)]}' { "log": [ { "commit": "0854ba5ff5c938307cd783e996b62c83f1ce923b", "tree": "039e3eaa4fa6e979a281c535017424016366f23c", "parents": [ "0238df646e6224016a45505d2c111a24669ebe21", "b7dc10b64f6190a008f05baf697d4d8fa9b8ed51" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Oct 08 16:25:01 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Oct 08 16:25:01 2018 +0200" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc\n\nDavid writes:\n \"Sparc fixes:\n\n 1) Minor fallthru comment tweaks from Gustavo A. R. Silva.\n\n 2) VLA removal from Kees Cook.\n\n 3) Make sparc vdso Makefile match x86, from Masahiro Yamada.\n\n 4) Fix clock divider programming in mach64 driver, from Mikulas\n Patocka.\"\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:\n sparc64: fix fall-through annotation\n sparc32: fix fall-through annotation\n sparc: vdso: clean-up vdso Makefile\n oradax: remove redundant null check before kfree\n sparc64: viohs: Remove VLA usage\n sbus: Use of_get_child_by_name helper\n sparc: Convert to using %pOFn instead of device_node.name\n mach64: detect the dot clock divider correctly on sparc\n" }, { "commit": "b7dc10b64f6190a008f05baf697d4d8fa9b8ed51", "tree": "8f198231a01e1ea6926093326fbf23a367fb0d19", "parents": [ "c4beb225f93a2fdaffbe2a610eccb0f6c86b3e45" ], "author": { "name": "Gustavo A. R. Silva", "email": "gustavo@embeddedor.com", "time": "Tue Oct 02 12:19:54 2018 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Oct 07 22:42:02 2018 -0700" }, "message": "sparc64: fix fall-through annotation\n\nReplace \"fallthru\" with a proper \"fall through\" annotation.\n\nThis fix is part of the ongoing efforts to enabling\n-Wimplicit-fallthrough\n\nSigned-off-by: Gustavo A. R. Silva \u003cgustavo@embeddedor.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "c4beb225f93a2fdaffbe2a610eccb0f6c86b3e45", "tree": "ebd029df6dd584359db6eca678ce7b9a3d3a58e6", "parents": [ "8cf7765d33ae894cd7722502fbb737efad0eaa9b" ], "author": { "name": "Gustavo A. R. Silva", "email": "gustavo@embeddedor.com", "time": "Tue Oct 02 12:15:17 2018 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Oct 07 22:42:02 2018 -0700" }, "message": "sparc32: fix fall-through annotation\n\nReplace \"fallthru\" with a proper \"fall through\" annotation.\n\nThis fix is part of the ongoing efforts to enabling\n-Wimplicit-fallthrough\n\nSigned-off-by: Gustavo A. R. Silva \u003cgustavo@embeddedor.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "8cf7765d33ae894cd7722502fbb737efad0eaa9b", "tree": "3b647114528293db2ee27879f7f4877aef8ed34f", "parents": [ "16e2a9d396c140d9a47d6b22e2a631f36c31e844" ], "author": { "name": "Masahiro Yamada", "email": "yamada.masahiro@socionext.com", "time": "Wed Sep 12 12:39:13 2018 +0900" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Oct 07 22:42:01 2018 -0700" }, "message": "sparc: vdso: clean-up vdso Makefile\n\narch/sparc/vdso/Makefile is a replica of arch/x86/entry/vdso/Makefile.\n\nClean-up the Makefile in the same way as I did for x86:\n\n - Remove unnecessary export\n - Put the generated linker script to $(obj)/ instead of $(src)/\n - Simplify cmd_vdso2c\n\nThe corresponding x86 commits are:\n\n - 61615faf0a89 (\"x86/build/vdso: Remove unnecessary export in Makefile\")\n - 1742ed2088cc (\"x86/build/vdso: Put generated linker scripts to $(obj)/\")\n - c5fcdbf15523 (\"x86/build/vdso: Simplify \u0027cmd_vdso2c\u0027\")\n\nSigned-off-by: Masahiro Yamada \u003cyamada.masahiro@socionext.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "16e2a9d396c140d9a47d6b22e2a631f36c31e844", "tree": "986a3521976351782ddc6694abaae0d4ed8bc761", "parents": [ "31a43fa7945a1de8c550b35c211be5670e32f12b" ], "author": { "name": "Colin Ian King", "email": "colin.king@canonical.com", "time": "Fri Sep 07 11:35:00 2018 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Oct 07 22:42:00 2018 -0700" }, "message": "oradax: remove redundant null check before kfree\n\nA null check before a kfree is redundant, so remove it.\n\nSigned-off-by: Colin Ian King \u003ccolin.king@canonical.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "31a43fa7945a1de8c550b35c211be5670e32f12b", "tree": "4e2bc3c2bea2aa6b4e644013718cefc9e99f7e37", "parents": [ "df58f37b5d8f883fb18ba85e8d9a624154879832" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Wed Sep 05 15:03:51 2018 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Oct 07 22:42:00 2018 -0700" }, "message": "sparc64: viohs: Remove VLA usage\n\nIn the quest to remove all stack VLA usage from the kernel[1], this\nallocates a fixed size array for the maximum number of cookies and\nadds a runtime sanity check.\n\n[1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC\u003dqPXydAacU1\nRqZWA@mail.gmail.com\n\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "df58f37b5d8f883fb18ba85e8d9a624154879832", "tree": "e451435e9eee69780594dcb693a733298ff1bdfd", "parents": [ "0b9871a3a8cc7234c285b5d9bf66cc6712cfee7c" ], "author": { "name": "Rob Herring", "email": "robh@kernel.org", "time": "Wed Aug 29 15:03:37 2018 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Oct 07 22:41:08 2018 -0700" }, "message": "sbus: Use of_get_child_by_name helper\n\nUse the of_get_child_by_name() helper instead of open coding searching\nfor the \u0027/options\u0027 node. This removes directly accessing the name\npointer as well.\n\nCc: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\nCc: sparclinux@vger.kernel.org\nSigned-off-by: Rob Herring \u003crobh@kernel.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "0b9871a3a8cc7234c285b5d9bf66cc6712cfee7c", "tree": "a3420867feb30634ec0a63228ee260d32606fbaa", "parents": [ "76ebebd2464c5c8a4453c98b6dbf9c95a599e810" ], "author": { "name": "Rob Herring", "email": "robh@kernel.org", "time": "Tue Aug 28 10:44:32 2018 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Oct 07 22:41:07 2018 -0700" }, "message": "sparc: Convert to using %pOFn instead of device_node.name\n\nIn preparation to remove the node name pointer from struct device_node,\nconvert printf users to use the %pOFn format specifier.\n\nCc: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\nCc: sparclinux@vger.kernel.org\nSigned-off-by: Rob Herring \u003crobh@kernel.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "76ebebd2464c5c8a4453c98b6dbf9c95a599e810", "tree": "af8ce763bef242472331fbca5805b8066dbcde73", "parents": [ "c1d84a1b42ef70d8ae601df9cadedc7ed4f1beb1" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Aug 17 15:19:37 2018 -0400" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Oct 07 22:41:05 2018 -0700" }, "message": "mach64: detect the dot clock divider correctly on sparc\n\nOn Sun Ultra 5, it happens that the dot clock is not set up properly for\nsome videomodes. For example, if we set the videomode \"r1024x768x60\" in\nthe firmware, Linux would incorrectly set a videomode with refresh rate\n180Hz when booting (suprisingly, my LCD monitor can display it, although\ndisplay quality is very low).\n\nThe reason is this: Older mach64 cards set the divider in the register\nVCLK_POST_DIV. The register has four 2-bit fields (the field that is\nactually used is specified in the lowest two bits of the register\nCLOCK_CNTL). The 2 bits select divider \"1, 2, 4, 8\". On newer mach64 cards,\nthere\u0027s another bit added - the top four bits of PLL_EXT_CNTL extend the\ndivider selection, so we have possible dividers \"1, 2, 4, 8, 3, 5, 6, 12\".\nThe Linux driver clears the top four bits of PLL_EXT_CNTL and never sets\nthem, so it can work regardless if the card supports them. However, the\nsparc64 firmware may set these extended dividers during boot - and the\nmach64 driver detects incorrect dot clock in this case.\n\nThis patch makes the driver read the additional divider bit from\nPLL_EXT_CNTL and calculate the initial refresh rate properly.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nCc: stable@vger.kernel.org\nAcked-by: David S. Miller \u003cdavem@davemloft.net\u003e\nReviewed-by: Ville Syrjälä \u003csyrjala@sci.fi\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "0238df646e6224016a45505d2c111a24669ebe21", "tree": "da09b3454af44d2d8914ca3a719e66ff233bd029", "parents": [ "fb1c592cf4c9eeb84ec6bce13c13c11c7d05b6c7" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 07 17:26:02 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 07 17:26:02 2018 +0200" }, "message": "Linux 4.19-rc7\n" }, { "commit": "fb1c592cf4c9eeb84ec6bce13c13c11c7d05b6c7", "tree": "5977346539c33f26cda10f60313365e4616931c1", "parents": [ "4ebaf0754c7a1109e66693f488f02b78f5875fee", "eafa717bc145963c944bb0a64d16add683861b35" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 07 08:15:57 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 07 08:15:57 2018 +0200" }, "message": "Merge tag \u0027char-misc-4.19-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc\n\nI wrote:\n \"Char/Misc fixes for 4.19-rc7\n\n Here are 8 small fixes for some char/misc driver issues\n\n Included here are:\n\t- fpga driver fixes\n\t- thunderbolt bugfixes\n\t- firmware core revert/fix\n\t- hv core fix\n\t- hv tool fix\n\n All of these have been in linux-next with no reported issues.\"\n\n* tag \u0027char-misc-4.19-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:\n thunderbolt: Initialize after IOMMUs\n thunderbolt: Do not handle ICM events after domain is stopped\n firmware: Always initialize the fw_priv list object\n docs: fpga: document fpga manager flags\n fpga: bridge: fix obvious function documentation error\n tools: hv: fcopy: set \u0027error\u0027 in case an unknown operation was requested\n fpga: do not access region struct after fpga_region_unregister\n Drivers: hv: vmbus: Use get/put_cpu() in vmbus_connect()\n" }, { "commit": "4ebaf0754c7a1109e66693f488f02b78f5875fee", "tree": "025219a2a74d9a35d831ef201cff22f19ac6bd44", "parents": [ "cc02f852872d2f9f3a15b3429b77998271814de0", "5b162cc4ac27ba76e576abc9090c54cf90a17980" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 07 08:14:59 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 07 08:14:59 2018 +0200" }, "message": "Merge tag \u0027tty-4.19-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty\n\nI wrote:\n \"Serial driver fixes for 4.19-rc7\n\n Here are 3 small serial driver fixes for 4.19-rc7\n - 2 sh-sci bugfixes for reported issues\n - a revert of the PM handling for the 8250_dw code\n\n All of these have been in linux-next with no reported issues.\"\n\n* tag \u0027tty-4.19-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:\n Revert \"serial: sh-sci: Allow for compressed SCIF address\"\n Revert \"serial: sh-sci: Remove SCIx_RZ_SCIFA_REGTYPE\"\n Revert \"serial: 8250_dw: Fix runtime PM handling\"\n" }, { "commit": "cc02f852872d2f9f3a15b3429b77998271814de0", "tree": "8e2d0cb58c7ead41a69a2cf582e4a4fc5eb6f993", "parents": [ "055d8d9eae35ac1edb97fcf70f357cea227bf3b2", "555df5820e733cded7eb8d0bf78b2a791be51d75" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 07 08:14:06 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 07 08:14:06 2018 +0200" }, "message": "Merge tag \u0027usb-4.19-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb\n\nI wrote:\n \"USB fixes for 4.19-rc7\n\n Here are some small USB fixes for 4.19-rc7\n\n These include:\n - the usual xhci bugfixes for reported issues\n - some new serial driver device ids\n - bugfix for the option serial driver for some devices\n - bugfix for the cdc_acm driver that has been there for a long time.\n\n All of these have been in linux-next for a while with no reported\n issues.\"\n\n* tag \u0027usb-4.19-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:\n usb: xhci-mtk: resume USB3 roothub first\n xhci: Add missing CAS workaround for Intel Sunrise Point xHCI\n usb: cdc_acm: Do not leak URB buffers\n USB: serial: simple: add Motorola Tetra MTP6550 id\n USB: serial: option: add two-endpoints device-id flag\n USB: serial: option: improve Quectel EP06 detection\n" }, { "commit": "055d8d9eae35ac1edb97fcf70f357cea227bf3b2", "tree": "f0e6de7a4de91e638cf3d5cfaa7d361eec693110", "parents": [ "40fa9167d307de29be2740bc10c4093502a917ed", "9ce7610e6d201e3923c0b2f454f2e1d54f5da49e" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 07 07:07:33 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 07 07:07:33 2018 +0200" }, "message": "Merge branch \u0027i2c/for-current\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux\n\nWolfram writes:\n \"i2c for 4.19\n\n I2C has three driver bugfixes and a fix for a typo for you.\"\n\n* \u0027i2c/for-current\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:\n i2c: designware: Call i2c_dw_clk_rate() only when calculating timings\n i2c: i2c-scmi: fix for i2c_smbus_write_block_data\n i2c: i2c-isch: fix spelling mistake \"unitialized\" -\u003e \"uninitialized\"\n i2c: i2c-qcom-geni: Properly handle DMA safe buffers\n" }, { "commit": "40fa9167d307de29be2740bc10c4093502a917ed", "tree": "4269055104cb48addcb1ab8ef95fd574613c3234", "parents": [ "cd2093cb45a4d9332d4e5a2170602f74bca298a4", "3cc5746e5ad7688e274e193fa71278d98aa52759" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 07 07:06:52 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 07 07:06:52 2018 +0200" }, "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nJames writes:\n \"SCSI fixes on 20181006\n\n Small fix for an unititialized mutex in the qedi driver.\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: qedi: Initialize the stats mutex lock\n" }, { "commit": "cd2093cb45a4d9332d4e5a2170602f74bca298a4", "tree": "ecf65f1ae67000b94f5a4890af9b140d566df216", "parents": [ "c1d84a1b42ef70d8ae601df9cadedc7ed4f1beb1", "ac1788cc7da4ce54edcfd2e499afdb0a23d5c41d" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 07 07:05:43 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 07 07:05:43 2018 +0200" }, "message": "Merge tag \u0027powerpc-4.19-4\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux\n\nMichael writes:\n \"powerpc fixes for 4.19 #4\n\n Four regression fixes.\n\n A fix for a change to lib/xz which broke our zImage loader when\n building with XZ compression. OK\u0027ed by Herbert who merged the\n original patch.\n\n The recent fix we did to avoid patching __init text broke some 32-bit\n machines, fix that.\n\n Our show_user_instructions() could be tricked into printing kernel\n memory, add a check to avoid that.\n\n And a fix for a change to our NUMA initialisation logic, which causes\n crashes in some kdump configurations.\n\n Thanks to:\n Christophe Leroy, Hari Bathini, Jann Horn, Joel Stanley, Meelis\n Roos, Murilo Opsfelder Araujo, Srikar Dronamraju.\"\n\n* tag \u0027powerpc-4.19-4\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:\n powerpc/numa: Skip onlining a offline node in kdump path\n powerpc: Don\u0027t print kernel instructions in show_user_instructions()\n powerpc/lib: fix book3s/32 boot failure due to code patching\n lib/xz: Put CRC32_POLY_LE in xz_private.h\n" }, { "commit": "c1d84a1b42ef70d8ae601df9cadedc7ed4f1beb1", "tree": "b3a68e7b9b3ed10ccde115a5d19387c7a62260ab", "parents": [ "091a1eaa0e309b0e8dcbf3f2da12c7f3d03ed182", "35f3625c21852ad839f20c91c7d81c4c1101e207" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 06 02:11:30 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 06 02:11:30 2018 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net\n\nDave writes:\n \"Networking fixes:\n\n 1) Fix truncation of 32-bit right shift in bpf, from Jann Horn.\n\n 2) Fix memory leak in wireless wext compat, from Stefan Seyfried.\n\n 3) Use after free in cfg80211\u0027s reg_process_hint(), from Yu Zhao.\n\n 4) Need to cancel pending work when unbinding in smsc75xx otherwise\n we oops, also from Yu Zhao.\n\n 5) Don\u0027t allow enslaving a team device to itself, from Ido Schimmel.\n\n 6) Fix backwards compat with older userspace for rtnetlink FDB dumps.\n From Mauricio Faria.\n\n 7) Add validation of tc policy netlink attributes, from David Ahern.\n\n 8) Fix RCU locking in rawv6_send_hdrinc(), from Wei Wang.\"\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (26 commits)\n net: mvpp2: Extract the correct ethtype from the skb for tx csum offload\n ipv6: take rcu lock in rawv6_send_hdrinc()\n net: sched: Add policy validation for tc attributes\n rtnetlink: fix rtnl_fdb_dump() for ndmsg header\n yam: fix a missing-check bug\n net: bpfilter: Fix type cast and pointer warnings\n net: cxgb3_main: fix a missing-check bug\n bpf: 32-bit RSH verification must truncate input before the ALU op\n net: phy: phylink: fix SFP interface autodetection\n be2net: don\u0027t flip hw_features when VXLANs are added/deleted\n net/packet: fix packet drop as of virtio gso\n net: dsa: b53: Keep CPU port as tagged in all VLANs\n openvswitch: load NAT helper\n bnxt_en: get the reduced max_irqs by the ones used by RDMA\n bnxt_en: free hwrm resources, if driver probe fails.\n bnxt_en: Fix enables field in HWRM_QUEUE_COS2BW_CFG request\n bnxt_en: Fix VNIC reservations on the PF.\n team: Forbid enslaving team device to itself\n net/usb: cancel pending work when unbinding smsc75xx\n mlxsw: spectrum: Delete RIF when VLAN device is removed\n ...