)]}' { "log": [ { "commit": "9ca1d50fa959cda1f04f43275f7930a70f1a631e", "tree": "52fed1b22b7eb25413f7be151170b7fa21dbd858", "parents": [ "e917563612e5d8ad3a80efa5f43e654be50fe82f" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:38 2016 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:38 2016 -0700" }, "message": "Linux 4.4.14\n" }, { "commit": "e917563612e5d8ad3a80efa5f43e654be50fe82f", "tree": "89453081a3c700bf0a2cd6c79a031e84f2d1e233", "parents": [ "d69f93d059c6294322bb91f9aaff796a21c3aa20" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Fri Apr 01 15:37:59 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:24 2016 -0700" }, "message": "netfilter: x_tables: introduce and use xt_copy_counters_from_user\n\ncommit d7591f0c41ce3e67600a982bab6989ef0f07b3ce upstream.\n\nThe three variants use same copy\u0026pasted code, condense this into a\nhelper and use that.\n\nMake sure info.name is 0-terminated.\n\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d69f93d059c6294322bb91f9aaff796a21c3aa20", "tree": "c49ba4403146b265dad32feaf7d2d1bc453521dc", "parents": [ "3a69c0f0487a6eba5fd5005c7902a230c8e31518" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Fri Apr 01 14:17:34 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:24 2016 -0700" }, "message": "netfilter: x_tables: do compat validation via translate_table\n\ncommit 09d9686047dbbe1cf4faa558d3ecc4aae2046054 upstream.\n\nThis looks like refactoring, but its also a bug fix.\n\nProblem is that the compat path (32bit iptables, 64bit kernel) lacks a few\nsanity tests that are done in the normal path.\n\nFor example, we do not check for underflows and the base chain policies.\n\nWhile its possible to also add such checks to the compat path, its more\ncopy\u0026pastry, for instance we cannot reuse check_underflow() helper as\ne-\u003etarget_offset differs in the compat case.\n\nOther problem is that it makes auditing for validation errors harder; two\nplaces need to be checked and kept in sync.\n\nAt a high level 32 bit compat works like this:\n1- initial pass over blob:\n validate match/entry offsets, bounds checking\n lookup all matches and targets\n do bookkeeping wrt. size delta of 32/64bit structures\n assign match/target.u.kernel pointer (points at kernel\n implementation, needed to access -\u003ecompatsize etc.)\n\n2- allocate memory according to the total bookkeeping size to\n contain the translated ruleset\n\n3- second pass over original blob:\n for each entry, copy the 32bit representation to the newly allocated\n memory. This also does any special match translations (e.g.\n adjust 32bit to 64bit longs, etc).\n\n4- check if ruleset is free of loops (chase all jumps)\n\n5-first pass over translated blob:\n call the checkentry function of all matches and targets.\n\nThe alternative implemented by this patch is to drop steps 3\u00264 from the\ncompat process, the translation is changed into an intermediate step\nrather than a full 1:1 translate_table replacement.\n\nIn the 2nd pass (step #3), change the 64bit ruleset back to a kernel\nrepresentation, i.e. put() the kernel pointer and restore -\u003eu.user.name .\n\nThis gets us a 64bit ruleset that is in the format generated by a 64bit\niptables userspace -- we can then use translate_table() to get the\n\u0027native\u0027 sanity checks.\n\nThis has two drawbacks:\n\n1. we re-validate all the match and target entry structure sizes even\nthough compat translation is supposed to never generate bogus offsets.\n2. we put and then re-lookup each match and target.\n\nTHe upside is that we get all sanity tests and ruleset validations\nprovided by the normal path and can remove some duplicated compat code.\n\niptables-restore time of autogenerated ruleset with 300k chains of form\n-A CHAIN0001 -m limit --limit 1/s -j CHAIN0002\n-A CHAIN0002 -m limit --limit 1/s -j CHAIN0003\n\nshows no noticeable differences in restore times:\nold: 0m30.796s\nnew: 0m31.521s\n64bit: 0m25.674s\n\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "3a69c0f0487a6eba5fd5005c7902a230c8e31518", "tree": "7f96592580690b701921992cfae713f48af6f366", "parents": [ "0fab6d3d18866bbc4f964696ae31a5456795bb10" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Fri Apr 01 14:17:33 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:23 2016 -0700" }, "message": "netfilter: x_tables: xt_compat_match_from_user doesn\u0027t need a retval\n\ncommit 0188346f21e6546498c2a0f84888797ad4063fc5 upstream.\n\nAlways returned 0.\n\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0fab6d3d18866bbc4f964696ae31a5456795bb10", "tree": "3b7e15b5ace5513e662cb6681816b25cb0e4445e", "parents": [ "77521be687870e2ecae748df7b8fb103dd57dac2" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Fri Apr 01 14:17:31 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:23 2016 -0700" }, "message": "netfilter: ip6_tables: simplify translate_compat_table args\n\ncommit 329a0807124f12fe1c8032f95d8a8eb47047fb0e upstream.\n\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "77521be687870e2ecae748df7b8fb103dd57dac2", "tree": "99af15f6b2eec7b3bad44b2136964e9e22dc394c", "parents": [ "946e8148dba1943e1762833694ec2c476469d1fe" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Fri Apr 01 14:17:30 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:23 2016 -0700" }, "message": "netfilter: ip_tables: simplify translate_compat_table args\n\ncommit 7d3f843eed29222254c9feab481f55175a1afcc9 upstream.\n\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "946e8148dba1943e1762833694ec2c476469d1fe", "tree": "6c31d6ebd94ae162dfb253c9f560638c981db791", "parents": [ "fe1e4026ce9f03653288c743218ed70ee0a2c4e0" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Fri Apr 01 14:17:32 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:23 2016 -0700" }, "message": "netfilter: arp_tables: simplify translate_compat_table args\n\ncommit 8dddd32756f6fe8e4e82a63361119b7e2384e02f upstream.\n\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "fe1e4026ce9f03653288c743218ed70ee0a2c4e0", "tree": "d567fa4757a47fd1cbe1dd81e236204290ac519e", "parents": [ "caa39a1e709c3cf89c0a4d600e98f9863085e3d5" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jun 01 02:04:44 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:23 2016 -0700" }, "message": "netfilter: x_tables: don\u0027t reject valid target size on some architectures\n\ncommit 7b7eba0f3515fca3296b8881d583f7c1042f5226 upstream.\n\nQuoting John Stultz:\n In updating a 32bit arm device from 4.6 to Linus\u0027 current HEAD, I\n noticed I was having some trouble with networking, and realized that\n /proc/net/ip_tables_names was suddenly empty.\n Digging through the registration process, it seems we\u0027re catching on the:\n\n if (strcmp(t-\u003eu.user.name, XT_STANDARD_TARGET) \u003d\u003d 0 \u0026\u0026\n target_offset + sizeof(struct xt_standard_target) !\u003d next_offset)\n return -EINVAL;\n\n Where next_offset seems to be 4 bytes larger then the\n offset + standard_target struct size.\n\nnext_offset needs to be aligned via XT_ALIGN (so we can access all members\nof ip(6)t_entry struct).\n\nThis problem didn\u0027t show up on i686 as it only needs 4-byte alignment for\nu64, but iptables userspace on other 32bit arches does insert extra padding.\n\nReported-by: John Stultz \u003cjohn.stultz@linaro.org\u003e\nTested-by: John Stultz \u003cjohn.stultz@linaro.org\u003e\nFixes: 7ed2abddd20cf (\"netfilter: x_tables: check standard target size too\")\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "caa39a1e709c3cf89c0a4d600e98f9863085e3d5", "tree": "f21ee379a64d8ad12edd80c2b102916d4a1b8b37", "parents": [ "8a865621540c7bc7f03665a2b7029cb444a9593a" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Fri Apr 01 14:17:29 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:23 2016 -0700" }, "message": "netfilter: x_tables: validate all offsets and sizes in a rule\n\ncommit 13631bfc604161a9d69cd68991dff8603edd66f9 upstream.\n\nValidate that all matches (if any) add up to the beginning of\nthe target and that each match covers at least the base structure size.\n\nThe compat path should be able to safely re-use the function\nas the structures only differ in alignment; added a\nBUILD_BUG_ON just in case we have an arch that adds padding as well.\n\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8a865621540c7bc7f03665a2b7029cb444a9593a", "tree": "1ac843fc3e185a7e2328a832b1d929f199205bb3", "parents": [ "2066499780e1455c43833b5b34858124047331ff" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Fri Apr 01 14:17:28 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:23 2016 -0700" }, "message": "netfilter: x_tables: check for bogus target offset\n\ncommit ce683e5f9d045e5d67d1312a42b359cb2ab2a13c upstream.\n\nWe\u0027re currently asserting that targetoff + targetsize \u003c\u003d nextoff.\n\nExtend it to also check that targetoff is \u003e\u003d sizeof(xt_entry).\nSince this is generic code, add an argument pointing to the start of the\nmatch/target, we can then derive the base structure size from the delta.\n\nWe also need the e-\u003eelems pointer in a followup change to validate matches.\n\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2066499780e1455c43833b5b34858124047331ff", "tree": "4298f99bb7866df57ccee616d51a444e006b3db2", "parents": [ "2985d199e713c05eec2eaffeeeac40682aa2e5cc" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Fri Apr 01 14:17:27 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:23 2016 -0700" }, "message": "netfilter: x_tables: check standard target size too\n\ncommit 7ed2abddd20cf8f6bd27f65bd218f26fa5bf7f44 upstream.\n\nWe have targets and standard targets -- the latter carries a verdict.\n\nThe ip/ip6tables validation functions will access t-\u003everdict for the\nstandard targets to fetch the jump offset or verdict for chainloop\ndetection, but this happens before the targets get checked/validated.\n\nThus we also need to check for verdict presence here, else t-\u003everdict\ncan point right after a blob.\n\nSpotted with UBSAN while testing malformed blobs.\n\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2985d199e713c05eec2eaffeeeac40682aa2e5cc", "tree": "81e47e43993e5c76f45e8f444e79f14fdb06815f", "parents": [ "ed30e07de077354993122c5d88e535cbe0a03754" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Fri Apr 01 14:17:26 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:23 2016 -0700" }, "message": "netfilter: x_tables: add compat version of xt_check_entry_offsets\n\ncommit fc1221b3a163d1386d1052184202d5dc50d302d1 upstream.\n\n32bit rulesets have different layout and alignment requirements, so once\nmore integrity checks get added to xt_check_entry_offsets it will reject\nwell-formed 32bit rulesets.\n\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ed30e07de077354993122c5d88e535cbe0a03754", "tree": "e9f41de97c1c4247514fa04d58bf1fdb63971459", "parents": [ "6bc803b795631cb14a6a3ea6d433589c8c666cc3" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Fri Apr 01 14:17:25 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:23 2016 -0700" }, "message": "netfilter: x_tables: assert minimum target size\n\ncommit a08e4e190b866579896c09af59b3bdca821da2cd upstream.\n\nThe target size includes the size of the xt_entry_target struct.\n\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6bc803b795631cb14a6a3ea6d433589c8c666cc3", "tree": "9507d1d10ab788c5b856d0cd26a17e8ecbca14aa", "parents": [ "cfdca13028ff3aa8c5f4b63ba5abf878cd55ced5" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Fri Apr 01 14:17:24 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:22 2016 -0700" }, "message": "netfilter: x_tables: kill check_entry helper\n\ncommit aa412ba225dd3bc36d404c28cdc3d674850d80d0 upstream.\n\nOnce we add more sanity testing to xt_check_entry_offsets it\nbecomes relvant if we\u0027re expecting a 32bit \u0027config_compat\u0027 blob\nor a normal one.\n\nSince we already have a lot of similar-named functions (check_entry,\ncompat_check_entry, find_and_check_entry, etc.) and the current\nincarnation is short just fold its contents into the callers.\n\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "cfdca13028ff3aa8c5f4b63ba5abf878cd55ced5", "tree": "ff22dfeda192e13b037f77b326ae49d27a6c4cd7", "parents": [ "611d408a531fdbecf07e268ac87e37d71dd5cd8e" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Fri Apr 01 14:17:23 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:22 2016 -0700" }, "message": "netfilter: x_tables: add and use xt_check_entry_offsets\n\ncommit 7d35812c3214afa5b37a675113555259cfd67b98 upstream.