\nAllocated by task 4115:\n save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59\n save_stack+0x43/0xd0 mm/kasan/kasan.c:447\n set_track mm/kasan/kasan.c:459 [inline]\n kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551\n kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489\n kmem_cache_alloc_node+0x13d/0x750 mm/slab.c:3651\n __alloc_skb+0xf1/0x740 net/core/skbuff.c:219\n alloc_skb include/linux/skbuff.h:903 [inline]\n tipc_tlv_alloc+0x26/0xb0 net/tipc/netlink_compat.c:148\n tipc_nl_compat_dumpit+0xf2/0x3c0 net/tipc/netlink_compat.c:248\n tipc_nl_compat_handle net/tipc/netlink_compat.c:1130 [inline]\n tipc_nl_compat_recv+0x756/0x18f0 net/tipc/netlink_compat.c:1199\n genl_family_rcv_msg+0x7b7/0xfb0 net/netlink/genetlink.c:598\n genl_rcv_msg+0xb2/0x140 net/netlink/genetlink.c:623\n netlink_rcv_skb+0x216/0x440 net/netlink/af_netlink.c:2397\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:634\n netlink_unicast_kernel net/netlink/af_netlink.c:1265 [inline]\n netlink_unicast+0x4e8/0x6f0 net/netlink/af_netlink.c:1291\n netlink_sendmsg+0xa4a/0xe60 net/netlink/af_netlink.c:1854\n sock_sendmsg_nosec net/socket.c:633 [inline]\n sock_sendmsg+0xca/0x110 net/socket.c:643\n sock_write_iter+0x31a/0x5d0 net/socket.c:898\n call_write_iter include/linux/fs.h:1743 [inline]\n new_sync_write fs/read_write.c:457 [inline]\n __vfs_write+0x684/0x970 fs/read_write.c:470\n vfs_write+0x189/0x510 fs/read_write.c:518\n SYSC_write fs/read_write.c:565 [inline]\n SyS_write+0xef/0x220 fs/read_write.c:557\n entry_SYSCALL_64_fastpath+0x1f/0xbe\n\nFreed by task 4115:\n save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59\n save_stack+0x43/0xd0 mm/kasan/kasan.c:447\n set_track mm/kasan/kasan.c:459 [inline]\n kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524\n __cache_free mm/slab.c:3503 [inline]\n kmem_cache_free+0x77/0x280 mm/slab.c:3763\n kfree_skbmem+0x1a1/0x1d0 net/core/skbuff.c:622\n __kfree_skb net/core/skbuff.c:682 [inline]\n kfree_skb+0x165/0x4c0 net/core/skbuff.c:699\n tipc_nl_compat_dumpit+0x36a/0x3c0 net/tipc/netlink_compat.c:260\n tipc_nl_compat_handle net/tipc/netlink_compat.c:1130 [inline]\n tipc_nl_compat_recv+0x756/0x18f0 net/tipc/netlink_compat.c:1199\n genl_family_rcv_msg+0x7b7/0xfb0 net/netlink/genetlink.c:598\n genl_rcv_msg+0xb2/0x140 net/netlink/genetlink.c:623\n netlink_rcv_skb+0x216/0x440 net/netlink/af_netlink.c:2397\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:634\n netlink_unicast_kernel net/netlink/af_netlink.c:1265 [inline]\n netlink_unicast+0x4e8/0x6f0 net/netlink/af_netlink.c:1291\n netlink_sendmsg+0xa4a/0xe60 net/netlink/af_netlink.c:1854\n sock_sendmsg_nosec net/socket.c:633 [inline]\n sock_sendmsg+0xca/0x110 net/socket.c:643\n sock_write_iter+0x31a/0x5d0 net/socket.c:898\n call_write_iter include/linux/fs.h:1743 [inline]\n new_sync_write fs/read_write.c:457 [inline]\n __vfs_write+0x684/0x970 fs/read_write.c:470\n vfs_write+0x189/0x510 fs/read_write.c:518\n SYSC_write fs/read_write.c:565 [inline]\n SyS_write+0xef/0x220 fs/read_write.c:557\n entry_SYSCALL_64_fastpath+0x1f/0xbe\n\nThe buggy address belongs to the object at ffff8801c6e71dc0\n which belongs to the cache skbuff_head_cache of size 224\nThe buggy address is located 208 bytes inside of\n 224-byte region [ffff8801c6e71dc0, ffff8801c6e71ea0)\nThe buggy address belongs to the page:\npage:ffffea00071b9c40 count:1 mapcount:0 mapping:ffff8801c6e71000 index:0x0\nflags: 0x200000000000100(slab)\nraw: 0200000000000100 ffff8801c6e71000 0000000000000000 000000010000000c\nraw: ffffea0007224a20 ffff8801d98caf48 ffff8801d9e79040 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff8801c6e71d80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb\n ffff8801c6e71e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\u003effff8801c6e71e80: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc\n ^\n ffff8801c6e71f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n ffff8801c6e71f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nCc: Jon Maloy \u003cjon.maloy@ericsson.com\u003e\nCc: Ying Xue \u003cying.xue@windriver.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "ff244c6b29b176f3f448bc75e55df297225e1b3a", "tree": "1a8b861b47ebb37accc7d362cd1e78fc17d54711", "parents": [ "a0917e0bc6efc05834c0c1eafebd579a9c75e6e9" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Fri Aug 18 13:39:56 2017 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Aug 18 15:55:35 2017 -0700" }, "message": "tun: handle register_netdevice() failures properly\n\nsyzkaller reported a double free [1], caused by the fact\nthat tun driver was not updated properly when priv_destructor\nwas added.\n\nWhen/if register_netdevice() fails, priv_destructor() must have been\ncalled already.\n\n[1]\nBUG: KASAN: double-free or invalid-free in selinux_tun_dev_free_security+0x15/0x20 security/selinux/hooks.c:5023\n\nCPU: 0 PID: 2919 Comm: syzkaller227220 Not tainted 4.13.0-rc4+ #23\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:16 [inline]\n dump_stack+0x194/0x257 lib/dump_stack.c:52\n print_address_description+0x7f/0x260 mm/kasan/report.c:252\n kasan_report_double_free+0x55/0x80 mm/kasan/report.c:333\n kasan_slab_free+0xa0/0xc0 mm/kasan/kasan.c:514\n __cache_free mm/slab.c:3503 [inline]\n kfree+0xd3/0x260 mm/slab.c:3820\n selinux_tun_dev_free_security+0x15/0x20 security/selinux/hooks.c:5023\n security_tun_dev_free_security+0x48/0x80 security/security.c:1512\n tun_set_iff drivers/net/tun.c:1884 [inline]\n __tun_chr_ioctl+0x2ce6/0x3d50 drivers/net/tun.c:2064\n tun_chr_ioctl+0x2a/0x40 drivers/net/tun.c:2309\n vfs_ioctl fs/ioctl.c:45 [inline]\n do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:685\n SYSC_ioctl fs/ioctl.c:700 [inline]\n SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691\n entry_SYSCALL_64_fastpath+0x1f/0xbe\nRIP: 0033:0x443ff9\nRSP: 002b:00007ffc34271f68 EFLAGS: 00000217 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 0000000000443ff9\nRDX: 0000000020533000 RSI: 00000000400454ca RDI: 0000000000000003\nRBP: 0000000000000086 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000217 R12: 0000000000401ce0\nR13: 0000000000401d70 R14: 0000000000000000 R15: 0000000000000000\n\nAllocated by task 2919:\n save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59\n save_stack+0x43/0xd0 mm/kasan/kasan.c:447\n set_track mm/kasan/kasan.c:459 [inline]\n kasan_kmalloc+0xaa/0xd0 mm/kasan/kasan.c:551\n kmem_cache_alloc_trace+0x101/0x6f0 mm/slab.c:3627\n kmalloc include/linux/slab.h:493 [inline]\n kzalloc include/linux/slab.h:666 [inline]\n selinux_tun_dev_alloc_security+0x49/0x170 security/selinux/hooks.c:5012\n security_tun_dev_alloc_security+0x6d/0xa0 security/security.c:1506\n tun_set_iff drivers/net/tun.c:1839 [inline]\n __tun_chr_ioctl+0x1730/0x3d50 drivers/net/tun.c:2064\n tun_chr_ioctl+0x2a/0x40 drivers/net/tun.c:2309\n vfs_ioctl fs/ioctl.c:45 [inline]\n do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:685\n SYSC_ioctl fs/ioctl.c:700 [inline]\n SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691\n entry_SYSCALL_64_fastpath+0x1f/0xbe\n\nFreed by task 2919:\n save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59\n save_stack+0x43/0xd0 mm/kasan/kasan.c:447\n set_track mm/kasan/kasan.c:459 [inline]\n kasan_slab_free+0x6e/0xc0 mm/kasan/kasan.c:524\n __cache_free mm/slab.c:3503 [inline]\n kfree+0xd3/0x260 mm/slab.c:3820\n selinux_tun_dev_free_security+0x15/0x20 security/selinux/hooks.c:5023\n security_tun_dev_free_security+0x48/0x80 security/security.c:1512\n tun_free_netdev+0x13b/0x1b0 drivers/net/tun.c:1563\n register_netdevice+0x8d0/0xee0 net/core/dev.c:7605\n tun_set_iff drivers/net/tun.c:1859 [inline]\n __tun_chr_ioctl+0x1caf/0x3d50 drivers/net/tun.c:2064\n tun_chr_ioctl+0x2a/0x40 drivers/net/tun.c:2309\n vfs_ioctl fs/ioctl.c:45 [inline]\n do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:685\n SYSC_ioctl fs/ioctl.c:700 [inline]\n SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691\n entry_SYSCALL_64_fastpath+0x1f/0xbe\n\nThe buggy address belongs to the object at ffff8801d2843b40\n which belongs to the cache kmalloc-32 of size 32\nThe buggy address is located 0 bytes inside of\n 32-byte region [ffff8801d2843b40, ffff8801d2843b60)\nThe buggy address belongs to the page:\npage:ffffea000660cea8 count:1 mapcount:0 mapping:ffff8801d2843000 index:0xffff8801d2843fc1\nflags: 0x200000000000100(slab)\nraw: 0200000000000100 ffff8801d2843000 ffff8801d2843fc1 000000010000003f\nraw: ffffea0006626a40 ffffea00066141a0 ffff8801dbc00100\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff8801d2843a00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc\n ffff8801d2843a80: 00 00 00 fc fc fc fc fc fb fb fb fb fc fc fc fc\n\u003effff8801d2843b00: 00 00 00 00 fc fc fc fc fb fb fb fb fc fc fc fc\n ^\n ffff8801d2843b80: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc\n ffff8801d2843c00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nFixes: cf124db566e6 (\"net: Fix inconsistent teardown and release of private netdev state.\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "c715b72c1ba406f133217b509044c38d8e714a37", "tree": "0b8b674d1aada4584cf33d48bd9c75576a21a327", "parents": [ "704b862f9efd6d4c87a8d0a344dda19bda9c6b69" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Fri Aug 18 15:16:31 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 15:32:02 2017 -0700" }, "message": "mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base changes\n\nMoving the x86_64 and arm64 PIE base from 0x555555554000 to 0x000100000000\nbroke AddressSanitizer. This is a partial revert of:\n\n eab09532d400 (\"binfmt_elf: use ELF_ET_DYN_BASE only for PIE\")\n 02445990a96e (\"arm64: move ELF_ET_DYN_BASE to 4GB / 4MB\")\n\nThe AddressSanitizer tool has hard-coded expectations about where\nexecutable mappings are loaded.\n\nThe motivation for changing the PIE base in the above commits was to\navoid the Stack-Clash CVEs that allowed executable mappings to get too\nclose to heap and stack. This was mainly a problem on 32-bit, but the\n64-bit bases were moved too, in an effort to proactively protect those\nsystems (proofs of concept do exist that show 64-bit collisions, but\nother recent changes to fix stack accounting and setuid behaviors will\nminimize the impact).\n\nThe new 32-bit PIE base is fine for ASan (since it matches the ET_EXEC\nbase), so only the 64-bit PIE base needs to be reverted to let x86 and\narm64 ASan binaries run again. Future changes to the 64-bit PIE base on\nthese architectures can be made optional once a more dynamic method for\ndealing with AddressSanitizer is found. (e.g. always loading PIE into\nthe mmap region for marked binaries.)\n\nLink: http://lkml.kernel.org/r/20170807201542.GA21271@beast\nFixes: eab09532d400 (\"binfmt_elf: use ELF_ET_DYN_BASE only for PIE\")\nFixes: 02445990a96e (\"arm64: move ELF_ET_DYN_BASE to 4GB / 4MB\")\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nReported-by: Kostya Serebryany \u003ckcc@google.com\u003e\nAcked-by: Will Deacon \u003cwill.deacon@arm.com\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: \"H. Peter Anvin\" \u003chpa@zytor.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "704b862f9efd6d4c87a8d0a344dda19bda9c6b69", "tree": "7e5b86e24c47e8ac8c021be6a08a705c40a134e2", "parents": [ "73223e4e2e3867ebf033a5a8eb2e5df0158ccc99" ], "author": { "name": "Laura Abbott", "email": "labbott@redhat.com", "time": "Fri Aug 18 15:16:27 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 15:32:02 2017 -0700" }, "message": "mm/vmalloc.c: don\u0027t unconditonally use __GFP_HIGHMEM\n\nCommit 19809c2da28a (\"mm, vmalloc: use __GFP_HIGHMEM implicitly\") added\nuse of __GFP_HIGHMEM for allocations. vmalloc_32 may use\nGFP_DMA/GFP_DMA32 which does not play nice with __GFP_HIGHMEM and will\ntrigger a BUG in gfp_zone.\n\nOnly add __GFP_HIGHMEM if we aren\u0027t using GFP_DMA/GFP_DMA32.\n\nBugzilla: https://bugzilla.redhat.com/show_bug.cgi?id\u003d1482249\nLink: http://lkml.kernel.org/r/20170816220705.31374-1-labbott@redhat.com\nFixes: 19809c2da28a (\"mm, vmalloc: use __GFP_HIGHMEM implicitly\")\nSigned-off-by: Laura Abbott \u003clabbott@redhat.com\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Vlastimil Babka \u003cvbabka@suse.cz\u003e\nCc: \"Kirill A. Shutemov\" \u003ckirill.shutemov@linux.intel.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "73223e4e2e3867ebf033a5a8eb2e5df0158ccc99", "tree": "cedd086b2294cc820f574ecbdb5ae7251e7d46c9", "parents": [ "da094e42848e3c36feaa3b5271e53983fd45424f" ], "author": { "name": "zhong jiang", "email": "zhongjiang@huawei.com", "time": "Fri Aug 18 15:16:24 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 15:32:02 2017 -0700" }, "message": "mm/mempolicy: fix use after free when calling get_mempolicy\n\nI hit a use after free issue when executing trinity and repoduced it\nwith KASAN enabled. The related call trace is as follows.