\n" }, { "commit": "091a1eaa0e309b0e8dcbf3f2da12c7f3d03ed182", "tree": "69b676d0c91cf4dd22bb5c9e69fc4bd6ded9ab05", "parents": [ "5943a9bbbb98b5c957662edd2fc902cc14e65895", "d41aa5252394c065d1f04d1ceea885b70d00c9c6" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 16:33:03 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 16:33:03 2018 -0700" }, "message": "Merge branch \u0027akpm\u0027\n\n* akpm:\n mm: madvise(MADV_DODUMP): allow hugetlbfs pages\n ocfs2: fix locking for res-\u003etracking and dlm-\u003etracking_list\n mm/vmscan.c: fix int overflow in callers of do_shrink_slab()\n mm/vmstat.c: skip NR_TLB_REMOTE_FLUSH* properly\n mm/vmstat.c: fix outdated vmstat_text\n proc: restrict kernel stack dumps to root\n mm/hugetlb: add mmap() encodings for 32MB and 512MB page sizes\n mm/migrate.c: split only transparent huge pages when allocation fails\n ipc/shm.c: use ERR_CAST() for shm_lock() error return\n mm/gup_benchmark: fix unsigned comparison to zero in __gup_benchmark_ioctl\n mm, thp: fix mlocking THP page with migration enabled\n ocfs2: fix crash in ocfs2_duplicate_clusters_by_page()\n hugetlb: take PMD sharing into account when flushing tlb/caches\n mm: migration: fix migration of huge PMD shared pages\n" }, { "commit": "d41aa5252394c065d1f04d1ceea885b70d00c9c6", "tree": "11a061a0a323119758ea3266449b2fc499705a83", "parents": [ "cbe355f57c8074bc4f452e5b6e35509044c6fa23" ], "author": { "name": "Daniel Black", "email": "daniel@linux.ibm.com", "time": "Fri Oct 05 15:52:19 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 16:32:05 2018 -0700" }, "message": "mm: madvise(MADV_DODUMP): allow hugetlbfs pages\n\nReproducer, assuming 2M of hugetlbfs available:\n\nHugetlbfs mounted, size\u003d2M and option user\u003dtestuser\n\n # mount | grep ^hugetlbfs\n hugetlbfs on /dev/hugepages type hugetlbfs (rw,pagesize\u003d2M,user\u003ddan)\n # sysctl vm.nr_hugepages\u003d1\n vm.nr_hugepages \u003d 1\n # grep Huge /proc/meminfo\n AnonHugePages: 0 kB\n ShmemHugePages: 0 kB\n HugePages_Total: 1\n HugePages_Free: 1\n HugePages_Rsvd: 0\n HugePages_Surp: 0\n Hugepagesize: 2048 kB\n Hugetlb: 2048 kB\n\nCode:\n\n #include \u003csys/mman.h\u003e\n #include \u003cstddef.h\u003e\n #define SIZE 2*1024*1024\n int main()\n {\n void *ptr;\n ptr \u003d mmap(NULL, SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_HUGETLB | MAP_ANONYMOUS, -1, 0);\n madvise(ptr, SIZE, MADV_DONTDUMP);\n madvise(ptr, SIZE, MADV_DODUMP);\n }\n\nCompile and strace:\n\n mmap(NULL, 2097152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_HUGETLB, -1, 0) \u003d 0x7ff7c9200000\n madvise(0x7ff7c9200000, 2097152, MADV_DONTDUMP) \u003d 0\n madvise(0x7ff7c9200000, 2097152, MADV_DODUMP) \u003d -1 EINVAL (Invalid argument)\n\nhugetlbfs pages have VM_DONTEXPAND in the VmFlags driver pages based on\nauthor testing with analysis from Florian Weimer[1].\n\nThe inclusion of VM_DONTEXPAND into the VM_SPECIAL defination was a\nconsequence of the large useage of VM_DONTEXPAND in device drivers.\n\nA consequence of [2] is that VM_DONTEXPAND marked pages are unable to be\nmarked DODUMP.\n\nA user could quite legitimately madvise(MADV_DONTDUMP) their hugetlbfs\nmemory for a while and later request that madvise(MADV_DODUMP) on the same\nmemory. We correct this omission by allowing madvice(MADV_DODUMP) on\nhugetlbfs pages.\n\n[1] https://stackoverflow.com/questions/52548260/madvisedodump-on-the-same-ptr-size-as-a-successful-madvisedontdump-fails-wit\n[2] commit 0103bd16fb90 (\"mm: prepare VM_DONTDUMP for using in drivers\")\n\nLink: http://lkml.kernel.org/r/20180930054629.29150-1-daniel@linux.ibm.com\nLink: https://lists.launchpad.net/maria-discuss/msg05245.html\nFixes: 0103bd16fb90 (\"mm: prepare VM_DONTDUMP for using in drivers\")\nReported-by: Kenneth Penza \u003ckpenza@gmail.com\u003e\nSigned-off-by: Daniel Black \u003cdaniel@linux.ibm.com\u003e\nReviewed-by: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Konstantin Khlebnikov \u003ckhlebnikov@openvz.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "cbe355f57c8074bc4f452e5b6e35509044c6fa23", "tree": "c0a25e2225892fe78ea161cac6083c114a923f9e", "parents": [ "b8e57efa2c98cc56c49461c4950cf026422c29e9" ], "author": { "name": "Ashish Samant", "email": "ashish.samant@oracle.com", "time": "Fri Oct 05 15:52:15 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 16:32:05 2018 -0700" }, "message": "ocfs2: fix locking for res-\u003etracking and dlm-\u003etracking_list\n\nIn dlm_init_lockres() we access and modify res-\u003etracking and\ndlm-\u003etracking_list without holding dlm-\u003etrack_lock. This can cause list\ncorruptions and can end up in kernel panic.\n\nFix this by locking res-\u003etracking and dlm-\u003etracking_list with\ndlm-\u003etrack_lock instead of dlm-\u003espinlock.\n\nLink: http://lkml.kernel.org/r/1529951192-4686-1-git-send-email-ashish.samant@oracle.com\nSigned-off-by: Ashish Samant \u003cashish.samant@oracle.com\u003e\nReviewed-by: Changwei Ge \u003cge.changwei@h3c.com\u003e\nAcked-by: Joseph Qi \u003cjiangqi903@gmail.com\u003e\nAcked-by: Jun Piao \u003cpiaojun@huawei.com\u003e\nCc: Mark Fasheh \u003cmark@fasheh.com\u003e\nCc: Joel Becker \u003cjlbec@evilplan.org\u003e\nCc: Junxiao Bi \u003cjunxiao.bi@oracle.com\u003e\nCc: Changwei Ge \u003cge.changwei@h3c.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b8e57efa2c98cc56c49461c4950cf026422c29e9", "tree": "844349c6cbf468687ffb737aba763c6fe8fd3bcf", "parents": [ "58bc4c34d249bf1bc50730a9a209139347cfacfe" ], "author": { "name": "Kirill Tkhai", "email": "ktkhai@virtuozzo.com", "time": "Fri Oct 05 15:52:10 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 16:32:05 2018 -0700" }, "message": "mm/vmscan.c: fix int overflow in callers of do_shrink_slab()\n\ndo_shrink_slab() returns unsigned long value, and the placing into int\nvariable cuts high bytes off. Then we compare ret and 0xfffffffe (since\nSHRINK_EMPTY is converted to ret type).\n\nThus a large number of objects returned by do_shrink_slab() may be\ninterpreted as SHRINK_EMPTY, if low bytes of their value are equal to\n0xfffffffe. Fix that by declaration ret as unsigned long in these\nfunctions.\n\nLink: http://lkml.kernel.org/r/153813407177.17544.14888305435570723973.stgit@localhost.localdomain\nSigned-off-by: Kirill Tkhai \u003cktkhai@virtuozzo.com\u003e\nReported-by: Cyrill Gorcunov \u003cgorcunov@openvz.org\u003e\nAcked-by: Cyrill Gorcunov \u003cgorcunov@openvz.org\u003e\nReviewed-by: Josef Bacik \u003cjosef@toxicpanda.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Andrey Ryabinin \u003caryabinin@virtuozzo.com\u003e\nCc: Johannes Weiner \u003channes@cmpxchg.org\u003e\nCc: Tetsuo Handa \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e\nCc: Shakeel Butt \u003cshakeelb@google.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "58bc4c34d249bf1bc50730a9a209139347cfacfe", "tree": "aa1e5fa07da1f433a163f1154ee03e3488b21d99", "parents": [ "28e2c4bb99aa40f9d5f07ac130cbc4da0ea93079" ], "author": { "name": "Jann Horn", "email": "jannh@google.com", "time": "Fri Oct 05 15:52:07 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 16:32:05 2018 -0700" }, "message": "mm/vmstat.c: skip NR_TLB_REMOTE_FLUSH* properly\n\n5dd0b16cdaff (\"mm/vmstat: Make NR_TLB_REMOTE_FLUSH_RECEIVED available even\non UP\") made the availability of the NR_TLB_REMOTE_FLUSH* counters inside\nthe kernel unconditional to reduce #ifdef soup, but (either to avoid\nshowing dummy zero counters to userspace, or because that code was missed)\ndidn\u0027t update the vmstat_array, meaning that all following counters would\nbe shown with incorrect values.\n\nThis only affects kernel builds with\nCONFIG_VM_EVENT_COUNTERS\u003dy \u0026\u0026 CONFIG_DEBUG_TLBFLUSH\u003dy \u0026\u0026 CONFIG_SMP\u003dn.\n\nLink: http://lkml.kernel.org/r/20181001143138.95119-2-jannh@google.com\nFixes: 5dd0b16cdaff (\"mm/vmstat: Make NR_TLB_REMOTE_FLUSH_RECEIVED available even on UP\")\nSigned-off-by: Jann Horn \u003cjannh@google.com\u003e\nReviewed-by: Kees Cook \u003ckeescook@chromium.org\u003e\nReviewed-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.com\u003e\nAcked-by: Roman Gushchin \u003cguro@fb.com\u003e\nCc: Davidlohr Bueso \u003cdave@stgolabs.net\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: Christoph Lameter \u003cclameter@sgi.com\u003e\nCc: Kemi Wang \u003ckemi.wang@intel.com\u003e\nCc: Andy Lutomirski \u003cluto@kernel.org\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "28e2c4bb99aa40f9d5f07ac130cbc4da0ea93079", "tree": "e1b488d425f07fc9426a397e2e4c20d6a88da3b9", "parents": [ "f8a00cef17206ecd1b30d3d9f99e10d9fa707aa7" ], "author": { "name": "Jann Horn", "email": "jannh@google.com", "time": "Fri Oct 05 15:52:03 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 16:32:05 2018 -0700" }, "message": "mm/vmstat.c: fix outdated vmstat_text\n\n7a9cdebdcc17 (\"mm: get rid of vmacache_flush_all() entirely\") removed the\nVMACACHE_FULL_FLUSHES statistics, but didn\u0027t remove the corresponding\nentry in vmstat_text. This causes an out-of-bounds access in\nvmstat_show().\n\nLuckily this only affects kernels with CONFIG_DEBUG_VM_VMACACHE\u003dy, which\nis probably very rare.\n\nLink: http://lkml.kernel.org/r/20181001143138.95119-1-jannh@google.com\nFixes: 7a9cdebdcc17 (\"mm: get rid of vmacache_flush_all() entirely\")\nSigned-off-by: Jann Horn \u003cjannh@google.com\u003e\nReviewed-by: Kees Cook \u003ckeescook@chromium.org\u003e\nReviewed-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.com\u003e\nAcked-by: Roman Gushchin \u003cguro@fb.com\u003e\nCc: Davidlohr Bueso \u003cdave@stgolabs.net\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: Christoph Lameter \u003cclameter@sgi.com\u003e\nCc: Kemi Wang \u003ckemi.wang@intel.com\u003e\nCc: Andy Lutomirski \u003cluto@kernel.org\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f8a00cef17206ecd1b30d3d9f99e10d9fa707aa7", "tree": "14c272777b2abd73875efe44b90741408913d334", "parents": [ "20916d4636a9b3c1bf562b305f91d126771edaf9" ], "author": { "name": "Jann Horn", "email": "jannh@google.com", "time": "Fri Oct 05 15:51:58 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 16:32:05 2018 -0700" }, "message": "proc: restrict kernel stack dumps to root\n\nCurrently, you can use /proc/self/task/*/stack to cause a stack walk on\na task you control while it is running on another CPU. That means that\nthe stack can change under the stack walker. The stack walker does\nhave guards against going completely off the rails and into random\nkernel memory, but it can interpret random data from your kernel stack\nas instruction pointers and stack pointers. This can cause exposure of\nkernel stack contents to userspace.\n\nRestrict the ability to inspect kernel stacks of arbitrary tasks to root\nin order to prevent a local attacker from exploiting racy stack unwinding\nto leak kernel task stack contents. See the added comment for a longer\nrationale.\n\nThere don\u0027t seem to be any users of this userspace API that can\u0027t\ngracefully bail out if reading from the file fails. Therefore, I believe\nthat this change is unlikely to break things. In the case that this patch\ndoes end up needing a revert, the next-best solution might be to fake a\nsingle-entry stack based on wchan.\n\nLink: http://lkml.kernel.org/r/20180927153316.200286-1-jannh@google.com\nFixes: 2ec220e27f50 (\"proc: add /proc/*/stack\")\nSigned-off-by: Jann Horn \u003cjannh@google.com\u003e\nAcked-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Alexey Dobriyan \u003cadobriyan@gmail.com\u003e\nCc: Ken Chen \u003ckenchen@google.com\u003e\nCc: Will Deacon \u003cwill.deacon@arm.com\u003e\nCc: Laura Abbott \u003clabbott@redhat.com\u003e\nCc: Andy Lutomirski \u003cluto@amacapital.net\u003e\nCc: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nCc: Josh Poimboeuf \u003cjpoimboe@redhat.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Ingo Molnar \u003cmingo@redhat.com\u003e\nCc: \"H . Peter Anvin\" \u003chpa@zytor.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "20916d4636a9b3c1bf562b305f91d126771edaf9", "tree": "62f074f581ff5129f89e38371dbffe121d200f7e", "parents": [ "e6112fc300702f96374f34368513d57795fc6d23" ], "author": { "name": "Anshuman Khandual", "email": "anshuman.khandual@arm.com", "time": "Fri Oct 05 15:51:54 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 16:32:04 2018 -0700" }, "message": "mm/hugetlb: add mmap() encodings for 32MB and 512MB page sizes\n\nARM64 architecture also supports 32MB and 512MB HugeTLB page sizes. This\njust adds mmap() system call argument encoding for them.\n\nLink: http://lkml.kernel.org/r/1537841300-6979-1-git-send-email-anshuman.khandual@arm.com\nSigned-off-by: Anshuman Khandual \u003canshuman.khandual@arm.com\u003e\nAcked-by: Punit Agrawal \u003cpunit.agrawal@arm.com\u003e\nAcked-by: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Michal Hocko \u003cmhocko@kernel.org\u003e\nCc: Will Deacon \u003cwill.deacon@arm.com\u003e\nCc: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "e6112fc300702f96374f34368513d57795fc6d23", "tree": "1b0fcdd204cbe582a12b3771e2f08abaf84149f2", "parents": [ "59cf0a9339ca4b0226e9b4329dfb0a5b8b0b9bc2" ], "author": { "name": "Anshuman Khandual", "email": "anshuman.khandual@arm.com", "time": "Fri Oct 05 15:51:51 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 16:32:04 2018 -0700" }, "message": "mm/migrate.c: split only transparent huge pages when allocation fails\n\nsplit_huge_page_to_list() fails on HugeTLB pages. I was experimenting\nwith moving 32MB contig HugeTLB pages on arm64 (with a debug patch\napplied) and hit the following stack trace when the kernel crashed.\n\n[ 3732.462797] Call trace:\n[ 3732.462835] split_huge_page_to_list+0x3b0/0x858\n[ 3732.462913] migrate_pages+0x728/0xc20\n[ 3732.462999] soft_offline_page+0x448/0x8b0\n[ 3732.463097] __arm64_sys_madvise+0x724/0x850\n[ 3732.463197] el0_svc_handler+0x74/0x110\n[ 3732.463297] el0_svc+0x8/0xc\n[ 3732.463347] Code: d1000400 f90b0e60 f2fbd5a2 a94982a1 (f9000420)\n\nWhen unmap_and_move[_huge_page]() fails due to lack of memory, the\nsplitting should happen only for transparent huge pages not for HugeTLB\npages. PageTransHuge() returns true for both THP and HugeTLB pages.\nHence the conditonal check should test PagesHuge() flag to make sure that\ngiven pages is not a HugeTLB one.\n\nLink: http://lkml.kernel.org/r/1537798495-4996-1-git-send-email-anshuman.khandual@arm.com\nFixes: 94723aafb9 (\"mm: unclutter THP migration\")\nSigned-off-by: Anshuman Khandual \u003canshuman.khandual@arm.com\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.com\u003e\nAcked-by: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nCc: Kirill A. Shutemov \u003ckirill.shutemov@linux.intel.com\u003e\nCc: Zi Yan \u003czi.yan@cs.rutgers.edu\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Vlastimil Babka \u003cvbabka@suse.cz\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "59cf0a9339ca4b0226e9b4329dfb0a5b8b0b9bc2", "tree": "0c62dcc4bffed5289923ac1f4212cd7f93911d4c", "parents": [ "51896864579d5a3349740847083f4db5c6487164" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Fri Oct 05 15:51:48 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 16:32:04 2018 -0700" }, "message": "ipc/shm.c: use ERR_CAST() for shm_lock() error return\n\nThis uses ERR_CAST() instead of an open-coded cast, as it is casting\nacross structure pointers, which upsets __randomize_layout:\n\nipc/shm.c: In function `shm_lock\u0027:\nipc/shm.c:209:9: note: randstruct: casting between randomized structure pointer types (ssa): `struct shmid_kernel\u0027 and `struct kern_ipc_perm\u0027\n\n return (void *)ipcp;\n ^~~~~~~~~~~~\n\nLink: http://lkml.kernel.org/r/20180919180722.GA15073@beast\nFixes: 82061c57ce93 (\"ipc: drop ipc_lock()\")\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Davidlohr Bueso \u003cdbueso@suse.de\u003e\nCc: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nCc: Arnd Bergmann \u003carnd@arndb.de\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "51896864579d5a3349740847083f4db5c6487164", "tree": "7db76ed2366fceaa24eb69e4ff38319588f0751a", "parents": [ "e125fe405abedc1dc8a5b2229b80ee91c1434015" ], "author": { "name": "YueHaibing", "email": "yuehaibing@huawei.com", "time": "Fri Oct 05 15:51:44 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 16:32:04 2018 -0700" }, "message": "mm/gup_benchmark: fix unsigned comparison to zero in __gup_benchmark_ioctl\n\nget_user_pages_fast() will return negative value if no pages were pinned,\nthen be converted to a unsigned, which is compared to zero, giving the\nwrong result.\n\nLink: http://lkml.kernel.org/r/20180921095015.26088-1-yuehaibing@huawei.com\nFixes: 09e35a4a1ca8 (\"mm/gup_benchmark: handle gup failures\")\nSigned-off-by: YueHaibing \u003cyuehaibing@huawei.com\u003e\nReviewed-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "e125fe405abedc1dc8a5b2229b80ee91c1434015", "tree": "2fc15b88860fe53c1cf1ad7ad866fed2b8b3e564", "parents": [ "69eb7765b9c6902444c89c54e7043242faf981e5" ], "author": { "name": "Kirill A. Shutemov", "email": "kirill.shutemov@linux.intel.com", "time": "Fri Oct 05 15:51:41 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 16:32:04 2018 -0700" }, "message": "mm, thp: fix mlocking THP page with migration enabled\n\nA transparent huge page is represented by a single entry on an LRU list.\nTherefore, we can only make unevictable an entire compound page, not\nindividual subpages.