\n\nCurrently arp/ip and ip6tables each implement a short helper to check that\nthe target offset is large enough to hold one xt_entry_target struct and\nthat t-\u003eu.target_size fits within the current rule.\n\nUnfortunately these checks are not sufficient.\n\nTo avoid adding new tests to all of ip/ip6/arptables move the current\nchecks into a helper, then extend this helper in followup patches.\n\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "611d408a531fdbecf07e268ac87e37d71dd5cd8e", "tree": "4380e451a5953edb0d587ee120e3076ba8b1375b", "parents": [ "d6f7cd1b21b9e797e09269ee16655f9c0e4a3fa1" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Fri Apr 01 14:17:22 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:22 2016 -0700" }, "message": "netfilter: x_tables: validate targets of jumps\n\ncommit 36472341017529e2b12573093cc0f68719300997 upstream.\n\nWhen we see a jump also check that the offset gets us to beginning of\na rule (an ipt_entry).\n\nThe extra overhead is negible, even with absurd cases.\n\n300k custom rules, 300k jumps to \u0027next\u0027 user chain:\n[ plus one jump from INPUT to first userchain ]:\n\nBefore:\nreal 0m24.874s\nuser 0m7.532s\nsys 0m16.076s\n\nAfter:\nreal 0m27.464s\nuser 0m7.436s\nsys 0m18.840s\n\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d6f7cd1b21b9e797e09269ee16655f9c0e4a3fa1", "tree": "060ec85472d2701221784a748886e7e585701863", "parents": [ "0d6ad54b74fd66ca016076900da97e96272ff83e" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Fri Apr 01 14:17:21 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:22 2016 -0700" }, "message": "netfilter: x_tables: don\u0027t move to non-existent next rule\n\ncommit f24e230d257af1ad7476c6e81a8dc3127a74204e upstream.\n\nBen Hawkes says:\n\n In the mark_source_chains function (net/ipv4/netfilter/ip_tables.c) it\n is possible for a user-supplied ipt_entry structure to have a large\n next_offset field. This field is not bounds checked prior to writing a\n counter value at the supplied offset.\n\nBase chains enforce absolute verdict.\n\nUser defined chains are supposed to end with an unconditional return,\nxtables userspace adds them automatically.\n\nBut if such return is missing we will move to non-existent next rule.\n\nReported-by: Ben Hawkes \u003chawkes@google.com\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0d6ad54b74fd66ca016076900da97e96272ff83e", "tree": "1e338ba0381c552e60df447ecbc8a6707cf7452f", "parents": [ "dbea3ce55ad13ddccf519a95ce0d77a5064e9ccc" ], "author": { "name": "Maarten Lankhorst", "email": "maarten.lankhorst@linux.intel.com", "time": "Wed May 04 14:38:26 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:22 2016 -0700" }, "message": "drm/core: Do not preserve framebuffer on rmfb, v4.\n\ncommit f2d580b9a8149735cbc4b59c4a8df60173658140 upstream.\n\nIt turns out that preserving framebuffers after the rmfb call breaks\nvmwgfx userspace. This was originally introduced because it was thought\nnobody relied on the behavior, but unfortunately it seems there are\nexceptions.\n\ndrm_framebuffer_remove may fail with -EINTR now, so a straight revert\nis impossible. There is no way to remove the framebuffer from the lists\nand active planes without introducing a race because of the different\nlocking requirements. Instead call drm_framebuffer_remove from a\nworkqueue, which is unaffected by signals.\n\nChanges since v1:\n- Add comment.\nChanges since v2:\n- Add fastpath for refcount \u003d 1. (danvet)\nChanges since v3:\n- Rebased.\n- Restore lastclose framebuffer removal too.\n\nFixes: 13803132818c (\"drm/core: Preserve the framebuffer after removing it.\")\nTestcase: kms_rmfb_basic\nReferences: https://lists.freedesktop.org/archives/dri-devel/2016-March/102876.html\nCc: Thomas Hellstrom \u003cthellstrom@vmware.com\u003e\nCc: David Herrmann \u003cdh.herrmann@gmail.com\u003e\nReviewed-by: Daniel Vetter \u003cdaniel.vetter@ffwll.ch\u003e\nTested-by: Thomas Hellstrom \u003cthellstrom@vmware.com\u003e #v3\nTested-by: Tvrtko Ursulin \u003ctvrtko.ursulin@intel.com\u003e\nSigned-off-by: Daniel Vetter \u003cdaniel.vetter@ffwll.ch\u003e\nLink: http://patchwork.freedesktop.org/patch/msgid/6c63ca37-0e7e-ac7f-a6d2-c7822e3d611f@linux.intel.com\nSigned-off-by: Hans de Goede \u003chdegoede@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "dbea3ce55ad13ddccf519a95ce0d77a5064e9ccc", "tree": "43080c7a5c28ac3c2a91e031d98a3cf4182cd665", "parents": [ "5ebdccd7685f1c0b451c516f99082642d8d49003" ], "author": { "name": "Tadeusz Struk", "email": "tadeusz.struk@intel.com", "time": "Fri Apr 29 10:43:40 2016 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:22 2016 -0700" }, "message": "crypto: qat - fix adf_ctl_drv.c:undefined reference to adf_init_pf_wq\n\ncommit 6dc5df71ee5c8b44607928bfe27be50314dcf848 upstream.\n\nFix undefined reference issue reported by kbuild test robot.\n\nReported-by: kbuild test robot \u003cfengguang.wu@intel.com\u003e\nSigned-off-by: Tadeusz Struk \u003ctadeusz.struk@intel.com\u003e\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5ebdccd7685f1c0b451c516f99082642d8d49003", "tree": "0fc6b63503c4065a5c5361b71ae697e346895be5", "parents": [ "868fe2536f8741ebf807ed717734e6c321c478e9" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Tue Mar 22 18:02:52 2016 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:22 2016 -0700" }, "message": "netfilter: x_tables: fix unconditional helper\n\ncommit 54d83fc74aa9ec72794373cb47432c5f7fb1a309 upstream.\n\nBen Hawkes says:\n\n In the mark_source_chains function (net/ipv4/netfilter/ip_tables.c) it\n is possible for a user-supplied ipt_entry structure to have a large\n next_offset field. This field is not bounds checked prior to writing a\n counter value at the supplied offset.\n\nProblem is that mark_source_chains should not have been called --\nthe rule doesn\u0027t have a next entry, so its supposed to return\nan absolute verdict of either ACCEPT or DROP.\n\nHowever, the function conditional() doesn\u0027t work as the name implies.\nIt only checks that the rule is using wildcard address matching.\n\nHowever, an unconditional rule must also not be using any matches\n(no -m args).\n\nThe underflow validator only checked the addresses, therefore\npassing the \u0027unconditional absolute verdict\u0027 test, while\nmark_source_chains also tested for presence of matches, and thus\nproceeeded to the next (not-existent) rule.\n\nUnify this so that all the callers have same idea of \u0027unconditional rule\u0027.\n\nReported-by: Ben Hawkes \u003chawkes@google.com\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "868fe2536f8741ebf807ed717734e6c321c478e9", "tree": "490b79094eb4d2c93fd7bdbc292958a190978708", "parents": [ "59ff9f9b38b39afeb167fdc16c52976587b2c45a" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Tue Mar 22 18:02:50 2016 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:22 2016 -0700" }, "message": "netfilter: x_tables: make sure e-\u003enext_offset covers remaining blob size\n\ncommit 6e94e0cfb0887e4013b3b930fa6ab1fe6bb6ba91 upstream.\n\nOtherwise this function may read data beyond the ruleset blob.\n\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "59ff9f9b38b39afeb167fdc16c52976587b2c45a", "tree": "33824afe2dda0c28d3c9481590c91bd61013858b", "parents": [ "ccb85835a159923d7f79fd51cfd614962426ecf2" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Tue Mar 22 18:02:49 2016 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:22 2016 -0700" }, "message": "netfilter: x_tables: validate e-\u003etarget_offset early\n\ncommit bdf533de6968e9686df777dc178486f600c6e617 upstream.\n\nWe should check that e-\u003etarget_offset is sane before\nmark_source_chains gets called since it will fetch the target entry\nfor loop detection.\n\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ccb85835a159923d7f79fd51cfd614962426ecf2", "tree": "967585b9044b926354ddbd68eb8c3aa232adc5ab", "parents": [ "561e4453dd06f56cd8a61ced33964189b3651558" ], "author": { "name": "Ralf Baechle", "email": "ralf@linux-mips.org", "time": "Thu Feb 04 01:24:40 2016 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:22 2016 -0700" }, "message": "MIPS: Fix 64k page support for 32 bit kernels.\n\ncommit d7de413475f443957a0c1d256e405d19b3a2cb22 upstream.\n\nTASK_SIZE was defined as 0x7fff8000UL which for 64k pages is not a\nmultiple of the page size. Somewhere further down the math fails\nsuch that executing an ELF binary fails.\n\nSigned-off-by: Ralf Baechle \u003cralf@linux-mips.org\u003e\nTested-by: Joshua Henderson \u003cjoshua.henderson@microchip.com\u003e\nCc: James Hogan \u003cjames.hogan@imgtec.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "561e4453dd06f56cd8a61ced33964189b3651558", "tree": "438c24f7e92a0441b616ebb814397620ae5af6b9", "parents": [ "1fda90c39d8ef6acbedfd3cd9bd710a5bcc490c3" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat May 28 20:41:12 2016 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:21 2016 -0700" }, "message": "sparc64: Fix return from trap window fill crashes.\n\n[ Upstream commit 7cafc0b8bf130f038b0ec2dcdd6a9de6dc59b65a ]\n\nWe must handle data access exception as well as memory address unaligned\nexceptions from return from trap window fill faults, not just normal\nTLB misses.\n\nOtherwise we can get an OOPS that looks like this:\n\nld-linux.so.2(36808): Kernel bad sw trap 5 [#1]\nCPU: 1 PID: 36808 Comm: ld-linux.so.2 Not tainted 4.6.0 #34\ntask: fff8000303be5c60 ti: fff8000301344000 task.ti: fff8000301344000\nTSTATE: 0000004410001601 TPC: 0000000000a1a784 TNPC: 0000000000a1a788 Y: 00000002 Not tainted\nTPC: \u003cdo_sparc64_fault+0x5c4/0x700\u003e\ng0: fff8000024fc8248 g1: 0000000000db04dc g2: 0000000000000000 g3: 0000000000000001\ng4: fff8000303be5c60 g5: fff800030e672000 g6: fff8000301344000 g7: 0000000000000001\no0: 0000000000b95ee8 o1: 000000000000012b o2: 0000000000000000 o3: 0000000200b9b358\no4: 0000000000000000 o5: fff8000301344040 sp: fff80003013475c1 ret_pc: 0000000000a1a77c\nRPC: \u003cdo_sparc64_fault+0x5bc/0x700\u003e\nl0: 00000000000007ff l1: 0000000000000000 l2: 000000000000005f l3: 0000000000000000\nl4: fff8000301347e98 l5: fff8000024ff3060 l6: 0000000000000000 l7: 0000000000000000\ni0: fff8000301347f60 i1: 0000000000102400 i2: 0000000000000000 i3: 0000000000000000\ni4: 0000000000000000 i5: 0000000000000000 i6: fff80003013476a1 i7: 0000000000404d4c\nI7: \u003cuser_rtt_fill_fixup+0x6c/0x7c\u003e\nCall Trace:\n [0000000000404d4c] user_rtt_fill_fixup+0x6c/0x7c\n\nThe window trap handlers are slightly clever, the trap table entries for them are\ncomposed of two pieces of code. First comes the code that actually performs\nthe window fill or spill trap handling, and then there are three instructions at\nthe end which are for exception processing.\n\nThe userland register window fill handler is:\n\n\tadd\t%sp, STACK_BIAS + 0x00, %g1;\t\t\\\n\tldxa\t[%g1 + %g0] ASI, %l0;\t\t\t\\\n\tmov\t0x08, %g2;\t\t\t\t\\\n\tmov\t0x10, %g3;\t\t\t\t\\\n\tldxa\t[%g1 + %g2] ASI, %l1;\t\t\t\\\n\tmov\t0x18, %g5;\t\t\t\t\\\n\tldxa\t[%g1 + %g3] ASI, %l2;\t\t\t\\\n\tldxa\t[%g1 + %g5] ASI, %l3;\t\t\t\\\n\tadd\t%g1, 0x20, %g1;\t\t\t\t\\\n\tldxa\t[%g1 + %g0] ASI, %l4;\t\t\t\\\n\tldxa\t[%g1 + %g2] ASI, %l5;\t\t\t\\\n\tldxa\t[%g1 + %g3] ASI, %l6;\t\t\t\\\n\tldxa\t[%g1 + %g5] ASI, %l7;\t\t\t\\\n\tadd\t%g1, 0x20, %g1;\t\t\t\t\\\n\tldxa\t[%g1 + %g0] ASI, %i0;\t\t\t\\\n\tldxa\t[%g1 + %g2] ASI, %i1;\t\t\t\\\n\tldxa\t[%g1 + %g3] ASI, %i2;\t\t\t\\\n\tldxa\t[%g1 + %g5] ASI, %i3;\t\t\t\\\n\tadd\t%g1, 0x20, %g1;\t\t\t\t\\\n\tldxa\t[%g1 + %g0] ASI, %i4;\t\t\t\\\n\tldxa\t[%g1 + %g2] ASI, %i5;\t\t\t\\\n\tldxa\t[%g1 + %g3] ASI, %i6;\t\t\t\\\n\tldxa\t[%g1 + %g5] ASI, %i7;\t\t\t\\\n\trestored;\t\t\t\t\t\\\n\tretry; nop; nop; nop; nop;\t\t\t\\\n\tb,a,pt\t%xcc, fill_fixup_dax;\t\t\t\\\n\tb,a,pt\t%xcc, fill_fixup_mna;\t\t\t\\\n\tb,a,pt\t%xcc, fill_fixup;\n\nAnd the way this works is that if any of those memory accesses\ngenerate an exception, the exception handler can revector to one of\nthose final three branch instructions depending upon which kind of\nexception the memory access took. In this way, the fault handler\ndoesn\u0027t have to know if it was a spill or a fill that it\u0027s handling\nthe fault for. It just always branches to the last instruction in\nthe parent trap\u0027s handler.\n\nFor example, for a regular fault, the code goes:\n\nwinfix_trampoline:\n\trdpr\t%tpc, %g3\n\tor\t%g3, 0x7c, %g3\n\twrpr\t%g3, %tnpc\n\tdone\n\nAll window trap handlers are 0x80 aligned, so if we \"or\" 0x7c into the\ntrap time program counter, we\u0027ll get that final instruction in the\ntrap handler.