\n\n BUG: KASan: use after free in SyS_get_mempolicy+0x3c8/0x960 at addr ffff8801f582d766\n Read of size 2 by task syz-executor1/798\n\n INFO: Allocated in mpol_new.part.2+0x74/0x160 age\u003d3 cpu\u003d1 pid\u003d799\n __slab_alloc+0x768/0x970\n kmem_cache_alloc+0x2e7/0x450\n mpol_new.part.2+0x74/0x160\n mpol_new+0x66/0x80\n SyS_mbind+0x267/0x9f0\n system_call_fastpath+0x16/0x1b\n INFO: Freed in __mpol_put+0x2b/0x40 age\u003d4 cpu\u003d1 pid\u003d799\n __slab_free+0x495/0x8e0\n kmem_cache_free+0x2f3/0x4c0\n __mpol_put+0x2b/0x40\n SyS_mbind+0x383/0x9f0\n system_call_fastpath+0x16/0x1b\n INFO: Slab 0xffffea0009cb8dc0 objects\u003d23 used\u003d8 fp\u003d0xffff8801f582de40 flags\u003d0x200000000004080\n INFO: Object 0xffff8801f582d760 @offset\u003d5984 fp\u003d0xffff8801f582d600\n\n Bytes b4 ffff8801f582d750: ae 01 ff ff 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a ........ZZZZZZZZ\n Object ffff8801f582d760: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk\n Object ffff8801f582d770: 6b 6b 6b 6b 6b 6b 6b a5 kkkkkkk.\n Redzone ffff8801f582d778: bb bb bb bb bb bb bb bb ........\n Padding ffff8801f582d8b8: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ\n Memory state around the buggy address:\n ffff8801f582d600: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc\n ffff8801f582d680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n \u003effff8801f582d700: fc fc fc fc fc fc fc fc fc fc fc fc fb fb fb fc\n\n!shared memory policy is not protected against parallel removal by other\nthread which is normally protected by the mmap_sem. do_get_mempolicy,\nhowever, drops the lock midway while we can still access it later.\n\nEarly premature up_read is a historical artifact from times when\nput_user was called in this path see https://lwn.net/Articles/124754/\nbut that is gone since 8bccd85ffbaf (\"[PATCH] Implement sys_* do_*\nlayering in the memory policy layer.\"). but when we have the the\ncurrent mempolicy ref count model. The issue was introduced\naccordingly.\n\nFix the issue by removing the premature release.\n\nLink: http://lkml.kernel.org/r/1502950924-27521-1-git-send-email-zhongjiang@huawei.com\nSigned-off-by: zhong jiang \u003czhongjiang@huawei.com\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Minchan Kim \u003cminchan@kernel.org\u003e\nCc: Vlastimil Babka \u003cvbabka@suse.cz\u003e\nCc: David Rientjes \u003crientjes@google.com\u003e\nCc: Mel Gorman \u003cmgorman@techsingularity.net\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[2.6+]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "da094e42848e3c36feaa3b5271e53983fd45424f", "tree": "b33c69a6eb206dc58225c2e8a2920fafd3804ca1", "parents": [ "eb61b5911bdc923875cde99eb25203a0e2b06d43" ], "author": { "name": "Prakash Gupta", "email": "guptap@codeaurora.org", "time": "Fri Aug 18 15:16:21 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 15:32:02 2017 -0700" }, "message": "mm/cma_debug.c: fix stack corruption due to sprintf usage\n\nname[] in cma_debugfs_add_one() can only accommodate 16 chars including\nNULL to store sprintf output. It\u0027s common for cma device name to be\nlarger than 15 chars. This can cause stack corrpution. If the gcc\nstack protector is turned on, this can cause a panic due to stack\ncorruption.\n\nBelow is one example trace:\n\n Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in:\n ffffff8e69a75730\n Call trace:\n dump_backtrace+0x0/0x2c4\n show_stack+0x20/0x28\n dump_stack+0xb8/0xf4\n panic+0x154/0x2b0\n print_tainted+0x0/0xc0\n cma_debugfs_init+0x274/0x290\n do_one_initcall+0x5c/0x168\n kernel_init_freeable+0x1c8/0x280\n\nFix the short sprintf buffer in cma_debugfs_add_one() by using\nscnprintf() instead of sprintf().\n\nLink: http://lkml.kernel.org/r/1502446217-21840-1-git-send-email-guptap@codeaurora.org\nFixes: f318dd083c81 (\"cma: Store a name in the cma structure\")\nSigned-off-by: Prakash Gupta \u003cguptap@codeaurora.org\u003e\nAcked-by: Laura Abbott \u003clabbott@redhat.com\u003e\nCc: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "eb61b5911bdc923875cde99eb25203a0e2b06d43", "tree": "5ba019b857b23212a0c30aeb24f7a3f54b568b51", "parents": [ "6b31d5955cb29a51c5baffee382f213d75e98fb8" ], "author": { "name": "Jamie Iles", "email": "jamie.iles@oracle.com", "time": "Fri Aug 18 15:16:18 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 15:32:02 2017 -0700" }, "message": "signal: don\u0027t remove SIGNAL_UNKILLABLE for traced tasks.\n\nWhen forcing a signal, SIGNAL_UNKILLABLE is removed to prevent recursive\nfaults, but this is undesirable when tracing. For example, debugging an\ninit process (whether global or namespace), hitting a breakpoint and\nSIGTRAP will force SIGTRAP and then remove SIGNAL_UNKILLABLE.\nEverything continues fine, but then once debugging has finished, the\ninit process is left killable which is unlikely what the user expects,\nresulting in either an accidentally killed init or an init that stops\nreaping zombies.\n\nLink: http://lkml.kernel.org/r/20170815112806.10728-1-jamie.iles@oracle.com\nSigned-off-by: Jamie Iles \u003cjamie.iles@oracle.com\u003e\nAcked-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "6b31d5955cb29a51c5baffee382f213d75e98fb8", "tree": "86405062da720e3cc0f60c9c0e48e21e3ab0189c", "parents": [ "5b53a6ea886700a128b697a6fe8375340dea2c30" ], "author": { "name": "Michal Hocko", "email": "mhocko@suse.com", "time": "Fri Aug 18 15:16:15 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 15:32:01 2017 -0700" }, "message": "mm, oom: fix potential data corruption when oom_reaper races with writer\n\nWenwei Tao has noticed that our current assumption that the oom victim\nis dying and never doing any visible changes after it dies, and so the\noom_reaper can tear it down, is not entirely true.\n\n__task_will_free_mem consider a task dying when SIGNAL_GROUP_EXIT is set\nbut do_group_exit sends SIGKILL to all threads _after_ the flag is set.\nSo there is a race window when some threads won\u0027t have\nfatal_signal_pending while the oom_reaper could start unmapping the\naddress space. Moreover some paths might not check for fatal signals\nbefore each PF/g-u-p/copy_from_user.\n\nWe already have a protection for oom_reaper vs. PF races by checking\nMMF_UNSTABLE. This has been, however, checked only for kernel threads\n(use_mm users) which can outlive the oom victim. A simple fix would be\nto extend the current check in handle_mm_fault for all tasks but that\nwouldn\u0027t be sufficient because the current check assumes that a kernel\nthread would bail out after EFAULT from get_user*/copy_from_user and\nnever re-read the same address which would succeed because the PF path\nhas established page tables already. This seems to be the case for the\nonly existing use_mm user currently (virtio driver) but it is rather\nfragile in general.\n\nThis is even more fragile in general for more complex paths such as\ngeneric_perform_write which can re-read the same address more times\n(e.g. iov_iter_copy_from_user_atomic to fail and then\niov_iter_fault_in_readable on retry).\n\nTherefore we have to implement MMF_UNSTABLE protection in a robust way\nand never make a potentially corrupted content visible. That requires\nto hook deeper into the PF path and check for the flag _every time_\nbefore a pte for anonymous memory is established (that means all\n!VM_SHARED mappings).\n\nThe corruption can be triggered artificially\n(http://lkml.kernel.org/r/201708040646.v746kkhC024636@www262.sakura.ne.jp)\nbut there doesn\u0027t seem to be any real life bug report. The race window\nshould be quite tight to trigger most of the time.\n\nLink: http://lkml.kernel.org/r/20170807113839.16695-3-mhocko@kernel.org\nFixes: aac453635549 (\"mm, oom: introduce oom reaper\")\nSigned-off-by: Michal Hocko \u003cmhocko@suse.com\u003e\nReported-by: Wenwei Tao \u003cwenwei.tww@alibaba-inc.com\u003e\nTested-by: Tetsuo Handa \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e\nCc: \"Kirill A. Shutemov\" \u003ckirill@shutemov.name\u003e\nCc: Andrea Argangeli \u003candrea@kernel.org\u003e\nCc: David Rientjes \u003crientjes@google.com\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: Tetsuo Handa \u003cpenguin-kernel@i-love.sakura.ne.jp\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "5b53a6ea886700a128b697a6fe8375340dea2c30", "tree": "b0b1fa8f6673367612dca66bce5c81d6bdbc7f11", "parents": [ "f6ba488073fe8159851fe398cc3c5ee383bb4c7a" ], "author": { "name": "Michal Hocko", "email": "mhocko@suse.com", "time": "Fri Aug 18 15:16:12 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 15:32:01 2017 -0700" }, "message": "mm: fix double mmap_sem unlock on MMF_UNSTABLE enforced SIGBUS\n\nTetsuo Handa has noticed that MMF_UNSTABLE SIGBUS path in\nhandle_mm_fault causes a lockdep splat\n\n Out of memory: Kill process 1056 (a.out) score 603 or sacrifice child\n Killed process 1056 (a.out) total-vm:4268108kB, anon-rss:2246048kB, file-rss:0kB, shmem-rss:0kB\n a.out (1169) used greatest stack depth: 11664 bytes left\n DEBUG_LOCKS_WARN_ON(depth \u003c\u003d 0)\n ------------[ cut here ]------------\n WARNING: CPU: 6 PID: 1339 at kernel/locking/lockdep.c:3617 lock_release+0x172/0x1e0\n CPU: 6 PID: 1339 Comm: a.out Not tainted 4.13.0-rc3-next-20170803+ #142\n Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/02/2015\n RIP: 0010:lock_release+0x172/0x1e0\n Call Trace:\n up_read+0x1a/0x40\n __do_page_fault+0x28e/0x4c0\n do_page_fault+0x30/0x80\n page_fault+0x28/0x30\n\nThe reason is that the page fault path might have dropped the mmap_sem\nand returned with VM_FAULT_RETRY. MMF_UNSTABLE check however rewrites\nthe error path to VM_FAULT_SIGBUS and we always expect mmap_sem taken in\nthat path. Fix this by taking mmap_sem when VM_FAULT_RETRY is held in\nthe MMF_UNSTABLE path.\n\nWe cannot simply add VM_FAULT_SIGBUS to the existing error code because\nall arch specific page fault handlers and g-u-p would have to learn a\nnew error code combination.\n\nLink: http://lkml.kernel.org/r/20170807113839.16695-2-mhocko@kernel.org\nFixes: 3f70dc38cec2 (\"mm: make sure that kthreads will not refault oom reaped memory\")\nReported-by: Tetsuo Handa \u003cpenguin-kernel@i-love.sakura.ne.jp\u003e\nSigned-off-by: Michal Hocko \u003cmhocko@suse.com\u003e\nAcked-by: David Rientjes \u003crientjes@google.com\u003e\nCc: Andrea Argangeli \u003candrea@kernel.org\u003e\nCc: \"Kirill A. Shutemov\" \u003ckirill@shutemov.name\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: Wenwei Tao \u003cwenwei.tww@alibaba-inc.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[4.9+]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "f6ba488073fe8159851fe398cc3c5ee383bb4c7a", "tree": "ef31a6801b9ba41c586349319994cb5eaf6555b6", "parents": [ "3010f876500f9ba921afaeccec30c45ca6584dc8" ], "author": { "name": "Vladimir Davydov", "email": "vdavydov.dev@gmail.com", "time": "Fri Aug 18 15:16:08 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 15:32:01 2017 -0700" }, "message": "slub: fix per memcg cache leak on css offline\n\nTo avoid a possible deadlock, sysfs_slab_remove() schedules an\nasynchronous work to delete sysfs entries corresponding to the kmem\ncache. To ensure the cache isn\u0027t freed before the work function is\ncalled, it takes a reference to the cache kobject. The reference is\nsupposed to be released by the work function.\n\nHowever, the work function (sysfs_slab_remove_workfn()) does nothing in\ncase the cache sysfs entry has already been deleted, leaking the kobject\nand the corresponding cache.\n\nThis may happen on a per memcg cache destruction, because sysfs entries\nof a per memcg cache are deleted on memcg offline if the cache is empty\n(see __kmemcg_cache_deactivate()).\n\nThe kmemleak report looks like this:\n\n unreferenced object 0xffff9f798a79f540 (size 32):\n comm \"kworker/1:4\", pid 15416, jiffies 4307432429 (age 28687.554s)\n hex dump (first 32 bytes):\n 6b 6d 61 6c 6c 6f 63 2d 31 36 28 31 35 39 39 3a kmalloc-16(1599:\n 6e 65 77 72 6f 6f 74 29 00 23 6b c0 ff ff ff ff newroot).#k.....\n backtrace:\n kmemleak_alloc+0x4a/0xa0\n __kmalloc_track_caller+0x148/0x2c0\n kvasprintf+0x66/0xd0\n kasprintf+0x49/0x70\n memcg_create_kmem_cache+0xe6/0x160\n memcg_kmem_cache_create_func+0x20/0x110\n process_one_work+0x205/0x5d0\n worker_thread+0x4e/0x3a0\n kthread+0x109/0x140\n ret_from_fork+0x2a/0x40\n unreferenced object 0xffff9f79b6136840 (size 416):\n comm \"kworker/1:4\", pid 15416, jiffies 4307432429 (age 28687.573s)\n hex dump (first 32 bytes):\n 40 fb 80 c2 3e 33 00 00 00 00 00 40 00 00 00 00 @...\u003e3.....@....\n 00 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 ................\n backtrace:\n kmemleak_alloc+0x4a/0xa0\n kmem_cache_alloc+0x128/0x280\n create_cache+0x3b/0x1e0\n memcg_create_kmem_cache+0x118/0x160\n memcg_kmem_cache_create_func+0x20/0x110\n process_one_work+0x205/0x5d0\n worker_thread+0x4e/0x3a0\n kthread+0x109/0x140\n ret_from_fork+0x2a/0x40\n\nFix the leak by adding the missing call to kobject_put() to\nsysfs_slab_remove_workfn().\n\nLink: http://lkml.kernel.org/r/20170812181134.25027-1-vdavydov.dev@gmail.com\nFixes: 3b7b314053d02 (\"slub: make sysfs file removal asynchronous\")\nSigned-off-by: Vladimir Davydov \u003cvdavydov.dev@gmail.com\u003e\nReported-by: Andrei Vagin \u003cavagin@gmail.com\u003e\nTested-by: Andrei Vagin \u003cavagin@gmail.com\u003e\nAcked-by: Tejun Heo \u003ctj@kernel.org\u003e\nAcked-by: David Rientjes \u003crientjes@google.com\u003e\nCc: Michal Hocko \u003cmhocko@kernel.org\u003e\nCc: Johannes Weiner \u003channes@cmpxchg.org\u003e\nCc: Christoph Lameter \u003ccl@linux.com\u003e\nCc: Pekka Enberg \u003cpenberg@kernel.org\u003e\nCc: Joonsoo Kim \u003ciamjoonsoo.kim@lge.