\n\nIf a user tries to mlock() part of a huge page, we want the rest of the\npage to be reclaimable.\n\nWe handle this by keeping PTE-mapped huge pages on normal LRU lists: the\nPMD on border of VM_LOCKED VMA will be split into PTE table.\n\nIntroduction of THP migration breaks[1] the rules around mlocking THP\npages. If we had a single PMD mapping of the page in mlocked VMA, the\npage will get mlocked, regardless of PTE mappings of the page.\n\nFor tmpfs/shmem it\u0027s easy to fix by checking PageDoubleMap() in\nremove_migration_pmd().\n\nAnon THP pages can only be shared between processes via fork(). Mlocked\npage can only be shared if parent mlocked it before forking, otherwise CoW\nwill be triggered on mlock().\n\nFor Anon-THP, we can fix the issue by munlocking the page on removing PTE\nmigration entry for the page. PTEs for the page will always come after\nmlocked PMD: rmap walks VMAs from oldest to newest.\n\nTest-case:\n\n\t#include \u003cunistd.h\u003e\n\t#include \u003csys/mman.h\u003e\n\t#include \u003csys/wait.h\u003e\n\t#include \u003clinux/mempolicy.h\u003e\n\t#include \u003cnumaif.h\u003e\n\n\tint main(void)\n\t{\n\t unsigned long nodemask \u003d 4;\n\t void *addr;\n\n\t\taddr \u003d mmap((void *)0x20000000UL, 2UL \u003c\u003c 20, PROT_READ | PROT_WRITE,\n\t\t\tMAP_PRIVATE | MAP_ANONYMOUS | MAP_LOCKED, -1, 0);\n\n\t if (fork()) {\n\t\t\twait(NULL);\n\t\t\treturn 0;\n\t }\n\n\t mlock(addr, 4UL \u003c\u003c 10);\n\t mbind(addr, 2UL \u003c\u003c 20, MPOL_PREFERRED | MPOL_F_RELATIVE_NODES,\n\t \u0026nodemask, 4, MPOL_MF_MOVE);\n\n\t return 0;\n\t}\n\n[1] https://lkml.kernel.org/r/CAOMGZ\u003dG52R-30rZvhGxEbkTw7rLLwBGadVYeo--iizcD3upL3A@mail.gmail.com\n\nLink: http://lkml.kernel.org/r/20180917133816.43995-1-kirill.shutemov@linux.intel.com\nFixes: 616b8371539a (\"mm: thp: enable thp migration in generic path\")\nSigned-off-by: Kirill A. Shutemov \u003ckirill.shutemov@linux.intel.com\u003e\nReported-by: Vegard Nossum \u003cvegard.nossum@oracle.com\u003e\nReviewed-by: Zi Yan \u003czi.yan@cs.rutgers.edu\u003e\nCc: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nCc: Vlastimil Babka \u003cvbabka@suse.cz\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[4.14+]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "69eb7765b9c6902444c89c54e7043242faf981e5", "tree": "dfcd61abd6c76d9c175de5b85b5e0ae8cf9b497a", "parents": [ "dff11abe280b47c21b804a8ace318e0638bb9a49" ], "author": { "name": "Larry Chen", "email": "lchen@suse.com", "time": "Fri Oct 05 15:51:37 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 16:32:04 2018 -0700" }, "message": "ocfs2: fix crash in ocfs2_duplicate_clusters_by_page()\n\nocfs2_duplicate_clusters_by_page() may crash if one of the extent\u0027s pages\nis dirty. When a page has not been written back, it is still in dirty\nstate. If ocfs2_duplicate_clusters_by_page() is called against the dirty\npage, the crash happens.\n\nTo fix this bug, we can just unlock the page and wait until the page until\nits not dirty.\n\nThe following is the backtrace:\n\nkernel BUG at /root/code/ocfs2/refcounttree.c:2961!\n[exception RIP: ocfs2_duplicate_clusters_by_page+822]\n__ocfs2_move_extent+0x80/0x450 [ocfs2]\n? __ocfs2_claim_clusters+0x130/0x250 [ocfs2]\nocfs2_defrag_extent+0x5b8/0x5e0 [ocfs2]\n__ocfs2_move_extents_range+0x2a4/0x470 [ocfs2]\nocfs2_move_extents+0x180/0x3b0 [ocfs2]\n? ocfs2_wait_for_recovery+0x13/0x70 [ocfs2]\nocfs2_ioctl_move_extents+0x133/0x2d0 [ocfs2]\nocfs2_ioctl+0x253/0x640 [ocfs2]\ndo_vfs_ioctl+0x90/0x5f0\nSyS_ioctl+0x74/0x80\ndo_syscall_64+0x74/0x140\nentry_SYSCALL_64_after_hwframe+0x3d/0xa2\n\nOnce we find the page is dirty, we do not wait until it\u0027s clean, rather we\nuse write_one_page() to write it back\n\nLink: http://lkml.kernel.org/r/20180829074740.9438-1-lchen@suse.com\n[lchen@suse.com: update comments]\n Link: http://lkml.kernel.org/r/20180830075041.14879-1-lchen@suse.com\n[akpm@linux-foundation.org: coding-style fixes]\nSigned-off-by: Larry Chen \u003clchen@suse.com\u003e\nAcked-by: Changwei Ge \u003cge.changwei@h3c.com\u003e\nCc: Mark Fasheh \u003cmark@fasheh.com\u003e\nCc: Joel Becker \u003cjlbec@evilplan.org\u003e\nCc: Junxiao Bi \u003cjunxiao.bi@oracle.com\u003e\nCc: Joseph Qi \u003cjiangqi903@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "dff11abe280b47c21b804a8ace318e0638bb9a49", "tree": "db5156b3f8602967aba6949c3ef389afd0055ac2", "parents": [ "017b1660df89f5fb4bfe66c34e35f7d2031100c7" ], "author": { "name": "Mike Kravetz", "email": "mike.kravetz@oracle.com", "time": "Fri Oct 05 15:51:33 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 16:32:04 2018 -0700" }, "message": "hugetlb: take PMD sharing into account when flushing tlb/caches\n\nWhen fixing an issue with PMD sharing and migration, it was discovered via\ncode inspection that other callers of huge_pmd_unshare potentially have an\nissue with cache and tlb flushing.\n\nUse the routine adjust_range_if_pmd_sharing_possible() to calculate worst\ncase ranges for mmu notifiers. Ensure that this range is flushed if\nhuge_pmd_unshare succeeds and unmaps a PUD_SUZE area.\n\nLink: http://lkml.kernel.org/r/20180823205917.16297-3-mike.kravetz@oracle.com\nSigned-off-by: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nAcked-by: Kirill A. Shutemov \u003ckirill.shutemov@linux.intel.com\u003e\nReviewed-by: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nCc: Vlastimil Babka \u003cvbabka@suse.cz\u003e\nCc: Davidlohr Bueso \u003cdave@stgolabs.net\u003e\nCc: Michal Hocko \u003cmhocko@kernel.org\u003e\nCc: Jerome Glisse \u003cjglisse@redhat.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "017b1660df89f5fb4bfe66c34e35f7d2031100c7", "tree": "3c12fd67a673e96b93e7f0f2f78379ff080d9744", "parents": [ "b2e45b46d85bfc67b7b28e0e0c1c7e9b9a35892c" ], "author": { "name": "Mike Kravetz", "email": "mike.kravetz@oracle.com", "time": "Fri Oct 05 15:51:29 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 16:32:04 2018 -0700" }, "message": "mm: migration: fix migration of huge PMD shared pages\n\nThe page migration code employs try_to_unmap() to try and unmap the source\npage. This is accomplished by using rmap_walk to find all vmas where the\npage is mapped. This search stops when page mapcount is zero. For shared\nPMD huge pages, the page map count is always 1 no matter the number of\nmappings. Shared mappings are tracked via the reference count of the PMD\npage. Therefore, try_to_unmap stops prematurely and does not completely\nunmap all mappings of the source page.\n\nThis problem can result is data corruption as writes to the original\nsource page can happen after contents of the page are copied to the target\npage. Hence, data is lost.\n\nThis problem was originally seen as DB corruption of shared global areas\nafter a huge page was soft offlined due to ECC memory errors. DB\ndevelopers noticed they could reproduce the issue by (hotplug) offlining\nmemory used to back huge pages. A simple testcase can reproduce the\nproblem by creating a shared PMD mapping (note that this must be at least\nPUD_SIZE in size and PUD_SIZE aligned (1GB on x86)), and using\nmigrate_pages() to migrate process pages between nodes while continually\nwriting to the huge pages being migrated.\n\nTo fix, have the try_to_unmap_one routine check for huge PMD sharing by\ncalling huge_pmd_unshare for hugetlbfs huge pages. If it is a shared\nmapping it will be \u0027unshared\u0027 which removes the page table entry and drops\nthe reference on the PMD page. After this, flush caches and TLB.\n\nmmu notifiers are called before locking page tables, but we can not be\nsure of PMD sharing until page tables are locked. Therefore, check for\nthe possibility of PMD sharing before locking so that notifiers can\nprepare for the worst possible case.\n\nLink: http://lkml.kernel.org/r/20180823205917.16297-2-mike.kravetz@oracle.com\n[mike.kravetz@oracle.com: make _range_in_vma() a static inline]\n Link: http://lkml.kernel.org/r/6063f215-a5c8-2f0c-465a-2c515ddc952d@oracle.com\nFixes: 39dde65c9940 (\"shared page table for hugetlb page\")\nSigned-off-by: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nAcked-by: Kirill A. Shutemov \u003ckirill.shutemov@linux.intel.com\u003e\nReviewed-by: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Vlastimil Babka \u003cvbabka@suse.cz\u003e\nCc: Davidlohr Bueso \u003cdave@stgolabs.net\u003e\nCc: Jerome Glisse \u003cjglisse@redhat.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "5943a9bbbb98b5c957662edd2fc902cc14e65895", "tree": "84603ce3f01c192cd4ca3b2fbeeddf88b915b3d1", "parents": [ "b98d6cb80b0dc44e1d3382bc8c530eaa80ad5b6c", "95375f2ab2960c135484d83ea9f8f357cb1be26a" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 16:11:16 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 16:11:16 2018 -0700" }, "message": "Merge tag \u0027pci-v4.19-fixes-3\u0027 of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/helgaas/pci\n\nBjorn writes:\n \"PCI fixes for v4.19:\n\n - Reprogram bridge prefetch registers to fix NVIDIA and Radeon issues\n after suspend/resume (Daniel Drake)\n\n - Fix mvebu I/O mapping creation sequence (Thomas Petazzoni)\n\n - Fix minor MAINTAINERS file match issue (Bjorn Helgaas)\"\n\n* tag \u0027pci-v4.19-fixes-3\u0027 of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:\n PCI: mvebu: Fix PCI I/O mapping creation sequence\n MAINTAINERS: Remove obsolete drivers/pci pattern from ACPI section\n PCI: Reprogram bridge prefetch registers on resume\n" }, { "commit": "b98d6cb80b0dc44e1d3382bc8c530eaa80ad5b6c", "tree": "eeb2c0e2f7e4ddff095bc8cb77534bd893517944", "parents": [ "3830711f3e93b056e3e3597f2b39da2df4636e0b", "5d07384a666d4b2f781dc056bfeec2c27fbdf383" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 16:09:56 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 16:09:56 2018 -0700" }, "message": "Merge tag \u0027for-4.19/dm-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm\n\nMike writes:\n \"device mapper fixes\n\n - Fix a DM thinp __udivdi3 undefined on 32-bit bug introduced during\n 4.19 merge window.\n\n - Fix leak and dangling pointer in DM multipath\u0027s scsi_dh related code.\n\n - A couple stable@ fixes for DM cache\u0027s resize support.\n\n - A DM raid fix to remove \"const\" from decipher_sync_action()\u0027s return\n type.\"\n\n* tag \u0027for-4.19/dm-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:\n dm cache: fix resize crash if user doesn\u0027t reload cache table\n dm cache metadata: ignore hints array being too small during resize\n dm raid: remove bogus const from decipher_sync_action() return type\n dm mpath: fix attached_handler_name leak and dangling hw_handler_name pointer\n dm thin metadata: fix __udivdi3 undefined on 32-bit\n" }, { "commit": "3830711f3e93b056e3e3597f2b39da2df4636e0b", "tree": "a2c8a053824bfb2bd179920daf705ce0a5ff8b4e", "parents": [ "5aebc7d2780df9176ee92f6d3bfd54b04457e349", "19a4fbffc94e41abaa2a623a25ce2641d69eccf0" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 16:09:11 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 16:09:11 2018 -0700" }, "message": "Merge tag \u0027gpio-v4.19-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio\n\nLinus writes:\n \"A single GPIO fix:\n Free the last used descriptor, an off by one error.\n This is tagged for stable as well.\"\n\n* tag \u0027gpio-v4.19-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:\n gpiolib: Free the last requested descriptor\n" }, { "commit": "5aebc7d2780df9176ee92f6d3bfd54b04457e349", "tree": "d96dc34f039663c80c325cd97ecf3cd2fb9ddd66", "parents": [ "31d099085d5415a073b52358a5fc61d50e9ab614", "69e445ab8b66a9f30519842ef18be555d3ee9b51" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 16:08:12 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 16:08:12 2018 -0700" }, "message": "Merge tag \u0027pm-4.19-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nRafael writes:\n \"Power management fix for 4.19-rc7\n\n Fix a bug that may cause runtime PM to misbehave for some devices\n after a failing or aborted system suspend which is nasty enough for\n an -rc7 time frame fix.\"\n\n* tag \u0027pm-4.19-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n PM / core: Clear the direct_complete flag on errors\n" }, { "commit": "31d099085d5415a073b52358a5fc61d50e9ab614", "tree": "813eb23d211235e96db942c2dcdf218fc4b030b9", "parents": [ "247373b5dd685fd307d2ea7fd0e58353486e4ad4", "d7cbbe49a9304520181fb8c9272d1327deec8453" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 16:07:13 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 16:07:13 2018 -0700" }, "message": "Merge branch \u0027perf-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nIngo writes:\n \"perf fixes:\n - fix a CPU#0 hot unplug bug and a PCI enumeration bug in the x86 Intel uncore PMU driver\n - fix a CPU event enumeration bug in the x86 AMD PMU driver\n - fix a perf ring-buffer corruption bug when using tracepoints\n - fix a PMU unregister locking bug\"\n\n* \u0027perf-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf/x86/amd/uncore: Set ThreadMask and SliceMask for L3 Cache perf events\n perf/x86/intel/uncore: Fix PCI BDF address of M3UPI on SKX\n perf/ring_buffer: Prevent concurent ring buffer access\n perf/x86/intel/uncore: Use boot_cpu_data.phys_proc_id instead of hardcorded physical package ID 0\n perf/core: Fix perf_pmu_unregister() locking\n" }, { "commit": "247373b5dd685fd307d2ea7fd0e58353486e4ad4", "tree": "eb93befebb8c5ad0fb5babce130a4de92b5f6876", "parents": [ "8be673735e5144e13fe739fba5a0a33fc50f3a16", "02e425668f5c9deb42787d10001a3b605993ad15" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 15:40:57 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 15:40:57 2018 -0700" }, "message": "Merge branch \u0027x86-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nIngo writes:\n \"x86 fixes:\n\n Misc fixes:\n\n - fix various vDSO bugs: asm constraints and retpolines\n - add vDSO test units to make sure they never re-appear\n - fix UV platform TSC initialization bug\n - fix build warning on Clang\"\n\n* \u0027x86-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/vdso: Fix vDSO syscall fallback asm constraint regression\n x86/cpu/amd: Remove unnecessary parentheses\n x86/vdso: Only enable vDSO retpolines when enabled and supported\n x86/tsc: Fix UV TSC initialization\n x86/platform/uv: Provide is_early_uv_system()\n selftests/x86: Add clock_gettime() tests to test_vdso\n x86/vdso: Fix asm constraints on vDSO syscall fallbacks\n" }, { "commit": "8be673735e5144e13fe739fba5a0a33fc50f3a16", "tree": "66612de0994ff7ff115a5071903f2a1301f6d4b1", "parents": [ "1df377db3d0131057fa33b4dcda05c3e341308ab", "37355bdc5a129899f6b245900a8eb944a092f7fd" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 15:39:38 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 15:39:38 2018 -0700" }, "message": "Merge branch \u0027sched-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nIngo writes:\n \"scheduler fixes:\n\n These fixes address a rather involved performance regression between\n v4.17-\u003ev4.19 in the sched/numa auto-balancing code. Since distros\n really need this fix we accelerated it to sched/urgent for a faster\n upstream merge.\n\n NUMA scheduling and balancing performance is now largely back to\n v4.17 levels, without reintroducing the NUMA placement bugs that\n v4.18 and v4.19 fixed.\n\n Many thanks to Srikar Dronamraju, Mel Gorman and Jirka Hladky, for\n reporting, testing, re-testing and solving this rather complex set of\n bugs.\"\n\n* \u0027sched-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n sched/numa: Migrate pages to local nodes quicker early in the lifetime of a task\n mm, sched/numa: Remove rate-limiting of automatic NUMA balancing migration\n sched/numa: Avoid task migration for small NUMA improvement\n mm/migrate: Use spin_trylock() while resetting rate limit\n sched/numa: Limit the conditions where scan period is reset\n sched/numa: Reset scan rate whenever task moves across nodes\n sched/numa: Pass destination CPU as a parameter to migrate_task_rq\n sched/numa: Stop multiple tasks from moving to the CPU at the same time\n" }, { "commit": "1df377db3d0131057fa33b4dcda05c3e341308ab", "tree": "99ed48d05eb00265bad6225ad602872d425d061f", "parents": [ "8b6b383c1fa33c7ed49885672cc2ddf61d6b46f0", "e4a02ed2aaf447fa849e3254bfdb3b9b01e1e520" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 15:38:32 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 15:38:32 2018 -0700" }, "message": "Merge branch \u0027locking-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nIngo writes:\n \"locking fixes:\n\n A fix in the ww_mutex self-test that produces a scary splat, plus an\n updates to the maintained-filed patters in MAINTAINER.