\n\nOn return from trap, we have to pull the register window in but we do\nthis by hand instead of just executing a \"restore\" instruction for\nseveral reasons. The largest being that from Niagara and onward we\nsimply don\u0027t have enough levels in the trap stack to fully resolve all\npossible exception cases of a window fault when we are already at\ntrap level 1 (which we enter to get ready to return from the original\ntrap).\n\nThis is executed inline via the FILL_*_RTRAP handlers. rtrap_64.S\u0027s\ncode branches directly to these to do the window fill by hand if\nnecessary. Now if you look at them, we\u0027ll see at the end:\n\n\t ba,a,pt %xcc, user_rtt_fill_fixup;\n\t ba,a,pt %xcc, user_rtt_fill_fixup;\n\t ba,a,pt %xcc, user_rtt_fill_fixup;\n\nAnd oops, all three cases are handled like a fault.\n\nThis doesn\u0027t work because each of these trap types (data access\nexception, memory address unaligned, and faults) store their auxiliary\ninfo in different registers to pass on to the C handler which does the\nreal work.\n\nSo in the case where the stack was unaligned, the unaligned trap\nhandler sets up the arg registers one way, and then we branched to\nthe fault handler which expects them setup another way.\n\nSo the FAULT_TYPE_* value ends up basically being garbage, and\nrandomly would generate the backtrace seen above.\n\nReported-by: Nick Alcock \u003cnix@esperi.org.uk\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "1fda90c39d8ef6acbedfd3cd9bd710a5bcc490c3", "tree": "8e2e663d6b6ec7e76f8dab12cad7012b6c12be23", "parents": [ "6bb3290ce9662055efcf13dc18c12bb62f6f39dc" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat May 28 21:21:31 2016 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:21 2016 -0700" }, "message": "sparc: Harden signal return frame checks.\n\n[ Upstream commit d11c2a0de2824395656cf8ed15811580c9dd38aa ]\n\nAll signal frames must be at least 16-byte aligned, because that is\nthe alignment we explicitly create when we build signal return stack\nframes.\n\nAll stack pointers must be at least 8-byte aligned.\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "6bb3290ce9662055efcf13dc18c12bb62f6f39dc", "tree": "72a9589262e752446b928c9e1a2f416bc16efa37", "parents": [ "87575e31be28afb08665f412ac269909c5911a33" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed May 25 12:51:20 2016 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:21 2016 -0700" }, "message": "sparc64: Take ctx_alloc_lock properly in hugetlb_setup().\n\n[ Upstream commit 9ea46abe22550e3366ff7cee2f8391b35b12f730 ]\n\nOn cheetahplus chips we take the ctx_alloc_lock in order to\nmodify the TLB lookup parameters for the indexed TLBs, which\nare stored in the context register.\n\nThis is called with interrupts disabled, however ctx_alloc_lock\nis an IRQ safe lock, therefore we must take acquire/release it\nproperly with spin_{lock,unlock}_irq().\n\nReported-by: Meelis Roos \u003cmroos@linux.ee\u003e\nTested-by: Meelis Roos \u003cmroos@linux.ee\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "87575e31be28afb08665f412ac269909c5911a33", "tree": "d97a2d0dafb4879d4ddba4b63fa7288bbef5c8e2", "parents": [ "ccd02310db44df820d1e8c54a97daf596dea1c9e" ], "author": { "name": "Nitin Gupta", "email": "nitin.m.gupta@oracle.com", "time": "Wed Mar 30 11:17:13 2016 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:21 2016 -0700" }, "message": "sparc64: Reduce TLB flushes during hugepte changes\n\n[ Upstream commit 24e49ee3d76b70853a96520e46b8837e5eae65b2 ]\n\nDuring hugepage map/unmap, TSB and TLB flushes are currently\nissued at every PAGE_SIZE\u0027d boundary which is unnecessary.\nWe now issue the flush at REAL_HPAGE_SIZE boundaries only.\n\nWithout this patch workloads which unmap a large hugepage\nbacked VMA region get CPU lockups due to excessive TLB\nflush calls.\n\nOrabug: 22365539, 22643230, 22995196\n\nSigned-off-by: Nitin Gupta \u003cnitin.m.gupta@oracle.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ccd02310db44df820d1e8c54a97daf596dea1c9e", "tree": "9f3a9ad75f33d2cee30e2545e5ecb5b30a5a937d", "parents": [ "b1206090828584bcb1caf4c850d175f297eb7bc8" ], "author": { "name": "Babu Moger", "email": "babu.moger@oracle.com", "time": "Thu Mar 24 13:02:22 2016 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:21 2016 -0700" }, "message": "sparc/PCI: Fix for panic while enabling SR-IOV\n\n[ Upstream commit d0c31e02005764dae0aab130a57e9794d06b824d ]\n\nWe noticed this panic while enabling SR-IOV in sparc.\n\nmlx4_core: Mellanox ConnectX core driver v2.2-1 (Jan 1 2015)\nmlx4_core: Initializing 0007:01:00.0\nmlx4_core 0007:01:00.0: Enabling SR-IOV with 5 VFs\nmlx4_core: Initializing 0007:01:00.1\nUnable to handle kernel NULL pointer dereference\ninsmod(10010): Oops [#1]\nCPU: 391 PID: 10010 Comm: insmod Not tainted\n\t\t4.1.12-32.el6uek.kdump2.sparc64 #1\nTPC: \u003cdma_supported+0x20/0x80\u003e\nI7: \u003c__mlx4_init_one+0x324/0x500 [mlx4_core]\u003e\nCall Trace:\n [00000000104c5ea4] __mlx4_init_one+0x324/0x500 [mlx4_core]\n [00000000104c613c] mlx4_init_one+0xbc/0x120 [mlx4_core]\n [0000000000725f14] local_pci_probe+0x34/0xa0\n [0000000000726028] pci_call_probe+0xa8/0xe0\n [0000000000726310] pci_device_probe+0x50/0x80\n [000000000079f700] really_probe+0x140/0x420\n [000000000079fa24] driver_probe_device+0x44/0xa0\n [000000000079fb5c] __device_attach+0x3c/0x60\n [000000000079d85c] bus_for_each_drv+0x5c/0xa0\n [000000000079f588] device_attach+0x88/0xc0\n [000000000071acd0] pci_bus_add_device+0x30/0x80\n [0000000000736090] virtfn_add.clone.1+0x210/0x360\n [00000000007364a4] sriov_enable+0x2c4/0x520\n [000000000073672c] pci_enable_sriov+0x2c/0x40\n [00000000104c2d58] mlx4_enable_sriov+0xf8/0x180 [mlx4_core]\n [00000000104c49ac] mlx4_load_one+0x42c/0xd40 [mlx4_core]\nDisabling lock debugging due to kernel taint\nCaller[00000000104c5ea4]: __mlx4_init_one+0x324/0x500 [mlx4_core]\nCaller[00000000104c613c]: mlx4_init_one+0xbc/0x120 [mlx4_core]\nCaller[0000000000725f14]: local_pci_probe+0x34/0xa0\nCaller[0000000000726028]: pci_call_probe+0xa8/0xe0\nCaller[0000000000726310]: pci_device_probe+0x50/0x80\nCaller[000000000079f700]: really_probe+0x140/0x420\nCaller[000000000079fa24]: driver_probe_device+0x44/0xa0\nCaller[000000000079fb5c]: __device_attach+0x3c/0x60\nCaller[000000000079d85c]: bus_for_each_drv+0x5c/0xa0\nCaller[000000000079f588]: device_attach+0x88/0xc0\nCaller[000000000071acd0]: pci_bus_add_device+0x30/0x80\nCaller[0000000000736090]: virtfn_add.clone.1+0x210/0x360\nCaller[00000000007364a4]: sriov_enable+0x2c4/0x520\nCaller[000000000073672c]: pci_enable_sriov+0x2c/0x40\nCaller[00000000104c2d58]: mlx4_enable_sriov+0xf8/0x180 [mlx4_core]\nCaller[00000000104c49ac]: mlx4_load_one+0x42c/0xd40 [mlx4_core]\nCaller[00000000104c5f90]: __mlx4_init_one+0x410/0x500 [mlx4_core]\nCaller[00000000104c613c]: mlx4_init_one+0xbc/0x120 [mlx4_core]\nCaller[0000000000725f14]: local_pci_probe+0x34/0xa0\nCaller[0000000000726028]: pci_call_probe+0xa8/0xe0\nCaller[0000000000726310]: pci_device_probe+0x50/0x80\nCaller[000000000079f700]: really_probe+0x140/0x420\nCaller[000000000079fa24]: driver_probe_device+0x44/0xa0\nCaller[000000000079fb08]: __driver_attach+0x88/0xa0\nCaller[000000000079d90c]: bus_for_each_dev+0x6c/0xa0\nCaller[000000000079f29c]: driver_attach+0x1c/0x40\nCaller[000000000079e35c]: bus_add_driver+0x17c/0x220\nCaller[00000000007a02d4]: driver_register+0x74/0x120\nCaller[00000000007263fc]: __pci_register_driver+0x3c/0x60\nCaller[00000000104f62bc]: mlx4_init+0x60/0xcc [mlx4_core]\nKernel panic - not syncing: Fatal exception\nPress Stop-A (L1-A) to return to the boot prom\n---[ end Kernel panic - not syncing: Fatal exception\n\nDetails:\nHere is the call sequence\nvirtfn_add-\u003e__mlx4_init_one-\u003edma_set_mask-\u003edma_supported\n\nThe panic happened at line 760(file arch/sparc/kernel/iommu.c)\n\n758 int dma_supported(struct device *dev, u64 device_mask)\n759 {\n760 struct iommu *iommu \u003d dev-\u003earchdata.iommu;\n761 u64 dma_addr_mask \u003d iommu-\u003edma_addr_mask;\n762\n763 if (device_mask \u003e\u003d (1UL \u003c\u003c 32UL))\n764 return 0;\n765\n766 if ((device_mask \u0026 dma_addr_mask) \u003d\u003d dma_addr_mask)\n767 return 1;\n768\n769 #ifdef CONFIG_PCI\n770 if (dev_is_pci(dev))\n771\t\treturn pci64_dma_supported(to_pci_dev(dev), device_mask);\n772 #endif\n773\n774 return 0;\n775 }\n776 EXPORT_SYMBOL(dma_supported);\n\nSame panic happened with Intel ixgbe driver also.\n\nSR-IOV code looks for arch specific data while enabling\nVFs. When VF device is added, driver probe function makes set\nof calls to initialize the pci device. Because the VF device is\nadded different way than the normal PF device(which happens via\nof_create_pci_dev for sparc), some of the arch specific initialization\ndoes not happen for VF device. That causes panic when archdata is\naccessed.\n\nTo fix this, I have used already defined weak function\npcibios_setup_device to copy archdata from PF to VF.\nAlso verified the fix.\n\nSigned-off-by: Babu Moger \u003cbabu.moger@oracle.com\u003e\nSigned-off-by: Sowmini Varadhan \u003csowmini.varadhan@oracle.com\u003e\nReviewed-by: Ethan Zhao \u003cethan.zhao@oracle.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b1206090828584bcb1caf4c850d175f297eb7bc8", "tree": "ef020f07083c2d36defe0700254749f879141467", "parents": [ "4185bd68ef40b275669efec624c0d792cd7a2acf" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Mar 01 00:25:32 2016 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:21 2016 -0700" }, "message": "sparc64: Fix sparc64_set_context stack handling.\n\n[ Upstream commit 397d1533b6cce0ccb5379542e2e6d079f6936c46 ]\n\nLike a signal return, we should use synchronize_user_stack() rather\nthan flush_user_windows().\n\nReported-by: Ilya Malakhov \u003cilmalakhovthefirst@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4185bd68ef40b275669efec624c0d792cd7a2acf", "tree": "c9ee8bda2729dbe2dfe0abea515980f7cb043f6e", "parents": [ "e9c74337a7c03d33f2afd5bb341cc20ad209698c" ], "author": { "name": "Nitin Gupta", "email": "nitin.m.gupta@oracle.com", "time": "Tue Jan 05 22:35:35 2016 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:21 2016 -0700" }, "message": "sparc64: Fix numa node distance initialization\n\n[ Upstream commit 36beca6571c941b28b0798667608239731f9bc3a ]\n\nOrabug: 22495713\n\nCurrently, NUMA node distance matrix is initialized only\nwhen a machine descriptor (MD) exists. However, sun4u\nmachines (e.g. Sun Blade 2500) do not have an MD and thus\ndistance values were left uninitialized. The initialization\nis now moved such that it happens on both sun4u and sun4v.\n\nSigned-off-by: Nitin Gupta \u003cnitin.m.gupta@oracle.com\u003e\nTested-by: Mikael Pettersson \u003cmikpelinux@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "e9c74337a7c03d33f2afd5bb341cc20ad209698c", "tree": "0db0ec26bff0dbf228b0c0e1d07568277701dcc5", "parents": [ "c9bc125c922e855055cd08b2ec064180218be161" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Apr 27 17:27:37 2016 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:21 2016 -0700" }, "message": "sparc64: Fix bootup regressions on some Kconfig combinations.\n\n[ Upstream commit 49fa5230462f9f2c4e97c81356473a6bdf06c422 ]\n\nThe system call tracing bug fix mentioned in the Fixes tag\nbelow increased the amount of assembler code in the sequence\nof assembler files included by head_64.S\n\nThis caused to total set of code to exceed 0x4000 bytes in\nsize, which overflows the expression in head_64.S that works\nto place swapper_tsb at address 0x408000.\n\nWhen this is violated, the TSB is not properly aligned, and\nalso the trap table is not aligned properly either. All of\nthis together results in failed boots.\n\nSo, do two things:\n\n1) Simplify some code by using ba,a instead of ba/nop to get\n those bytes back.\n\n2) Add a linker script assertion to make sure that if this\n happens again the build will fail.\n\nFixes: 1a40b95374f6 (\"sparc: Fix system call tracing register handling.\")\nReported-by: Meelis Roos \u003cmroos@linux.ee\u003e\nReported-by: Joerg Abraham \u003cjoerg.abraham@nokia.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "c9bc125c922e855055cd08b2ec064180218be161", "tree": "d0755f0f542490a949a868a5207275641603c310", "parents": [ "2b11d80e1aa70b56c6431e4dc3c686ffc61a73bf" ], "author": { "name": "Mike Frysinger", "email": "vapier@gentoo.org", "time": "Mon Jan 18 06:32:30 2016 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:21 2016 -0700" }, "message": "sparc: Fix system call tracing register handling.\n\n[ Upstream commit 1a40b95374f680625318ab61d81958e949e0afe3 ]\n\nA system call trace trigger on entry allows the tracing\nprocess to inspect and potentially change the traced\nprocess\u0027s registers.