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[4.12.x]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "3010f876500f9ba921afaeccec30c45ca6584dc8", "tree": "61f656b6b3f56459f27cb11944102bf3dfcc162b", "parents": [ "768dc4e48420955518974d8486c1b00ec05e7274" ], "author": { "name": "Pavel Tatashin", "email": "pasha.tatashin@oracle.com", "time": "Fri Aug 18 15:16:05 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 15:32:01 2017 -0700" }, "message": "mm: discard memblock data later\n\nThere is existing use after free bug when deferred struct pages are\nenabled:\n\nThe memblock_add() allocates memory for the memory array if more than\n128 entries are needed. See comment in e820__memblock_setup():\n\n * The bootstrap memblock region count maximum is 128 entries\n * (INIT_MEMBLOCK_REGIONS), but EFI might pass us more E820 entries\n * than that - so allow memblock resizing.\n\nThis memblock memory is freed here:\n free_low_memory_core_early()\n\nWe access the freed memblock.memory later in boot when deferred pages\nare initialized in this path:\n\n deferred_init_memmap()\n for_each_mem_pfn_range()\n __next_mem_pfn_range()\n type \u003d \u0026memblock.memory;\n\nOne possible explanation for why this use-after-free hasn\u0027t been hit\nbefore is that the limit of INIT_MEMBLOCK_REGIONS has never been\nexceeded at least on systems where deferred struct pages were enabled.\n\nTested by reducing INIT_MEMBLOCK_REGIONS down to 4 from the current 128,\nand verifying in qemu that this code is getting excuted and that the\nfreed pages are sane.\n\nLink: http://lkml.kernel.org/r/1502485554-318703-2-git-send-email-pasha.tatashin@oracle.com\nFixes: 7e18adb4f80b (\"mm: meminit: initialise remaining struct pages in parallel with kswapd\")\nSigned-off-by: Pavel Tatashin \u003cpasha.tatashin@oracle.com\u003e\nReviewed-by: Steven Sistare \u003csteven.sistare@oracle.com\u003e\nReviewed-by: Daniel Jordan \u003cdaniel.m.jordan@oracle.com\u003e\nReviewed-by: Bob Picco \u003cbob.picco@oracle.com\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Mel Gorman \u003cmgorman@techsingularity.net\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "768dc4e48420955518974d8486c1b00ec05e7274", "tree": "de2cbc00cdbbfe3c78ec62f0d620e7a60b9e79df", "parents": [ "2ba293c9e7db150943f06b12d3eb7213e7fae624" ], "author": { "name": "Luis R. Rodriguez", "email": "mcgrof@kernel.org", "time": "Fri Aug 18 15:16:02 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 15:32:01 2017 -0700" }, "message": "test_kmod: fix description for -s -and -c parameters\n\nThe descriptions were reversed, correct this.\n\nLink: http://lkml.kernel.org/r/20170809234635.13443-4-mcgrof@kernel.org\nFixes: 64b671204afd71 (\"test_sysctl: add generic script to expand on tests\")\nSigned-off-by: Luis R. Rodriguez \u003cmcgrof@kernel.org\u003e\nReported-by: Daniel Mentz \u003cdanielmentz@google.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: Colin Ian King \u003ccolin.king@canonical.com\u003e\nCc: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nCc: David Binderman \u003cdcb314@hotmail.com\u003e\nCc: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\nCc: Ingo Molnar \u003cmingo@redhat.com\u003e\nCc: Jessica Yu \u003cjeyu@redhat.com\u003e\nCc: Josh Poimboeuf \u003cjpoimboe@redhat.com\u003e\nCc: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Matt Redfearn \u003cmatt.redfearn@imgetc.com\u003e\nCc: Matt Redfearn \u003cmatt.redfearn@imgtec.com\u003e\nCc: Michal Marek \u003cmmarek@suse.com\u003e\nCc: Miroslav Benes \u003cmbenes@suse.cz\u003e\nCc: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nCc: Petr Mladek \u003cpmladek@suse.com\u003e\nCc: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nCc: Shuah Khan \u003cshuah@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "2ba293c9e7db150943f06b12d3eb7213e7fae624", "tree": "cfb1356e158aa173014f9b3b364309eefc5d0d61", "parents": [ "8ada92799ec4de00f4bc0f10b1ededa256c1ab22" ], "author": { "name": "Luis R. Rodriguez", "email": "mcgrof@kernel.org", "time": "Fri Aug 18 15:15:58 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 15:32:01 2017 -0700" }, "message": "kmod: fix wait on recursive loop\n\nRecursive loops with module loading were previously handled in kmod by\nrestricting the number of modprobe calls to 50 and if that limit was\nbreached request_module() would return an error and a user would see the\nfollowing on their kernel dmesg:\n\n request_module: runaway loop modprobe binfmt-464c\n Starting init:/sbin/init exists but couldn\u0027t execute it (error -8)\n\nThis issue could happen for instance when a 64-bit kernel boots a 32-bit\nuserspace on some architectures and has no 32-bit binary format\nhanlders. This is visible, for instance, when a CONFIG_MODULES enabled\n64-bit MIPS kernel boots a into o32 root filesystem and the binfmt\nhandler for o32 binaries is not built-in.\n\nAfter commit 6d7964a722af (\"kmod: throttle kmod thread limit\") we now\ndon\u0027t have any visible signs of an error and the kernel just waits for\nthe loop to end somehow.\n\nAlthough this *particular* recursive loop could also be addressed by\ndoing a sanity check on search_binary_handler() and disallowing a\nmodular binfmt to be required for modprobe, a generic solution for any\nrecursive kernel kmod issues is still needed.\n\nThis should catch these loops. We can investigate each loop and address\neach one separately as they come in, this however puts a stop gap for\nthem as before.\n\nLink: http://lkml.kernel.org/r/20170809234635.13443-3-mcgrof@kernel.org\nFixes: 6d7964a722af (\"kmod: throttle kmod thread limit\")\nSigned-off-by: Luis R. Rodriguez \u003cmcgrof@kernel.org\u003e\nReported-by: Matt Redfearn \u003cmatt.redfearn@imgtec.com\u003e\nTested-by: Matt Redfearn \u003cmatt.redfearn@imgetc.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: Colin Ian King \u003ccolin.king@canonical.com\u003e\nCc: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nCc: Daniel Mentz \u003cdanielmentz@google.com\u003e\nCc: David Binderman \u003cdcb314@hotmail.com\u003e\nCc: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\nCc: Ingo Molnar \u003cmingo@redhat.com\u003e\nCc: Jessica Yu \u003cjeyu@redhat.com\u003e\nCc: Josh Poimboeuf \u003cjpoimboe@redhat.com\u003e\nCc: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Michal Marek \u003cmmarek@suse.com\u003e\nCc: Miroslav Benes \u003cmbenes@suse.cz\u003e\nCc: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nCc: Petr Mladek \u003cpmladek@suse.com\u003e\nCc: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nCc: Shuah Khan \u003cshuah@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "8ada92799ec4de00f4bc0f10b1ededa256c1ab22", "tree": "0a46e01c5681017a638409044478f708bdf0792e", "parents": [ "92e5aae457787d0bc6b255200d2fb116edf69794" ], "author": { "name": "Luis R. Rodriguez", "email": "mcgrof@kernel.org", "time": "Fri Aug 18 15:15:55 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 15:32:01 2017 -0700" }, "message": "wait: add wait_event_killable_timeout()\n\nThese are the few pending fixes I have queued up for v4.13-final. One\nis a a generic regression fix for recursive loops on kmod and the other\none is a trivial print out correction.\n\nDuring the v4.13 development we assumed that recursive kmod loops were\nno longer possible. Clearly that is not true. The regression fix makes\nuse of a new killable wait. We use a killable wait to be paranoid in\nhow signals might be sent to modprobe and only accept a proper SIGKILL.\nThe signal will only be available to userspace to issue *iff* a thread\nhas already entered a wait state, and that happens only if we\u0027ve already\nthrottled after 50 kmod threads have been hit.\n\nNote that although it may seem excessive to trigger a failure afer 5\nseconds if all kmod thread remain busy, prior to the series of changes\nthat went into v4.13 we would actually *always* fatally fail any request\nwhich came in if the limit was already reached. The new waiting\nimplemented in v4.13 actually gives us *more* breathing room -- the wait\nfor 5 seconds is a wait for *any* kmod thread to finish. We give up and\nfail *iff* no kmod thread has finished and they\u0027re *all* running\nstraight for 5 consecutive seconds. If 50 kmod threads are running\nconsecutively for 5 seconds something else must be really bad.\n\nRecursive loops with kmod are bad but they\u0027re also hard to implement\nproperly as a selftest without currently fooling current userspace tools\nlike kmod [1]. For instance kmod will complain when you run depmod if\nit finds a recursive loop with symbol dependency between modules as such\nthis type of recursive loop cannot go upstream as the modules_install\ntarget will fail after running depmod.\n\nThese tests already exist on userspace kmod upstream though (refer to\nthe testsuite/module-playground/mod-loop-*.c files). The same is not\ntrue if request_module() is used though, or worst if aliases are used.\n\nLikewise the issue with 64-bit kernels booting 32-bit userspace without\na binfmt handler built-in is also currently not detected and proactively\navoided by userspace kmod tools, or kconfig for all architectures.\nAlthough we could complain in the kernel when some of these individual\nrecursive issues creep up, proactively avoiding these situations in\nuserspace at build time is what we should keep striving for.\n\nLastly, since recursive loops could happen with kmod it may mean\nrecursive loops may also be possible with other kernel usermode helpers,\nthis should be investigated and long term if we can come up with a more\nsensible generic solution even better!\n\n[0] https://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux.git/log/?h\u003d20170809-kmod-for-v4.13-final\n[1] https://git.kernel.org/pub/scm/utils/kernel/kmod/kmod.git\n\nThis patch (of 3):\n\nThis wait is similar to wait_event_interruptible_timeout() but only\naccepts SIGKILL interrupt signal. Other signals are ignored.\n\nLink: http://lkml.kernel.org/r/20170809234635.13443-2-mcgrof@kernel.org\nSigned-off-by: Luis R. Rodriguez \u003cmcgrof@kernel.org\u003e\nAcked-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nCc: Ingo Molnar \u003cmingo@redhat.com\u003e\nCc: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\nCc: Jessica Yu \u003cjeyu@redhat.com\u003e\nCc: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nCc: Michal Marek \u003cmmarek@suse.com\u003e\nCc: Petr Mladek \u003cpmladek@suse.com\u003e\nCc: Miroslav Benes \u003cmbenes@suse.cz\u003e\nCc: Josh Poimboeuf \u003cjpoimboe@redhat.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: Shuah Khan \u003cshuah@kernel.org\u003e\nCc: Matt Redfearn \u003cmatt.redfearn@imgtec.com\u003e\nCc: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nCc: Colin Ian King \u003ccolin.king@canonical.com\u003e\nCc: Daniel Mentz \u003cdanielmentz@google.com\u003e\nCc: David Binderman \u003cdcb314@hotmail.com\u003e\nCc: Matt Redfearn \u003cmatt.redfearn@imgetc.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "92e5aae457787d0bc6b255200d2fb116edf69794", "tree": "e246feb15627b3bbde2a033947ccede1eb0b2004", "parents": [ "739f79fc9db1b38f96b5a5109b247a650fbebf6d" ], "author": { "name": "Nicholas Piggin", "email": "npiggin@gmail.com", "time": "Fri Aug 18 15:15:51 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 15:32:01 2017 -0700" }, "message": "kernel/watchdog: fix Kconfig constraints for perf hardlockup watchdog\n\nCommit 05a4a9527931 (\"kernel/watchdog: split up config options\") lost\nthe perf-based hardlockup detector\u0027s dependency on PERF_EVENTS, which\ncan result in broken builds with some powerpc configurations.\n\nRestore the dependency. Add it in for x86 too, despite x86 always\nselecting PERF_EVENTS it seems reasonable to make the dependency\nexplicit.\n\nLink: http://lkml.kernel.org/r/20170810114452.6673-1-npiggin@gmail.com\nFixes: 05a4a9527931 (\"kernel/watchdog: split up config options\")\nSigned-off-by: Nicholas Piggin \u003cnpiggin@gmail.com\u003e\nAcked-by: Don Zickus \u003cdzickus@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "739f79fc9db1b38f96b5a5109b247a650fbebf6d", "tree": "793f1f37d28fb7f6e9e4cb9cb1c20bbb457662df", "parents": [ "039a8e38473323ed9f6c4415b4c3a36777efac34" ], "author": { "name": "Johannes Weiner", "email": "hannes@cmpxchg.org", "time": "Fri Aug 18 15:15:48 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 15:32:01 2017 -0700" }, "message": "mm: memcontrol: fix NULL pointer crash in test_clear_page_writeback()\n\nJaegeuk and Brad report a NULL pointer crash when writeback ending tries\nto update the memcg stats:\n\n BUG: unable to handle kernel NULL pointer dereference at 00000000000003b0\n IP: test_clear_page_writeback+0x12e/0x2c0\n [...]\n RIP: 0010:test_clear_page_writeback+0x12e/0x2c0\n Call Trace:\n \u003cIRQ\u003e\n end_page_writeback+0x47/0x70\n f2fs_write_end_io+0x76/0x180 [f2fs]\n bio_endio+0x9f/0x120\n blk_update_request+0xa8/0x2f0\n scsi_end_request+0x39/0x1d0\n scsi_io_completion+0x211/0x690\n scsi_finish_command+0xd9/0x120\n scsi_softirq_done+0x127/0x150\n __blk_mq_complete_request_remote+0x13/0x20\n flush_smp_call_function_queue+0x56/0x110\n generic_smp_call_function_single_interrupt+0x13/0x30\n smp_call_function_single_interrupt+0x27/0x40\n call_function_single_interrupt+0x89/0x90\n RIP: 0010:native_safe_halt+0x6/0x10\n\n (gdb) l *(test_clear_page_writeback+0x12e)\n 0xffffffff811bae3e is in test_clear_page_writeback (./include/linux/memcontrol.h:619).