\"\n\n* \u0027locking-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n locking/ww_mutex: Fix runtime warning in the WW mutex selftest\n MAINTAINERS: Remove dead path from LOCKING PRIMITIVES entry\n" }, { "commit": "8b6b383c1fa33c7ed49885672cc2ddf61d6b46f0", "tree": "3bd513065f659f1be0347b6a984e3a7c3ba2dcb9", "parents": [ "b2e45b46d85bfc67b7b28e0e0c1c7e9b9a35892c", "709ae62e8e6d9ac4df7dadb3b8ae432675c45ef9" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 15:37:22 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 15:37:22 2018 -0700" }, "message": "Merge tag \u0027sound-4.19-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nTakashi writes:\n \"sound fixes for 4.19-rc7\n\n Just two small fixes for HD-audio: one is for a typo in completion\n timeout, and another a fixup for Dell machines as usual\"\n\n* tag \u0027sound-4.19-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:\n ALSA: hda/realtek - Cannot adjust speaker\u0027s volume on Dell XPS 27 7760\n ALSA: hda: Fix the audio-component completion timeout\n" }, { "commit": "35f3625c21852ad839f20c91c7d81c4c1101e207", "tree": "b6e41c36935045703f589f169f1f6a3554adc272", "parents": [ "a688caa34beb2fd2a92f1b6d33e40cde433ba160" ], "author": { "name": "Maxime Chevallier", "email": "maxime.chevallier@bootlin.com", "time": "Fri Oct 05 09:04:40 2018 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Oct 05 14:52:43 2018 -0700" }, "message": "net: mvpp2: Extract the correct ethtype from the skb for tx csum offload\n\nWhen offloading the L3 and L4 csum computation on TX, we need to extract\nthe l3_proto from the ethtype, independently of the presence of a vlan\ntag.\n\nThe actual driver uses skb-\u003eprotocol as-is, resulting in packets with\nthe wrong L4 checksum being sent when there\u0027s a vlan tag in the packet\nheader and checksum offloading is enabled.\n\nThis commit makes use of vlan_protocol_get() to get the correct ethtype\nregardless the presence of a vlan tag.\n\nFixes: 3f518509dedc (\"ethernet: Add new driver for Marvell Armada 375 network unit\")\nSigned-off-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "a688caa34beb2fd2a92f1b6d33e40cde433ba160", "tree": "8e2ae900070ac9ceb3ec0026993f589e25a688ff", "parents": [ "8b4c3cdd9dd8290343ce959a132d3b334062c5b9" ], "author": { "name": "Wei Wang", "email": "weiwan@google.com", "time": "Thu Oct 04 10:12:37 2018 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Oct 05 14:45:34 2018 -0700" }, "message": "ipv6: take rcu lock in rawv6_send_hdrinc()\n\nIn rawv6_send_hdrinc(), in order to avoid an extra dst_hold(), we\ndirectly assign the dst to skb and set passed in dst to NULL to avoid\ndouble free.\nHowever, in error case, we free skb and then do stats update with the\ndst pointer passed in. This causes use-after-free on the dst.\nFix it by taking rcu read lock right before dst could get released to\nmake sure dst does not get freed until the stats update is done.\nNote: we don\u0027t have this issue in ipv4 cause dst is not used for stats\nupdate in v4.\n\nSyzkaller reported following crash:\nBUG: KASAN: use-after-free in rawv6_send_hdrinc net/ipv6/raw.c:692 [inline]\nBUG: KASAN: use-after-free in rawv6_sendmsg+0x4421/0x4630 net/ipv6/raw.c:921\nRead of size 8 at addr ffff8801d95ba730 by task syz-executor0/32088\n\nCPU: 1 PID: 32088 Comm: syz-executor0 Not tainted 4.19.0-rc2+ #93\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113\n print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256\n kasan_report_error mm/kasan/report.c:354 [inline]\n kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412\n __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433\n rawv6_send_hdrinc net/ipv6/raw.c:692 [inline]\n rawv6_sendmsg+0x4421/0x4630 net/ipv6/raw.c:921\n inet_sendmsg+0x1a1/0x690 net/ipv4/af_inet.c:798\n sock_sendmsg_nosec net/socket.c:621 [inline]\n sock_sendmsg+0xd5/0x120 net/socket.c:631\n ___sys_sendmsg+0x7fd/0x930 net/socket.c:2114\n __sys_sendmsg+0x11d/0x280 net/socket.c:2152\n __do_sys_sendmsg net/socket.c:2161 [inline]\n __se_sys_sendmsg net/socket.c:2159 [inline]\n __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2159\n do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290\n entry_SYSCALL_64_after_hwframe+0x49/0xbe\nRIP: 0033:0x457099\nCode: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00\nRSP: 002b:00007f83756edc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007f83756ee6d4 RCX: 0000000000457099\nRDX: 0000000000000000 RSI: 0000000020003840 RDI: 0000000000000004\nRBP: 00000000009300a0 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff\nR13: 00000000004d4b30 R14: 00000000004c90b1 R15: 0000000000000000\n\nAllocated by task 32088:\n save_stack+0x43/0xd0 mm/kasan/kasan.c:448\n set_track mm/kasan/kasan.c:460 [inline]\n kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553\n kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490\n kmem_cache_alloc+0x12e/0x730 mm/slab.c:3554\n dst_alloc+0xbb/0x1d0 net/core/dst.c:105\n ip6_dst_alloc+0x35/0xa0 net/ipv6/route.c:353\n ip6_rt_cache_alloc+0x247/0x7b0 net/ipv6/route.c:1186\n ip6_pol_route+0x8f8/0xd90 net/ipv6/route.c:1895\n ip6_pol_route_output+0x54/0x70 net/ipv6/route.c:2093\n fib6_rule_lookup+0x277/0x860 net/ipv6/fib6_rules.c:122\n ip6_route_output_flags+0x2c5/0x350 net/ipv6/route.c:2121\n ip6_route_output include/net/ip6_route.h:88 [inline]\n ip6_dst_lookup_tail+0xe27/0x1d60 net/ipv6/ip6_output.c:951\n ip6_dst_lookup_flow+0xc8/0x270 net/ipv6/ip6_output.c:1079\n rawv6_sendmsg+0x12d9/0x4630 net/ipv6/raw.c:905\n inet_sendmsg+0x1a1/0x690 net/ipv4/af_inet.c:798\n sock_sendmsg_nosec net/socket.c:621 [inline]\n sock_sendmsg+0xd5/0x120 net/socket.c:631\n ___sys_sendmsg+0x7fd/0x930 net/socket.c:2114\n __sys_sendmsg+0x11d/0x280 net/socket.c:2152\n __do_sys_sendmsg net/socket.c:2161 [inline]\n __se_sys_sendmsg net/socket.c:2159 [inline]\n __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2159\n do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290\n entry_SYSCALL_64_after_hwframe+0x49/0xbe\n\nFreed by task 5356:\n save_stack+0x43/0xd0 mm/kasan/kasan.c:448\n set_track mm/kasan/kasan.c:460 [inline]\n __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521\n kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528\n __cache_free mm/slab.c:3498 [inline]\n kmem_cache_free+0x83/0x290 mm/slab.c:3756\n dst_destroy+0x267/0x3c0 net/core/dst.c:141\n dst_destroy_rcu+0x16/0x19 net/core/dst.c:154\n __rcu_reclaim kernel/rcu/rcu.h:236 [inline]\n rcu_do_batch kernel/rcu/tree.c:2576 [inline]\n invoke_rcu_callbacks kernel/rcu/tree.c:2880 [inline]\n __rcu_process_callbacks kernel/rcu/tree.c:2847 [inline]\n rcu_process_callbacks+0xf23/0x2670 kernel/rcu/tree.c:2864\n __do_softirq+0x30b/0xad8 kernel/softirq.c:292\n\nFixes: 1789a640f556 (\"raw: avoid two atomics in xmit\")\nSigned-off-by: Wei Wang \u003cweiwan@google.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "8b4c3cdd9dd8290343ce959a132d3b334062c5b9", "tree": "11f2cdafb6a217858f0fa1f273bb26cc919be840", "parents": [ "bd961c9bc66497f0c63f4ba1d02900bb85078366" ], "author": { "name": "David Ahern", "email": "dsahern@gmail.com", "time": "Wed Oct 03 15:05:36 2018 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Oct 05 14:26:44 2018 -0700" }, "message": "net: sched: Add policy validation for tc attributes\n\nA number of TC attributes are processed without proper validation\n(e.g., length checks). Add a tca policy for all input attributes and use\nwhen invoking nlmsg_parse.\n\nThe 2 Fixes tags below cover the latest additions. The other attributes\nare a string (KIND), nested attribute (OPTIONS which does seem to have\nvalidation in most cases), for dumps only or a flag.\n\nFixes: 5bc1701881e39 (\"net: sched: introduce multichain support for filters\")\nFixes: d47a6b0e7c492 (\"net: sched: introduce ingress/egress block index attributes for qdisc\")\nSigned-off-by: David Ahern \u003cdsahern@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "bd961c9bc66497f0c63f4ba1d02900bb85078366", "tree": "3f694df84a8398299736c365590fdc814d382808", "parents": [ "0781168e23a2fc8dceb989f11fc5b39b3ccacc35" ], "author": { "name": "Mauricio Faria de Oliveira", "email": "mfo@canonical.com", "time": "Mon Oct 01 22:46:40 2018 -0300" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Oct 05 14:21:42 2018 -0700" }, "message": "rtnetlink: fix rtnl_fdb_dump() for ndmsg header\n\nCurrently, rtnl_fdb_dump() assumes the family header is \u0027struct ifinfomsg\u0027,\nwhich is not always true -- \u0027struct ndmsg\u0027 is used by iproute2 (\u0027ip neigh\u0027).\n\nThe problem is, the function bails out early if nlmsg_parse() fails, which\ndoes occur for iproute2 usage of \u0027struct ndmsg\u0027 because the payload length\nis shorter than the family header alone (as \u0027struct ifinfomsg\u0027 is assumed).\n\nThis breaks backward compatibility with userspace -- nothing is sent back.\n\nSome examples with iproute2 and netlink library for go [1]:\n\n 1) $ bridge fdb show\n 33:33:00:00:00:01 dev ens3 self permanent\n 01:00:5e:00:00:01 dev ens3 self permanent\n 33:33:ff:15:98:30 dev ens3 self permanent\n\n This one works, as it uses \u0027struct ifinfomsg\u0027.\n\n fdb_show() @ iproute2/bridge/fdb.c\n \"\"\"\n .n.nlmsg_len \u003d NLMSG_LENGTH(sizeof(struct ifinfomsg)),\n ...\n if (rtnl_dump_request(\u0026rth, RTM_GETNEIGH, [...]\n \"\"\"\n\n 2) $ ip --family bridge neigh\n RTNETLINK answers: Invalid argument\n Dump terminated\n\n This one fails, as it uses \u0027struct ndmsg\u0027.\n\n do_show_or_flush() @ iproute2/ip/ipneigh.c\n \"\"\"\n .n.nlmsg_type \u003d RTM_GETNEIGH,\n .n.nlmsg_len \u003d NLMSG_LENGTH(sizeof(struct ndmsg)),\n \"\"\"\n\n 3) $ ./neighlist\n \u003c no output \u003e\n\n This one fails, as it uses \u0027struct ndmsg\u0027-based.\n\n neighList() @ netlink/neigh_linux.go\n \"\"\"\n req :\u003d h.newNetlinkRequest(unix.RTM_GETNEIGH, [...]\n msg :\u003d Ndmsg{\n \"\"\"\n\nThe actual breakage was introduced by commit 0ff50e83b512 (\"net: rtnetlink:\nbail out from rtnl_fdb_dump() on parse error\"), because nlmsg_parse() fails\nif the payload length (with the _actual_ family header) is less than the\nfamily header length alone (which is assumed, in parameter \u0027hdrlen\u0027).\nThis is true in the examples above with struct ndmsg, with size and payload\nlength shorter than struct ifinfomsg.\n\nHowever, that commit just intends to fix something under the assumption the\nfamily header is indeed an \u0027struct ifinfomsg\u0027 - by preventing access to the\npayload as such (via \u0027ifm\u0027 pointer) if the payload length is not sufficient\nto actually contain it.\n\nThe assumption was introduced by commit 5e6d24358799 (\"bridge: netlink dump\ninterface at par with brctl\"), to support iproute2\u0027s \u0027bridge fdb\u0027 command\n(not \u0027ip neigh\u0027) which indeed uses \u0027struct ifinfomsg\u0027, thus is not broken.\n\nSo, in order to unbreak the \u0027struct ndmsg\u0027 family headers and still allow\n\u0027struct ifinfomsg\u0027 to continue to work, check for the known message sizes\nused with \u0027struct ndmsg\u0027 in iproute2 (with zero or one attribute which is\nnot used in this function anyway) then do not parse the data as ifinfomsg.\n\nSame examples with this patch applied (or revert/before the original fix):\n\n $ bridge fdb show\n 33:33:00:00:00:01 dev ens3 self permanent\n 01:00:5e:00:00:01 dev ens3 self permanent\n 33:33:ff:15:98:30 dev ens3 self permanent\n\n $ ip --family bridge neigh\n dev ens3 lladdr 33:33:00:00:00:01 PERMANENT\n dev ens3 lladdr 01:00:5e:00:00:01 PERMANENT\n dev ens3 lladdr 33:33:ff:15:98:30 PERMANENT\n\n $ ./neighlist\n netlink.Neigh{LinkIndex:2, Family:7, State:128, Type:0, Flags:2, IP:net.IP(nil), HardwareAddr:net.HardwareAddr{0x33, 0x33, 0x0, 0x0, 0x0, 0x1}, LLIPAddr:net.IP(nil), Vlan:0, VNI:0}\n netlink.Neigh{LinkIndex:2, Family:7, State:128, Type:0, Flags:2, IP:net.IP(nil), HardwareAddr:net.HardwareAddr{0x1, 0x0, 0x5e, 0x0, 0x0, 0x1}, LLIPAddr:net.IP(nil), Vlan:0, VNI:0}\n netlink.Neigh{LinkIndex:2, Family:7, State:128, Type:0, Flags:2, IP:net.IP(nil), HardwareAddr:net.HardwareAddr{0x33, 0x33, 0xff, 0x15, 0x98, 0x30}, LLIPAddr:net.IP(nil), Vlan:0, VNI:0}\n\nTested on mainline (v4.19-rc6) and net-next (3bd09b05b068).\n\nReferences:\n\n[1] netlink library for go (test-case)\n https://github.com/vishvananda/netlink\n\n $ cat ~/go/src/neighlist/main.go\n package main\n import (\"fmt\"; \"syscall\"; \"github.com/vishvananda/netlink\")\n func main() {\n neighs, _ :\u003d netlink.NeighList(0, syscall.AF_BRIDGE)\n for _, neigh :\u003d range neighs { fmt.Printf(\"%#v\\n\", neigh) }\n }\n\n $ export GOPATH\u003d~/go\n $ go get github.com/vishvananda/netlink\n $ go build neighlist\n $ ~/go/src/neighlist/neighlist\n\nThanks to David Ahern for suggestions to improve this patch.\n\nFixes: 0ff50e83b512 (\"net: rtnetlink: bail out from rtnl_fdb_dump() on parse error\")\nFixes: 5e6d24358799 (\"bridge: netlink dump interface at par with brctl\")\nReported-by: Aidan Obley \u003caobley@pivotal.io\u003e\nSigned-off-by: Mauricio Faria de Oliveira \u003cmfo@canonical.com\u003e\nReviewed-by: David Ahern \u003cdsahern@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "0781168e23a2fc8dceb989f11fc5b39b3ccacc35", "tree": "2712d98048d8297fa79067427e0a251e5fc72f90", "parents": [ "33aa8da1f8a7dc050b9d68f1db761ab787621065" ], "author": { "name": "Wenwen Wang", "email": "wang6495@umn.edu", "time": "Fri Oct 05 10:59:36 2018 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Oct 05 11:54:55 2018 -0700" }, "message": "yam: fix a missing-check bug\n\nIn yam_ioctl(), the concrete ioctl command is firstly copied from the\nuser-space buffer \u0027ifr-\u003eifr_data\u0027 to \u0027ioctl_cmd\u0027 and checked through the\nfollowing switch statement. If the command is not as expected, an error\ncode EINVAL is returned. In the following execution the buffer\n\u0027ifr-\u003eifr_data\u0027 is copied again in the cases of the switch statement to\nspecific data structures according to what kind of ioctl command is\nrequested. However, after the second copy, no re-check is enforced on the\nnewly-copied command. Given that the buffer \u0027ifr-\u003eifr_data\u0027 is in the user\nspace, a malicious user can race to change the command between the two\ncopies. This way, the attacker can inject inconsistent data and cause\nundefined behavior.\n\nThis patch adds a re-check in each case of the switch statement if there is\na second copy in that case, to re-check whether the command obtained in the\nsecond copy is the same as the one in the first copy. If not, an error code\nEINVAL will be returned.\n\nSigned-off-by: Wenwen Wang \u003cwang6495@umn.edu\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "33aa8da1f8a7dc050b9d68f1db761ab787621065", "tree": "1d14813926ccef392fa12afd43c007e4cec2108f", "parents": [ "2c05d88818ab6571816b93edce4d53703870d7ae" ], "author": { "name": "Shanthosh RK", "email": "shanthosh.rk@gmail.com", "time": "Fri Oct 05 20:57:48 2018 +0530" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Oct 05 11:51:06 2018 -0700" }, "message": "net: bpfilter: Fix type cast and pointer warnings\n\nFixes the following Sparse warnings:\n\nnet/bpfilter/bpfilter_kern.c:62:21: warning: cast removes address space\nof expression\nnet/bpfilter/bpfilter_kern.c:101:49: warning: Using plain integer as\nNULL pointer\n\nSigned-off-by: Shanthosh RK \u003cshanthosh.rk@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "2c05d88818ab6571816b93edce4d53703870d7ae", "tree": "5d9764c00549b793eb582c06f87be24ff7d3f67a", "parents": [ "b8d5b7cec43618c8f91a9fbe80067ef2dcbc4d35" ], "author": { "name": "Wenwen Wang", "email": "wang6495@umn.edu", "time": "Fri Oct 05 08:48:27 2018 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Oct 05 11:47:19 2018 -0700" }, "message": "net: cxgb3_main: fix a missing-check bug\n\nIn cxgb_extension_ioctl(), the command of the ioctl is firstly copied from\nthe user-space buffer \u0027useraddr\u0027 to \u0027cmd\u0027 and checked through the\nswitch statement. If the command is not as expected, an error code\nEOPNOTSUPP is returned. In the following execution, i.e., the cases of the\nswitch statement, the whole buffer of \u0027useraddr\u0027 is copied again to a\nspecific data structure, according to what kind of command is requested.\nHowever, after the second copy, there is no re-check on the newly-copied\ncommand. Given that the buffer \u0027useraddr\u0027 is in the user space, a malicious\nuser can race to change the command between the two copies. By doing so,\nthe attacker can supply malicious data to the kernel and cause undefined\nbehavior.\n\nThis patch adds a re-check in each case of the switch statement if there is\na second copy in that case, to re-check whether the command obtained in the\nsecond copy is the same as the one in the first copy. If not, an error code\nEINVAL is returned.\n\nSigned-off-by: Wenwen Wang \u003cwang6495@umn.edu\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "b8d5b7cec43618c8f91a9fbe80067ef2dcbc4d35", "tree": "02adf7f3451ecf1a7a397a86f705a9022d27ae09", "parents": [ "7e4183752735deb7543e179a44f4f4b44917cd6f", "b799207e1e1816b09e7a5920fbb2d5fcf6edd681" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Oct 05 10:53:13 2018 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Oct 05 10:53:13 2018 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf\n\nDaniel Borkmann says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull-request: bpf 2018-10-05\n\nThe following pull-request contains BPF updates for your *net* tree.\n\nThe main changes are:\n\n1) Fix to truncate input on ALU operations in 32 bit mode, from Jann.\n\n2) Fixes for cgroup local storage to reject reserved flags on element\n update and rejection of map allocation with zero-sized value, from Roman.