\n\nAccount for that by reloading the %g1 (syscall number)\nand %i0-%i5 (syscall argument) values. We need to be\ncareful to revalidate the range of %g1, and reload the\nsystem call table entry it corresponds to into %l7.\n\nReported-by: Mike Frysinger \u003cvapier@gentoo.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nTested-by: Mike Frysinger \u003cvapier@gentoo.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "2b11d80e1aa70b56c6431e4dc3c686ffc61a73bf", "tree": "2a0c3d92db21ff8416b84648d495d26f81ea0c2f", "parents": [ "c08b1a593a042ae01e788ec5504bee2cfc83e1f2" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Jun 07 21:26:55 2016 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:21 2016 -0700" }, "message": "fix d_walk()/non-delayed __d_free() race\n\ncommit 3d56c25e3bb0726a5c5e16fc2d9e38f8ed763085 upstream.\n\nAscend-to-parent logics in d_walk() depends on all encountered child\ndentries not getting freed without an RCU delay. Unfortunately, in\nquite a few cases it is not true, with hard-to-hit oopsable race as\nthe result.\n\nFortunately, the fix is simiple; right now the rule is \"if it ever\nbeen hashed, freeing must be delayed\" and changing it to \"if it\never had a parent, freeing must be delayed\" closes that hole and\ncovers all cases the old rule used to cover. Moreover, pipes and\nsockets remain _not_ covered, so we do not introduce RCU delay in\nthe cases which are the reason for having that delay conditional\nin the first place.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c08b1a593a042ae01e788ec5504bee2cfc83e1f2", "tree": "3e175f87b549fa0f2487002fafca71c3eca74003", "parents": [ "9beb96b344c846779f67d1be1cdafc66562b94ec" ], "author": { "name": "Jann Horn", "email": "jannh@google.com", "time": "Wed Jun 01 11:55:07 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:20 2016 -0700" }, "message": "sched: panic on corrupted stack end\n\ncommit 29d6455178a09e1dc340380c582b13356227e8df upstream.\n\nUntil now, hitting this BUG_ON caused a recursive oops (because oops\nhandling involves do_exit(), which calls into the scheduler, which in\nturn raises an oops), which caused stuff below the stack to be\noverwritten until a panic happened (e.g. via an oops in interrupt\ncontext, caused by the overwritten CPU index in the thread_info).\n\nJust panic directly.\n\nSigned-off-by: Jann Horn \u003cjannh@google.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9beb96b344c846779f67d1be1cdafc66562b94ec", "tree": "34de9f551916b9439f3044e1f91f40aa2ee9db77", "parents": [ "035a94d8d1acdb829575a987222a6d5c45e8a5f2" ], "author": { "name": "Jann Horn", "email": "jannh@google.com", "time": "Wed Jun 01 11:55:05 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:20 2016 -0700" }, "message": "proc: prevent stacking filesystems on top\n\ncommit e54ad7f1ee263ffa5a2de9c609d58dfa27b21cd9 upstream.\n\nThis prevents stacking filesystems (ecryptfs and overlayfs) from using\nprocfs as lower filesystem. There is too much magic going on inside\nprocfs, and there is no good reason to stack stuff on top of procfs.\n\n(For example, procfs does access checks in VFS open handlers, and\necryptfs by design calls open handlers from a kernel thread that doesn\u0027t\ndrop privileges or so.)\n\nSigned-off-by: Jann Horn \u003cjannh@google.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "035a94d8d1acdb829575a987222a6d5c45e8a5f2", "tree": "579e4ba2b30b5daa859ac82f435faab75150dd6a", "parents": [ "47648b5862145187fc8273de0b5330bb9968feb3" ], "author": { "name": "Andy Lutomirski", "email": "luto@kernel.org", "time": "Tue May 24 15:54:04 2016 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:20 2016 -0700" }, "message": "x86/entry/traps: Don\u0027t force in_interrupt() to return true in IST handlers\n\ncommit aaee8c3c5cce2d9107310dd9f3026b4f901d441c upstream.\n\nForcing in_interrupt() to return true if we\u0027re not in a bona fide\ninterrupt confuses the softirq code. This fixes warnings like:\n\n NOHZ: local_softirq_pending 282\n\n... which can happen when running things like selftests/x86.\n\nThis will change perf\u0027s static percpu buffer usage in IST context.\nI think this is okay, and it\u0027s changing the behavior to match\nhistorical (pre-4.0) behavior.\n\nSigned-off-by: Andy Lutomirski \u003cluto@kernel.org\u003e\nCc: Andy Lutomirski \u003cluto@amacapital.net\u003e\nCc: Borislav Petkov \u003cbp@alien8.de\u003e\nCc: Brian Gerst \u003cbrgerst@gmail.com\u003e\nCc: Denys Vlasenko \u003cdvlasenk@redhat.com\u003e\nCc: H. Peter Anvin \u003chpa@zytor.com\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nFixes: 959274753857 (\"x86, traps: Track entry into and exit from IST context\")\nLink: http://lkml.kernel.org/r/cdc215f94d118d691d73df35275022331156fb45.1464130360.git.luto@kernel.org\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "47648b5862145187fc8273de0b5330bb9968feb3", "tree": "9c10a71d51f1c4c784cb74edfdf95b5bc516557b", "parents": [ "dea2cf7c0c6e42ccb1eea2baba028163597bcf22" ], "author": { "name": "Prasun Maiti", "email": "prasunmaiti87@gmail.com", "time": "Mon Jun 06 20:04:19 2016 +0530" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:20 2016 -0700" }, "message": "wext: Fix 32 bit iwpriv compatibility issue with 64 bit Kernel\n\ncommit 3d5fdff46c4b2b9534fa2f9fc78e90a48e0ff724 upstream.\n\niwpriv app uses iw_point structure to send data to Kernel. The iw_point\nstructure holds a pointer. For compatibility Kernel converts the pointer\nas required for WEXT IOCTLs (SIOCIWFIRST to SIOCIWLAST). Some drivers\nmay use iw_handler_def.private_args to populate iwpriv commands instead\nof iw_handler_def.private. For those case, the IOCTLs from\nSIOCIWFIRSTPRIV to SIOCIWLASTPRIV will follow the path ndo_do_ioctl().\nAccordingly when the filled up iw_point structure comes from 32 bit\niwpriv to 64 bit Kernel, Kernel will not convert the pointer and sends\nit to driver. So, the driver may get the invalid data.\n\nThe pointer conversion for the IOCTLs (SIOCIWFIRSTPRIV to\nSIOCIWLASTPRIV), which follow the path ndo_do_ioctl(), is mandatory.\nThis patch adds pointer conversion from 32 bit to 64 bit and vice versa,\nif the ioctl comes from 32 bit iwpriv to 64 bit Kernel.\n\nSigned-off-by: Prasun Maiti \u003cprasunmaiti87@gmail.com\u003e\nSigned-off-by: Ujjal Roy \u003croyujjal@gmail.com\u003e\nTested-by: Dibyajyoti Ghosh \u003cdibyajyotig@gmail.com\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "dea2cf7c0c6e42ccb1eea2baba028163597bcf22", "tree": "3c8a6beccef08e03dfd271fdaf394e2e4c68f4e5", "parents": [ "d3f97524ef1b2b12df6669a701e66c02f1da523d" ], "author": { "name": "Jann Horn", "email": "jannh@google.com", "time": "Wed Jun 01 11:55:06 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:20 2016 -0700" }, "message": "ecryptfs: forbid opening files without mmap handler\n\ncommit 2f36db71009304b3f0b95afacd8eba1f9f046b87 upstream.\n\nThis prevents users from triggering a stack overflow through a recursive\ninvocation of pagefault handling that involves mapping procfs files into\nvirtual memory.\n\nSigned-off-by: Jann Horn \u003cjannh@google.com\u003e\nAcked-by: Tyler Hicks \u003ctyhicks@canonical.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d3f97524ef1b2b12df6669a701e66c02f1da523d", "tree": "c443528307241d5f64314ee5eecd83167521e86e", "parents": [ "1125f3b09513831b6863a1ed78fb0d1750105bfc" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Jun 03 14:55:44 2016 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:20 2016 -0700" }, "message": "memcg: add RCU locking around css_for_each_descendant_pre() in memcg_offline_kmem()\n\ncommit 3a06bb78ceeceacc86a1e31133a7944013f9775b upstream.\n\nmemcg_offline_kmem() may be called from memcg_free_kmem() after a css\ninit failure. memcg_free_kmem() is a -\u003ecss_free callback which is\ncalled without cgroup_mutex and memcg_offline_kmem() ends up using\ncss_for_each_descendant_pre() without any locking. Fix it by adding rcu\nread locking around it.\n\n mkdir: cannot create directory `65530\u0027: No space left on device\n \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n [ INFO: suspicious RCU usage. ]\n 4.6.0-work+ #321 Not tainted\n -------------------------------\n kernel/cgroup.c:4008 cgroup_mutex or RCU read lock required!\n [ 527.243970] other info that might help us debug this:\n [ 527.244715]\n rcu_scheduler_active \u003d 1, debug_locks \u003d 0\n 2 locks held by kworker/0:5/1664:\n #0: (\"cgroup_destroy\"){.+.+..}, at: [\u003cffffffff81060ab5\u003e] process_one_work+0x165/0x4a0\n #1: ((\u0026css-\u003edestroy_work)#3){+.+...}, at: [\u003cffffffff81060ab5\u003e] process_one_work+0x165/0x4a0\n [ 527.248098] stack backtrace:\n CPU: 0 PID: 1664 Comm: kworker/0:5 Not tainted 4.6.0-work+ #321\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.1-1.fc24 04/01/2014\n Workqueue: cgroup_destroy css_free_work_fn\n Call Trace:\n dump_stack+0x68/0xa1\n lockdep_rcu_suspicious+0xd7/0x110\n css_next_descendant_pre+0x7d/0xb0\n memcg_offline_kmem.part.44+0x4a/0xc0\n mem_cgroup_css_free+0x1ec/0x200\n css_free_work_fn+0x49/0x5e0\n process_one_work+0x1c5/0x4a0\n worker_thread+0x49/0x490\n kthread+0xea/0x100\n ret_from_fork+0x1f/0x40\n\nLink: http://lkml.kernel.org/r/20160526203018.GG23194@mtj.duckdns.org\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nAcked-by: Vladimir Davydov \u003cvdavydov@virtuozzo.com\u003e\nAcked-by: Johannes Weiner \u003channes@cmpxchg.org\u003e\nCc: Michal Hocko \u003cmhocko@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1125f3b09513831b6863a1ed78fb0d1750105bfc", "tree": "0c4cc85c3e38a170ebcae61f2cbabdcb4e220d71", "parents": [ "b5ff1d6012726f539723c24712bb71976ee2bc77" ], "author": { "name": "Helge Deller", "email": "deller@gmx.de", "time": "Sat Jun 04 17:21:33 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:20 2016 -0700" }, "message": "parisc: Fix pagefault crash in unaligned __get_user() call\n\ncommit 8b78f260887df532da529f225c49195d18fef36b upstream.\n\nOne of the debian buildd servers had this crash in the syslog without\nany other information:\n\n Unaligned handler failed, ret \u003d -2\n clock_adjtime (pid 22578): Unaligned data reference (code 28)\n CPU: 1 PID: 22578 Comm: clock_adjtime Tainted: G E 4.5.0-2-parisc64-smp #1 Debian 4.5.4-1\n task: 000000007d9960f8 ti: 00000001bde7c000 task.ti: 00000001bde7c000\n\n YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI\n PSW: 00001000000001001111100000001111 Tainted: G E\n r00-03 000000ff0804f80f 00000001bde7c2b0 00000000402d2be8 00000001bde7c2b0\n r04-07 00000000409e1fd0 00000000fa6f7fff 00000001bde7c148 00000000fa6f7fff\n r08-11 0000000000000000 00000000ffffffff 00000000fac9bb7b 000000000002b4d4\n r12-15 000000000015241c 000000000015242c 000000000000002d 00000000fac9bb7b\n r16-19 0000000000028800 0000000000000001 0000000000000070 00000001bde7c218\n r20-23 0000000000000000 00000001bde7c210 0000000000000002 0000000000000000\n r24-27 0000000000000000 0000000000000000 00000001bde7c148 00000000409e1fd0\n r28-31 0000000000000001 00000001bde7c320 00000001bde7c350 00000001bde7c218\n sr00-03 0000000001200000 0000000001200000 0000000000000000 0000000001200000\n sr04-07 0000000000000000 0000000000000000 0000000000000000 0000000000000000\n\n IASQ: 0000000000000000 0000000000000000 IAOQ: 00000000402d2e84 00000000402d2e88\n IIR: 0ca0d089 ISR: 0000000001200000 IOR: 00000000fa6f7fff\n CPU: 1 CR30: 00000001bde7c000 CR31: ffffffffffffffff\n ORIG_R28: 00000002369fe628\n IAOQ[0]: compat_get_timex+0x2dc/0x3c0\n IAOQ[1]: compat_get_timex+0x2e0/0x3c0\n RP(r2): compat_get_timex+0x40/0x3c0\n Backtrace:\n [\u003c00000000402d4608\u003e] compat_SyS_clock_adjtime+0x40/0xc0\n [\u003c0000000040205024\u003e] syscall_exit+0x0/0x14\n\nThis means the userspace program clock_adjtime called the clock_adjtime()\nsyscall and then crashed inside the compat_get_timex() function.\nSyscalls should never crash programs, but instead return EFAULT.\n\nThe IIR register contains the executed instruction, which disassebles\ninto \"ldw 0(sr3,r5),r9\".\nThis load-word instruction is part of __get_user() which tried to read the word\nat %r5/IOR (0xfa6f7fff). This means the unaligned handler jumped in. The\nunaligned handler is able to emulate all ldw instructions, but it fails if it\nfails to read the source e.g. because of page fault.