\n 614\t\tmod_node_page_state(page_pgdat(page), idx, val);\n 615\t\tif (mem_cgroup_disabled() || !page-\u003emem_cgroup)\n 616\t\t\treturn;\n 617\t\tmod_memcg_state(page-\u003emem_cgroup, idx, val);\n 618\t\tpn \u003d page-\u003emem_cgroup-\u003enodeinfo[page_to_nid(page)];\n 619\t\tthis_cpu_add(pn-\u003elruvec_stat-\u003ecount[idx], val);\n 620\t}\n 621\n 622\tunsigned long mem_cgroup_soft_limit_reclaim(pg_data_t *pgdat, int order,\n 623\t\t\t\t\t\t\tgfp_t gfp_mask,\n\nThe issue is that writeback doesn\u0027t hold a page reference and the page\nmight get freed after PG_writeback is cleared (and the mapping is\nunlocked) in test_clear_page_writeback(). The stat functions looking up\nthe page\u0027s node or zone are safe, as those attributes are static across\nallocation and free cycles. But page-\u003emem_cgroup is not, and it will\nget cleared if we race with truncation or migration.\n\nIt appears this race window has been around for a while, but less likely\nto trigger when the memcg stats were updated first thing after\nPG_writeback is cleared. Recent changes reshuffled this code to update\nthe global node stats before the memcg ones, though, stretching the race\nwindow out to an extent where people can reproduce the problem.\n\nUpdate test_clear_page_writeback() to look up and pin page-\u003emem_cgroup\nbefore clearing PG_writeback, then not use that pointer afterward. It\nis a partial revert of 62cccb8c8e7a (\"mm: simplify lock_page_memcg()\")\nbut leaves the pageref-holding callsites that aren\u0027t affected alone.\n\nLink: http://lkml.kernel.org/r/20170809183825.GA26387@cmpxchg.org\nFixes: 62cccb8c8e7a (\"mm: simplify lock_page_memcg()\")\nSigned-off-by: Johannes Weiner \u003channes@cmpxchg.org\u003e\nReported-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\nTested-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\nReported-by: Bradley Bolen \u003cbradleybolen@gmail.com\u003e\nTested-by: Brad Bolen \u003cbradleybolen@gmail.com\u003e\nCc: Vladimir Davydov \u003cvdavydov@virtuozzo.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.cz\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[4.6+]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "a0917e0bc6efc05834c0c1eafebd579a9c75e6e9", "tree": "31f8b60d8e7a0a20943057d7345fdca3558e5ed8", "parents": [ "2110ba58303f0c2a03360c5f81fbe67ed312e7b9" ], "author": { "name": "Matthew Dawson", "email": "matthew@mjdsystems.ca", "time": "Fri Aug 18 15:04:54 2017 -0400" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Aug 18 15:12:54 2017 -0700" }, "message": "datagram: When peeking datagrams with offset \u003c 0 don\u0027t skip empty skbs\n\nDue to commit e6afc8ace6dd5cef5e812f26c72579da8806f5ac (\"udp: remove\nheaders from UDP packets before queueing\"), when udp packets are being\npeeked the requested extra offset is always 0 as there is no need to skip\nthe udp header. However, when the offset is 0 and the next skb is\nof length 0, it is only returned once. The behaviour can be seen with\nthe following python script:\n\nfrom socket import *;\nf\u003dsocket(AF_INET6, SOCK_DGRAM | SOCK_NONBLOCK, 0);\ng\u003dsocket(AF_INET6, SOCK_DGRAM | SOCK_NONBLOCK, 0);\nf.bind((\u0027::\u0027, 0));\naddr\u003d(\u0027::1\u0027, f.getsockname()[1]);\ng.sendto(b\u0027\u0027, addr)\ng.sendto(b\u0027b\u0027, addr)\nprint(f.recvfrom(10, MSG_PEEK));\nprint(f.recvfrom(10, MSG_PEEK));\n\nWhere the expected output should be the empty string twice.\n\nInstead, make sk_peek_offset return negative values, and pass those values\nto __skb_try_recv_datagram/__skb_try_recv_from_queue. If the passed offset\nto __skb_try_recv_from_queue is negative, the checked skb is never skipped.\n__skb_try_recv_from_queue will then ensure the offset is reset back to 0\nif a peek is requested without an offset, unless no packets are found.\n\nAlso simplify the if condition in __skb_try_recv_from_queue. If _off is\ngreater then 0, and off is greater then or equal to skb-\u003elen, then\n(_off || skb-\u003elen) must always be true assuming skb-\u003elen \u003e\u003d 0 is always\ntrue.\n\nAlso remove a redundant check around a call to sk_peek_offset in af_unix.c,\nas it double checked if MSG_PEEK was set in the flags.\n\nV2:\n - Moved the negative fixup into __skb_try_recv_from_queue, and remove now\nredundant checks\n - Fix peeking in udp{,v6}_recvmsg to report the right value when the\noffset is 0\n\nV3:\n - Marked new branch in __skb_try_recv_from_queue as unlikely.\n\nSigned-off-by: Matthew Dawson \u003cmatthew@mjdsystems.ca\u003e\nAcked-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "cc28fcdc017e553375c999ca12107ceb27f34ab3", "tree": "c76c0a50ca4d6739f31eff748734dc524c6e49d9", "parents": [ "70bfc741f845e55227900e4e5770bc359192c564", "77aff8c76425c8f49b50d0b9009915066739e7d2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 14:25:50 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 14:25:50 2017 -0700" }, "message": "Merge tag \u0027xfs-4.13-fixes-5\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux\n\nPull xfs fixes from Darrick Wong:\n \"A handful more bug fixes for you today.\n\n Changes since last time:\n\n - Don\u0027t leak resources when mount fails\n\n - Don\u0027t accidentally clobber variables when looking for free inodes\"\n\n* tag \u0027xfs-4.13-fixes-5\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:\n xfs: don\u0027t leak quotacheck dquots when cow recovery\n xfs: clear MS_ACTIVE after finishing log recovery\n iomap: fix integer truncation issues in the zeroing and dirtying helpers\n xfs: fix inobt inode allocation search optimization\n" }, { "commit": "70bfc741f845e55227900e4e5770bc359192c564", "tree": "7d71492bd7a3df269d83ece5e5de6fce59774193", "parents": [ "edb20a1b4a31fae825470138a45a1ccee1e051c7", "c005390374957baacbc38eef96ea360559510aa7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 14:12:39 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 14:12:39 2017 -0700" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.dk/linux-block\n\nPull block fixes from Jens Axboe:\n \"A small set of fixes that should go into this release. This contains:\n\n - An NVMe pull request from Christoph, with a few select fixes.\n\n One of them fix a polling regression in this series, in which it\u0027s\n trivial to cause the kernel to disable most of the hardware queue\n interrupts.\n\n - Fixup for a blk-mq queue usage imbalance on request allocation,\n from Keith.\n\n - A xen block pull request from Konrad, fixing two issues with\n xen/xen-blkfront\"\n\n* \u0027for-linus\u0027 of git://git.kernel.dk/linux-block:\n blk-mq-pci: add a fallback when pci_irq_get_affinity returns NULL\n nvme-pci: set cqe_seen on polled completions\n nvme-fabrics: fix reporting of unrecognized options\n nvmet-fc: eliminate incorrect static markers on local variables\n nvmet-fc: correct use after free on list teardown\n nvmet: don\u0027t overwrite identify sn/fr with 0-bytes\n xen-blkfront: use a right index when checking requests\n xen: fix bio vec merging\n blk-mq: Fix queue usage on failed request allocation\n" }, { "commit": "edb20a1b4a31fae825470138a45a1ccee1e051c7", "tree": "45b8377d31d8d306cca629c9d35eb41bca5c8d34", "parents": [ "039a8e38473323ed9f6c4415b4c3a36777efac34", "870201f95fcbd19538aef630393fe9d583eff82e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 12:35:22 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 12:35:22 2017 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma\n\nPull rdma fixes from Doug Ledford:\n \"Fourth set of -rc fixes for 4.13 cycle. This is all of the -rc fixes\n that we know of. I suspect this will be the last rc pull request, but\n you never know, I could be wrong.\n\n Nothing major here. There are the i40iw patches I mentioned in my last\n pull request minus one that I pulled out because it wasn\u0027t a fix and\n not appropriate for the rc cycle. Then a few other items trickled in\n and were added to the pull request. It\u0027s fairly small aside from those\n five i40iw patches\n\n - Set of five i40iw fixes (the first of these is rather large by line\n count consideration, but I decided to send it because if fixes a\n legitimate issue and the line count is because it does so by\n creating a new function and using it where needed instead of just\n patching up a few lines...a smaller fix could probably be done, but\n the larger fix is the better code solution)\n\n - One vmw_pvrdma fix\n\n - One hns_roce fix (this silences a checker warning, but can\u0027t\n actually happen, I expect a patch to remove this from all drivers\n that share this same check in for-next)\n\n - One iw_cxgb4 fix\n\n - Two IB core fixes\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma:\n IB/uverbs: Fix NULL pointer dereference during device removal\n IB/core: Protect sysfs entry on ib_unregister_device\n iw_cxgb4: fix misuse of integer variable\n IB/hns: fix memory leak on ah on error return path\n i40iw: Fix potential fcn_id_array out of bounds\n i40iw: Use correct alignment for CQ0 memory\n i40iw: Fix typecast of tcp_seq_num\n i40iw: Correct variable names\n i40iw: Fix parsing of query/commit FPM buffers\n RDMA/vmw_pvrdma: Report CQ missed events\n" }, { "commit": "039a8e38473323ed9f6c4415b4c3a36777efac34", "tree": "315d9235076a263249b8ee365b3eed51b13ab6b5", "parents": [ "42833468027770b8b731e3d9620165873439d237", "5a69aec945d27e78abac9fd032533d3aaebf7c1e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 11:11:03 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 11:11:03 2017 -0700" }, "message": "Merge tag \u0027powerpc-4.13-7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux\n\nPull powerpc fixes from Michael Ellerman:\n \"A bug in the VSX register saving that could cause userspace FP/VMX\n register corruption.\n\n Never seen to happen (that we know of), was found by code inspection,\n but still tagged for stable given the consequences\"\n\n* tag \u0027powerpc-4.13-7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:\n powerpc: Fix VSX enabling/flushing to also test MSR_FP and MSR_VEC\n" }, { "commit": "42833468027770b8b731e3d9620165873439d237", "tree": "b94b2ef35c8921126fa975417183f8795b076dc7", "parents": [ "cb247857f3dae0bdb843362c35027a0066b963a4", "4dd6a9973b8aaffac4bf37c5bb70e8eae5a7afb4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 11:08:48 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 11:08:48 2017 -0700" }, "message": "Merge tag \u0027armsoc-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc\n\nPull ARM SoC fixes from Arnd Bergmann:\n \"A small number of bugfixes, nothing serious this time. Here is a full\n list.\n\n 4.13 regression fix:\n\n - imx7d-sdb pinctrl support regressed in 4.13 due to an incomplete\n patch\n\n DT fixes for recently added devices:\n\n - badly copied DT entries on imx6qdl-nitrogen6_som broke PCI reset\n\n - sama5d2 memory controller had the wrong ID and registers\n\n - imx7 power domains did not work correctly with deferred probing\n (driver added in 4.12)\n\n - Allwinner H5 pinctrl (added in 4.12) did not work right with GPIO\n interrupts\n\n Fixes for older bugs that just got noticed:\n\n - i.MX25 ADC support (added in 4.6) apparently never worked right due\n to a missing \u0027ranges\u0027 property in DT.\n\n - Renesas Salvador Audio support (added in v4.5) was broken for\n device repeated bind/unbind due to a naming conflict.\n\n - Various allwinner boards are missing an \u0027ethernet\u0027 alias in DT,\n leading to unstable device naming.\n\n Preventive bugfix:\n\n - TI Keystone needs a fix to prevent a NULL pointer dereference with\n an upcoming PM change\"\n\n* tag \u0027armsoc-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:\n soc: ti: ti_sci_pm_domains: Populate name for genpd\n ARM: dts: imx6qdl-nitrogen6_som2: fix PCIe reset\n arm64: allwinner: h5: fix pinctrl IRQs\n arm64: allwinner: a64: sopine: add missing ethernet0 alias\n arm64: allwinner: a64: pine64: add missing ethernet0 alias\n arm64: allwinner: a64: bananapi-m64: add missing ethernet0 alias\n arm64: renesas: salvator-common: avoid audio_clkout naming conflict\n ARM: dts: i.MX25: add ranges to tscadc\n soc: imx: gpcv2: fix regulator deferred probe\n ARM: dts: at91: sama5d2: fix EBI/NAND controllers declaration\n ARM: dts: at91: sama5d2: use sama5d2 compatible string for SMC\n ARM: dts: imx7d-sdb: Put pinctrl_spi4 in the correct location\n" }, { "commit": "cb247857f3dae0bdb843362c35027a0066b963a4", "tree": "ffb4d52bde2172ba7c195bbd3f33084acba948d4", "parents": [ "4478976a43c5df8bc70e3a6b0e8ead9d7cff0a3f", "0b36f2bd28d040acedb52f4327eb2441afe4f514" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 11:02:49 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 11:02:49 2017 -0700" }, "message": "Merge tag \u0027sound-4.13-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A collection of small fixes, mostly for regression fixes (sequencer\n kconfig and emu10k1 probe) and device-specific quirks (three for USB\n and one for HD-audio).