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "b799207e1e1816b09e7a5920fbb2d5fcf6edd681", "tree": "c3e93b0287fc25e137120342f98953362a27a555", "parents": [ "b0584ea66d73919cbf5878a3420a837f06ab8396" ], "author": { "name": "Jann Horn", "email": "jannh@google.com", "time": "Fri Oct 05 18:17:59 2018 +0200" }, "committer": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Fri Oct 05 18:41:45 2018 +0200" }, "message": "bpf: 32-bit RSH verification must truncate input before the ALU op\n\nWhen I wrote commit 468f6eafa6c4 (\"bpf: fix 32-bit ALU op verification\"), I\nassumed that, in order to emulate 64-bit arithmetic with 32-bit logic, it\nis sufficient to just truncate the output to 32 bits; and so I just moved\nthe register size coercion that used to be at the start of the function to\nthe end of the function.\n\nThat assumption is true for almost every op, but not for 32-bit right\nshifts, because those can propagate information towards the least\nsignificant bit. Fix it by always truncating inputs for 32-bit ops to 32\nbits.\n\nAlso get rid of the coerce_reg_to_size() after the ALU op, since that has\nno effect.\n\nFixes: 468f6eafa6c4 (\"bpf: fix 32-bit ALU op verification\")\nAcked-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nSigned-off-by: Jann Horn \u003cjannh@google.com\u003e\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\n" }, { "commit": "b2e45b46d85bfc67b7b28e0e0c1c7e9b9a35892c", "tree": "c032cc4ddc637e0c61530412f27873c8d136ee5b", "parents": [ "08b297bb10d6a270739d92098adabe3c550377e9", "b3e9b515b08e407ab3a026dc2e4d935c48d05f69" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 08:30:40 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 08:30:40 2018 -0700" }, "message": "Merge tag \u0027iommu-fixes-v4.19-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu\n\nJoerg writes:\n \"IOMMU Fix for Linux v4.19-rc6\n\n One important fix:\n\t- Fix a memory leak with AMD IOMMU when SME is active and a VM\n\t has assigned devices. In that case the complete guest memory\n\t will be leaked without this fix.\"\n\n* tag \u0027iommu-fixes-v4.19-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:\n iommu/amd: Clear memory encryption mask from physical address\n" }, { "commit": "08b297bb10d6a270739d92098adabe3c550377e9", "tree": "7b499c4363a38f21ae69f2e2d1f058e31a37c63d", "parents": [ "4fbeba43b9b6f76a270108edcf5305dc1882a478", "cc906f07d7d569a30bb6f0baf8f80b2968353dc9" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 08:29:44 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 08:29:44 2018 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm\n\nPaolo writes:\n \"KVM changes for 4.19-rc7\n\n x86 and PPC bugfixes, mostly introduced in 4.19-rc1.\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm:\n kvm: nVMX: fix entry with pending interrupt if APICv is enabled\n KVM: VMX: hide flexpriority from guest when disabled at the module level\n KVM: VMX: check for existence of secondary exec controls before accessing\n KVM: PPC: Book3S HV: Avoid crash from THP collapse during radix page fault\n KVM: x86: fix L1TF\u0027s MMIO GFN calculation\n tools/kvm_stat: cut down decimal places in update interval dialog\n KVM: nVMX: Fix emulation of VM_ENTRY_LOAD_BNDCFGS\n KVM: x86: Do not use kvm_x86_ops-\u003empx_supported() directly\n KVM: nVMX: Do not expose MPX VMX controls when guest MPX disabled\n KVM: x86: never trap MSR_KERNEL_GS_BASE\n" }, { "commit": "4fbeba43b9b6f76a270108edcf5305dc1882a478", "tree": "8905d4da0b387d3c2a66d8f3140c3b814a9fd1e8", "parents": [ "087f759a4155dcae08fb82841af2bafd231c7c9b", "ba439a6cbfa2936a6713f64cb499de7943673fe3" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 08:28:35 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 08:28:35 2018 -0700" }, "message": "Merge branch \u0027linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6\n\nHerbert writes:\n \"Crypto Fixes for 4.19\n\n This push fixes the following issues:\n - Out-of-bound stack access in qat.\n - Illegal schedule in mxs-dcp.\n - Memory corruption in chelsio.\n - Incorrect pointer computation in caam.\"\n\n* \u0027linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:\n crypto: qat - Fix KASAN stack-out-of-bounds bug in adf_probe()\n crypto: mxs-dcp - Fix wait logic on chan threads\n crypto: chelsio - Fix memory corruption in DMA Mapped buffers.\n crypto: caam/jr - fix ablkcipher_edesc pointer arithmetic\n" }, { "commit": "087f759a4155dcae08fb82841af2bafd231c7c9b", "tree": "8515415dc3914e6c23258ee1634e897789e00c4b", "parents": [ "befad944e2312c18d855013ce154ca7d2b110ade", "7af929d6d05ba5564139718e30d5bc96bdbc716a" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 08:27:47 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 05 08:27:47 2018 -0700" }, "message": "Merge tag \u00274.19-rc6-smb3-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6\n\nSteve writes:\n \"SMB3 fixes\n\n four small SMB3 fixes: one for stable, the others to address a more\n recent regression\"\n\n* tag \u00274.19-rc6-smb3-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6:\n smb3: fix lease break problem introduced by compounding\n cifs: only wake the thread for the very last PDU in a compound\n cifs: add a warning if we try to to dequeue a deleted mid\n smb2: fix missing files in root share directory listing\n" }, { "commit": "ac1788cc7da4ce54edcfd2e499afdb0a23d5c41d", "tree": "5ab28cd1777cf40eed8c7c8c955e3335fe20fa8a", "parents": [ "a932ed3b718147c6537da290b7a91e990fdedb43" ], "author": { "name": "Srikar Dronamraju", "email": "srikar@linux.vnet.ibm.com", "time": "Fri Sep 28 09:17:32 2018 +0530" }, "committer": { "name": "Michael Ellerman", "email": "mpe@ellerman.id.au", "time": "Fri Oct 05 23:21:54 2018 +1000" }, "message": "powerpc/numa: Skip onlining a offline node in kdump path\n\nWith commit 2ea626306810 (\"powerpc/topology: Get topology for shared\nprocessors at boot\"), kdump kernel on shared LPAR may crash.\n\nThe necessary conditions are\n- Shared LPAR with at least 2 nodes having memory and CPUs.\n- Memory requirement for kdump kernel must be met by the first N-1\n nodes where there are at least N nodes with memory and CPUs.\n\nExample numactl of such a machine.\n $ numactl -H\n available: 5 nodes (0,2,5-7)\n node 0 cpus:\n node 0 size: 0 MB\n node 0 free: 0 MB\n node 2 cpus:\n node 2 size: 255 MB\n node 2 free: 189 MB\n node 5 cpus: 24 25 26 27 28 29 30 31\n node 5 size: 4095 MB\n node 5 free: 4024 MB\n node 6 cpus: 0 1 2 3 4 5 6 7 16 17 18 19 20 21 22 23\n node 6 size: 6353 MB\n node 6 free: 5998 MB\n node 7 cpus: 8 9 10 11 12 13 14 15 32 33 34 35 36 37 38 39\n node 7 size: 7640 MB\n node 7 free: 7164 MB\n node distances:\n node 0 2 5 6 7\n 0: 10 40 40 40 40\n 2: 40 10 40 40 40\n 5: 40 40 10 40 40\n 6: 40 40 40 10 20\n 7: 40 40 40 20 10\n\nSteps to reproduce.\n1. Load / start kdump service.\n2. Trigger a kdump (for example : echo c \u003e /proc/sysrq-trigger)\n\nWhen booting a kdump kernel with 2048M:\n\n kexec: Starting switchover sequence.\n I\u0027m in purgatory\n Using 1TB segments\n hash-mmu: Initializing hash mmu with SLB\n Linux version 4.19.0-rc5-master+ (srikar@linux-xxu6) (gcc version 4.8.5 (SUSE Linux)) #1 SMP Thu Sep 27 19:45:00 IST 2018\n Found initrd at 0xc000000009e70000:0xc00000000ae554b4\n Using pSeries machine description\n -----------------------------------------------------\n ppc64_pft_size \u003d 0x1e\n phys_mem_size \u003d 0x88000000\n dcache_bsize \u003d 0x80\n icache_bsize \u003d 0x80\n cpu_features \u003d 0x000000ff8f5d91a7\n possible \u003d 0x0000fbffcf5fb1a7\n always \u003d 0x0000006f8b5c91a1\n cpu_user_features \u003d 0xdc0065c2 0xef000000\n mmu_features \u003d 0x7c006001\n firmware_features \u003d 0x00000007c45bfc57\n htab_hash_mask \u003d 0x7fffff\n physical_start \u003d 0x8000000\n -----------------------------------------------------\n numa: NODE_DATA [mem 0x87d5e300-0x87d67fff]\n numa: NODE_DATA(0) on node 6\n numa: NODE_DATA [mem 0x87d54600-0x87d5e2ff]\n Top of RAM: 0x88000000, Total RAM: 0x88000000\n Memory hole size: 0MB\n Zone ranges:\n DMA [mem 0x0000000000000000-0x0000000087ffffff]\n DMA32 empty\n Normal empty\n Movable zone start for each node\n Early memory node ranges\n node 6: [mem 0x0000000000000000-0x0000000087ffffff]\n Could not find start_pfn for node 0\n Initmem setup node 0 [mem 0x0000000000000000-0x0000000000000000]\n On node 0 totalpages: 0\n Initmem setup node 6 [mem 0x0000000000000000-0x0000000087ffffff]\n On node 6 totalpages: 34816\n\n Unable to handle kernel paging request for data at address 0x00000060\n Faulting instruction address: 0xc000000008703a54\n Oops: Kernel access of bad area, sig: 11 [#1]\n LE SMP NR_CPUS\u003d2048 NUMA pSeries\n Modules linked in:\n CPU: 11 PID: 1 Comm: swapper/11 Not tainted 4.19.0-rc5-master+ #1\n NIP: c000000008703a54 LR: c000000008703a38 CTR: 0000000000000000\n REGS: c00000000b673440 TRAP: 0380 Not tainted (4.19.0-rc5-master+)\n MSR: 8000000002009033 \u003cSF,VEC,EE,ME,IR,DR,RI,LE\u003e CR: 24022022 XER: 20000002\n CFAR: c0000000086fc238 IRQMASK: 0\n GPR00: c000000008703a38 c00000000b6736c0 c000000009281900 0000000000000000\n GPR04: 0000000000000000 0000000000000000 fffffffffffff001 c00000000b660080\n GPR08: 0000000000000000 0000000000000000 0000000000000000 0000000000000220\n GPR12: 0000000000002200 c000000009e51400 0000000000000000 0000000000000008\n GPR16: 0000000000000000 c000000008c152e8 c000000008c152a8 0000000000000000\n GPR20: c000000009422fd8 c000000009412fd8 c000000009426040 0000000000000008\n GPR24: 0000000000000000 0000000000000000 c000000009168bc8 c000000009168c78\n GPR28: c00000000b126410 0000000000000000 c00000000916a0b8 c00000000b126400\n NIP [c000000008703a54] bus_add_device+0x84/0x1e0\n LR [c000000008703a38] bus_add_device+0x68/0x1e0\n Call Trace:\n [c00000000b6736c0] [c000000008703a38] bus_add_device+0x68/0x1e0 (unreliable)\n [c00000000b673740] [c000000008700194] device_add+0x454/0x7c0\n [c00000000b673800] [c00000000872e660] __register_one_node+0xb0/0x240\n [c00000000b673860] [c00000000839a6bc] __try_online_node+0x12c/0x180\n [c00000000b673900] [c00000000839b978] try_online_node+0x58/0x90\n [c00000000b673930] [c0000000080846d8] find_and_online_cpu_nid+0x158/0x190\n [c00000000b673a10] [c0000000080848a0] numa_update_cpu_topology+0x190/0x580\n [c00000000b673c00] [c000000008d3f2e4] smp_cpus_done+0x94/0x108\n [c00000000b673c70] [c000000008d5c00c] smp_init+0x174/0x19c\n [c00000000b673d00] [c000000008d346b8] kernel_init_freeable+0x1e0/0x450\n [c00000000b673dc0] [c0000000080102e8] kernel_init+0x28/0x160\n [c00000000b673e30] [c00000000800b65c] ret_from_kernel_thread+0x5c/0x80\n Instruction dump:\n 60000000 60000000 e89e0020 7fe3fb78 4bff87d5 60000000 7c7d1b79 4082008c\n e8bf0050 e93e0098 3b9f0010 2fa50000 \u003ce8690060\u003e 38630018 419e0114 7f84e378\n ---[ end trace 593577668c2daa65 ]---\n\nHowever a regular kernel with 4096M (2048 gets reserved for crash\nkernel) boots properly.\n\nUnlike regular kernels, which mark all available nodes as online,\nkdump kernel only marks just enough nodes as online and marks the rest\nas offline at boot. However kdump kernel boots with all available\nCPUs. With Commit 2ea626306810 (\"powerpc/topology: Get topology for\nshared processors at boot\"), all CPUs are onlined on their respective\nnodes at boot time. try_online_node() tries to online the offline\nnodes but fails as all needed subsystems are not yet initialized.\n\nAs part of fix, detect and skip early onlining of a offline node.\n\nFixes: 2ea626306810 (\"powerpc/topology: Get topology for shared processors at boot\")\nReported-by: Pavithra Prakash \u003cpavrampu@in.ibm.com\u003e\nSigned-off-by: Srikar Dronamraju \u003csrikar@linux.vnet.ibm.com\u003e\nTested-by: Hari Bathini \u003chbathini@linux.ibm.com\u003e\nSigned-off-by: Michael Ellerman \u003cmpe@ellerman.id.au\u003e\n" }, { "commit": "a932ed3b718147c6537da290b7a91e990fdedb43", "tree": "9b0f53e526e5ef0b85a8b82ef58b0469da3e6a4b", "parents": [ "b45ba4a51cde29b2939365ef0c07ad34c8321789" ], "author": { "name": "Michael Ellerman", "email": "mpe@ellerman.id.au", "time": "Fri Oct 05 16:43:55 2018 +1000" }, "committer": { "name": "Michael Ellerman", "email": "mpe@ellerman.id.au", "time": "Fri Oct 05 23:18:12 2018 +1000" }, "message": "powerpc: Don\u0027t print kernel instructions in show_user_instructions()\n\nRecently we implemented show_user_instructions() which dumps the code\naround the NIP when a user space process dies with an unhandled\nsignal. This was modelled on the x86 code, and we even went so far as\nto implement the exact same bug, namely that if the user process\ncrashed with its NIP pointing into the kernel we will dump kernel text\nto dmesg. eg:\n\n bad-bctr[2996]: segfault (11) at c000000000010000 nip c000000000010000 lr 12d0b0894 code 1\n bad-bctr[2996]: code: fbe10068 7cbe2b78 7c7f1b78 fb610048 38a10028 38810020 fb810050 7f8802a6\n bad-bctr[2996]: code: 3860001c f8010080 48242371 60000000 \u003c7c7b1b79\u003e 4082002c e8010080 eb610048\n\nThis was discovered on x86 by Jann Horn and fixed in commit\n342db04ae712 (\"x86/dumpstack: Don\u0027t dump kernel memory based on usermode RIP\").\n\nFix it by checking the adjusted NIP value (pc) and number of\ninstructions against USER_DS, and bail if we fail the check, eg:\n\n bad-bctr[2969]: segfault (11) at c000000000010000 nip c000000000010000 lr 107930894 code 1\n bad-bctr[2969]: Bad NIP, not dumping instructions.\n\nFixes: 88b0fe175735 (\"powerpc: Add show_user_instructions()\")\nSigned-off-by: Michael Ellerman \u003cmpe@ellerman.id.au\u003e\n" }, { "commit": "9ce7610e6d201e3923c0b2f454f2e1d54f5da49e", "tree": "9cb5f7d68703b30af79028e3d58e49559a05248e", "parents": [ "08d9db00fe0e300d6df976e6c294f974988226dd" ], "author": { "name": "Jarkko Nikula", "email": "jarkko.nikula@linux.intel.com", "time": "Mon Oct 01 14:49:05 2018 +0300" }, "committer": { "name": "Wolfram Sang", "email": "wsa@the-dreams.de", "time": "Fri Oct 05 13:40:05 2018 +0200" }, "message": "i2c: designware: Call i2c_dw_clk_rate() only when calculating timings\n\nThere are platforms which don\u0027t provide input clock rate but provide\nI2C timing parameters. Commit 3bd4f277274b (\"i2c: designware: Call\ni2c_dw_clk_rate() only once in i2c_dw_init_master()\") causes needless\nwarning during probe on those platforms since i2c_dw_clk_rate(), which\ncauses the warning when input clock is unknown, is called even when\nthere is no need to calculate timing parameters.\n\nFixes: 3bd4f277274b (\"i2c: designware: Call i2c_dw_clk_rate() only once in i2c_dw_init_master()\")\nReported-by: Ard Biesheuvel \u003card.biesheuvel@linaro.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e # 4.19\nSigned-off-by: Jarkko Nikula \u003cjarkko.nikula@linux.intel.com\u003e\nTested-by: Ard Biesheuvel \u003card.biesheuvel@linaro.org\u003e\nSigned-off-by: Wolfram Sang \u003cwsa@the-dreams.de\u003e\n" }, { "commit": "b3e9b515b08e407ab3a026dc2e4d935c48d05f69", "tree": "d0c99fd98cbbea1b47136a97f4c9cb92c8950282", "parents": [ "17b57b1883c1285f3d0dc2266e8f79286a7bef38" ], "author": { "name": "Singh, Brijesh", "email": "brijesh.singh@amd.com", "time": "Thu Oct 04 21:40:23 2018 +0000" }, "committer": { "name": "Joerg Roedel", "email": "jroedel@suse.de", "time": "Fri Oct 05 10:20:24 2018 +0200" }, "message": "iommu/amd: Clear memory encryption mask from physical address\n\nBoris Ostrovsky reported a memory leak with device passthrough when SME\nis active.\n\nThe VFIO driver uses iommu_iova_to_phys() to get the physical address for\nan iova. This physical address is later passed into vfio_unmap_unpin() to\nunpin the memory. The vfio_unmap_unpin() uses pfn_valid() before unpinning\nthe memory. The pfn_valid() check was failing because encryption mask was\npart of the physical address returned. This resulted in the memory not\nbeing unpinned and therefore leaked after the guest terminates.\n\nThe memory encryption mask must be cleared from the physical address in\niommu_iova_to_phys().\n\nFixes: 2543a786aa25 (\"iommu/amd: Allow the AMD IOMMU to work with memory encryption\")\nReported-by: Boris Ostrovsky \u003cboris.ostrovsky@oracle.com\u003e\nCc: Tom Lendacky \u003cthomas.lendacky@amd.com\u003e\nCc: Joerg Roedel \u003cjoro@8bytes.org\u003e\nCc: \u003ciommu@lists.linux-foundation.org\u003e\nCc: Borislav Petkov \u003cbp@suse.de\u003e\nCc: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\nCc: Radim Krčmář \u003crkrcmar@redhat.com\u003e\nCc: kvm@vger.kernel.org\nCc: Boris Ostrovsky \u003cboris.ostrovsky@oracle.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e # 4.14+\nSigned-off-by: Brijesh Singh \u003cbrijesh.singh@amd.com\u003e\nSigned-off-by: Joerg Roedel \u003cjroedel@suse.de\u003e\n" }, { "commit": "7e4183752735deb7543e179a44f4f4b44917cd6f", "tree": "8e824d068ccec95206d0ff741d9224a2da60ab29", "parents": [ "2d52527e80c2dc0c5f43f50adf183781262ec565" ], "author": { "name": "Baruch Siach", "email": "baruch@tkos.co.il", "time": "Wed Oct 03 19:04:49 2018 +0300" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Oct 05 01:04:12 2018 -0700" }, "message": "net: phy: phylink: fix SFP interface autodetection\n\nWhen connecting SFP PHY to phylink use the detected interface.\nOtherwise, the link fails to come up when the configured \u0027phy-mode\u0027\ndiffers from the SFP detected mode.