\n\nThe following program reproduces the problem:\n\n#define _GNU_SOURCE\n#include \u003cunistd.h\u003e\n#include \u003csys/syscall.h\u003e\n#include \u003csys/mman.h\u003e\n\nint main(void) {\n /* allocate 8k */\n char *ptr \u003d mmap(NULL, 2*4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);\n /* free second half (upper 4k) and make it invalid. */\n munmap(ptr+4096, 4096);\n /* syscall where first int is unaligned and clobbers into invalid memory region */\n /* syscall should return EFAULT */\n return syscall(__NR_clock_adjtime, 0, ptr+4095);\n}\n\nTo fix this issue we simply need to check if the faulting instruction address\nis in the exception fixup table when the unaligned handler failed. If it\nis, call the fixup routine instead of crashing.\n\nWhile looking at the unaligned handler I found another issue as well: The\ntarget register should not be modified if the handler was unsuccessful.\n\nSigned-off-by: Helge Deller \u003cdeller@gmx.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b5ff1d6012726f539723c24712bb71976ee2bc77", "tree": "4f62677a816da57cc2ca5586046afff76a39314b", "parents": [ "a976f62a601a763ea37d116d5a9009a2eec9d0f3" ], "author": { "name": "hongkun.cao", "email": "hongkun.cao@mediatek.com", "time": "Sat May 21 15:23:39 2016 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:20 2016 -0700" }, "message": "pinctrl: mediatek: fix dual-edge code defect\n\ncommit 5edf673d07fdcb6498be24914f3f38f8d8843199 upstream.\n\nWhen a dual-edge irq is triggered, an incorrect irq will be reported on\ncondition that the external signal is not stable and this incorrect irq\nhas been registered.\nCorrect the register offset.\n\nSigned-off-by: Hongkun Cao \u003chongkun.cao@mediatek.com\u003e\nReviewed-by: Matthias Brugger \u003cmatthias.bgg@gmail.com\u003e\nSigned-off-by: Linus Walleij \u003clinus.walleij@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a976f62a601a763ea37d116d5a9009a2eec9d0f3", "tree": "5d49a7535bf95129360f1d5ba011c613db9699d6", "parents": [ "cac2863ff3e64221f8888da9fcf72080181e91a8" ], "author": { "name": "Thomas Huth", "email": "thuth@redhat.com", "time": "Tue May 31 07:51:17 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:20 2016 -0700" }, "message": "powerpc/pseries: Add POWER8NVL support to ibm,client-architecture-support call\n\ncommit 7cc851039d643a2ee7df4d18177150f2c3a484f5 upstream.\n\nIf we do not provide the PVR for POWER8NVL, a guest on this system\ncurrently ends up in PowerISA 2.06 compatibility mode on KVM, since QEMU\ndoes not provide a generic PowerISA 2.07 mode yet. So some new\ninstructions from POWER8 (like \"mtvsrd\") get disabled for the guest,\nresulting in crashes when using code compiled explicitly for\nPOWER8 (e.g. with the \"-mcpu\u003dpower8\" option of GCC).\n\nFixes: ddee09c099c3 (\"powerpc: Add PVR for POWER8NVL processor\")\nSigned-off-by: Thomas Huth \u003cthuth@redhat.com\u003e\nSigned-off-by: Michael Ellerman \u003cmpe@ellerman.id.au\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "cac2863ff3e64221f8888da9fcf72080181e91a8", "tree": "0742a599d2bcea9ccd9fdf284bec5c5ee06687df", "parents": [ "4f27ca0e25df7b317983a1c8a1febecbeae81813" ], "author": { "name": "Thomas Huth", "email": "thuth@redhat.com", "time": "Thu May 12 13:29:11 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:20 2016 -0700" }, "message": "powerpc: Use privileged SPR number for MMCR2\n\ncommit 8dd75ccb571f3c92c48014b3dabd3d51a115ab41 upstream.\n\nWe are already using the privileged versions of MMCR0, MMCR1\nand MMCRA in the kernel, so for MMCR2, we should better use\nthe privileged versions, too, to be consistent.\n\nFixes: 240686c13687 (\"powerpc: Initialise PMU related regs on Power8\")\nSuggested-by: Paul Mackerras \u003cpaulus@ozlabs.org\u003e\nSigned-off-by: Thomas Huth \u003cthuth@redhat.com\u003e\nAcked-by: Paul Mackerras \u003cpaulus@ozlabs.org\u003e\nSigned-off-by: Michael Ellerman \u003cmpe@ellerman.id.au\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "4f27ca0e25df7b317983a1c8a1febecbeae81813", "tree": "463c1ba3c2d7d1cc3a055a9f537fb61fc91579b5", "parents": [ "baa6dfd627b460f73a8b79fd4cf87ea31e690e36" ], "author": { "name": "Thomas Huth", "email": "thuth@redhat.com", "time": "Thu May 12 13:26:44 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:19 2016 -0700" }, "message": "powerpc: Fix definition of SIAR and SDAR registers\n\ncommit d23fac2b27d94aeb7b65536a50d32bfdc21fe01e upstream.\n\nThe SIAR and SDAR registers are available twice, one time as SPRs\n780 / 781 (unprivileged, but read-only), and one time as the SPRs\n796 / 797 (privileged, but read and write). The Linux kernel code\ncurrently uses the unprivileged SPRs - while this is OK for reading,\nwriting to that register of course does not work.\nSince the KVM code tries to write to this register, too (see the mtspr\nin book3s_hv_rmhandlers.S), the contents of this register sometimes get\nlost for the guests, e.g. during migration of a VM.\nTo fix this issue, simply switch to the privileged SPR numbers instead.\n\nSigned-off-by: Thomas Huth \u003cthuth@redhat.com\u003e\nAcked-by: Paul Mackerras \u003cpaulus@ozlabs.org\u003e\nSigned-off-by: Michael Ellerman \u003cmpe@ellerman.id.au\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "baa6dfd627b460f73a8b79fd4cf87ea31e690e36", "tree": "d8f6e24d888e692e1fbe0d4b3e8b3383b2a390c5", "parents": [ "5e8b53a4db947494f1d808469a411f7f2f8bb3ca" ], "author": { "name": "Russell Currey", "email": "ruscur@russell.cc", "time": "Thu Apr 07 16:28:26 2016 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:19 2016 -0700" }, "message": "powerpc/pseries/eeh: Handle RTAS delay requests in configure_bridge\n\ncommit 871e178e0f2c4fa788f694721a10b4758d494ce1 upstream.\n\nIn the \"ibm,configure-pe\" and \"ibm,configure-bridge\" RTAS calls, the\nspec states that values of 9900-9905 can be returned, indicating that\nsoftware should delay for 10^x (where x is the last digit, i.e. 990x)\nmilliseconds and attempt the call again. Currently, the kernel doesn\u0027t\nknow about this, and respecting it fixes some PCI failures when the\nhypervisor is busy.\n\nThe delay is capped at 0.2 seconds.\n\nSigned-off-by: Russell Currey \u003cruscur@russell.cc\u003e\nAcked-by: Gavin Shan \u003cgwshan@linux.vnet.ibm.com\u003e\nSigned-off-by: Michael Ellerman \u003cmpe@ellerman.id.au\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5e8b53a4db947494f1d808469a411f7f2f8bb3ca", "tree": "f8e22db5c604427f82b297436049276204a715ab", "parents": [ "d0bc1f47b8a7eee50b10035c645f6e6d7e719a62" ], "author": { "name": "Will Deacon", "email": "will.deacon@arm.com", "time": "Tue Jun 07 17:55:15 2016 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:19 2016 -0700" }, "message": "arm64: mm: always take dirty state from new pte in ptep_set_access_flags\n\ncommit 0106d456c4cb1770253fefc0ab23c9ca760b43f7 upstream.\n\nCommit 66dbd6e61a52 (\"arm64: Implement ptep_set_access_flags() for\nhardware AF/DBM\") ensured that pte flags are updated atomically in the\nface of potential concurrent, hardware-assisted updates. However, Alex\nreports that:\n\n | This patch breaks swapping for me.\n | In the broken case, you\u0027ll see either systemd cpu time spike (because\n | it\u0027s stuck in a page fault loop) or the system hang (because the\n | application owning the screen is stuck in a page fault loop).\n\nIt turns out that this is because the \u0027dirty\u0027 argument to\nptep_set_access_flags is always 0 for read faults, and so we can\u0027t use\nit to set PTE_RDONLY. The failing sequence is:\n\n 1. We put down a PTE_WRITE | PTE_DIRTY | PTE_AF pte\n 2. Memory pressure -\u003e pte_mkold(pte) -\u003e clear PTE_AF\n 3. A read faults due to the missing access flag\n 4. ptep_set_access_flags is called with dirty \u003d 0, due to the read fault\n 5. pte is then made PTE_WRITE | PTE_DIRTY | PTE_AF | PTE_RDONLY (!)\n 6. A write faults, but pte_write is true so we get stuck\n\nThe solution is to check the new page table entry (as would be done by\nthe generic, non-atomic definition of ptep_set_access_flags that just\ncalls set_pte_at) to establish the dirty state.\n\nFixes: 66dbd6e61a52 (\"arm64: Implement ptep_set_access_flags() for hardware AF/DBM\")\nReviewed-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nReported-by: Alexander Graf \u003cagraf@suse.de\u003e\nTested-by: Alexander Graf \u003cagraf@suse.de\u003e\nSigned-off-by: Will Deacon \u003cwill.deacon@arm.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d0bc1f47b8a7eee50b10035c645f6e6d7e719a62", "tree": "64a07a67720b5f93b81d8d68cb3c4ec1c97adf87", "parents": [ "774920eece6e15f6560ba0ad5a9b25eb43d075fe" ], "author": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Tue May 31 15:55:03 2016 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:19 2016 -0700" }, "message": "arm64: Provide \"model name\" in /proc/cpuinfo for PER_LINUX32 tasks\n\ncommit e47b020a323d1b2a7b1e9aac86e99eae19463630 upstream.\n\nThis patch brings the PER_LINUX32 /proc/cpuinfo format more in line with\nthe 32-bit ARM one by providing an additional line:\n\nmodel name : ARMv8 Processor rev X (v8l)\n\nAcked-by: Will Deacon \u003cwill.deacon@arm.com\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nSigned-off-by: Will Deacon \u003cwill.deacon@arm.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "774920eece6e15f6560ba0ad5a9b25eb43d075fe", "tree": "cf5e16832cce0b789bad8718ff14e81b1f51851f", "parents": [ "b440f3ae617bd81a5699bbba5120c8f54c456f81" ], "author": { "name": "Tom Lendacky", "email": "thomas.lendacky@amd.com", "time": "Fri May 20 17:33:03 2016 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:19 2016 -0700" }, "message": "crypto: ccp - Fix AES XTS error for request sizes above 4096\n\ncommit ab6a11a7c8ef47f996974dd3c648c2c0b1a36ab1 upstream.\n\nThe ccp-crypto module for AES XTS support has a bug that can allow requests\ngreater than 4096 bytes in size to be passed to the CCP hardware. The CCP\nhardware does not support request sizes larger than 4096, resulting in\nincorrect output. The request should actually be handled by the fallback\nmechanism instantiated by the ccp-crypto module.\n\nAdd a check to insure the request size is less than or equal to the maximum\nsupported size and use the fallback mechanism if it is not.\n\nSigned-off-by: Tom Lendacky \u003cthomas.lendacky@amd.com\u003e\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b440f3ae617bd81a5699bbba5120c8f54c456f81", "tree": "d729e63041e95a531979e6ff1f7fd95ff5ba8e28", "parents": [ "f32ef5c8e9e847706a3ef96791e14b207914d9e3" ], "author": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Wed May 18 16:55:56 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:19 2016 -0700" }, "message": "crypto: public_key: select CRYPTO_AKCIPHER\n\ncommit bad6a185b4d6f81d0ed2b6e4c16307969f160b95 upstream.\n\nIn some rare randconfig builds, we can end up with\nASYMMETRIC_PUBLIC_KEY_SUBTYPE enabled but CRYPTO_AKCIPHER disabled,\nwhich fails to link because of the reference to crypto_alloc_akcipher:\n\ncrypto/built-in.o: In function `public_key_verify_signature\u0027:\n:(.text+0x110e4): undefined reference to `crypto_alloc_akcipher\u0027\n\nThis adds a Kconfig \u0027select\u0027 statement to ensure the dependency\nis always there.\n\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f32ef5c8e9e847706a3ef96791e14b207914d9e3", "tree": "2a8e81139884ac5dc2466a1124d50e31fc47ce0d", "parents": [ "9be2fa205c9e1337a68847ae38e791bd6b17cc42" ], "author": { "name": "Marc Zyngier", "email": "marc.zyngier@arm.com", "time": "Thu Jun 02 09:00:28 2016 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:19 2016 -0700" }, "message": "irqchip/gic-v3: Fix ICC_SGI1R_EL1.INTID decoding mask\n\ncommit dd5f1b049dc139876801db3cdd0f20d21fd428cc upstream.\n\nThe INTID mask is wrong, and is made a signed value, which has\nnteresting effects in the KVM emulation. Let\u0027s sanitize it.\n\nSigned-off-by: Marc Zyngier \u003cmarc.zyngier@arm.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9be2fa205c9e1337a68847ae38e791bd6b17cc42", "tree": "1c4e514f398e285466b32d5648a201992ca602c0", "parents": [ "ebf529182a6da5fcbecf0305b19de4e0cba048fb" ], "author": { "name": "Michael Holzheu", "email": "holzheu@linux.vnet.ibm.com", "time": "Thu May 12 18:10:48 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:19 2016 -0700" }, "message": "s390/bpf: reduce maximum program size to 64 KB\n\ncommit 0fa963553a5c28d8f8aabd8878326d3f782045fc upstream.\n\nThe s390 BFP compiler currently uses relative branch instructions\nthat only support jumps up to 64 KB. Examples are \"j\", \"jnz\", \"cgrj\",\netc. Currently the maximum size of s390 BPF programs is set\nto 0x7ffff. If branches over 64 KB are generated the, kernel can\ncrash due to incorrect code.\n\nSo fix this an reduce the maximum size to 64 KB. Programs larger than\nthat will be interpreted.\n\nFixes: ce2b6ad9c185 (\"s390/bpf: increase BPF_SIZE_MAX\")\nSigned-off-by: Michael Holzheu \u003cholzheu@linux.vnet.ibm.com\u003e\nSigned-off-by: Martin Schwidefsky \u003cschwidefsky@de.ibm.