\n\n One significant change is a fix for races in ALSA sequencer core,\n which covers over the previous incomplete fix\"\n\n* tag \u0027sound-4.13-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:\n ALSA: emu10k1: Fix forgotten user-copy conversion in init code\n ALSA: usb-audio: add DSD support for new Amanero PID\n ALSA: usb-audio: Add mute TLV for playback volumes on C-Media devices\n ALSA: usb-audio: Apply sample rate quirk to Sennheiser headset\n ALSA: seq: 2nd attempt at fixing race creating a queue\n ALSA: hda/realtek - Fix pincfg for Dell XPS 13 9370\n ALSA: seq: Fix CONFIG_SND_SEQ_MIDI dependency\n" }, { "commit": "2110ba58303f0c2a03360c5f81fbe67ed312e7b9", "tree": "ed5b08bc788e8d52ef9fd9d91735444b088cbfa4", "parents": [ "a120d9ab65354727559b9db75ded8071b7ef19e2" ], "author": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Fri Aug 18 17:11:06 2017 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Aug 18 11:00:41 2017 -0700" }, "message": "bpf, doc: improve sysctl knob description\n\nCurrent context speaking of tcpdump filters is out of date these\ndays, so lets improve the sysctl description for the BPF knobs\na bit.\n\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "a120d9ab65354727559b9db75ded8071b7ef19e2", "tree": "adf2dd18549834743e6e0d8ec8f805b56def2ac1", "parents": [ "eac2c68d663effb077210218788952b5a0c1f60e" ], "author": { "name": "Colin Ian King", "email": "colin.king@canonical.com", "time": "Fri Aug 18 14:12:06 2017 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Aug 18 10:58:33 2017 -0700" }, "message": "netxen: fix incorrect loop counter decrement\n\nThe loop counter k is currently being decremented from zero which\nis incorrect. Fix this by incrementing k instead\n\nDetected by CoverityScan, CID#401847 (\"Infinite loop\")\n\nFixes: 83f18a557c6d (\"netxen_nic: fw dump support\")\nSigned-off-by: Colin Ian King \u003ccolin.king@canonical.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "4478976a43c5df8bc70e3a6b0e8ead9d7cff0a3f", "tree": "237e1fbcc10735f806781f55f3ac6fb6268dfe12", "parents": [ "04d49f3638d0210de592dd52ad62cfca8b3ed9fe", "ee7b1f31200d9f3cc45e1bd22e962bd6b1d4d611" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 10:51:30 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 18 10:51:30 2017 -0700" }, "message": "Merge tag \u0027dma-mapping-4.13-3\u0027 of git://git.infradead.org/users/hch/dma-mapping\n\nPull dma-mapping fix from Christoph Hellwig:\n \"Another dma-mapping regression fix\"\n\n* tag \u0027dma-mapping-4.13-3\u0027 of git://git.infradead.org/users/hch/dma-mapping:\n of: fix DMA mask generation\n" }, { "commit": "eac2c68d663effb077210218788952b5a0c1f60e", "tree": "fcd5bc7f3dd1f73d6f767626de623b55eaf8cd36", "parents": [ "acc8b31665b4cc17b35c4fa445427f7e2f6dc86b" ], "author": { "name": "Colin Ian King", "email": "colin.king@canonical.com", "time": "Fri Aug 18 12:11:50 2017 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Aug 18 10:28:06 2017 -0700" }, "message": "nfp: fix infinite loop on umapping cleanup\n\nThe while loop that performs the dma page unmapping never decrements\nindex counter f and hence loops forever. Fix this with a pre-decrement\non f.\n\nDetected by CoverityScan, CID#1357309 (\"Infinite loop\")\n\nFixes: 4c3523623dc0 (\"net: add driver for Netronome NFP4000/NFP6000 NIC VFs\")\nSigned-off-by: Colin Ian King \u003ccolin.king@canonical.com\u003e\nAcked-by: Jakub Kicinski \u003cjakub.kicinski@netronome.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "acc8b31665b4cc17b35c4fa445427f7e2f6dc86b", "tree": "a81f0632c483e2d8733a401339b9d5fbef3c67ba", "parents": [ "014cd0a368dc6351c65d51e4ee34f8573a4a1543" ], "author": { "name": "Jiri Pirko", "email": "jiri@mellanox.com", "time": "Fri Aug 18 10:10:43 2017 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Aug 18 10:19:11 2017 -0700" }, "message": "net: sched: fix p_filter_chain check in tcf_chain_flush\n\nThe dereference before check is wrong and leads to an oops when\np_filter_chain is NULL. The check needs to be done on the pointer to\nprevent NULL dereference.\n\nFixes: f93e1cdcf42c (\"net/sched: fix filter flushing\")\nSigned-off-by: Jiri Pirko \u003cjiri@mellanox.com\u003e\nAcked-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "c005390374957baacbc38eef96ea360559510aa7", "tree": "6055f163f22d993bcf03ed965510a45a8d28745b", "parents": [ "6caa0503c43d65de92309b967b5b1aa289af303b" ], "author": { "name": "Christoph Hellwig", "email": "hch@lst.de", "time": "Thu Aug 17 12:24:47 2017 +0200" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Aug 18 08:08:14 2017 -0600" }, "message": "blk-mq-pci: add a fallback when pci_irq_get_affinity returns NULL\n\nWhile pci_irq_get_affinity should never fail for SMP kernel that\nimplement the affinity mapping, it will always return NULL in the\nUP case, so provide a fallback mapping of all queues to CPU 0 in\nthat case.\n\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\nCc: stable@vger.kernel.org\nReviewed-by: Omar Sandoval \u003cosandov@fb.com\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "6caa0503c43d65de92309b967b5b1aa289af303b", "tree": "a6c71e2455deac92e834d36cfe4509fa289d301c", "parents": [ "3e09fc802d05695393a48f6c2d888771b80c4301", "e9d8a0fdeacd843c85dcef480cdb2ab76bcdb6e4" ], "author": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Aug 18 08:04:15 2017 -0600" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Aug 18 08:04:15 2017 -0600" }, "message": "Merge branch \u0027nvme-4.13\u0027 of git://git.infradead.org/nvme into for-linus\n\nPull NVMe changes from Christoph:\n\n\"The fixes are getting really small now - two for FC, one for PCI, one\n for the fabrics layer and one for the target.\"\n" }, { "commit": "7edaeb6841dfb27e362288ab8466ebdc4972e867", "tree": "419ce3f71f7ffc17131bb911fb16ff037e3c6bb1", "parents": [ "ef954844c7ace62f773f4f23e28d2d915adc419f" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Tue Aug 15 09:50:13 2017 +0200" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Fri Aug 18 12:35:02 2017 +0200" }, "message": "kernel/watchdog: Prevent false positives with turbo modes\n\nThe hardlockup detector on x86 uses a performance counter based on unhalted\nCPU cycles and a periodic hrtimer. The hrtimer period is about 2/5 of the\nperformance counter period, so the hrtimer should fire 2-3 times before the\nperformance counter NMI fires. The NMI code checks whether the hrtimer\nfired since the last invocation. If not, it assumess a hard lockup.\n\nThe calculation of those periods is based on the nominal CPU\nfrequency. Turbo modes increase the CPU clock frequency and therefore\nshorten the period of the perf/NMI watchdog. With extreme Turbo-modes (3x\nnominal frequency) the perf/NMI period is shorter than the hrtimer period\nwhich leads to false positives.\n\nA simple fix would be to shorten the hrtimer period, but that comes with\nthe side effect of more frequent hrtimer and softlockup thread wakeups,\nwhich is not desired.\n\nImplement a low pass filter, which checks the perf/NMI period against\nkernel time. If the perf/NMI fires before 4/5 of the watchdog period has\nelapsed then the event is ignored and postponed to the next perf/NMI.\n\nThat solves the problem and avoids the overhead of shorter hrtimer periods\nand more frequent softlockup thread wakeups.\n\nFixes: 58687acba592 (\"lockup_detector: Combine nmi_watchdog and softlockup detector\")\nReported-and-tested-by: Kan Liang \u003cKan.liang@intel.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: dzickus@redhat.com\nCc: prarit@redhat.com\nCc: ak@linux.intel.com\nCc: babu.moger@oracle.com\nCc: peterz@infradead.org\nCc: eranian@google.com\nCc: acme@redhat.com\nCc: stable@vger.kernel.org\nCc: atomlin@redhat.com\nCc: akpm@linux-foundation.org\nCc: torvalds@linux-foundation.org\nLink: http://lkml.kernel.org/r/alpine.DEB.2.20.1708150931310.1886@nanos\n" }, { "commit": "e8f241893dfbbebe2813c01eac54f263e6a5e59c", "tree": "756b308ef749eb12bc0b6011d301f3d272ce0d62", "parents": [ "7374bfb82e3844abcc5a5b8034620d80b92b820d" ], "author": { "name": "Marc Zyngier", "email": "marc.zyngier@arm.com", "time": "Fri Aug 18 10:53:45 2017 +0100" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Fri Aug 18 12:04:14 2017 +0200" }, "message": "genirq: Restore trigger settings in irq_modify_status()\n\nirq_modify_status starts by clearing the trigger settings from\nirq_data before applying the new settings, but doesn\u0027t restore them,\nleaving them to IRQ_TYPE_NONE.\n\nThat\u0027s pretty confusing to the potential request_irq() that could\nfollow. Instead, snapshot the settings before clearing them, and restore\nthem if the irq_modify_status() invocation was not changing the trigger.\n\nFixes: 1e2a7d78499e (\"irqdomain: Don\u0027t set type when mapping an IRQ\")\nReported-and-tested-by: jeffy \u003cjeffy.chen@rock-chips.com\u003e\nSigned-off-by: Marc Zyngier \u003cmarc.zyngier@arm.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Jon Hunter \u003cjonathanh@nvidia.com\u003e\nCc: stable@vger.kernel.org\nLink: http://lkml.kernel.org/r/20170818095345.12378-1-marc.zyngier@arm.com\n\n" }, { "commit": "4dd6a9973b8aaffac4bf37c5bb70e8eae5a7afb4", "tree": "139c5acd4a4f0d98649ce414f57b2de382561032", "parents": [ "93112486f4b625130e7a998932b5fe6ff05bef3d" ], "author": { "name": "Dave Gerlach", "email": "d-gerlach@ti.com", "time": "Fri Jul 28 09:51:34 2017 -0700" }, "committer": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Fri Aug 18 11:59:53 2017 +0200" }, "message": "soc: ti: ti_sci_pm_domains: Populate name for genpd\n\nCommit b6a1d093f96b (\"PM / Domains: Extend generic power domain\ndebugfs\") now creates a debugfs directory for each genpd based on the\nname of the genpd. Currently no name is given to the genpd created by\nti_sci_pm_domains driver so because of this we see a NULL pointer\ndereferences when it is accessed on boot when the debugfs entry creation\nis attempted.\n\nGive the genpd a name before registering it to avoid this.\n\nFixes: 52835d59fc6c (\"soc: ti: Add ti_sci_pm_domains driver\")\nSigned-off-by: Dave Gerlach \u003cd-gerlach@ti.com\u003e\nSigned-off-by: Santosh Shilimkar \u003cssantosh@kernel.org\u003e\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\n" }, { "commit": "93112486f4b625130e7a998932b5fe6ff05bef3d", "tree": "028679b25f45d9ece5c6b683761dbc7c21dc8087", "parents": [ "552c497c406e49261e6bee6236dd9a3f8fdd7ab5", "c40bc54fdf2d52a80f66b365f1eac9d43b32e107" ], "author": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Fri Aug 18 11:58:38 2017 +0200" }, "committer": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Fri Aug 18 11:58:38 2017 +0200" }, "message": "Merge tag \u0027imx-fixes-4.13-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into fixes\n\nPull \"i.MX fixes for 4.13, round 3\" from Shawn Guo:\n\n - Fix PCIe reset GPIO of imx6qdl-nitrogen6_som2 board, which was\n a bad copy from nitrogen6_max device tree.\n\n* tag \u0027imx-fixes-4.13-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:\n ARM: dts: imx6qdl-nitrogen6_som2: fix PCIe reset\n" }, { "commit": "552c497c406e49261e6bee6236dd9a3f8fdd7ab5", "tree": "7d9ea53510a3b1aa8174c7ae83e550b921dcbf7b", "parents": [ "872784bffbe4217611922bc0f929dbd9cad65528", "d86e63e1f0b7868c55c8d4a54854b85e2bac690b" ], "author": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Fri Aug 18 11:55:44 2017 +0200" }, "committer": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Fri Aug 18 11:55:44 2017 +0200" }, "message": "Merge tag \u0027sunxi-fixes-for-4.13-2\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into fixes\n\nPull \"Allwinner fixes for 4.13, round 2\" from Chen-Yu Tsai:\n\nThree fixes adding a missing alias for the Ethernet controller on A64\nboards. One adding a missing interrupt for the pin controller.\n\n* tag \u0027sunxi-fixes-for-4.13-2\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux:\n arm64: allwinner: h5: fix pinctrl IRQs\n arm64: allwinner: a64: sopine: add missing ethernet0 alias\n arm64: allwinner: a64: pine64: add missing ethernet0 alias\n arm64: allwinner: a64: bananapi-m64: add missing ethernet0 alias\n" }, { "commit": "45bd07ad82622fb7c8dd7504d976b7dd11568965", "tree": "714db6b5a427f26ac62018479a9019216930c4a7", "parents": [ "187e91fe5e915f4b7f39b824aa422493463e443d" ], "author": { "name": "Arvind Yadav", "email": "arvind.yadav.cs@gmail.com", "time": "Thu Jul 20 17:00:32 2017 +0530" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Fri Aug 18 11:30:35 2017 +0200" }, "message": "x86: Constify attribute_group structures\n\nattribute_groups are not supposed to change at runtime and none of the\ngroups is modified.\n\nMark the non-const structs as const.\n\n[ tglx: Folded into one big patch ]\n\nSigned-off-by: Arvind Yadav \u003carvind.yadav.cs@gmail.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: tony.luck@intel.com\nCc: bp@alien8.de\nLink: http://lkml.kernel.org/r/1500550238-15655-2-git-send-email-arvind.yadav.cs@gmail.com\n\n" }, { "commit": "7374bfb82e3844abcc5a5b8034620d80b92b820d", "tree": "d1d2272dff303239a270341ca025ce1be715eef6", "parents": [ "9c9947f893a254ec92cd5fe1439587e583302c9c" ], "author": { "name": "Florian Fainelli", "email": "f.fainelli@gmail.com", "time": "Thu Jul 27 15:47:33 2017 -0700" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Fri Aug 18 11:06:35 2017 +0200" }, "message": "MAINTAINERS: Remove Jason Cooper\u0027s irqchip git tree\n\nJason\u0027s irqchip tree does not seem to have been updated for many months\nnow, remove it from the list of trees to avoid any possible confusion.