\n\nMove most of phylink_connect_phy() into __phylink_connect_phy(), and\nleave phylink_connect_phy() as a wrapper. phylink_sfp_connect_phy() can\nnow pass the SFP detected PHY interface to __phylink_connect_phy().\n\nThis fixes 1GB SFP module link up on eth3 of the Macchiatobin board that\nis configured in the DT to \"2500base-x\" phy-mode.\n\nFixes: 9525ae83959b6 (\"phylink: add phylink infrastructure\")\nSuggested-by: Russell King \u003crmk+kernel@armlinux.org.uk\u003e\nSigned-off-by: Baruch Siach \u003cbaruch@tkos.co.il\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "2d52527e80c2dc0c5f43f50adf183781262ec565", "tree": "9236400b15184a6d52116da13cdcd0dec1cda418", "parents": [ "9d2f67e43b73e8af7438be219b66a5de0cfa8bd9" ], "author": { "name": "Davide Caratti", "email": "dcaratti@redhat.com", "time": "Wed Oct 03 15:20:58 2018 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Oct 05 00:59:21 2018 -0700" }, "message": "be2net: don\u0027t flip hw_features when VXLANs are added/deleted\n\nthe be2net implementation of .ndo_tunnel_{add,del}() changes the value of\nNETIF_F_GSO_UDP_TUNNEL bit in \u0027features\u0027 and \u0027hw_features\u0027, but it forgets\nto call netdev_features_change(). Moreover, ethtool setting for that bit\ncan potentially be reverted after a tunnel is added or removed.\n\nGSO already does software segmentation when \u0027hw_enc_features\u0027 is 0, even\nif VXLAN offload is turned on. In addition, commit 096de2f83ebc (\"benet:\nstricter vxlan offloading check in be_features_check\") avoids hardware\nsegmentation of non-VXLAN tunneled packets, or VXLAN packets having wrong\ndestination port. So, it\u0027s safe to avoid flipping the above feature on\naddition/deletion of VXLAN tunnels.\n\nFixes: 630f4b70567f (\"be2net: Export tunnel offloads only when a VxLAN tunnel is created\")\nSigned-off-by: Davide Caratti \u003cdcaratti@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "cc906f07d7d569a30bb6f0baf8f80b2968353dc9", "tree": "5a0098288a77c5a4482dd3d820c8d22cd443c3d8", "parents": [ "7e7126846c95a34f98a1524d5c473af1f0783735", "6579804c431712d56956a63b1a01509441cc6800" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri Oct 05 09:39:53 2018 +0200" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri Oct 05 09:39:53 2018 +0200" }, "message": "Merge tag \u0027kvm-ppc-fixes-4.19-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc into kvm-master\n\nThird set of PPC KVM fixes for 4.19\n\nOne patch here, fixing a potential host crash introduced (or at least\nexacerbated) by a previous fix for corruption relating to radix guest\npage faults and THP operations.\n" }, { "commit": "9d2f67e43b73e8af7438be219b66a5de0cfa8bd9", "tree": "015f9d003d764dbb4aea0fde8d2ea6c01eafd577", "parents": [ "ca8931948344c485569b04821d1f6bcebccd376b" ], "author": { "name": "Jianfeng Tan", "email": "jianfeng.tan@linux.alibaba.com", "time": "Sat Sep 29 15:41:27 2018 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 04 22:23:15 2018 -0700" }, "message": "net/packet: fix packet drop as of virtio gso\n\nWhen we use raw socket as the vhost backend, a packet from virito with\ngso offloading information, cannot be sent out in later validaton at\nxmit path, as we did not set correct skb-\u003eprotocol which is further used\nfor looking up the gso function.\n\nTo fix this, we set this field according to virito hdr information.\n\nFixes: e858fae2b0b8f4 (\"virtio_net: use common code for virtio_net_hdr and skb GSO conversion\")\nSigned-off-by: Jianfeng Tan \u003cjianfeng.tan@linux.alibaba.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "ca8931948344c485569b04821d1f6bcebccd376b", "tree": "c24ede5ccead8729da4400bc81a6147fefcfcc77", "parents": [ "17c357efe5eceebdc3971a48b3d4d61a03c1178b" ], "author": { "name": "Florian Fainelli", "email": "f.fainelli@gmail.com", "time": "Thu Oct 04 20:24:13 2018 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 04 21:52:49 2018 -0700" }, "message": "net: dsa: b53: Keep CPU port as tagged in all VLANs\n\nCommit c499696e7901 (\"net: dsa: b53: Stop using dev-\u003ecpu_port\nincorrectly\") was a bit too trigger happy in removing the CPU port from\nthe VLAN membership because we rely on DSA to program the CPU port VLAN,\nwhich it does, except it does not bother itself with tagged/untagged and\njust usese untagged.\n\nHaving the CPU port \"follow\" the user ports tagged/untagged is not great\nand does not allow for properly differentiating, so keep the CPU port\ntagged in all VLANs.\n\nReported-by: Gerhard Wiesinger \u003clists@wiesinger.com\u003e\nFixes: c499696e7901 (\"net: dsa: b53: Stop using dev-\u003ecpu_port incorrectly\")\nSigned-off-by: Florian Fainelli \u003cf.fainelli@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "17c357efe5eceebdc3971a48b3d4d61a03c1178b", "tree": "38e146f1f6ea635ab9f57ae5bd8a1f6e6b5bb7ee", "parents": [ "508646aa2ba57cea501e0300468f84d5cc3dd8cd" ], "author": { "name": "Flavio Leitner", "email": "fbl@redhat.com", "time": "Fri Sep 28 14:51:28 2018 -0300" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 04 21:45:16 2018 -0700" }, "message": "openvswitch: load NAT helper\n\nLoad the respective NAT helper module if the flow uses it.\n\nSigned-off-by: Flavio Leitner \u003cfbl@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "508646aa2ba57cea501e0300468f84d5cc3dd8cd", "tree": "721cf4f30d03fe07142e75c8af1175141491830a", "parents": [ "471b83bd8bbe4e89743683ef8ecb78f7029d8288", "c78fe058879bdea919d44f23e21da26f603e9166" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 04 21:41:16 2018 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 04 21:41:16 2018 -0700" }, "message": "Merge branch \u0027bnxt_en-fixes\u0027\n\nMichael Chan says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbnxt_en: Misc. bug fixes.\n\n4 small bug fixes related to setting firmware message enables bits, possible\nmemory leak when probe fails, and ring accouting when RDMA driver is loaded.\n\nPlease queue these for -stable as well. Thanks.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "c78fe058879bdea919d44f23e21da26f603e9166", "tree": "721cf4f30d03fe07142e75c8af1175141491830a", "parents": [ "a2bf74f4e1b82395dad2b08d2a911d9151db71c1" ], "author": { "name": "Vasundhara Volam", "email": "vasundhara-v.volam@broadcom.com", "time": "Fri Oct 05 00:26:03 2018 -0400" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 04 21:41:16 2018 -0700" }, "message": "bnxt_en: get the reduced max_irqs by the ones used by RDMA\n\nWhen getting the max rings supported, get the reduced max_irqs\nby the ones used by RDMA.\n\nIf the number MSIX is the limiting factor, this bug may cause the\nmax ring count to be higher than it should be when RDMA driver is\nloaded and may result in ring allocation failures.\n\nFixes: 30f529473ec9 (\"bnxt_en: Do not modify max IRQ count after RDMA driver requests/frees IRQs.\")\nSigned-off-by: Vasundhara Volam \u003cvasundhara-v.volam@broadcom.com\u003e\nSigned-off-by: Michael Chan \u003cmichael.chan@broadcom.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "a2bf74f4e1b82395dad2b08d2a911d9151db71c1", "tree": "3e411c0859b3e98179f3c067847e49520ad01ed6", "parents": [ "5db0e0969af6501ad45fe0494039d3b9c797822b" ], "author": { "name": "Venkat Duvvuru", "email": "venkatkumar.duvvuru@broadcom.com", "time": "Fri Oct 05 00:26:02 2018 -0400" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 04 21:41:16 2018 -0700" }, "message": "bnxt_en: free hwrm resources, if driver probe fails.\n\nWhen the driver probe fails, all the resources that were allocated prior\nto the failure must be freed. However, hwrm dma response memory is not\ngetting freed.\n\nThis patch fixes the problem described above.\n\nFixes: c0c050c58d84 (\"bnxt_en: New Broadcom ethernet driver.\")\nSigned-off-by: Venkat Duvvuru \u003cvenkatkumar.duvvuru@broadcom.com\u003e\nSigned-off-by: Michael Chan \u003cmichael.chan@broadcom.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5db0e0969af6501ad45fe0494039d3b9c797822b", "tree": "b069515368af1eaa93c0a87e04770641ec8c7bff", "parents": [ "dbe80d446c859873820eedfff4abc61c71f1927b" ], "author": { "name": "Vasundhara Volam", "email": "vasundhara-v.volam@broadcom.com", "time": "Fri Oct 05 00:26:01 2018 -0400" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 04 21:41:16 2018 -0700" }, "message": "bnxt_en: Fix enables field in HWRM_QUEUE_COS2BW_CFG request\n\nIn HWRM_QUEUE_COS2BW_CFG request, enables field should have the bits\nset only for the queue ids which are having the valid parameters.\n\nThis causes firmware to return error when the TC to hardware CoS queue\nmapping is not 1:1 during DCBNL ETS setup.\n\nFixes: 2e8ef77ee0ff (\"bnxt_en: Add TC to hardware QoS queue mapping logic.\")\nSigned-off-by: Vasundhara Volam \u003cvasundhara-v.volam@broadcom.com\u003e\nSigned-off-by: Michael Chan \u003cmichael.chan@broadcom.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "dbe80d446c859873820eedfff4abc61c71f1927b", "tree": "15aebdb2f14a982d8cc292a3cd80457c83210a4e", "parents": [ "471b83bd8bbe4e89743683ef8ecb78f7029d8288" ], "author": { "name": "Michael Chan", "email": "michael.chan@broadcom.com", "time": "Fri Oct 05 00:26:00 2018 -0400" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 04 21:41:16 2018 -0700" }, "message": "bnxt_en: Fix VNIC reservations on the PF.\n\nThe enables bit for VNIC was set wrong when calling the HWRM_FUNC_CFG\nfirmware call to reserve VNICs. This has the effect that the firmware\nwill keep a large number of VNICs for the PF, and having very few for\nVFs. DPDK driver running on the VFs, which requires more VNICs, may not\nwork properly as a result.\n\nFixes: 674f50a5b026 (\"bnxt_en: Implement new method to reserve rings.\")\nSigned-off-by: Michael Chan \u003cmichael.chan@broadcom.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "befad944e2312c18d855013ce154ca7d2b110ade", "tree": "544f38cb6d0a2a35794a33cf9e37396787e7bea1", "parents": [ "010bd965f9711f801f2902ec3a6a2826c6656491", "bdf800c6fdf5674999bc0228d5040cc0ae218fa8" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 04 17:23:58 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 04 17:23:58 2018 -0700" }, "message": "Merge tag \u0027drm-fixes-2018-10-05\u0027 of git://anongit.freedesktop.org/drm/drm\n\nDave writes:\n \"amdgpu and two core fixes\n\n Two fixes for amdgpu:\n one corrects a use of process-\u003emm\n one fix for display code race condition that can result in a crash\n\n Two core fixes:\n One for a use-after-free in the leasing code\n One for a cma/fbdev crash.\"\n\n* tag \u0027drm-fixes-2018-10-05\u0027 of git://anongit.freedesktop.org/drm/drm:\n drm/amdkfd: Fix incorrect use of process-\u003emm\n drm/amd/display: Signal hw_done() after waiting for flip_done()\n drm/cma-helper: Fix crash in fbdev error path\n drm: fix use-after-free read in drm_mode_create_lease_ioctl()\n" }, { "commit": "bdf800c6fdf5674999bc0228d5040cc0ae218fa8", "tree": "223c6c6764fe1e3b40b3cca522eb0f11a8fdf69d", "parents": [ "3a9df1e9259362ed1ec321ce4229f1cd992355e6", "11b29c9e25788d0afb2ddb67bcd89424bd25f2f7" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Oct 05 08:39:31 2018 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Oct 05 08:39:35 2018 +1000" }, "message": "Merge branch \u0027drm-fixes-4.19\u0027 of git://people.freedesktop.org/~agd5f/linux into drm-fixes\n\n- Fix an ordering issue in DC with respect to atomic flips that could result\n in a crash\n- Fix incorrect use of process-\u003emm in KFD\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Alex Deucher \u003calexdeucher@gmail.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/1538668374-22334-1-git-send-email-alexander.deucher@amd.com\n" }, { "commit": "3a9df1e9259362ed1ec321ce4229f1cd992355e6", "tree": "e4e6592d3c361ba88c69d48f19a210f88323e767", "parents": [ "d8938c981f58ee344687b7910a611ac345960045", "4d4c2d89913e2d891bd6a34b12050a2576e60525" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Oct 05 08:39:01 2018 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Oct 05 08:39:04 2018 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2018-10-04\u0027 of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes\n\ndrm-misc-fixes for v4.19-rc7:\n- Fix use-after-free in drm_mode_create_lease_ioctl()\n- Fix crash in fbdev error path.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Maarten Lankhorst \u003cmaarten.lankhorst@linux.intel.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/13b2c3ac-9a96-710e-ceb9-890af164f10e@linux.intel.com\n" }, { "commit": "471b83bd8bbe4e89743683ef8ecb78f7029d8288", "tree": "dbb9b31d76ccceca2e826795400883c754ea5924", "parents": [ "f7b2a56e1f3dcbdb4cf09b2b63e859ffe0e09df8" ], "author": { "name": "Ido Schimmel", "email": "idosch@mellanox.com", "time": "Mon Oct 01 12:21:59 2018 +0300" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 04 13:55:40 2018 -0700" }, "message": "team: Forbid enslaving team device to itself\n\nteam\u0027s ndo_add_slave() acquires \u0027team-\u003elock\u0027 and later tries to open the\nnewly enslaved device via dev_open(). This emits a \u0027NETDEV_UP\u0027 event\nthat causes the VLAN driver to add VLAN 0 on the team device. team\u0027s\nndo_vlan_rx_add_vid() will also try to acquire \u0027team-\u003elock\u0027 and\ndeadlock.\n\nFix this by checking early at the enslavement function that a team\ndevice is not being enslaved to itself.\n\nA similar check was added to the bond driver in commit 09a89c219baf\n(\"bonding: disallow enslaving a bond to itself\").\n\nWARNING: possible recursive locking detected\n4.18.0-rc7+ #176 Not tainted\n--------------------------------------------\nsyz-executor4/6391 is trying to acquire lock:\n(____ptrval____) (\u0026team-\u003elock){+.+.}, at: team_vlan_rx_add_vid+0x3b/0x1e0 drivers/net/team/team.c:1868\n\nbut task is already holding lock:\n(____ptrval____) (\u0026team-\u003elock){+.+.}, at: team_add_slave+0xdb/0x1c30 drivers/net/team/team.c:1947\n\nother info that might help us debug this:\n Possible unsafe locking scenario:\n\n CPU0\n ----\n lock(\u0026team-\u003elock);\n lock(\u0026team-\u003elock);\n\n *** DEADLOCK ***\n\n May be due to missing lock nesting notation\n\n2 locks held by syz-executor4/6391:\n #0: (____ptrval____) (rtnl_mutex){+.+.}, at: rtnl_lock net/core/rtnetlink.c:77 [inline]\n #0: (____ptrval____) (rtnl_mutex){+.+.}, at: rtnetlink_rcv_msg+0x412/0xc30 net/core/rtnetlink.c:4662\n #1: (____ptrval____) (\u0026team-\u003elock){+.+.}, at: team_add_slave+0xdb/0x1c30 drivers/net/team/team.c:1947\n\nstack backtrace:\nCPU: 1 PID: 6391 Comm: syz-executor4 Not tainted 4.18.0-rc7+ #176\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113\n print_deadlock_bug kernel/locking/lockdep.c:1765 [inline]\n check_deadlock kernel/locking/lockdep.c:1809 [inline]\n validate_chain kernel/locking/lockdep.c:2405 [inline]\n __lock_acquire.cold.64+0x1fb/0x486 kernel/locking/lockdep.c:3435\n lock_acquire+0x1e4/0x540 kernel/locking/lockdep.c:3924\n __mutex_lock_common kernel/locking/mutex.c:757 [inline]\n __mutex_lock+0x176/0x1820 kernel/locking/mutex.c:894\n mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:909\n team_vlan_rx_add_vid+0x3b/0x1e0 drivers/net/team/team.c:1868\n vlan_add_rx_filter_info+0x14a/0x1d0 net/8021q/vlan_core.c:210\n __vlan_vid_add net/8021q/vlan_core.c:278 [inline]\n vlan_vid_add+0x63e/0x9d0 net/8021q/vlan_core.c:308\n vlan_device_event.cold.12+0x2a/0x2f net/8021q/vlan.c:381\n notifier_call_chain+0x180/0x390 kernel/notifier.c:93\n __raw_notifier_call_chain kernel/notifier.c:394 [inline]\n raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401\n call_netdevice_notifiers_info+0x3f/0x90 net/core/dev.c:1735\n call_netdevice_notifiers net/core/dev.c:1753 [inline]\n dev_open+0x173/0x1b0 net/core/dev.c:1433\n team_port_add drivers/net/team/team.c:1219 [inline]\n team_add_slave+0xa8b/0x1c30 drivers/net/team/team.c:1948\n do_set_master+0x1c9/0x220 net/core/rtnetlink.c:2248\n do_setlink+0xba4/0x3e10 net/core/rtnetlink.c:2382\n rtnl_setlink+0x2a9/0x400 net/core/rtnetlink.c:2636\n rtnetlink_rcv_msg+0x46e/0xc30 net/core/rtnetlink.c:4665\n netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2455\n rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4683\n netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]\n netlink_unicast+0x5a0/0x760 net/netlink/af_netlink.c:1343\n netlink_sendmsg+0xa18/0xfd0 net/netlink/af_netlink.c:1908\n sock_sendmsg_nosec net/socket.c:642 [inline]\n sock_sendmsg+0xd5/0x120 net/socket.c:652\n ___sys_sendmsg+0x7fd/0x930 net/socket.c:2126\n __sys_sendmsg+0x11d/0x290 net/socket.c:2164\n __do_sys_sendmsg net/socket.c:2173 [inline]\n __se_sys_sendmsg net/socket.c:2171 [inline]\n __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2171\n do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290\n entry_SYSCALL_64_after_hwframe+0x49/0xbe\nRIP: 0033:0x456b29\nCode: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00\nRSP: 002b:00007f9706bf8c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007f9706bf96d4 RCX: 0000000000456b29\nRDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000004\nRBP: 00000000009300a0 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff\nR13: 00000000004d3548 R14: 00000000004c8227 R15: 0000000000000000\n\nFixes: 87002b03baab (\"net: introduce vlan_vid_[add/del] and use them instead of