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ebf529182a6da5fcbecf0305b19de4e0cba048fb", "tree": "90019b3ab10e3f7f98b6333e31418d75adf789f3", "parents": [ "e1c35534e3684e25053f5caf6e032956894e8b1f" ], "author": { "name": "Michael Holzheu", "email": "holzheu@linux.vnet.ibm.com", "time": "Wed May 11 21:13:13 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:19 2016 -0700" }, "message": "s390/bpf: fix recache skb-\u003edata/hlen for skb_vlan_push/pop\n\ncommit 6edf0aa4f8bbdfbb4d6d786892fa02728d05dc36 upstream.\n\nIn case of usage of skb_vlan_push/pop, in the prologue we store\nthe SKB pointer on the stack and restore it after BPF_JMP_CALL\nto skb_vlan_push/pop.\n\nUnfortunately currently there are two bugs in the code:\n\n 1) The wrong stack slot (offset 170 instead of 176) is used\n 2) The wrong register (W1 instead of B1) is saved\n\nSo fix this and use correct stack slot and register.\n\nFixes: 9db7f2b81880 (\"s390/bpf: recache skb-\u003edata/hlen for skb_vlan_push/pop\")\nSigned-off-by: Michael Holzheu \u003cholzheu@linux.vnet.ibm.com\u003e\nSigned-off-by: Martin Schwidefsky \u003cschwidefsky@de.ibm.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e1c35534e3684e25053f5caf6e032956894e8b1f", "tree": "7e684a0e22fce0915f6966d9ced8d5bc21427821", "parents": [ "9edd6fd1eb92ebd61c84975855335922db632ea5" ], "author": { "name": "Ben Dooks", "email": "ben.dooks@codethink.co.uk", "time": "Tue Jun 07 17:22:17 2016 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:19 2016 -0700" }, "message": "gpio: bcm-kona: fix bcm_kona_gpio_reset() warnings\n\ncommit b66b2a0adf0e48973b582e055758b9907a7eee7c upstream.\n\nThe bcm_kona_gpio_reset() calls bcm_kona_gpio_write_lock_regs()\nwith what looks like the wrong parameter. The write_lock_regs\nfunction takes a pointer to the registers, not the bcm_kona_gpio\nstructure.\n\nFix the warning, and probably bug by changing the function to\npass reg_base instead of kona_gpio, fixing the following warning:\n\ndrivers/gpio/gpio-bcm-kona.c:550:47: warning: incorrect type in argument 1\n (different address spaces)\n expected void [noderef] \u003casn:2\u003e*reg_base\n got struct bcm_kona_gpio *kona_gpio\n warning: incorrect type in argument 1 (different address spaces)\n expected void [noderef] \u003casn:2\u003e*reg_base\n got struct bcm_kona_gpio *kona_gpio\n\nSigned-off-by: Ben Dooks \u003cben.dooks@codethink.co.uk\u003e\nAcked-by: Ray Jui \u003cray.jui@broadcom.com\u003e\nReviewed-by: Markus Mayer \u003cmmayer@broadcom.com\u003e\nSigned-off-by: Linus Walleij \u003clinus.walleij@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9edd6fd1eb92ebd61c84975855335922db632ea5", "tree": "f46adccb9a9c0147d6f93824db28ebbc6b263318", "parents": [ "da7f1c92042c25048a53b0eaf716fc66aaac62a9" ], "author": { "name": "Russell King", "email": "rmk+kernel@armlinux.org.uk", "time": "Mon May 30 23:14:56 2016 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:18 2016 -0700" }, "message": "ARM: fix PTRACE_SETVFPREGS on SMP systems\n\ncommit e2dfb4b880146bfd4b6aa8e138c0205407cebbaf upstream.\n\nPTRACE_SETVFPREGS fails to properly mark the VFP register set to be\nreloaded, because it undoes one of the effects of vfp_flush_hwstate().\n\nSpecifically vfp_flush_hwstate() sets thread-\u003evfpstate.hard.cpu to\nan invalid CPU number, but vfp_set() overwrites this with the original\nCPU number, thereby rendering the hardware state as apparently \"valid\",\neven though the software state is more recent.\n\nFix this by reverting the previous change.\n\nFixes: 8130b9d7b9d8 (\"ARM: 7308/1: vfp: flush thread hwstate before copying ptrace registers\")\nAcked-by: Will Deacon \u003cwill.deacon@arm.com\u003e\nTested-by: Simon Marchi \u003csimon.marchi@ericsson.com\u003e\nSigned-off-by: Russell King \u003crmk+kernel@armlinux.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "da7f1c92042c25048a53b0eaf716fc66aaac62a9", "tree": "98087d7efd4bbb57a81c90b1a16ae8d004ffe74b", "parents": [ "81999107ce6de995fc532d4fed23a5189ce18eac" ], "author": { "name": "Torsten Hilbrich", "email": "torsten.hilbrich@secunet.com", "time": "Tue Jun 07 13:14:21 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:18 2016 -0700" }, "message": "ALSA: hda/realtek: Add T560 docking unit fixup\n\ncommit dab38e43b298501a4e8807b56117c029e2e98383 upstream.\n\nTested with Lenovo Ultradock. Fixes the non-working headphone jack on\nthe docking unit.\n\nSigned-off-by: Torsten Hilbrich \u003ctorsten.hilbrich@secunet.com\u003e\nTested-by: Torsten Hilbrich \u003ctorsten.hilbrich@secunet.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "81999107ce6de995fc532d4fed23a5189ce18eac", "tree": "a45a3f9e5f663bbe985a1fe99b09d5ed200fda00", "parents": [ "c3fd646bb8c4faab68fed0e751d0e4f623b5dbab" ], "author": { "name": "Kailang Yang", "email": "kailang@realtek.com", "time": "Mon May 30 16:44:20 2016 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:18 2016 -0700" }, "message": "ALSA: hda/realtek - Add support for new codecs ALC700/ALC701/ALC703\n\ncommit 6fbae35a3170c3e2b1b9d7b9cc943cbe48771362 upstream.\n\nSupport new codecs for ALC700/ALC701/ALC703.\n\nSigned-off-by: Kailang Yang \u003ckailang@realtek.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c3fd646bb8c4faab68fed0e751d0e4f623b5dbab", "tree": "085fca748049c1be1610a64c3ae8137437d181ff", "parents": [ "1bf80a48ff88552644ede5c953321d667808fa1d" ], "author": { "name": "Kailang Yang", "email": "kailang@realtek.com", "time": "Mon May 30 15:58:28 2016 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:18 2016 -0700" }, "message": "ALSA: hda/realtek - ALC256 speaker noise issue\n\ncommit e69e7e03ed225abf3e1c43545aa3bcb68dc81d5f upstream.\n\nThat is some different register for ALC255 and ALC256.\nALC256 can\u0027t fit with some ALC255 register.\nThis issue is cause from LDO output voltage control.\nThis patch is updated the right LDO register value.\n\nSigned-off-by: Kailang Yang \u003ckailang@realtek.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1bf80a48ff88552644ede5c953321d667808fa1d", "tree": "9bb01ea69cf122ea11f28250a1fc494f685fa535", "parents": [ "1f4b75078c205b34f3fcfd04098d61b77e044e68" ], "author": { "name": "AceLan Kao", "email": "acelan.kao@canonical.com", "time": "Fri Jun 03 14:45:25 2016 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:18 2016 -0700" }, "message": "ALSA: hda - Fix headset mic detection problem for Dell machine\n\ncommit f90d83b301701026b2e4c437a3613f377f63290e upstream.\n\nAdd the pin configuration value of this machine into the pin_quirk\ntable to make DELL1_MIC_NO_PRESENCE apply to this machine.\n\nSigned-off-by: AceLan Kao \u003cacelan.kao@canonical.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1f4b75078c205b34f3fcfd04098d61b77e044e68", "tree": "67fde2edc0e1521af5b5a300f47bac42599d7366", "parents": [ "2cb77b0ad44351869427d6a744bf5791e6a2c100" ], "author": { "name": "Vinod Koul", "email": "vinod.koul@intel.com", "time": "Thu Jun 09 11:32:14 2016 +0530" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:18 2016 -0700" }, "message": "ALSA: hda - Add PCI ID for Kabylake\n\ncommit 35639a0e98391036a4c7f23253c321d6621a8897 upstream.\n\nKabylake shows up as PCI ID 0xa171. And Kabylake-LP as 0x9d71.\nSince these are similar to Skylake add these to SKL_PLUS macro\n\nSigned-off-by: Vinod Koul \u003cvinod.koul@intel.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2cb77b0ad44351869427d6a744bf5791e6a2c100", "tree": "b203c6ea2d7523b825da5b67a9b47f527ddec889", "parents": [ "ded4fc623b3c331b847d23f947f457a020f25683" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Wed Jun 01 14:09:21 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:18 2016 -0700" }, "message": "KVM: irqfd: fix NULL pointer dereference in kvm_irq_map_gsi\n\ncommit c622a3c21ede892e370b56e1ceb9eb28f8bbda6b upstream.\n\nFound by syzkaller:\n\n BUG: unable to handle kernel NULL pointer dereference at 0000000000000120\n IP: [\u003cffffffffa0797202\u003e] kvm_irq_map_gsi+0x12/0x90 [kvm]\n PGD 6f80b067 PUD b6535067 PMD 0\n Oops: 0000 [#1] SMP\n CPU: 3 PID: 4988 Comm: a.out Not tainted 4.4.9-300.fc23.x86_64 #1\n [...]\n Call Trace:\n [\u003cffffffffa0795f62\u003e] irqfd_update+0x32/0xc0 [kvm]\n [\u003cffffffffa0796c7c\u003e] kvm_irqfd+0x3dc/0x5b0 [kvm]\n [\u003cffffffffa07943f4\u003e] kvm_vm_ioctl+0x164/0x6f0 [kvm]\n [\u003cffffffff81241648\u003e] do_vfs_ioctl+0x298/0x480\n [\u003cffffffff812418a9\u003e] SyS_ioctl+0x79/0x90\n [\u003cffffffff817a1062\u003e] tracesys_phase2+0x84/0x89\n Code: b5 71 a7 e0 5b 41 5c 41 5d 5d f3 c3 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 8b 8f 10 2e 00 00 31 c0 48 89 e5 \u003c39\u003e 91 20 01 00 00 76 6a 48 63 d2 48 8b 94 d1 28 01 00 00 48 85\n RIP [\u003cffffffffa0797202\u003e] kvm_irq_map_gsi+0x12/0x90 [kvm]\n RSP \u003cffff8800926cbca8\u003e\n CR2: 0000000000000120\n\nTestcase:\n\n #include \u003cunistd.h\u003e\n #include \u003csys/syscall.h\u003e\n #include \u003cstring.h\u003e\n #include \u003cstdint.h\u003e\n #include \u003clinux/kvm.h\u003e\n #include \u003cfcntl.h\u003e\n #include \u003csys/ioctl.h\u003e\n\n long r[26];\n\n int main()\n {\n memset(r, -1, sizeof(r));\n r[2] \u003d open(\"/dev/kvm\", 0);\n r[3] \u003d ioctl(r[2], KVM_CREATE_VM, 0);\n\n struct kvm_irqfd ifd;\n ifd.fd \u003d syscall(SYS_eventfd2, 5, 0);\n ifd.gsi \u003d 3;\n ifd.flags \u003d 2;\n ifd.resamplefd \u003d ifd.fd;\n r[25] \u003d ioctl(r[3], KVM_IRQFD, \u0026ifd);\n return 0;\n }\n\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\nSigned-off-by: Radim Krčmář \u003crkrcmar@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ded4fc623b3c331b847d23f947f457a020f25683", "tree": "5eccbe210448880913388a8b643587d563df525a", "parents": [ "ce9c0dba5bf3ad4a25a9dc202e36e74d904df61d" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Wed Jun 01 14:09:23 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:18 2016 -0700" }, "message": "KVM: x86: fix OOPS after invalid KVM_SET_DEBUGREGS\n\ncommit d14bdb553f9196169f003058ae1cdabe514470e6 upstream.\n\nMOV to DR6 or DR7 causes a #GP if an attempt is made to write a 1 to\nany of bits 63:32. However, this is not detected at KVM_SET_DEBUGREGS\ntime, and the next KVM_RUN oopses:\n\n general protection fault: 0000 [#1] SMP\n CPU: 2 PID: 14987 Comm: a.out Not tainted 4.4.9-300.fc23.x86_64 #1\n Hardware name: LENOVO 2325F51/2325F51, BIOS G2ET32WW (1.12 ) 05/30/2012\n [...]\n Call Trace:\n [\u003cffffffffa072c93d\u003e] kvm_arch_vcpu_ioctl_run+0x141d/0x14e0 [kvm]\n [\u003cffffffffa071405d\u003e] kvm_vcpu_ioctl+0x33d/0x620 [kvm]\n [\u003cffffffff81241648\u003e] do_vfs_ioctl+0x298/0x480\n [\u003cffffffff812418a9\u003e] SyS_ioctl+0x79/0x90\n [\u003cffffffff817a0f2e\u003e] entry_SYSCALL_64_fastpath+0x12/0x71\n Code: 55 83 ff 07 48 89 e5 77 27 89 ff ff 24 fd 90 87 80 81 0f 23 fe 5d c3 0f 23 c6 5d c3 0f 23 ce 5d c3 0f 23 d6 5d c3 0f 23 de 5d c3 \u003c0f\u003e 23 f6 5d c3 0f 0b 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00\n RIP [\u003cffffffff810639eb\u003e] native_set_debugreg+0x2b/0x40\n RSP \u003cffff88005836bd50\u003e\n\nTestcase (beautified/reduced from syzkaller output):\n\n #include \u003cunistd.h\u003e\n #include \u003csys/syscall.h\u003e\n #include \u003cstring.h\u003e\n #include \u003cstdint.h\u003e\n #include \u003clinux/kvm.h\u003e\n #include \u003cfcntl.h\u003e\n #include \u003csys/ioctl.h\u003e\n\n long r[8];\n\n int main()\n {\n struct kvm_debugregs dr \u003d { 0 };\n\n r[2] \u003d open(\"/dev/kvm\", O_RDONLY);\n r[3] \u003d ioctl(r[2], KVM_CREATE_VM, 0);\n r[4] \u003d ioctl(r[3], KVM_CREATE_VCPU, 7);\n\n memcpy(\u0026dr,\n \"\\x5d\\x6a\\x6b\\xe8\\x57\\x3b\\x4b\\x7e\\xcf\\x0d\\xa1\\x72\"\n \"\\xa3\\x4a\\x29\\x0c\\xfc\\x6d\\x44\\x00\\xa7\\x52\\xc7\\xd8\"\n \"\\x00\\xdb\\x89\\x9d\\x78\\xb5\\x54\\x6b\\x6b\\x13\\x1c\\xe9\"\n \"\\x5e\\xd3\\x0e\\x40\\x6f\\xb4\\x66\\xf7\\x5b\\xe3\\x36\\xcb\",\n 48);\n r[7] \u003d ioctl(r[4], KVM_SET_DEBUGREGS, \u0026dr);\n r[6] \u003d ioctl(r[4], KVM_RUN, 0);\n }\n\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\nSigned-off-by: Radim Krčmář \u003crkrcmar@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ce9c0dba5bf3ad4a25a9dc202e36e74d904df61d", "tree": "14ca25b6aa9083e1a5f8c0477c9679940e00f6bc", "parents": [ "51d7c394605bd5d72e76745def0002dd938ec48b" ], "author": { "name": "David Wragg", "email": "david@weave.works", "time": "Fri Jun 03 18:58:15 2016 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:18 2016 -0700" }, "message": "vxlan, gre, geneve: Set a large MTU on ovs-created tunnel devices\n\n[ Upstream commit 7e059158d57b79159eaf1f504825d19866ef2c42 ]\n\nPrior to 4.3, openvswitch tunnel vports (vxlan, gre and geneve) could\ntransmit vxlan packets of any size, constrained only by the ability to\nsend out the resulting packets. 