\n\nJason says:\n\n \"Unfortunately, when I have time for irqchip, I don\u0027t always have the\n time to properly follow up with pull-requests. So, for the time being,\n I\u0027ll stick to reviewing as I can.\"\n\nSigned-off-by: Florian Fainelli \u003cf.fainelli@gmail.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nAcked-by: Jason Cooper \u003cjason@lakedaemon.net\u003e\nCc: marc.zyngier@arm.com\nLink: http://lkml.kernel.org/r/20170727224733.8288-1-f.fainelli@gmail.com\n" }, { "commit": "0b36f2bd28d040acedb52f4327eb2441afe4f514", "tree": "cc2ebf4500efe626c1e1627359848f26f2e49ffc", "parents": [ "ed993c6fdfa7734881a4516852d95ae2d3b604d3" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri Aug 18 10:55:10 2017 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri Aug 18 10:59:02 2017 +0200" }, "message": "ALSA: emu10k1: Fix forgotten user-copy conversion in init code\n\nThe commit d42fe63d5839 (\"ALSA: emu10k1: Get rid of set_fs() usage\")\nconverted the user-space copy hack with set_fs() to the direct\nmemcpy(), but one place was forgotten. This resulted in the error\nfrom snd_emu10k1_init_efx(), eventually failed to load the driver.\nFix the missing piece.\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id\u003d196687\nFixes: d42fe63d5839 (\"ALSA: emu10k1: Get rid of set_fs() usage\")\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "ed993c6fdfa7734881a4516852d95ae2d3b604d3", "tree": "d329f785ef41b3a02036ecd83c25a7ea06f0387b", "parents": [ "0f174b3525a43bd51f9397394763925e0ebe7bc7" ], "author": { "name": "Jussi Laako", "email": "jussi@sonarnerd.net", "time": "Fri Aug 18 10:42:14 2017 +0300" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri Aug 18 10:13:21 2017 +0200" }, "message": "ALSA: usb-audio: add DSD support for new Amanero PID\n\nAdd DSD support for new Amanero Combo384 firmware version with a new\nPID. This firmware uses DSD_U32_BE.\n\nFixes: 3eff682d765b (\"ALSA: usb-audio: Support both DSD LE/BE Amanero firmware versions\")\nSigned-off-by: Jussi Laako \u003cjussi@sonarnerd.net\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "e9d8a0fdeacd843c85dcef480cdb2ab76bcdb6e4", "tree": "a0abd84c323fd92b2e267c989334bc1d8715f2ee", "parents": [ "81a0b8d74edd5841be29d223ce44bc8db2b00d09" ], "author": { "name": "Keith Busch", "email": "keith.busch@intel.com", "time": "Thu Aug 17 16:45:06 2017 -0400" }, "committer": { "name": "Christoph Hellwig", "email": "hch@lst.de", "time": "Fri Aug 18 09:19:39 2017 +0200" }, "message": "nvme-pci: set cqe_seen on polled completions\n\nFixes: 920d13a884 (\"nvme-pci: factor out the cqe reading mechanics from __nvme_process_cq\")\nReported-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nSigned-off-by: Keith Busch \u003ckeith.busch@intel.com\u003e\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\n" }, { "commit": "c40bc54fdf2d52a80f66b365f1eac9d43b32e107", "tree": "414f215d615b70e74da2bcc6f4be34789608a82b", "parents": [ "8317562097acec4c9e9750eb91115687931bca35" ], "author": { "name": "Gary Bisson", "email": "gary.bisson@boundarydevices.com", "time": "Thu Aug 17 15:50:10 2017 +0200" }, "committer": { "name": "Shawn Guo", "email": "shawnguo@kernel.org", "time": "Fri Aug 18 09:40:40 2017 +0800" }, "message": "ARM: dts: imx6qdl-nitrogen6_som2: fix PCIe reset\n\nPrevious value was a bad copy of nitrogen6_max device tree.\n\nSigned-off-by: Gary Bisson \u003cgary.bisson@boundarydevices.com\u003e\nFixes: 3faa1bb2e89c (\"ARM: dts: imx: add Boundary Devices Nitrogen6_SOM2 support\")\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Shawn Guo \u003cshawnguo@kernel.org\u003e\n" }, { "commit": "04d49f3638d0210de592dd52ad62cfca8b3ed9fe", "tree": "7fecc08beedc44265ede1b6716f7633226255a70", "parents": [ "d33a2a914319e9ec71f49bad2b8c8b9e05a58edf", "28eb46287916f7f3ceec874959693e3fc49a294a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Aug 17 16:48:29 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Aug 17 16:48:29 2017 -0700" }, "message": "Merge tag \u0027drm-fixes-for-v4.13-rc6\u0027 of git://people.freedesktop.org/~airlied/linux\n\nPull drm fixes from Dave Airlie:\n \"Seems to be slowing down nicely, just one amdgpu fix, and a bunch of\n i915 fixes\"\n\n* tag \u0027drm-fixes-for-v4.13-rc6\u0027 of git://people.freedesktop.org/~airlied/linux:\n drm/amdgpu: save list length when fence is signaled\n drm/i915: Avoid the gpu reset vs. modeset deadlock\n drm/i915: Suppress switch_mm emission between the same aliasing_ppgtt\n drm/i915: Return correct EDP voltage swing table for 0.85V\n drm/i915/cnl: Add slice and subslice information to debugfs.\n drm/i915: Perform an invalidate prior to executing golden renderstate\n drm/i915: remove unused function declaration\n" }, { "commit": "d33a2a914319e9ec71f49bad2b8c8b9e05a58edf", "tree": "4e4de33d81a96e99da477ed28e3eb5965be475d2", "parents": [ "440105d3c958cf10b5900fac9d4632d47d57a0cc", "8179962b84668d71586cd3efcb70e823f37a5702" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Aug 17 14:21:18 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Aug 17 14:21:18 2017 -0700" }, "message": "Merge tag \u0027pm-4.13-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fixes from Rafael Wysocki:\n \"These fix two issues related to exposing the current CPU frequency to\n user space on x86.\n\n Specifics:\n\n - Disable interrupts around reading IA32_APERF and IA32_MPERF in\n aperfmperf_snapshot_khz() (introduced recently) to avoid excessive\n delays between the reads that may result from interrupt handling\n (Doug Smythies).\n\n - Fix the computation of the CPU frequency to be reported through the\n pstate_sample tracepoint in intel_pstate (Doug Smythies)\"\n\n* tag \u0027pm-4.13-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n cpufreq: x86: Disable interrupts during MSRs reading\n cpufreq: intel_pstate: report correct CPU frequencies during trace\n" }, { "commit": "440105d3c958cf10b5900fac9d4632d47d57a0cc", "tree": "e89313c0979b050f985f252c76ad6613cc5a91ad", "parents": [ "3bc6c906eacec34f0d8dcfd3c7e4513edf152297", "76988690402dde2880bfe06ecccf381d48ba8e1c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Aug 17 13:45:44 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Aug 17 13:45:44 2017 -0700" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input\n\nPull input fixes from Dmitry Torokhov.\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:\n Input: elan_i2c - Add antoher Lenovo ACPI ID for upcoming Lenovo NB\n Input: elan_i2c - add ELAN0608 to the ACPI table\n Input: trackpoint - assume 3 buttons when buttons detection fails\n" }, { "commit": "28eb46287916f7f3ceec874959693e3fc49a294a", "tree": "fdbce10ee987b700ec3794141401ba823f7640d3", "parents": [ "41d31b5fd29bd768a7174b754249c97563c21fae", "7a7c286d07f9c704e8fd11dd960bf421cc67b66b" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Aug 18 05:45:03 2017 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Aug 18 05:45:03 2017 +1000" }, "message": "Merge branch \u0027drm-fixes-4.13\u0027 of git://people.freedesktop.org/~agd5f/linux into drm-fixes\n\nsingle amdgpu fix.\n\n* \u0027drm-fixes-4.13\u0027 of git://people.freedesktop.org/~agd5f/linux:\n drm/amdgpu: save list length when fence is signaled\n" }, { "commit": "41d31b5fd29bd768a7174b754249c97563c21fae", "tree": "3c3d1f16f3ec2706a463a388ae58c699b9b22144", "parents": [ "ef954844c7ace62f773f4f23e28d2d915adc419f", "781cc76e0c2469cb7ac12ba238a4ea006978e321" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Aug 18 05:43:10 2017 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Aug 18 05:43:10 2017 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2017-08-16\u0027 of git://anongit.freedesktop.org/git/drm-intel into drm-fixes\n\ndrm/i915 fixes for v4.13-rc6\n\n\"Chris\u0027 \"drm/i915: Perform an invalidate prior to executing golden renderstate\" and Daniel\u0027s\n\"drm/i915: Avoid the gpu reset vs. modeset deadlock\" seem like the most important ones.\n\n* tag \u0027drm-intel-fixes-2017-08-16\u0027 of git://anongit.freedesktop.org/git/drm-intel:\n drm/i915: Avoid the gpu reset vs. modeset deadlock\n drm/i915: Suppress switch_mm emission between the same aliasing_ppgtt\n drm/i915: Return correct EDP voltage swing table for 0.85V\n drm/i915/cnl: Add slice and subslice information to debugfs.\n drm/i915: Perform an invalidate prior to executing golden renderstate\n drm/i915: remove unused function declaration\n" }, { "commit": "77aff8c76425c8f49b50d0b9009915066739e7d2", "tree": "a50370e38abe86979873fbf79c68e791c9aff0cd", "parents": [ "8204f8ddaafafcae074746fcf2a05a45e6827603" ], "author": { "name": "Darrick J. Wong", "email": "darrick.wong@oracle.com", "time": "Thu Aug 10 14:20:29 2017 -0700" }, "committer": { "name": "Darrick J. Wong", "email": "darrick.wong@oracle.com", "time": "Thu Aug 17 12:40:33 2017 -0700" }, "message": "xfs: don\u0027t leak quotacheck dquots when cow recovery\n\nIf we fail a mount on account of cow recovery errors, it\u0027s possible that\na previous quotacheck left some dquots in memory. The bailout clause of\nxfs_mountfs forgets to purge these, and so we leak them. Fix that.\n\nSigned-off-by: Darrick J. Wong \u003cdarrick.wong@oracle.com\u003e\nReviewed-by: Brian Foster \u003cbfoster@redhat.com\u003e\n" }, { "commit": "8204f8ddaafafcae074746fcf2a05a45e6827603", "tree": "9313a82a31be8acdbc07a403981a3636a900d608", "parents": [ "e28ae8e428fefe2facd72cea9f29906ecb9c861d" ], "author": { "name": "Darrick J. Wong", "email": "darrick.wong@oracle.com", "time": "Thu Aug 10 14:20:28 2017 -0700" }, "committer": { "name": "Darrick J. Wong", "email": "darrick.wong@oracle.com", "time": "Thu Aug 17 12:40:33 2017 -0700" }, "message": "xfs: clear MS_ACTIVE after finishing log recovery\n\nWay back when we established inode block-map redo log items, it was\ndiscovered that we needed to prevent the VFS from evicting inodes during\nlog recovery because any given inode might be have bmap redo items to\nreplay even if the inode has no link count and is ultimately deleted,\nand any eviction of an unlinked inode causes the inode to be truncated\nand freed too early.\n\nTo make this possible, we set MS_ACTIVE so that inodes would not be torn\ndown immediately upon release. Unfortunately, this also results in the\nquota inodes not being released at all if a later part of the mount\nprocess should fail, because we never reclaim the inodes. So, set\nMS_ACTIVE right before we do the last part of log recovery and clear it\nimmediately after we finish the log recovery so that everything\nwill be torn down properly if we abort the mount.\n\nFixes: 17c12bcd30 (\"xfs: when replaying bmap operations, don\u0027t let unlinked inodes get reaped\")\nSigned-off-by: Darrick J. Wong \u003cdarrick.wong@oracle.com\u003e\nReviewed-by: Brian Foster \u003cbfoster@redhat.com\u003e\n" }, { "commit": "8179962b84668d71586cd3efcb70e823f37a5702", "tree": "406df08e9216516d057e3c7b6ede926c845637fa", "parents": [ "ef954844c7ace62f773f4f23e28d2d915adc419f", "c587c79f90632df59c61383c6abebb2e07a81911", "8e2f3bce05e056575c2c84a344a8291fdabb5f21" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Thu Aug 17 21:00:30 2017 +0200" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Thu Aug 17 21:00:30 2017 +0200" }, "message": "Merge branches \u0027intel_pstate-fix\u0027 and \u0027cpufreq-x86-fix\u0027\n\n* intel_pstate-fix:\n cpufreq: intel_pstate: report correct CPU frequencies during trace\n\n* cpufreq-x86-fix:\n cpufreq: x86: Disable interrupts during MSRs reading\n" }, { "commit": "3bc6c906eacec34f0d8dcfd3c7e4513edf152297", "tree": "6fdca669a44a3084d140fffeda7fc4a157b5772b", "parents": [ "99f781b1bfc199ec8eb86d4e015920faf79d5d57", "d6957f3396d0b1ee54d183524550d791054b5ebe" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Aug 17 11:39:54 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Aug 17 11:39:54 2017 -0700" }, "message": "Merge branch \u0027parisc-4.13-5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux\n\nPull parisc fixes from Helge Deller:\n\n - Fix PCI memory bar assignments with 64-bit kernels on machines with\n Dino/Cujo PCI chipsets. This makes PCI graphic cards work on such\n machines (from Thomas Bogendoerfer).\n\n - Fix documentation to be more clear about the difference between %pF\n and %pS printk format usage. There are still many places in the\n kernel which have it wrong (from Petr Mladek, Sergey Senozhatsky \u0026\n me).\n\n* \u0027parisc-4.13-5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:\n printk-formats.txt: Better describe the difference between %pS and %pF\n parisc: pci memory bar assignment fails with 64bit kernels on dino/cujo\n" }, { "commit": "014cd0a368dc6351c65d51e4ee34f8573a4a1543", "tree": "965417f9d84fffdabf3930c6b3f9f242f7506750", "parents": [ "c780a049f9bf442314335372c9abc4548bfe3e44" ], "author": { "name": "Michael Ellerman", "email": "mpe@ellerman.id.au", "time": "Thu Aug 17 20:30:39 2017 +1000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Aug 17 10:09:28 2017 -0700" }, "message": "bpf: Update sysctl documentation to list all supported architectures\n\nThe sysctl documentation states that the JIT is only available on\nx86_64, which is no longer correct.