direct [add/kill]_vid ndo calls\")\nSigned-off-by: Ido Schimmel \u003cidosch@mellanox.com\u003e\nReported-and-tested-by: syzbot+bd051aba086537515cdb@syzkaller.appspotmail.com\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "f7b2a56e1f3dcbdb4cf09b2b63e859ffe0e09df8", "tree": "54258f407d1147571214229d9d88ff9343f33d0e", "parents": [ "9e15ff7b89b6d9c51c296499539ea884220ab590" ], "author": { "name": "Yu Zhao", "email": "yuzhao@google.com", "time": "Fri Sep 28 17:04:30 2018 -0600" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 04 13:51:30 2018 -0700" }, "message": "net/usb: cancel pending work when unbinding smsc75xx\n\nCancel pending work before freeing smsc75xx private data structure\nduring binding. This fixes the following crash in the driver:\n\nBUG: unable to handle kernel NULL pointer dereference at 0000000000000050\nIP: mutex_lock+0x2b/0x3f\n\u003csnipped\u003e\nWorkqueue: events smsc75xx_deferred_multicast_write [smsc75xx]\ntask: ffff8caa83e85700 task.stack: ffff948b80518000\nRIP: 0010:mutex_lock+0x2b/0x3f\n\u003csnipped\u003e\nCall Trace:\n smsc75xx_deferred_multicast_write+0x40/0x1af [smsc75xx]\n process_one_work+0x18d/0x2fc\n worker_thread+0x1a2/0x269\n ? pr_cont_work+0x58/0x58\n kthread+0xfa/0x10a\n ? pr_cont_work+0x58/0x58\n ? rcu_read_unlock_sched_notrace+0x48/0x48\n ret_from_fork+0x22/0x40\n\nSigned-off-by: Yu Zhao \u003cyuzhao@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "9e15ff7b89b6d9c51c296499539ea884220ab590", "tree": "c8dafe318000268a4c3915934e5cb7ddfb7cd0a6", "parents": [ "b576eddb5d8d8bdd5fe4fada5e397c19b7ea4ffc", "1db58529454742f67ebd96e3588315e880b72837" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 04 13:47:39 2018 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 04 13:47:39 2018 -0700" }, "message": "Merge tag \u0027mac80211-for-davem-2018-10-04\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211\n\nJohannes Berg says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nJust three small fixes:\n * fix use-after-free in regulatory code\n * fix rx-mgmt key flag in AP mode (mac80211)\n * fix wireless extensions compat code memory leak\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "010bd965f9711f801f2902ec3a6a2826c6656491", "tree": "1df6d608a9eeae2e084812bda475023d3a052c3d", "parents": [ "ac0657edb13ac7971569aa88cc6f27ea26deb883", "1a8f8d2a443ef9ad9a3065ba8c8119df714240fa" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 04 13:24:38 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 04 13:24:38 2018 -0700" }, "message": "Merge tag \u0027ovl-fixes-4.19-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs\n\nMiklos writes:\n \"overlayfs fixes for 4.19-rc7\n\n This update fixes a couple of regressions in the stacked file update\n added in this cycle, as well as some older bugs uncovered by\n syzkaller.\n\n There\u0027s also one trivial naming change that touches other parts of\n the fs subsystem.\"\n\n* tag \u0027ovl-fixes-4.19-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs:\n ovl: fix format of setxattr debug\n ovl: fix access beyond unterminated strings\n ovl: make symbol \u0027ovl_aops\u0027 static\n vfs: swap names of {do,vfs}_clone_file_range()\n ovl: fix freeze protection bypass in ovl_clone_file_range()\n ovl: fix freeze protection bypass in ovl_write_iter()\n ovl: fix memory leak on unlink of indexed file\n" }, { "commit": "5d07384a666d4b2f781dc056bfeec2c27fbdf383", "tree": "74d8d0932b0abc02137d00d989418f7711a745d7", "parents": [ "4561ffca88c546f96367f94b8f1e4715a9c62314" ], "author": { "name": "Mike Snitzer", "email": "snitzer@redhat.com", "time": "Tue Sep 25 20:56:02 2018 -0400" }, "committer": { "name": "Mike Snitzer", "email": "snitzer@redhat.com", "time": "Thu Oct 04 15:20:52 2018 -0400" }, "message": "dm cache: fix resize crash if user doesn\u0027t reload cache table\n\nA reload of the cache\u0027s DM table is needed during resize because\notherwise a crash will occur when attempting to access smq policy\nentries associated with the portion of the cache that was recently\nextended.\n\nThe reason is cache-size based data structures in the policy will not be\nresized, the only way to safely extend the cache is to allow for a\nproper cache policy initialization that occurs when the cache table is\nloaded. For example the smq policy\u0027s space_init(), init_allocator(),\ncalc_hotspot_params() must be sized based on the extended cache size.\n\nThe fix for this is to disallow cache resizes of this pattern:\n1) suspend \"cache\" target\u0027s device\n2) resize the fast device used for the cache\n3) resume \"cache\" target\u0027s device\n\nInstead, the last step must be a full reload of the cache\u0027s DM table.\n\nFixes: 66a636356 (\"dm cache: add stochastic-multi-queue (smq) policy\")\nCc: stable@vger.kernel.org\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\n" }, { "commit": "4561ffca88c546f96367f94b8f1e4715a9c62314", "tree": "2143e12ead2aacd17d73d9ea90af991b13c5d032", "parents": [ "0328ba90407c82874f9f39f9a5a6e5ad6cb76f44" ], "author": { "name": "Joe Thornber", "email": "ejt@redhat.com", "time": "Mon Sep 24 16:19:30 2018 -0400" }, "committer": { "name": "Mike Snitzer", "email": "snitzer@redhat.com", "time": "Thu Oct 04 15:20:51 2018 -0400" }, "message": "dm cache metadata: ignore hints array being too small during resize\n\nCommit fd2fa9541 (\"dm cache metadata: save in-core policy_hint_size to\non-disk superblock\") enabled previously written policy hints to be\nused after a cache is reactivated. But in doing so the cache\nmetadata\u0027s hint array was left exposed to out of bounds access because\non resize the metadata\u0027s on-disk hint array wasn\u0027t ever extended.\n\nFix this by ignoring that there are no on-disk hints associated with the\nnewly added cache blocks. An expanded on-disk hint array is later\nrewritten upon the next clean shutdown of the cache.\n\nFixes: fd2fa9541 (\"dm cache metadata: save in-core policy_hint_size to on-disk superblock\")\nCc: stable@vger.kernel.org\nSigned-off-by: Joe Thornber \u003cejt@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\n" }, { "commit": "69e445ab8b66a9f30519842ef18be555d3ee9b51", "tree": "115eba75d4db85e1a78a63b614bf4df9b94c815d", "parents": [ "17b57b1883c1285f3d0dc2266e8f79286a7bef38" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Thu Oct 04 11:08:12 2018 +0200" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Thu Oct 04 19:39:31 2018 +0200" }, "message": "PM / core: Clear the direct_complete flag on errors\n\nIf __device_suspend() runs asynchronously (in which case the device\npassed to it is in dpm_suspended_list at that point) and it returns\nearly on an error or pending wakeup, and the power.direct_complete\nflag has been set for the device already, the subsequent\ndevice_resume() will be confused by that and it will call\npm_runtime_enable() incorrectly, as runtime PM has not been\ndisabled for the device by __device_suspend().\n\nTo avoid that, clear power.direct_complete if __device_suspend()\nis not going to disable runtime PM for the device before returning.\n\nFixes: aae4518b3124 (PM / sleep: Mechanism to avoid resuming runtime-suspended devices unnecessarily)\nReported-by: Al Cooper \u003calcooperx@gmail.com\u003e\nTested-by: Al Cooper \u003calcooperx@gmail.com\u003e\nReviewed-by: Ulf Hansson \u003culf.hansson@linaro.org\u003e\nCc: 3.16+ \u003cstable@vger.kernel.org\u003e # 3.16+\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\n" }, { "commit": "b576eddb5d8d8bdd5fe4fada5e397c19b7ea4ffc", "tree": "f20dee6d3425f4512464374c4ed1a7996c235048", "parents": [ "cec4de302c5ff2c5eb3bfcb0c4845a095f5149b9", "c360867ec46a4ec5cb19e5c329d65dff522cc69d" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 04 09:53:03 2018 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 04 09:53:03 2018 -0700" }, "message": "Merge branch \u0027mlxsw-fixes\u0027\n\nIdo Schimmel says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nmlxsw: Couple of fixes\n\nFirst patch works around an hardware issue in Spectrum-2 where a field\nindicating the event type is always set to the same value. Since there\nare only two event types and they are reported using different queues,\nwe can use the queue number to derive the event type.\n\nSecond patch prevents a router interface (RIF) leakage when a VLAN\ndevice is deleted from on top a bridge device.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "c360867ec46a4ec5cb19e5c329d65dff522cc69d", "tree": "f20dee6d3425f4512464374c4ed1a7996c235048", "parents": [ "f3c84a8e3e922afdcbc55f04df8fdf8a548f5a21" ], "author": { "name": "Ido Schimmel", "email": "idosch@mellanox.com", "time": "Thu Oct 04 15:48:03 2018 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 04 09:53:03 2018 -0700" }, "message": "mlxsw: spectrum: Delete RIF when VLAN device is removed\n\nIn commit 602b74eda813 (\"mlxsw: spectrum_switchdev: Do not leak RIFs\nwhen removing bridge\") I handled the case where RIFs created for VLAN\ndevices were not properly cleaned up when their real device (a bridge)\nwas removed.\n\nHowever, I forgot to handle the case of the VLAN device itself being\nremoved. Do so now when the VLAN device is being unlinked from its real\ndevice.\n\nFixes: 99f44bb3527b (\"mlxsw: spectrum: Enable L3 interfaces on top of bridge devices\")\nSigned-off-by: Ido Schimmel \u003cidosch@mellanox.com\u003e\nReviewed-by: Jiri Pirko \u003cjiri@mellanox.com\u003e\nReported-by: Artem Shvorin \u003cart@qrator.net\u003e\nTested-by: Artem Shvorin \u003cart@qrator.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "f3c84a8e3e922afdcbc55f04df8fdf8a548f5a21", "tree": "5af0ad36e33d3efeb325e926efe6a6c03ff92e8e", "parents": [ "cec4de302c5ff2c5eb3bfcb0c4845a095f5149b9" ], "author": { "name": "Nir Dotan", "email": "nird@mellanox.com", "time": "Thu Oct 04 15:48:02 2018 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 04 09:53:03 2018 -0700" }, "message": "mlxsw: pci: Derive event type from event queue number\n\nDue to a hardware issue in Spectrum-2, the field event_type of the event\nqueue element (EQE) has become reserved. It was used to distinguish between\ncommand interface completion events and completion events.\n\nUse queue number to determine event type, as command interface completion\nevents are always received on EQ0 and mlxsw driver maps completion events\nto EQ1.\n\nFixes: c3ab435466d5 (\"mlxsw: spectrum: Extend to support Spectrum-2 ASIC\")\nSigned-off-by: Nir Dotan \u003cnird@mellanox.com\u003e\nReviewed-by: Jiri Pirko \u003cjiri@mellanox.com\u003e\nSigned-off-by: Ido Schimmel \u003cidosch@mellanox.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "ac0657edb13ac7971569aa88cc6f27ea26deb883", "tree": "27dc90f8dc02635a7aa6e503327c80bf8edc0892", "parents": [ "10be83cc641884e7c5dfcc0d3e74ba9f3b332e27", "3a58ac65e2d7969bcdf1b6acb70fa4d12a88e53e" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 04 09:48:10 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 04 09:48:10 2018 -0700" }, "message": "Merge branch \u0027fixes\u0027 of git://git.armlinux.org.uk/~rmk/linux-arm\n\nRussell writes:\n \"A couple of small ARM fixes from Stefan and Thomas:\n - Adding the io_pgetevents syscall\n - Fixing a bounds check in pci_ioremap_io()\"\n\n* \u0027fixes\u0027 of git://git.armlinux.org.uk/~rmk/linux-arm:\n ARM: 8799/1: mm: fix pci_ioremap_io() offset check\n ARM: 8787/1: wire up io_pgetevents syscall\n" }, { "commit": "10be83cc641884e7c5dfcc0d3e74ba9f3b332e27", "tree": "e7c91156b438cffa7172f23a4b44a81dcc8a9cd0", "parents": [ "1b0350c355b2f32bcbd453310bf6dfb50cbe965f", "d8938c981f58ee344687b7910a611ac345960045" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 04 09:18:44 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 04 09:18:44 2018 -0700" }, "message": "Merge tag \u0027drm-fixes-2018-10-04\u0027 of git://anongit.freedesktop.org/drm/drm\n\nDave writes:\n \"drm exynos, tda9950 and intel fixes\n\n 3 i915 fixes:\n compressed error handling zlib fix\n compiler warning cleanup\n and a minor code cleanup\n\n 2 tda9950:\n Two fixes for the HDMI CEC\n\n 1 exynos:\n A fix required for IOMMU interaction.\"\n\n* tag \u0027drm-fixes-2018-10-04\u0027 of git://anongit.freedesktop.org/drm/drm:\n drm/i915: Handle incomplete Z_FINISH for compressed error states\n drm/i915: Avoid compiler warning for maybe unused gu_misc_iir\n drm/i915: Do not redefine the has_csr parameter.\n drm/exynos: Use selected dma_dev default iommu domain instead of a fake one\n drm/i2c: tda9950: set MAX_RETRIES for errors only\n drm/i2c: tda9950: fix timeout counter check\n" }, { "commit": "1b0350c355b2f32bcbd453310bf6dfb50cbe965f", "tree": "b64e213a661babcc5b4364d181d62ea0be8cf13f", "parents": [ "d2467adb66108f1b7fec8cadbdb8ca140e88effe", "e55ec4ddbef9897199c307dfb23167e3801fdaf5" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 04 09:17:38 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 04 09:17:38 2018 -0700" }, "message": "Merge tag \u0027xfs-fixes-for-4.19-rc6\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux\n\nDave writes:\n \"XFS fixes for 4.19-rc6\n\n Accumlated regression and bug fixes for 4.19-rc6, including:\n\n o make iomap correctly mark dirty pages for sub-page block sizes\n o fix regression in handling extent-to-btree format conversion errors\n o fix torn log wrap detection for new logs\n o various corrupt inode detection fixes\n o various delalloc state fixes\n o cleanup all the missed transaction cancel cases missed from changes merged\n in 4.19-rc1\n o fix lockdep false positive on transaction allocation\n o fix locking and reference counting on buffer log items\"\n\n* tag \u0027xfs-fixes-for-4.19-rc6\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:\n xfs: fix error handling in xfs_bmap_extents_to_btree\n iomap: set page dirty after partial delalloc on mkwrite\n xfs: remove invalid log recovery first/last cycle check\n xfs: validate inode di_forkoff\n xfs: skip delalloc COW blocks in xfs_reflink_end_cow\n xfs: don\u0027t treat unknown di_flags2 as corruption in scrub\n xfs: remove duplicated include from alloc.c\n xfs: don\u0027t bring in extents in xfs_bmap_punch_delalloc_range\n xfs: fix transaction leak in xfs_reflink_allocate_cow()\n xfs: avoid lockdep false positives in xfs_trans_alloc\n xfs: refactor xfs_buf_log_item reference count handling\n xfs: clean up xfs_trans_brelse()\n xfs: don\u0027t unlock invalidated buf on aborted tx commit\n xfs: remove last of unnecessary xfs_defer_cancel() callers\n xfs: don\u0027t crash the vfs on a garbage inline symlink\n" }, { "commit": "d2467adb66108f1b7fec8cadbdb8ca140e88effe", "tree": "7baa151185988bef922863f2dcb7ffcff6e10287", "parents": [ "cec4de302c5ff2c5eb3bfcb0c4845a095f5149b9", "ef1f2258748b675422ca0107e5bfb9ceeac675de" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 04 09:16:11 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 04 09:16:11 2018 -0700" }, "message": "Merge tag \u0027riscv-for-linus-4.19-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux\n\nPalmer writes:\n \"A Single RISC-V Fix for 4.19-rc7\n\n This tag contains a single patch that managed to get lost in the\n shuffle, which explains why it\u0027s so late. This single line has been\n floating around in various patch sets for months, and fixes our DMA32\n region.\"\n\n* tag \u0027riscv-for-linus-4.19-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux:\n RISCV: Fix end PFN for low memory\n" }, { "commit": "11b29c9e25788d0afb2ddb67bcd89424bd25f2f7", "tree": "12b50c02a89f402ac4f77a9fbd20c32056a56d0c", "parents": [ "987bf116445db5d63a5c2ed94c4479687d9c9973" ], "author": { "name": "Felix Kuehling", "email": "Felix.Kuehling@amd.com", "time": "Tue Oct 02 18:41:12 2018 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 04 11:37:25 2018 -0400" }, "message": "drm/amdkfd: Fix incorrect use of process-\u003emm\n\nThis mm_struct pointer should never be dereferenced. If running in\na user thread, just use current-\u003emm. If running in a kernel worker\nuse get_task_mm to get a safe reference to the mm_struct.\n\nReviewed-by: Oded Gabbay \u003coded.gabbay@gmail.com\u003e\nAcked-by: Christian König \u003cchristian.koenig@amd.com\u003e\nSigned-off-by: Felix Kuehling \u003cFelix.Kuehling@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n" }, { "commit": "987bf116445db5d63a5c2ed94c4479687d9c9973", "tree": "cc24ce79670260b56c3ab152b43607fa5f714af7", "parents": [ "d8938c981f58ee344687b7910a611ac345960045" ], "author": { "name": "Shirish S", "email": "shirish.s@amd.com", "time": "Mon Sep 24 19:01:47 2018 +0530" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 04 11:21:03 2018 -0400" }, "message": "drm/amd/display: Signal hw_done() after waiting for flip_done()\n\nIn amdgpu_dm_commit_tail(), wait until flip_done() is signaled before\nwe signal hw_done().\n\n[Why]\n\nThis is to temporarily address a paging error that occurs when a\nnonblocking commit contends with another commit, particularly in a\nmirrored display configuration where at least 2 CRTCs are updated.\nThe error occurs in drm_atomic_helper_wait_for_flip_done(), when we\nattempt to access the contents of new_crtc_state-\u003ecommit.\n\nHere\u0027s the sequence for a mirrored 2 display setup (irrelevant steps\nleft out for clarity):\n\n**THREAD 1** | **THREAD 2**\n |\nInitialize atomic state for flip |\n |\nQueue worker |\n ...