4.3 introduced netdevs corresponding\nto tunnel vports. These netdevs have an MTU, which limits the size of\na packet that can be successfully encapsulated. The default MTU\nvalues are low (1500 or less), which is awkwardly small in the context\nof physical networks supporting jumbo frames, and leads to a\nconspicuous change in behaviour for userspace.\n\nInstead, set the MTU on openvswitch-created netdevs to be the relevant\nmaximum (i.e. the maximum IP packet size minus any relevant overhead),\neffectively restoring the behaviour prior to 4.3.\n\nSigned-off-by: David Wragg \u003cdavid@weave.works\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "51d7c394605bd5d72e76745def0002dd938ec48b", "tree": "82399e0cff02fc65f8240bb0fdf611b050f1ee64", "parents": [ "3dc443059897b8a2fa3e3b18f794ee31c0063730" ], "author": { "name": "David Wragg", "email": "david@weave.works", "time": "Fri Jun 03 18:58:14 2016 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:18 2016 -0700" }, "message": "geneve: Relax MTU constraints\n\n[ Upstream commit 55e5bfb53cff286c1c1ff49f51325dc15c7fea63 ]\n\nAllow the MTU of geneve devices to be set to large values, in order to\nexploit underlying networks with larger frame sizes.\n\nGENEVE does not have a fixed encapsulation overhead (an openvswitch\nrule can add variable length options), so there is no relevant maximum\nMTU to enforce. A maximum of IP_MAX_MTU is used instead.\nEncapsulated packets that are too big for the underlying network will\nget dropped on the floor.\n\nSigned-off-by: David Wragg \u003cdavid@weave.works\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "3dc443059897b8a2fa3e3b18f794ee31c0063730", "tree": "555907108e23515328ddf7af3102f2d7a0998037", "parents": [ "4d82f395bb0597a3aba23387406e2c07332d6ae9" ], "author": { "name": "David Wragg", "email": "david@weave.works", "time": "Fri Jun 03 18:58:13 2016 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:17 2016 -0700" }, "message": "vxlan: Relax MTU constraints\n\n[ Upstream commit 72564b59ffc438ea103b0727a921aaddce766728 ]\n\nAllow the MTU of vxlan devices without an underlying device to be set\nto larger values (up to a maximum based on IP packet limits and vxlan\noverhead).\n\nPreviously, their MTUs could not be set to higher than the\nconventional ethernet value of 1500. This is a very arbitrary value\nin the context of vxlan, and prevented vxlan devices from being able\nto take advantage of jumbo frames etc.\n\nThe default MTU remains 1500, for compatibility.\n\nSigned-off-by: David Wragg \u003cdavid@weave.works\u003e\nAcked-by: Roopa Prabhu \u003croopa@cumulusnetworks.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4d82f395bb0597a3aba23387406e2c07332d6ae9", "tree": "8e6734a0d0cbf9ca3023eeff3428b7200a6363c1", "parents": [ "05cbd46be7f1aaa355301e2e12c378cbfdeeeb2a" ], "author": { "name": "Jakub Sitnicki", "email": "jkbs@redhat.com", "time": "Wed Jun 08 15:13:34 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:17 2016 -0700" }, "message": "ipv6: Skip XFRM lookup if dst_entry in socket cache is valid\n\n[ Upstream commit 00bc0ef5880dc7b82f9c320dead4afaad48e47be ]\n\nAt present we perform an xfrm_lookup() for each UDPv6 message we\nsend. The lookup involves querying the flow cache (flow_cache_lookup)\nand, in case of a cache miss, creating an XFRM bundle.\n\nIf we miss the flow cache, we can end up creating a new bundle and\nderiving the path MTU (xfrm_init_pmtu) from on an already transformed\ndst_entry, which we pass from the socket cache (sk-\u003esk_dst_cache) down\nto xfrm_lookup(). This can happen only if we\u0027re caching the dst_entry\nin the socket, that is when we\u0027re using a connected UDP socket.\n\nTo put it another way, the path MTU shrinks each time we miss the flow\ncache, which later on leads to incorrectly fragmented payload. It can\nbe observed with ESPv6 in transport mode:\n\n 1) Set up a transformation and lower the MTU to trigger fragmentation\n # ip xfrm policy add dir out src ::1 dst ::1 \\\n tmpl src ::1 dst ::1 proto esp spi 1\n # ip xfrm state add src ::1 dst ::1 \\\n proto esp spi 1 enc \u0027aes\u0027 0x0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b\n # ip link set dev lo mtu 1500\n\n 2) Monitor the packet flow and set up an UDP sink\n # tcpdump -ni lo -ttt \u0026\n # socat udp6-listen:12345,fork /dev/null \u0026\n\n 3) Send a datagram that needs fragmentation with a connected socket\n # perl -e \u0027print \"@\" x 1470 | socat - udp6:[::1]:12345\n 2016/06/07 18:52:52 socat[724] E read(3, 0x555bb3d5ba00, 8192): Protocol error\n 00:00:00.000000 IP6 ::1 \u003e ::1: frag (0|1448) ESP(spi\u003d0x00000001,seq\u003d0x2), length 1448\n 00:00:00.000014 IP6 ::1 \u003e ::1: frag (1448|32)\n 00:00:00.000050 IP6 ::1 \u003e ::1: ESP(spi\u003d0x00000001,seq\u003d0x3), length 1272\n (^ ICMPv6 Parameter Problem)\n 00:00:00.000022 IP6 ::1 \u003e ::1: ESP(spi\u003d0x00000001,seq\u003d0x5), length 136\n\n 4) Compare it to a non-connected socket\n # perl -e \u0027print \"@\" x 1500\u0027 | socat - udp6-sendto:[::1]:12345\n 00:00:40.535488 IP6 ::1 \u003e ::1: frag (0|1448) ESP(spi\u003d0x00000001,seq\u003d0x6), length 1448\n 00:00:00.000010 IP6 ::1 \u003e ::1: frag (1448|64)\n\nWhat happens in step (3) is:\n\n 1) when connecting the socket in __ip6_datagram_connect(), we\n perform an XFRM lookup, miss the flow cache, create an XFRM\n bundle, and cache the destination,\n\n 2) afterwards, when sending the datagram, we perform an XFRM lookup,\n again, miss the flow cache (due to mismatch of flowi6_iif and\n flowi6_oif, which is an issue of its own), and recreate an XFRM\n bundle based on the cached (and already transformed) destination.\n\nTo prevent the recreation of an XFRM bundle, avoid an XFRM lookup\naltogether whenever we already have a destination entry cached in the\nsocket. This prevents the path MTU shrinkage and brings us on par with\nUDPv4.\n\nThe fix also benefits connected PINGv6 sockets, another user of\nip6_sk_dst_lookup_flow(), who also suffer messages being transformed\ntwice.\n\nJoint work with Hannes Frederic Sowa.\n\nReported-by: Jan Tluka \u003cjtluka@redhat.com\u003e\nSigned-off-by: Jakub Sitnicki \u003cjkbs@redhat.com\u003e\nAcked-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "05cbd46be7f1aaa355301e2e12c378cbfdeeeb2a", "tree": "f41ff867c3c682728835787869657dea2d7ec067", "parents": [ "38f56354f4e1cfbaa1f2f10e9acb30f105b70aed" ], "author": { "name": "Guillaume Nault", "email": "g.nault@alphalink.fr", "time": "Wed Jun 08 12:59:17 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:17 2016 -0700" }, "message": "l2tp: fix configuration passed to setup_udp_tunnel_sock()\n\n[ Upstream commit a5c5e2da8551eb69e5d5d09d51d526140b5db9fb ]\n\nUnused fields of udp_cfg must be all zeros. Otherwise\nsetup_udp_tunnel_sock() fills -\u003egro_receive and -\u003egro_complete\ncallbacks with garbage, eventually resulting in panic when used by\nudp_gro_receive().\n\n[ 72.694123] BUG: unable to handle kernel paging request at ffff880033f87d78\n[ 72.695518] IP: [\u003cffff880033f87d78\u003e] 0xffff880033f87d78\n[ 72.696530] PGD 26e2067 PUD 26e3067 PMD 342ed063 PTE 8000000033f87163\n[ 72.696530] Oops: 0011 [#1] SMP KASAN\n[ 72.696530] Modules linked in: l2tp_ppp l2tp_netlink l2tp_core ip6_udp_tunnel udp_tunnel pptp gre pppox ppp_generic slhc crc32c_intel ghash_clmulni_intel jitterentropy_rng sha256_generic hmac drbg ansi_cprng aesni_intel evdev aes_x86_64 ablk_helper cryptd lrw gf128mul glue_helper serio_raw acpi_cpufreq button proc\\\nessor ext4 crc16 jbd2 mbcache virtio_blk virtio_net virtio_pci virtio_ring virtio\n[ 72.696530] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 4.7.0-rc1 #1\n[ 72.696530] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Debian-1.8.2-1 04/01/2014\n[ 72.696530] task: ffff880035b59700 ti: ffff880035b70000 task.ti: ffff880035b70000\n[ 72.696530] RIP: 0010:[\u003cffff880033f87d78\u003e] [\u003cffff880033f87d78\u003e] 0xffff880033f87d78\n[ 72.696530] RSP: 0018:ffff880035f87bc0 EFLAGS: 00010246\n[ 72.696530] RAX: ffffed000698f996 RBX: ffff88003326b840 RCX: ffffffff814cc823\n[ 72.696530] RDX: ffff88003326b840 RSI: ffff880033e48038 RDI: ffff880034c7c780\n[ 72.696530] RBP: ffff880035f87c18 R08: 000000000000a506 R09: 0000000000000000\n[ 72.696530] R10: ffff880035f87b38 R11: ffff880034b9344d R12: 00000000ebfea715\n[ 72.696530] R13: 0000000000000000 R14: ffff880034c7c780 R15: 0000000000000000\n[ 72.696530] FS: 0000000000000000(0000) GS:ffff880035f80000(0000) knlGS:0000000000000000\n[ 72.696530] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 72.696530] CR2: ffff880033f87d78 CR3: 0000000033c98000 CR4: 00000000000406a0\n[ 72.696530] Stack:\n[ 72.696530] ffffffff814cc834 ffff880034b93468 0000001481416818 ffff88003326b874\n[ 72.696530] ffff880034c7ccb0 ffff880033e48038 ffff88003326b840 ffff880034b93462\n[ 72.696530] ffff88003326b88a ffff88003326b88c ffff880034b93468 ffff880035f87c70\n[ 72.696530] Call Trace:\n[ 72.696530] \u003cIRQ\u003e\n[ 72.696530] [\u003cffffffff814cc834\u003e] ? udp_gro_receive+0x1c6/0x1f9\n[ 72.696530] [\u003cffffffff814ccb1c\u003e] udp4_gro_receive+0x2b5/0x310\n[ 72.696530] [\u003cffffffff814d989b\u003e] inet_gro_receive+0x4a3/0x4cd\n[ 72.696530] [\u003cffffffff81431b32\u003e] dev_gro_receive+0x584/0x7a3\n[ 72.696530] [\u003cffffffff810adf7a\u003e] ? __lock_is_held+0x29/0x64\n[ 72.696530] [\u003cffffffff814321f7\u003e] napi_gro_receive+0x124/0x21d\n[ 72.696530] [\u003cffffffffa000b145\u003e] virtnet_receive+0x8df/0x8f6 [virtio_net]\n[ 72.696530] [\u003cffffffffa000b27e\u003e] virtnet_poll+0x1d/0x8d [virtio_net]\n[ 72.696530] [\u003cffffffff81431350\u003e] net_rx_action+0x15b/0x3b9\n[ 72.696530] [\u003cffffffff815893d6\u003e] __do_softirq+0x216/0x546\n[ 72.696530] [\u003cffffffff81062392\u003e] irq_exit+0x49/0xb6\n[ 72.696530] [\u003cffffffff81588e9a\u003e] do_IRQ+0xe2/0xfa\n[ 72.696530] [\u003cffffffff81587a49\u003e] common_interrupt+0x89/0x89\n[ 72.696530] \u003cEOI\u003e\n[ 72.696530] [\u003cffffffff810b05df\u003e] ? trace_hardirqs_on_caller+0x229/0x270\n[ 72.696530] [\u003cffffffff8102b3c7\u003e] ? default_idle+0x1c/0x2d\n[ 72.696530] [\u003cffffffff8102b3c5\u003e] ? default_idle+0x1a/0x2d\n[ 72.696530] [\u003cffffffff8102bb8c\u003e] arch_cpu_idle+0xa/0xc\n[ 72.696530] [\u003cffffffff810a6c39\u003e] default_idle_call+0x1a/0x1c\n[ 72.696530] [\u003cffffffff810a6d96\u003e] cpu_startup_entry+0x15b/0x20f\n[ 72.696530] [\u003cffffffff81039a81\u003e] start_secondary+0x12c/0x133\n[ 72.696530] Code: ff ff ff ff ff ff ff ff ff ff 7f ff ff ff ff ff ff ff 7f 00 7e f8 33 00 88 ff ff 6d 61 58 81 ff ff ff ff 5e de 0a 81 ff ff ff ff \u003c00\u003e 5c e2 34 00 88 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00\n[ 72.696530] RIP [\u003cffff880033f87d78\u003e] 0xffff880033f87d78\n[ 72.696530] RSP \u003cffff880035f87bc0\u003e\n[ 72.696530] CR2: ffff880033f87d78\n[ 72.696530] ---[ end trace ad7758b9a1dccf99 ]---\n[ 72.696530] Kernel panic - not syncing: Fatal exception in interrupt\n[ 72.696530] Kernel Offset: disabled\n[ 72.696530] ---[ end Kernel panic - not syncing: Fatal exception in interrupt\n\nv2: use empty initialiser instead of \"{ NULL }\" to avoid relying on\n first field\u0027s type.\n\nFixes: 38fd2af24fcf (\"udp: Add socket based GRO and config\")\nSigned-off-by: Guillaume Nault \u003cg.nault@alphalink.fr\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "38f56354f4e1cfbaa1f2f10e9acb30f105b70aed", "tree": "404a6cf5d18c92e7fb950afc82e5025997c744cf", "parents": [ "f946ceab11c4bede9b3d6c0d56f0964d65bfff65" ], "author": { "name": "Toshiaki Makita", "email": "makita.toshiaki@lab.ntt.co.jp", "time": "Tue Jun 07 19:14:17 2016 +0900" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:17 2016 -0700" }, "message": "bridge: Don\u0027t insert unnecessary local fdb entry on changing mac address\n\n[ Upstream commit 0b148def403153a4d1565f1640356cb78ce5109f ]\n\nThe missing br_vlan_should_use() test caused creation of an unneeded\nlocal fdb entry on changing mac address of a bridge device when there is\na vlan which is configured on a bridge port but not on the bridge\ndevice.\n\nFixes: 2594e9064a57 (\"bridge: vlan: add per-vlan struct and move to rhashtables\")\nSigned-off-by: Toshiaki Makita \u003cmakita.toshiaki@lab.ntt.co.jp\u003e\nAcked-by: Nikolay Aleksandrov \u003cnikolay@cumulusnetworks.