\n\nUpdate the list, and break it out to indicate which architectures\nsupport the cBPF JIT (via HAVE_CBPF_JIT) or the eBPF JIT\n(HAVE_EBPF_JIT).\n\nSigned-off-by: Michael Ellerman \u003cmpe@ellerman.id.au\u003e\nAcked-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "81a0b8d74edd5841be29d223ce44bc8db2b00d09", "tree": "84017dbbeda72bcf8c2dc30a3b3a35b086098b76", "parents": [ "369157b41cca435442cf5add9df209aaf951860d" ], "author": { "name": "Christoph Hellwig", "email": "hch@lst.de", "time": "Thu Aug 17 13:57:49 2017 +0200" }, "committer": { "name": "Christoph Hellwig", "email": "hch@lst.de", "time": "Thu Aug 17 18:48:54 2017 +0200" }, "message": "nvme-fabrics: fix reporting of unrecognized options\n\nOnly print the specified options that are not recognized, instead\nof the whole list of options.\n\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\nReviewed-by: Max Gurtovoy \u003cmaxg@mellanox.com\u003e\n" }, { "commit": "99f781b1bfc199ec8eb86d4e015920faf79d5d57", "tree": "68fe7253ef59880a6a18b51f51a8bef8bdc427b6", "parents": [ "c8c03f1858331e85d397bacccd34ef409aae993c", "41e327b586762833e48b3703d53312ac32f05f24" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Aug 17 09:26:10 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Aug 17 09:26:10 2017 -0700" }, "message": "Merge branch \u0027for_linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs\n\nPull quota fix from Jan Kara:\n \"A fix of a check for quota limit\"\n\n* \u0027for_linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:\n quota: correct space limit check\n" }, { "commit": "c8c03f1858331e85d397bacccd34ef409aae993c", "tree": "02e36380538407e87ebd5b523c79851f7549d6c9", "parents": [ "ac9a40905a610fb02086a37b11ff4bf046825a88" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Aug 16 17:08:07 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Aug 17 09:10:48 2017 -0700" }, "message": "pty: fix the cached path of the pty slave file descriptor in the master\n\nChristian Brauner reported that if you use the TIOCGPTPEER ioctl() to\nget a slave pty file descriptor, the resulting file descriptor doesn\u0027t\nlook right in /proc/\u003cpid\u003e/fd/\u003cfd\u003e. In particular, he wanted to use\nreadlink() on /proc/self/fd/\u003cfd\u003e to get the pathname of the slave pty\n(basically implementing \"ptsname{_r}()\").\n\nThe reason for that was that we had generated the wrong \u0027struct path\u0027\nwhen we create the pty in ptmx_open().\n\nIn particular, the dentry was correct, but the vfsmount pointed to the\nmount of the ptmx node. That _can_ be correct - in case you use\n\"/dev/pts/ptmx\" to open the master - but usually is not. The normal\ncase is to use /dev/ptmx, which then looks up the pts/ directory, and\nthen the vfsmount of the ptmx node is obviously the /dev directory, not\nthe /dev/pts/ directory.\n\nWe actually did have the right vfsmount available, but in the wrong\nplace (it gets looked up in \u0027devpts_acquire()\u0027 when we get a reference\nto the pts filesystem), and so ptmx_open() used the wrong mnt pointer.\n\nThe end result of this confusion was that the pty worked fine, but when\nif you did TIOCGPTPEER to get the slave side of the pty, end end result\nwould also work, but have that dodgy \u0027struct path\u0027.\n\nAnd then when doing \"d_path()\" on to get the pathname, the vfsmount\nwould not match the root of the pts directory, and d_path() would return\nan empty pathname thinking that the entry had escaped a bind mount into\nanother mount.\n\nThis fixes the problem by making devpts_acquire() return the vfsmount\nfor the pts filesystem, allowing ptmx_open() to trivially just use the\nright mount for the pts dentry, and create the proper \u0027struct path\u0027.\n\nReported-by: Christian Brauner \u003cchristian.brauner@ubuntu.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nAcked-by: Eric Biederman \u003cebiederm@xmission.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "0f174b3525a43bd51f9397394763925e0ebe7bc7", "tree": "f13262060f55267e5740e1cea1ad979e36813f4a", "parents": [ "a8e800fe0f68bc28ce309914f47e432742b865ed" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Aug 16 14:18:37 2017 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Aug 17 17:52:16 2017 +0200" }, "message": "ALSA: usb-audio: Add mute TLV for playback volumes on C-Media devices\n\nC-Media devices (at least some models) mute the playback stream when\nvolumes are set to the minimum value. But this isn\u0027t informed via TLV\nand the user-space, typically PulseAudio, gets confused as if it\u0027s\nstill played in a low volume.\n\nThis patch adds the new flag, min_mute, to struct usb_mixer_elem_info\nfor indicating that the mixer element is with the minimum-mute volume.\nThis flag is set for known C-Media devices in\nsnd_usb_mixer_fu_apply_quirk() in turn.\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id\u003d196669\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "872784bffbe4217611922bc0f929dbd9cad65528", "tree": "b38bd8ba020eff9da284786ae629ab7e3740b4ed", "parents": [ "44506752fafae0c9358af95ffc89c687ce56650e", "8cd7b51ff57c74260b20c97623b0e0d420c22be8" ], "author": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Thu Aug 17 11:00:26 2017 +0200" }, "committer": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Thu Aug 17 11:00:26 2017 +0200" }, "message": "Merge tag \u0027renesas-fixes4-for-v4.13\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into fixes\n\nPull \"Fourth Round of Renesas ARM Based SoC Fixes for v4.13\" from Simon Horman:\n\n* Avoid audio_clkout naming conflict for salvator boards using\n Renesas R-Car Gen 3 SoCs\n\n Morimoto-san says \"The clock name of \"audio_clkout\" is used by the\n Renesas sound driver. This duplicated naming breaks its clock\n registering/unregistering. Especially when unbind/bind it can\u0027t handle\n clkout correctly. This patch renames \"audio_clkout\" to \"audio-clkout\" to\n avoid the naming conflict.\"\n\n* tag \u0027renesas-fixes4-for-v4.13\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas:\n arm64: renesas: salvator-common: avoid audio_clkout naming conflict\n" }, { "commit": "ee7b1f31200d9f3cc45e1bd22e962bd6b1d4d611", "tree": "9988e94d8327023090322f4b5e54683cddb51d2c", "parents": [ "ef954844c7ace62f773f4f23e28d2d915adc419f" ], "author": { "name": "Robin Murphy", "email": "robin.murphy@arm.com", "time": "Fri Aug 11 17:29:56 2017 +0100" }, "committer": { "name": "Christoph Hellwig", "email": "hch@lst.de", "time": "Thu Aug 17 10:23:45 2017 +0200" }, "message": "of: fix DMA mask generation\n\nHistorically, DMA masks have suffered some ambiguity between whether\nthey represent the range of physical memory a device can access, or the\naddress bits a device is capable of driving, particularly since on many\nplatforms the two are equivalent. Whilst there are some stragglers left\n(dma_max_pfn(), I\u0027m looking at you...), the majority of DMA code has\nbeen cleaned up to follow the latter definition, not least since it is\nthe only one which makes sense once IOMMUs are involved.\n\nIn this respect, of_dma_configure() has always done the wrong thing in\nhow it generates initial masks based on \"dma-ranges\". Although rounding\ndown did not affect the TI Keystone platform where dma_addr + size is\nalready a power of two, in any other case it results in a mask which is\nat best unnecessarily constrained and at worst unusable.\n\nBCM2837 illustrates the problem nicely, where we have a DMA base of 3GB\nand a size of 1GB - 16MB, giving dma_addr + size \u003d 0xff000000 and a\nresultant mask of 0x7fffffff, which is then insufficient to even cover\nthe necessary offset, effectively making all DMA addresses out-of-range.\nThis has been hidden until now (mostly because we don\u0027t yet prevent\ndrivers from simply overwriting this initial mask later upon probe), but\ndue to recent changes elsewhere now shows up as USB being broken on\nRaspberry Pi 3.\n\nMake it right by rounding up instead of down, such that the mask\ncorrectly correctly describes all possisble bits the device needs to\nemit.\n\nFixes: 9a6d7298b083 (\"of: Calculate device DMA masks based on DT dma-range size\")\nReported-by: Stefan Wahren \u003cstefan.wahren@i2se.com\u003e\nReported-by: Andreas Färber \u003cafaerber@suse.de\u003e\nReported-by: Hans Verkuil \u003chverkuil@xs4all.nl\u003e\nSigned-off-by: Robin Murphy \u003crobin.murphy@arm.com\u003e\nAcked-by: Rob Herring \u003crobh@kernel.org\u003e\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\n" }, { "commit": "187e91fe5e915f4b7f39b824aa422493463e443d", "tree": "4b2c8fe90f4d4be61b2a25ceb1c5a6fe20d6aad0", "parents": [ "01578e36163cdd0e4fd61d9976de15f13364e26d" ], "author": { "name": "Alexander Potapenko", "email": "glider@google.com", "time": "Wed Aug 16 21:08:08 2017 +0200" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Thu Aug 17 09:53:00 2017 +0200" }, "message": "x86/boot/64/clang: Use fixup_pointer() to access \u0027next_early_pgt\u0027\n\n__startup_64() is normally using fixup_pointer() to access globals in a\nposition-independent fashion. However \u0027next_early_pgt\u0027 was accessed\ndirectly, which wasn\u0027t guaranteed to work.\n\nLuckily GCC was generating a R_X86_64_PC32 PC-relative relocation for\n\u0027next_early_pgt\u0027, but Clang emitted a R_X86_64_32S, which led to\naccessing invalid memory and rebooting the kernel.\n\nSigned-off-by: Alexander Potapenko \u003cglider@google.com\u003e\nAcked-by: Kirill A. Shutemov \u003ckirill.shutemov@linux.intel.com\u003e\nCc: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nCc: Kirill A. Shutemov \u003ckirill.shutemov@linux.intel.com\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Michael Davidson \u003cmd@google.com\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nFixes: c88d71508e36 (\"x86/boot/64: Rewrite startup_64() in C\")\nLink: http://lkml.kernel.org/r/20170816190808.131748-1-glider@google.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n" }, { "commit": "369157b41cca435442cf5add9df209aaf951860d", "tree": "01e5eb2a6603be7be9b56374b8de54fa79589f13", "parents": [ "16a5a480f067f945fd27bf91ffdce3f959b0d4b6" ], "author": { "name": "James Smart", "email": "jsmart2021@gmail.com", "time": "Wed Aug 16 10:47:03 2017 -0700" }, "committer": { "name": "Christoph Hellwig", "email": "hch@lst.de", "time": "Thu Aug 17 09:35:08 2017 +0200" }, "message": "nvmet-fc: eliminate incorrect static markers on local variables\n\nThere were 2 statics introduced that were bogus. Removed the static\ndesignations.\n\nSigned-off-by: James Smart \u003cjames.smart@broadcom.com\u003e\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\n" }, { "commit": "ac9a40905a610fb02086a37b11ff4bf046825a88", "tree": "b08dfbd233483126fa1cd8aa5559564105d00c02", "parents": [ "422ce075f969ffd650e371faa5a02586d0c0b2e6", "424f727b94132a4193af401dd823c44612d1d59f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Aug 16 17:21:20 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Aug 16 17:21:20 2017 -0700" }, "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"A couple of minor fixes (st, ses) and some bigger driver fixes for\n qla2xxx (crash triggered by fw dump) and ipr (lockdep problems with\n mq)\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: ses: Fix wrong page error\n scsi: ipr: Fix scsi-mq lockdep issue\n scsi: st: fix blk_get_queue usage\n scsi: qla2xxx: Fix system crash while triggering FW dump\n" }, { "commit": "422ce075f969ffd650e371faa5a02586d0c0b2e6", "tree": "c9cbc23d3ae63eef00447a592799014e47b428cd", "parents": [ "510c8a899caf095cb13d09d203573deef15db2fe", "b5fed474b98332559f2590c6bc90388a0899e793" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Aug 16 16:48:34 2017 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Aug 16 16:48:34 2017 -0700" }, "message": "Merge tag \u0027audit-pr-20170816\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit\n\nPull audit fixes from Paul Moore:\n \"Two small fixes to the audit code, both explained well in the\n respective patch descriptions, but the quick summary is one\n use-after-free fix, and one silly fanotify notification flag fix\"\n\n* tag \u0027audit-pr-20170816\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:\n audit: Receive unmount event\n audit: Fix use after free in audit_remove_watch_rule()\n" }, { "commit": "c780a049f9bf442314335372c9abc4548bfe3e44", "tree": "9bfe8c76f75ea6d1dbc52efa95ff294d80d58c8a", "parents": [ "81fbfe8adaf38d4f5a98c19bebfd41c5d6acaee8" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Aug 16 11:09:12 2017 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Aug 16 16:28:47 2017 -0700" }, "message": "ipv4: better IP_MAX_MTU enforcement\n\nWhile working on yet another syzkaller report, I found\nthat our IP_MAX_MTU enforcements were not properly done.\n\ngcc seems to reload dev-\u003emtu for min(dev-\u003emtu, IP_MAX_MTU), and\nfinal result can be bigger than IP_MAX_MTU :/\n\nThis is a problem because device mtu can be changed on other cpus or\nthreads.