\n\n | Do work for flip\n |\n | Signal hw_done() on CRTC 1\n | Signal hw_done() on CRTC 2\n |\n | Wait for flip_done() on CRTC 1\n\n \u003c---- **PREEMPTED BY THREAD 1**\n\nInitialize atomic state for cursor |\nupdate (1) |\n |\nDo cursor update work on both CRTCs |\n |\nClear atomic state (2) |\n**DONE** |\n ...\n |\n | Wait for flip_done() on CRTC 2\n | *ERROR*\n |\n\nThe issue starts with (1). When the atomic state is initialized, the\ncurrent CRTC states are duplicated to be the new_crtc_states, and\nreferenced to be the old_crtc_states. (The new_crtc_states are to be\nfilled with update data.)\n\nSome things to note:\n\n* Due to the mirrored configuration, the cursor updates on both CRTCs.\n\n* At this point, the pflip IRQ has already been handled, and flip_done\n signaled on all CRTCs. The cursor commit can therefore continue.\n\n* The old_crtc_states used by the cursor update are the **same states**\n as the new_crtc_states used by the flip worker.\n\nAt (2), the old_crtc_state is freed (*), and the cursor commit\ncompletes. We then context switch back to the flip worker, where we\nattempt to access the new_crtc_state-\u003ecommit object. This is\nproblematic, as this state has already been freed.\n\n(*) Technically, \u0027state-\u003ecrtcs[i].state\u0027 is freed, which was made to\n reference old_crtc_state in drm_atomic_helper_swap_state()\n\n[How]\n\nBy moving hw_done() after wait_for_flip_done(), we\u0027re guaranteed that\nthe new_crtc_state (from the flip worker\u0027s perspective) still exists.\nThis is because any other commit will be blocked, waiting for the\nhw_done() signal.\n\nNote that both the i915 and imx drivers have this sequence flipped\nalready, masking this problem.\n\nSigned-off-by: Shirish S \u003cshirish.s@amd.com\u003e\nSigned-off-by: Leo Li \u003csunpeng.li@amd.com\u003e\nReviewed-by: Harry Wentland \u003charry.wentland@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n" }, { "commit": "7e7126846c95a34f98a1524d5c473af1f0783735", "tree": "7bc04aa69fde69d85d83112eee7c17993dd948b3", "parents": [ "2cf7ea9f40fabee0f8b40db4eb2d1e85cc6c0a95" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Wed Oct 03 13:44:26 2018 +0200" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Thu Oct 04 17:10:40 2018 +0200" }, "message": "kvm: nVMX: fix entry with pending interrupt if APICv is enabled\n\nCommit b5861e5cf2fcf83031ea3e26b0a69d887adf7d21 introduced a check on\nthe interrupt-window and NMI-window CPU execution controls in order to\ninject an external interrupt vmexit before the first guest instruction\nexecutes. However, when APIC virtualization is enabled the host does not\nneed a vmexit in order to inject an interrupt at the next interrupt window;\ninstead, it just places the interrupt vector in RVI and the processor will\ninject it as soon as possible. Therefore, on machines with APICv it is\nnot enough to check the CPU execution controls: the same scenario can also\nhappen if RVI\u003evPPR.\n\nFixes: b5861e5cf2fcf83031ea3e26b0a69d887adf7d21\nReviewed-by: Nikita Leshchenko \u003cnikita.leshchenko@oracle.com\u003e\nCc: Sean Christopherson \u003csean.j.christopherson@intel.com\u003e\nCc: Liran Alon \u003cliran.alon@oracle.com\u003e\nCc: Radim Krčmář \u003crkrcmar@redhat.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "1a8f8d2a443ef9ad9a3065ba8c8119df714240fa", "tree": "3abb9da74ff7da89a3a700710a6611a39c61ebf9", "parents": [ "601350ff58d5415a001769532f6b8333820e5786" ], "author": { "name": "Miklos Szeredi", "email": "mszeredi@redhat.com", "time": "Thu Oct 04 14:49:10 2018 +0200" }, "committer": { "name": "Miklos Szeredi", "email": "mszeredi@redhat.com", "time": "Thu Oct 04 14:49:10 2018 +0200" }, "message": "ovl: fix format of setxattr debug\n\nFormat has a typo: it was meant to be \"%.*s\", not \"%*s\". But at some point\ncallers grew nonprintable values as well, so use \"%*pE\" instead with a\nmaximized length.\n\nReported-by: Amir Goldstein \u003camir73il@gmail.com\u003e\nSigned-off-by: Miklos Szeredi \u003cmszeredi@redhat.com\u003e\nFixes: 3a1e819b4e80 (\"ovl: store file handle of lower inode on copy up\")\nCc: \u003cstable@vger.kernel.org\u003e # v4.12\n" }, { "commit": "601350ff58d5415a001769532f6b8333820e5786", "tree": "56ac78548e6345a2f5c3a6d96dd5d9fe304d69ed", "parents": [ "69383c5913a5d74b4aa7e2b78a5cf14ebfbba538" ], "author": { "name": "Amir Goldstein", "email": "amir73il@gmail.com", "time": "Fri Sep 28 21:00:48 2018 +0300" }, "committer": { "name": "Miklos Szeredi", "email": "mszeredi@redhat.com", "time": "Thu Oct 04 14:49:10 2018 +0200" }, "message": "ovl: fix access beyond unterminated strings\n\nKASAN detected slab-out-of-bounds access in printk from overlayfs,\nbecause string format used %*s instead of %.*s.\n\n\u003e BUG: KASAN: slab-out-of-bounds in string+0x298/0x2d0 lib/vsprintf.c:604\n\u003e Read of size 1 at addr ffff8801c36c66ba by task syz-executor2/27811\n\u003e\n\u003e CPU: 0 PID: 27811 Comm: syz-executor2 Not tainted 4.19.0-rc5+ #36\n...\n\u003e printk+0xa7/0xcf kernel/printk/printk.c:1996\n\u003e ovl_lookup_index.cold.15+0xe8/0x1f8 fs/overlayfs/namei.c:689\n\nReported-by: syzbot+376cea2b0ef340db3dd4@syzkaller.appspotmail.com\nSigned-off-by: Amir Goldstein \u003camir73il@gmail.com\u003e\nSigned-off-by: Miklos Szeredi \u003cmszeredi@redhat.com\u003e\nFixes: 359f392ca53e (\"ovl: lookup index entry for copy up origin\")\nCc: \u003cstable@vger.kernel.org\u003e # v4.13\n" }, { "commit": "2cf7ea9f40fabee0f8b40db4eb2d1e85cc6c0a95", "tree": "a2fac261c821b28d52f42e54eaa725d08654d895", "parents": [ "fd6b6d9b82f97a851fb0078201ddc38fe9728cda" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Wed Oct 03 10:34:00 2018 +0200" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Thu Oct 04 13:40:44 2018 +0200" }, "message": "KVM: VMX: hide flexpriority from guest when disabled at the module level\n\nAs of commit 8d860bbeedef (\"kvm: vmx: Basic APIC virtualization controls\nhave three settings\"), KVM will disable VIRTUALIZE_APIC_ACCESSES when\na nested guest writes APIC_BASE MSR and kvm-intel.flexpriority\u003d0,\nwhereas previously KVM would allow a nested guest to enable\nVIRTUALIZE_APIC_ACCESSES so long as it\u0027s supported in hardware. That is,\nKVM now advertises VIRTUALIZE_APIC_ACCESSES to a guest but doesn\u0027t\n(always) allow setting it when kvm-intel.flexpriority\u003d0, and may even\ninitially allow the control and then clear it when the nested guest\nwrites APIC_BASE MSR, which is decidedly odd even if it doesn\u0027t cause\nfunctional issues.\n\nHide the control completely when the module parameter is cleared.\n\nreported-by: Sean Christopherson \u003csean.j.christopherson@intel.com\u003e\nFixes: 8d860bbeedef (\"kvm: vmx: Basic APIC virtualization controls have three settings\")\nCc: Jim Mattson \u003cjmattson@google.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "fd6b6d9b82f97a851fb0078201ddc38fe9728cda", "tree": "da59ad4082bb1aa09feac7d87cb2b79106107982", "parents": [ "daa07cbc9ae3da2d61b7ce900c0b9107d134f2c1" ], "author": { "name": "Sean Christopherson", "email": "sean.j.christopherson@intel.com", "time": "Mon Oct 01 14:25:34 2018 -0700" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Thu Oct 04 13:40:21 2018 +0200" }, "message": "KVM: VMX: check for existence of secondary exec controls before accessing\n\nReturn early from vmx_set_virtual_apic_mode() if the processor doesn\u0027t\nsupport VIRTUALIZE_APIC_ACCESSES or VIRTUALIZE_X2APIC_MODE, both of\nwhich reside in SECONDARY_VM_EXEC_CONTROL. This eliminates warnings\ndue to VMWRITEs to SECONDARY_VM_EXEC_CONTROL (VMCS field 401e) failing\non processors without secondary exec controls.\n\nRemove the similar check for TPR shadowing as it is incorporated in the\nflexpriority_enabled check and the APIC-related code in\nvmx_update_msr_bitmap() is further gated by VIRTUALIZE_X2APIC_MODE.\n\nReported-by: Gerhard Wiesinger \u003credhat@wiesinger.com\u003e\nFixes: 8d860bbeedef (\"kvm: vmx: Basic APIC virtualization controls have three settings\")\nCc: Jim Mattson \u003cjmattson@google.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Sean Christopherson \u003csean.j.christopherson@intel.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "02e425668f5c9deb42787d10001a3b605993ad15", "tree": "4694f40f6acceb4c1715cc8b9e1b08ee19eaf014", "parents": [ "88296bd42b4e9d24e138a68b337c235b5cac89a7" ], "author": { "name": "Andy Lutomirski", "email": "luto@kernel.org", "time": "Wed Oct 03 16:23:49 2018 -0700" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Thu Oct 04 08:17:50 2018 +0200" }, "message": "x86/vdso: Fix vDSO syscall fallback asm constraint regression\n\nWhen I added the missing memory outputs, I failed to update the\nindex of the first argument (ebx) on 32-bit builds, which broke the\nfallbacks. Somehow I must have screwed up my testing or gotten\nlucky.\n\nAdd another test to cover gettimeofday() as well.\n\nSigned-off-by: Andy Lutomirski \u003cluto@kernel.org\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: stable@vger.kernel.org\nFixes: 715bd9d12f84 (\"x86/vdso: Fix asm constraints on vDSO syscall fallbacks\")\nLink: http://lkml.kernel.org/r/21bd45ab04b6d838278fa5bebfa9163eceffa13c.1538608971.git.luto@kernel.org\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n" }, { "commit": "709ae62e8e6d9ac4df7dadb3b8ae432675c45ef9", "tree": "775a43d99fab51ac9d1f8a4dc5803dd78d048861", "parents": [ "b3a5402cbcebaf5a9db4d6a3268070e4a099355d" ], "author": { "name": "Kai-Heng Feng", "email": "kai.heng.feng@canonical.com", "time": "Thu Oct 04 11:39:42 2018 +0800" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Oct 04 07:50:48 2018 +0200" }, "message": "ALSA: hda/realtek - Cannot adjust speaker\u0027s volume on Dell XPS 27 7760\n\nThe issue is the same as commit dd9aa335c880 (\"ALSA: hda/realtek - Can\u0027t\nadjust speaker\u0027s volume on a Dell AIO\"), the output requires to connect\nto a node with Amp-out capability.\n\nApplying the same fixup ALC298_FIXUP_SPK_VOLUME can fix the issue.\n\nBugLink: https://bugs.launchpad.net/bugs/1775068\nSigned-off-by: Kai-Heng Feng \u003ckai.heng.feng@canonical.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "6579804c431712d56956a63b1a01509441cc6800", "tree": "173e1622e1319cdf22fc63eb544228edc200c51a", "parents": [ "71d29f43b6332badc5598c656616a62575e83342" ], "author": { "name": "Paul Mackerras", "email": "paulus@ozlabs.org", "time": "Thu Oct 04 14:51:11 2018 +1000" }, "committer": { "name": "Paul Mackerras", "email": "paulus@ozlabs.org", "time": "Thu Oct 04 14:51:11 2018 +1000" }, "message": "KVM: PPC: Book3S HV: Avoid crash from THP collapse during radix page fault\n\nCommit 71d29f43b633 (\"KVM: PPC: Book3S HV: Don\u0027t use compound_order to\ndetermine host mapping size\", 2018-09-11) added a call to \n__find_linux_pte() and a dereference of the returned PTE pointer to the\nradix page fault path in the common case where the page is normal\nsystem memory. Previously, __find_linux_pte() was only called for\nmappings to physical addresses which don\u0027t have a page struct (e.g.\nmemory-mapped I/O) or where the page struct is marked as reserved\nmemory.\n\nThis exposes us to the possibility that the returned PTE pointer\ncould be NULL, for example in the case of a concurrent THP collapse\noperation. Dereferencing the returned NULL pointer causes a host\ncrash.\n\nTo fix this, we check for NULL, and if it is NULL, we retry the\noperation by returning to the guest, with the expectation that it\nwill generate the same page fault again (unless of course it has\nbeen fixed up by another CPU in the meantime).\n\nFixes: 71d29f43b633 (\"KVM: PPC: Book3S HV: Don\u0027t use compound_order to determine host mapping size\")\nSigned-off-by: Paul Mackerras \u003cpaulus@ozlabs.org\u003e\n" }, { "commit": "d8938c981f58ee344687b7910a611ac345960045", "tree": "3a9c70ce5c7a8889e82292643cdec5fa4a2357d8", "parents": [ "659c9370e53c99b2e98eba0c07161f839dbf8521", "e0dccce1193f87597548d0db6ecc942fb92c04cd" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu Oct 04 10:28:27 2018 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu Oct 04 10:32:14 2018 +1000" }, "message": "Merge branch \u0027drm-tda9950-fixes\u0027 of git://git.armlinux.org.uk/~rmk/linux-arm into drm-fixes\n\ntwo tda9950 fixes.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Russell King \u003crmk@armlinux.org.uk\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/20181001162948.GA9508@rmk-PC.armlinux.org.uk\n" }, { "commit": "659c9370e53c99b2e98eba0c07161f839dbf8521", "tree": "cb9f2ac651e4e8332a7608b067c668484f92fc71", "parents": [ "77d981b16f2db81ba6c7792a9102652045535127", "4c9613ce556fdeb671e779668b627ea3a2b61728" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu Oct 04 10:04:38 2018 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu Oct 04 10:07:20 2018 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2018-10-03\u0027 of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes\n\nThere\u0027s one fix for our zlib incomlete Z_FINISH on our error state handling,\nplus a compilation warning fix and a tiny code clean up.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/20181003202840.GA23560@intel.com\n" }, { "commit": "cec4de302c5ff2c5eb3bfcb0c4845a095f5149b9", "tree": "da7eeaae52d6c9a5842db0cebf669476c2163f91", "parents": [ "95773dc0862717ab9612d69bc07d0386bd104603", "4233cfe6ec4683497d7318f55ce7617e97f2e610" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Oct 03 16:09:11 2018 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Oct 03 16:09:11 2018 -0700" }, "message": "Merge gitolite.kernel.org:/pub/scm/linux/kernel/git/davem/net\n\nDavid writes:\n \"Networking fixes:\n 1) Prefix length validation in xfrm layer, from Steffen Klassert.\n\n 2) TX status reporting fix in mac80211, from Andrei Otcheretianski.\n\n 3) Fix hangs due to TX_DROP in mac80211, from Bob Copeland.\n\n 4) Fix DMA error regression in b43, from Larry Finger.\n\n 5) Add input validation to xenvif_set_hash_mapping(), from Jan Beulich.\n\n 6) SMMU unmapping fix in hns driver, from Yunsheng Lin.\n\n 7) Bluetooh crash in unpairing on SMP, from Matias Karhumaa.\n\n 8) WoL handling fixes in the phy layer, from Heiner Kallweit.\n\n 9) Fix deadlock in bonding, from Mahesh Bandewar.\n\n 10) Fill ttl inherit infor in vxlan driver, from Hangbin Liu.\n\n 11) Fix TX timeouts during netpoll, from Michael Chan.\n\n 12) RXRPC layer fixes from David Howells.\n\n 13) Another batch of ndo_poll_controller() removals to deal with\n excessive resource consumption during load. From Eric Dumazet.\n\n 14) Fix a specific TIPC failure secnario, from LUU Duc Canh.\n\n 15) Really disable clocks in r8169 during suspend so that low\n power states can actually be reached.\n\n 16) Fix SYN backlog lockdep issue in tcp and dccp, from Eric Dumazet.\n\n 17) Fix RCU locking in netpoll SKB send, which shows up in bonding,\n from Dave Jones.\n\n 18) Fix TX stalls in r8169, from Heiner Kallweit.\n\n 19) Fix locksup in nfp due to control message storms, from Jakub\n Kicinski.\n\n 20) Various rmnet bug fixes from Subash Abhinov Kasiviswanathan and\n Sean Tranchetti.\n\n 21) Fix use after free in ip_cmsg_recv_dstaddr(), from Eric Dumazet.\"\n\n* gitolite.kernel.org:/pub/scm/linux/kernel/git/davem/net: (122 commits)\n ixgbe: check return value of napi_complete_done()\n sctp: fix fall-through annotation\n r8169: always autoneg on resume\n ipv4: fix use-after-free in ip_cmsg_recv_dstaddr()\n net: qualcomm: rmnet: Fix incorrect allocation flag in receive path\n net: qualcomm: rmnet: Fix incorrect allocation flag in transmit\n net: qualcomm: rmnet: Skip processing loopback packets\n net: systemport: Fix wake-up interrupt race during resume\n rtnl: limit IFLA_NUM_TX_QUEUES and IFLA_NUM_RX_QUEUES to 4096\n bonding: fix warning message\n inet: make sure to grab rcu_read_lock before using ireq-\u003eireq_opt\n nfp: avoid soft lockups under control message storm\n declance: Fix continuation with the adapter identification message\n net: fec: fix rare tx timeout\n r8169: fix network stalls due to missing bit TXCFG_AUTO_FIFO\n tun: napi flags belong to tfile\n tun: initialize napi_mutex unconditionally\n tun: remove unused parameters\n bond: take rcu lock in netpoll_send_skb_on_dev\n rtnetlink: Fail dump if target netnsid is invalid\n ...\n" }, { "commit": "4233cfe6ec4683497d7318f55ce7617e97f2e610", "tree": "5a742ed70e661b7a2e166e825a53ff6e24251335", "parents": [ "2cc543f5cd6deda27ef463686fa08c16c8c0990b" ], "author": { "name": "Song Liu", "email": "songliubraving@fb.com", "time": "Wed Oct 03 11:30:35 2018 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Oct 03 14:40:32 2018 -0700" }, "message": "ixgbe: check return value of napi_complete_done()\n\nThe NIC driver should only enable interrupts when napi_complete_done()\nreturns true. This patch adds the check for ixgbe.\n\nCc: stable@vger.kernel.org # 4.10+\nSuggested-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: Song Liu \u003csongliubraving@fb.com\u003e\nTested-by: Andrew Bowers \u003candrewx.bowers@intel.com\u003e\nSigned-off-by: Jeff Kirsher \u003cjeffrey.t.kirsher@intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" } ], "next": "95773dc0862717ab9612d69bc07d0386bd104603" }