\n\nWhile this patch does not fix the issue I am working on, it is\nprobably worth addressing it.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "81fbfe8adaf38d4f5a98c19bebfd41c5d6acaee8", "tree": "d6b6fc17c19f0df3e916e55726dee279c055deb6", "parents": [ "120e9dabaf551c6dc03d3a10a1f026376cb1811c" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Aug 16 10:36:47 2017 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Aug 16 16:28:47 2017 -0700" }, "message": "ptr_ring: use kmalloc_array()\n\nAs found by syzkaller, malicious users can set whatever tx_queue_len\non a tun device and eventually crash the kernel.\n\nLets remove the ALIGN(XXX, SMP_CACHE_BYTES) thing since a small\nring buffer is not fast anyway.\n\nFixes: 2e0ab8ca83c1 (\"ptr_ring: array based FIFO for pointers\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nCc: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nCc: Jason Wang \u003cjasowang@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "120e9dabaf551c6dc03d3a10a1f026376cb1811c", "tree": "0232e1136cfee64e288463da58788fe18b6632b7", "parents": [ "494bea39f3201776cdfddc232705f54a0bd210c4" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Aug 16 07:03:15 2017 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Aug 16 14:26:26 2017 -0700" }, "message": "dccp: defer ccid_hc_tx_delete() at dismantle time\n\nsyszkaller team reported another problem in DCCP [1]\n\nProblem here is that the structure holding RTO timer\n(ccid2_hc_tx_rto_expire() handler) is freed too soon.\n\nWe can not use del_timer_sync() to cancel the timer\nsince this timer wants to grab socket lock (that would risk a dead lock)\n\nSolution is to defer the freeing of memory when all references to\nthe socket were released. Socket timers do own a reference, so this\nshould fix the issue.\n\n[1]\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nBUG: KASAN: use-after-free in ccid2_hc_tx_rto_expire+0x51c/0x5c0 net/dccp/ccids/ccid2.c:144\nRead of size 4 at addr ffff8801d2660540 by task kworker/u4:7/3365\n\nCPU: 1 PID: 3365 Comm: kworker/u4:7 Not tainted 4.13.0-rc4+ #3\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nWorkqueue: events_unbound call_usermodehelper_exec_work\nCall Trace:\n \u003cIRQ\u003e\n __dump_stack lib/dump_stack.c:16 [inline]\n dump_stack+0x194/0x257 lib/dump_stack.c:52\n print_address_description+0x73/0x250 mm/kasan/report.c:252\n kasan_report_error mm/kasan/report.c:351 [inline]\n kasan_report+0x24e/0x340 mm/kasan/report.c:409\n __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:429\n ccid2_hc_tx_rto_expire+0x51c/0x5c0 net/dccp/ccids/ccid2.c:144\n call_timer_fn+0x233/0x830 kernel/time/timer.c:1268\n expire_timers kernel/time/timer.c:1307 [inline]\n __run_timers+0x7fd/0xb90 kernel/time/timer.c:1601\n run_timer_softirq+0x21/0x80 kernel/time/timer.c:1614\n __do_softirq+0x2f5/0xba3 kernel/softirq.c:284\n invoke_softirq kernel/softirq.c:364 [inline]\n irq_exit+0x1cc/0x200 kernel/softirq.c:405\n exiting_irq arch/x86/include/asm/apic.h:638 [inline]\n smp_apic_timer_interrupt+0x76/0xa0 arch/x86/kernel/apic/apic.c:1044\n apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:702\nRIP: 0010:arch_local_irq_enable arch/x86/include/asm/paravirt.h:824 [inline]\nRIP: 0010:__raw_write_unlock_irq include/linux/rwlock_api_smp.h:267 [inline]\nRIP: 0010:_raw_write_unlock_irq+0x56/0x70 kernel/locking/spinlock.c:343\nRSP: 0018:ffff8801cd50eaa8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10\nRAX: dffffc0000000000 RBX: ffffffff85a090c0 RCX: 0000000000000006\nRDX: 1ffffffff0b595f3 RSI: 1ffff1003962f989 RDI: ffffffff85acaf98\nRBP: ffff8801cd50eab0 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffff8801cc96ea60\nR13: dffffc0000000000 R14: ffff8801cc96e4c0 R15: ffff8801cc96e4c0\n \u003c/IRQ\u003e\n release_task+0xe9e/0x1a40 kernel/exit.c:220\n wait_task_zombie kernel/exit.c:1162 [inline]\n wait_consider_task+0x29b8/0x33c0 kernel/exit.c:1389\n do_wait_thread kernel/exit.c:1452 [inline]\n do_wait+0x441/0xa90 kernel/exit.c:1523\n kernel_wait4+0x1f5/0x370 kernel/exit.c:1665\n SYSC_wait4+0x134/0x140 kernel/exit.c:1677\n SyS_wait4+0x2c/0x40 kernel/exit.c:1673\n call_usermodehelper_exec_sync kernel/kmod.c:286 [inline]\n call_usermodehelper_exec_work+0x1a0/0x2c0 kernel/kmod.c:323\n process_one_work+0xbf3/0x1bc0 kernel/workqueue.c:2097\n worker_thread+0x223/0x1860 kernel/workqueue.c:2231\n kthread+0x35e/0x430 kernel/kthread.c:231\n ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:425\n\nAllocated by task 21267:\n save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59\n save_stack+0x43/0xd0 mm/kasan/kasan.c:447\n set_track mm/kasan/kasan.c:459 [inline]\n kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551\n kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489\n kmem_cache_alloc+0x127/0x750 mm/slab.c:3561\n ccid_new+0x20e/0x390 net/dccp/ccid.c:151\n dccp_hdlr_ccid+0x27/0x140 net/dccp/feat.c:44\n __dccp_feat_activate+0x142/0x2a0 net/dccp/feat.c:344\n dccp_feat_activate_values+0x34e/0xa90 net/dccp/feat.c:1538\n dccp_rcv_request_sent_state_process net/dccp/input.c:472 [inline]\n dccp_rcv_state_process+0xed1/0x1620 net/dccp/input.c:677\n dccp_v4_do_rcv+0xeb/0x160 net/dccp/ipv4.c:679\n sk_backlog_rcv include/net/sock.h:911 [inline]\n __release_sock+0x124/0x360 net/core/sock.c:2269\n release_sock+0xa4/0x2a0 net/core/sock.c:2784\n inet_wait_for_connect net/ipv4/af_inet.c:557 [inline]\n __inet_stream_connect+0x671/0xf00 net/ipv4/af_inet.c:643\n inet_stream_connect+0x58/0xa0 net/ipv4/af_inet.c:682\n SYSC_connect+0x204/0x470 net/socket.c:1642\n SyS_connect+0x24/0x30 net/socket.c:1623\n entry_SYSCALL_64_fastpath+0x1f/0xbe\n\nFreed by task 3049:\n save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59\n save_stack+0x43/0xd0 mm/kasan/kasan.c:447\n set_track mm/kasan/kasan.c:459 [inline]\n kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524\n __cache_free mm/slab.c:3503 [inline]\n kmem_cache_free+0x77/0x280 mm/slab.c:3763\n ccid_hc_tx_delete+0xc5/0x100 net/dccp/ccid.c:190\n dccp_destroy_sock+0x1d1/0x2b0 net/dccp/proto.c:225\n inet_csk_destroy_sock+0x166/0x3f0 net/ipv4/inet_connection_sock.c:833\n dccp_done+0xb7/0xd0 net/dccp/proto.c:145\n dccp_time_wait+0x13d/0x300 net/dccp/minisocks.c:72\n dccp_rcv_reset+0x1d1/0x5b0 net/dccp/input.c:160\n dccp_rcv_state_process+0x8fc/0x1620 net/dccp/input.c:663\n dccp_v4_do_rcv+0xeb/0x160 net/dccp/ipv4.c:679\n sk_backlog_rcv include/net/sock.h:911 [inline]\n __sk_receive_skb+0x33e/0xc00 net/core/sock.c:521\n dccp_v4_rcv+0xef1/0x1c00 net/dccp/ipv4.c:871\n ip_local_deliver_finish+0x2e2/0xba0 net/ipv4/ip_input.c:216\n NF_HOOK include/linux/netfilter.h:248 [inline]\n ip_local_deliver+0x1ce/0x6d0 net/ipv4/ip_input.c:257\n dst_input include/net/dst.h:477 [inline]\n ip_rcv_finish+0x8db/0x19c0 net/ipv4/ip_input.c:397\n NF_HOOK include/linux/netfilter.h:248 [inline]\n ip_rcv+0xc3f/0x17d0 net/ipv4/ip_input.c:488\n __netif_receive_skb_core+0x19af/0x33d0 net/core/dev.c:4417\n __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4455\n process_backlog+0x203/0x740 net/core/dev.c:5130\n napi_poll net/core/dev.c:5527 [inline]\n net_rx_action+0x792/0x1910 net/core/dev.c:5593\n __do_softirq+0x2f5/0xba3 kernel/softirq.c:284\n\nThe buggy address belongs to the object at ffff8801d2660100\n which belongs to the cache ccid2_hc_tx_sock of size 1240\nThe buggy address is located 1088 bytes inside of\n 1240-byte region [ffff8801d2660100, ffff8801d26605d8)\nThe buggy address belongs to the page:\npage:ffffea0007499800 count:1 mapcount:0 mapping:ffff8801d2660100 index:0x0 compound_mapcount: 0\nflags: 0x200000000008100(slab|head)\nraw: 0200000000008100 ffff8801d2660100 0000000000000000 0000000100000005\nraw: ffffea00075271a0 ffffea0007538820 ffff8801d3aef9c0 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff8801d2660400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff8801d2660480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\u003effff8801d2660500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ^\n ffff8801d2660580: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc\n ffff8801d2660600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nCc: Gerrit Renker \u003cgerrit@erg.abdn.ac.uk\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "494bea39f3201776cdfddc232705f54a0bd210c4", "tree": "657cb0733bea47a668c47c4e0cd37eadc3acafc7", "parents": [ "c7b725be84985532161bcb4fbecd056326998a77" ], "author": { "name": "Liping Zhang", "email": "zlpnobody@gmail.com", "time": "Wed Aug 16 13:30:07 2017 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Aug 16 14:12:37 2017 -0700" }, "message": "openvswitch: fix skb_panic due to the incorrect actions attrlen\n\nFor sw_flow_actions, the actions_len only represents the kernel part\u0027s\nsize, and when we dump the actions to the userspace, we will do the\nconvertions, so it\u0027s true size may become bigger than the actions_len.\n\nBut unfortunately, for OVS_PACKET_ATTR_ACTIONS, we use the actions_len\nto alloc the skbuff, so the user_skb\u0027s size may become insufficient and\noops will happen like this:\n skbuff: skb_over_panic: text:ffffffff8148fabf len:1749 put:157 head:\n ffff881300f39000 data:ffff881300f39000 tail:0x6d5 end:0x6c0 dev:\u003cNULL\u003e\n ------------[ cut here ]------------\n kernel BUG at net/core/skbuff.c:129!\n [...]\n Call Trace:\n \u003cIRQ\u003e\n [\u003cffffffff8148be82\u003e] skb_put+0x43/0x44\n [\u003cffffffff8148fabf\u003e] skb_zerocopy+0x6c/0x1f4\n [\u003cffffffffa0290d36\u003e] queue_userspace_packet+0x3a3/0x448 [openvswitch]\n [\u003cffffffffa0292023\u003e] ovs_dp_upcall+0x30/0x5c [openvswitch]\n [\u003cffffffffa028d435\u003e] output_userspace+0x132/0x158 [openvswitch]\n [\u003cffffffffa01e6890\u003e] ? ip6_rcv_finish+0x74/0x77 [ipv6]\n [\u003cffffffffa028e277\u003e] do_execute_actions+0xcc1/0xdc8 [openvswitch]\n [\u003cffffffffa028e3f2\u003e] ovs_execute_actions+0x74/0x106 [openvswitch]\n [\u003cffffffffa0292130\u003e] ovs_dp_process_packet+0xe1/0xfd [openvswitch]\n [\u003cffffffffa0292b77\u003e] ? key_extract+0x63c/0x8d5 [openvswitch]\n [\u003cffffffffa029848b\u003e] ovs_vport_receive+0xa1/0xc3 [openvswitch]\n [...]\n\nAlso we can find that the actions_len is much little than the orig_len:\n crash\u003e struct sw_flow_actions 0xffff8812f539d000\n struct sw_flow_actions {\n rcu \u003d {\n next \u003d 0xffff8812f5398800,\n func \u003d 0xffffe3b00035db32\n },\n orig_len \u003d 1384,\n actions_len \u003d 592,\n actions \u003d 0xffff8812f539d01c\n }\n\nSo as a quick fix, use the orig_len instead of the actions_len to alloc\nthe user_skb.\n\nLast, this oops happened on our system running a relative old kernel, but\nthe same risk still exists on the mainline, since we use the wrong\nactions_len from the beginning.\n\nFixes: ccea74457bbd (\"openvswitch: include datapath actions with sampled-packet upcall to userspace\")\nCc: Neil McKee \u003cneil.mckee@inmon.com\u003e\nSigned-off-by: Liping Zhang \u003czlpnobody@gmail.com\u003e\nAcked-by: Pravin B Shelar \u003cpshelar@ovn.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "d6957f3396d0b1ee54d183524550d791054b5ebe", "tree": "ae4a0c48a2595a8dd04fcd134ddaf5ad7061a5a9", "parents": [ "4098116039911e8870d84c975e2ec22dab65a909" ], "author": { "name": "Helge Deller", "email": "deller@gmx.de", "time": "Tue Aug 15 11:34:19 2017 +0200" }, "committer": { "name": "Helge Deller", "email": "deller@gmx.de", "time": "Wed Aug 16 21:09:45 2017 +0200" }, "message": "printk-formats.txt: Better describe the difference between %pS and %pF\n\nSometimes people seems unclear when to use the %pS or %pF printk format.\nFor example, see commit 51d96dc2e2dc (\"random: fix warning message on ia64\nand parisc\") which fixed such a wrong format string.\n\nThe documentation should be more clear about the difference.\n\nSigned-off-by: Helge Deller \u003cdeller@gmx.de\u003e\n[pmladek@suse.com: Restructure the entire section]\nSigned-off-by: Petr Mladek \u003cpmladek@suse.com\u003e\nReviewed-by: Sergey Senozhatsky \u003csergey.senozhatsky@gmail.com\u003e\nSigned-off-by: Helge Deller \u003cdeller@gmx.de\u003e\n" }, { "commit": "01578e36163cdd0e4fd61d9976de15f13364e26d", "tree": "86533cfa0a449da9da60106db7e198502a0a65c1", "parents": [ "47ac5484fd961420e5ec0bb5b972fde381f57365" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Tue Aug 15 17:40:11 2017 +0200" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Wed Aug 16 20:32:02 2017 +0200" }, "message": "x86/elf: Remove the unnecessary ADDR_NO_RANDOMIZE checks\n\nThe ADDR_NO_RANDOMIZE checks in stack_maxrandom_size() and\nrandomize_stack_top() are not required.\n\nPF_RANDOMIZE is set by load_elf_binary() only if ADDR_NO_RANDOMIZE is not\nset, no need to re-check after that.\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nReviewed-by: Dmitry Safonov \u003cdsafonov@virtuozzo.com\u003e\nCc: stable@vger.kernel.org\nCc: Andy Lutomirski \u003cluto@amacapital.net\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: Borislav Petkov \u003cbp@suse.de\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: \"Kirill A. Shutemov\" \u003ckirill.shutemov@linux.intel.com\u003e\nLink: http://lkml.kernel.org/r/20170815154011.GB1076@redhat.com\n\n" } ], "next": "47ac5484fd961420e5ec0bb5b972fde381f57365" }