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f946ceab11c4bede9b3d6c0d56f0964d65bfff65", "tree": "272a614f1291c4811f0bde6e1f68cee3424035d3", "parents": [ "721976e93e5d8963d0c937ee236489968bfcfb81" ], "author": { "name": "Yuchung Cheng", "email": "ycheng@google.com", "time": "Mon Jun 06 15:07:18 2016 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:17 2016 -0700" }, "message": "tcp: record TLP and ER timer stats in v6 stats\n\n[ Upstream commit ce3cf4ec0305919fc69a972f6c2b2efd35d36abc ]\n\nThe v6 tcp stats scan do not provide TLP and ER timer information\ncorrectly like the v4 version . This patch fixes that.\n\nFixes: 6ba8a3b19e76 (\"tcp: Tail loss probe (TLP)\")\nFixes: eed530b6c676 (\"tcp: early retransmit\")\nSigned-off-by: Yuchung Cheng \u003cycheng@google.com\u003e\nSigned-off-by: Neal Cardwell \u003cncardwell@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "721976e93e5d8963d0c937ee236489968bfcfb81", "tree": "0b2e4cd45a88ae41ee39474b0c33625664cfb6fc", "parents": [ "13a055d6ca34dcce324ccfab63cc05db726030bc" ], "author": { "name": "Chen Haiquan", "email": "oc@yunify.com", "time": "Fri May 27 10:49:11 2016 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:17 2016 -0700" }, "message": "vxlan: Accept user specified MTU value when create new vxlan link\n\n[ Upstream commit ce577668a426c6a9e2470a09dcd07fbd6e45272a ]\n\nWhen create a new vxlan link, example:\n ip link add vtap mtu 1440 type vxlan vni 1 dev eth0\n\nThe argument \"mtu\" has no effect, because it is not set to conf-\u003emtu. The\ndefault value is used in vxlan_dev_configure function.\n\nThis problem was introduced by commit 0dfbdf4102b9 (vxlan: Factor out device\nconfiguration).\n\nFixes: 0dfbdf4102b9 (vxlan: Factor out device configuration)\nSigned-off-by: Chen Haiquan \u003coc@yunify.com\u003e\nAcked-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "13a055d6ca34dcce324ccfab63cc05db726030bc", "tree": "8790ab977458e62e53681e9db9f93cd7c57a0eaf", "parents": [ "450db517b9223908ab5c1a9b5ddce3b6c4d75b18" ], "author": { "name": "Ivan Vecera", "email": "ivecera@redhat.com", "time": "Wed May 25 21:21:52 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:17 2016 -0700" }, "message": "team: don\u0027t call netdev_change_features under team-\u003elock\n\n[ Upstream commit f6988cb63a4e698d8a62a1d085d263d1fcc351ea ]\n\nThe team_device_event() notifier calls team_compute_features() to fix\nvlan_features under team-\u003elock to protect team-\u003eport_list. The problem is\nthat subsequent __team_compute_features() calls netdev_change_features()\nto propagate vlan_features to upper vlan devices while team-\u003elock is still\ntaken. This can lead to deadlock when NETIF_F_LRO is modified on lower\ndevices or team device itself.\n\nExample:\nThe team0 as active backup with eth0 and eth1 NICs. Both eth0 \u0026 eth1 are\nLRO capable and LRO is enabled. Thus LRO is also enabled on team0.\n\nThe command \u0027ethtool -K team0 lro off\u0027 now hangs due to this deadlock:\n\ndev_ethtool()\n-\u003e ethtool_set_features()\n -\u003e __netdev_update_features(team)\n -\u003e netdev_sync_lower_features()\n -\u003e netdev_update_features(lower_1)\n -\u003e __netdev_update_features(lower_1)\n -\u003e netdev_features_change(lower_1)\n -\u003e call_netdevice_notifiers(...)\n -\u003e team_device_event(lower_1)\n -\u003e team_compute_features(team) [TAKES team-\u003elock]\n -\u003e netdev_change_features(team)\n -\u003e __netdev_update_features(team)\n -\u003e netdev_sync_lower_features()\n -\u003e netdev_update_features(lower_2)\n -\u003e __netdev_update_features(lower_2)\n -\u003e netdev_features_change(lower_2)\n -\u003e call_netdevice_notifiers(...)\n -\u003e team_device_event(lower_2)\n -\u003e team_compute_features(team) [DEADLOCK]\n\nThe bug is present in team from the beginning but it appeared after the commit\nfd867d5 (net/core: generic support for disabling netdev features down stack)\nthat adds synchronization of features with lower devices.\n\nFixes: fd867d5 (net/core: generic support for disabling netdev features down stack)\nCc: Jiri Pirko \u003cjiri@resnulli.us\u003e\nSigned-off-by: Ivan Vecera \u003civecera@redhat.com\u003e\nSigned-off-by: Jiri Pirko \u003cjiri@mellanox.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "450db517b9223908ab5c1a9b5ddce3b6c4d75b18", "tree": "1cd9d2558dfe8f0d7b53eb79ccf589f739e2971c", "parents": [ "bfe951d547bf15bf1192abd20773e6603dacadf1" ], "author": { "name": "Edward Cree", "email": "ecree@solarflare.com", "time": "Tue May 24 18:53:36 2016 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:17 2016 -0700" }, "message": "sfc: on MC reset, clear PIO buffer linkage in TXQs\n\n[ Upstream commit c0795bf64cba4d1b796fdc5b74b33772841ed1bb ]\n\nOtherwise, if we fail to allocate new PIO buffers, our TXQs will try to\nuse the old ones, which aren\u0027t there any more.\n\nFixes: 183233bec810 \"sfc: Allocate and link PIO buffers; map them with write-combining\"\nSigned-off-by: Edward Cree \u003cecree@solarflare.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "bfe951d547bf15bf1192abd20773e6603dacadf1", "tree": "cb5bbaa050f31290feeadbf051974770f193805f", "parents": [ "f5f16bf66d7e07e5a04f07226caefeaf3136c83a" ], "author": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Sun May 22 23:16:18 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:17 2016 -0700" }, "message": "bpf, inode: disallow userns mounts\n\n[ Upstream commit 612bacad78ba6d0a91166fc4487af114bac172a8 ]\n\nFollow-up to commit e27f4a942a0e (\"bpf: Use mount_nodev not mount_ns\nto mount the bpf filesystem\"), which removes the FS_USERNS_MOUNT flag.\n\nThe original idea was to have a per mountns instance instead of a\nsingle global fs instance, but that didn\u0027t work out and we had to\nswitch to mount_nodev() model. The intent of that middle ground was\nthat we avoid users who don\u0027t play nice to create endless instances\nof bpf fs which are difficult to control and discover from an admin\npoint of view, but at the same time it would have allowed us to be\nmore flexible with regard to namespaces.\n\nTherefore, since we now did the switch to mount_nodev() as a fix\nwhere individual instances are created, we also need to remove userns\nmount flag along with it to avoid running into mentioned situation.\nI don\u0027t expect any breakage at this early point in time with removing\nthe flag and we can revisit this later should the requirement for\nthis come up with future users. This and commit e27f4a942a0e have\nbeen split to facilitate tracking should any of them run into the\nunlikely case of causing a regression.\n\nFixes: b2197755b263 (\"bpf: add support for persistent maps/progs\")\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nAcked-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nAcked-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f5f16bf66d7e07e5a04f07226caefeaf3136c83a", "tree": "89ae65a4b9ac5c829313248dcd1b517b7208e71d", "parents": [ "ab1f253ddccc235520fa4f70d32a8dd6bf8ef346" ], "author": { "name": "Nicolas Dichtel", "email": "nicolas.dichtel@6wind.com", "time": "Thu May 19 17:26:29 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:17 2016 -0700" }, "message": "uapi glibc compat: fix compilation when !__USE_MISC in glibc\n\n[ Upstream commit f0a3fdca794d1e68ae284ef4caefe681f7c18e89 ]\n\nThese structures are defined only if __USE_MISC is set in glibc net/if.h\nheaders, ie when _BSD_SOURCE or _SVID_SOURCE are defined.\n\nCC: Jan Engelhardt \u003cjengelh@inai.de\u003e\nCC: Josh Boyer \u003cjwboyer@fedoraproject.org\u003e\nCC: Stephen Hemminger \u003cshemming@brocade.com\u003e\nCC: Waldemar Brodkorb \u003cmail@waldemar-brodkorb.de\u003e\nCC: Gabriel Laskar \u003cgabriel@lse.epita.fr\u003e\nCC: Mikko Rapeli \u003cmikko.rapeli@iki.fi\u003e\nFixes: 4a91cb61bb99 (\"uapi glibc compat: fix compile errors when glibc net/if.h included before linux/if.h\")\nSigned-off-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ab1f253ddccc235520fa4f70d32a8dd6bf8ef346", "tree": "6987771cbaf34563f6989a7467d1d41d918c53a2", "parents": [ "5b7ea922e1754107f77d146011612f2e42600cc1" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Thu May 19 15:58:33 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:16 2016 -0700" }, "message": "udp: prevent skbs lingering in tunnel socket queues\n\n[ Upstream commit e5aed006be918af163eb397e45aa5ea6cefd5e01 ]\n\nIn case we find a socket with encapsulation enabled we should call\nthe encap_recv function even if just a udp header without payload is\navailable. The callbacks are responsible for correctly verifying and\ndropping the packets.\n\nAlso, in case the header validation fails for geneve and vxlan we\nshouldn\u0027t put the skb back into the socket queue, no one will pick\nthem up there. Instead we can simply discard them in the respective\nencap_recv functions.\n\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "5b7ea922e1754107f77d146011612f2e42600cc1", "tree": "0057a5e96644e008724570a3eb8bffbad2c0c922", "parents": [ "bccd56fad0433ef1ed0661bb3a4055503cdec4e9" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Fri May 20 17:22:48 2016 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:16 2016 -0700" }, "message": "bpf: Use mount_nodev not mount_ns to mount the bpf filesystem\n\n[ Upstream commit e27f4a942a0ee4b84567a3c6cfa84f273e55cbb7 ]\n\nWhile reviewing the filesystems that set FS_USERNS_MOUNT I spotted the\nbpf filesystem. Looking at the code I saw a broken usage of mount_ns\nwith current-\u003ensproxy-\u003emnt_ns. As the code does not acquire a\nreference to the mount namespace it can not possibly be correct to\nstore the mount namespace on the superblock as it does.\n\nReplace mount_ns with mount_nodev so that each mount of the bpf\nfilesystem returns a distinct instance, and the code is not buggy.\n\nIn discussion with Hannes Frederic Sowa it was reported that the use\nof mount_ns was an attempt to have one bpf instance per mount\nnamespace, in an attempt to keep resources that pin resources from\nhiding. That intent simply does not work, the vfs is not built to\nallow that kind of behavior. Which means that the bpf filesystem\nreally is buggy both semantically and in it\u0027s implemenation as it does\nnot nor can it implement the original intent.\n\nThis change is userspace visible, but my experience with similar\nfilesystems leads me to believe nothing will break with a model of each\nmount of the bpf filesystem is distinct from all others.\n\nFixes: b2197755b263 (\"bpf: add support for persistent maps/progs\")\nCc: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nAcked-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nSigned-off-by: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nAcked-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "bccd56fad0433ef1ed0661bb3a4055503cdec4e9", "tree": "4d5b77f60faf9fbe06c9c6a9943db6b91a242bae", "parents": [ "835d0122a57ffaea43162d0e7a4f5bf25d2af78b" ], "author": { "name": "Jason Wang", "email": "jasowang@redhat.com", "time": "Thu May 19 13:36:51 2016 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:16 2016 -0700" }, "message": "tuntap: correctly wake up process during uninit\n\n[ Upstream commit addf8fc4acb1cf79492ac64966f07178793cb3d7 ]\n\nWe used to check dev-\u003ereg_state against NETREG_REGISTERED after each\ntime we are woke up. But after commit 9e641bdcfa4e (\"net-tun:\nrestructure tun_do_read for better sleep/wakeup efficiency\"), it uses\nskb_recv_datagram() which does not check dev-\u003ereg_state. This will\nresult if we delete a tun/tap device after a process is blocked in the\nreading. The device will wait for the reference count which was held\nby that process for ever.\n\nFixes this by using RCV_SHUTDOWN which will be checked during\nsk_recv_datagram() before trying to wake up the process during uninit.\n\nFixes: 9e641bdcfa4e (\"net-tun: restructure tun_do_read for better\nsleep/wakeup efficiency\")\nCc: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Xi Wang \u003cxii@google.com\u003e\nCc: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nSigned-off-by: Jason Wang \u003cjasowang@redhat.com\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "835d0122a57ffaea43162d0e7a4f5bf25d2af78b", "tree": "6ac2447552cf93568d82b65bc69394940776b669", "parents": [ "6a58f3e12e8e5c330940b38cc8c98d52171aefa8" ], "author": { "name": "Jiri Pirko", "email": "jiri@mellanox.com", "time": "Tue May 17 18:58:08 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:16 2016 -0700" }, "message": "switchdev: pass pointer to fib_info instead of copy\n\n[ Upstream commit da4ed55165d41b1073f9a476f1c18493e9bf8c8e ]\n\nThe problem is that fib_info-\u003enh is [0] so the struct fib_info\nallocation size depends on number of nexthops. If we just copy fib_info,\nwe do not copy the nexthops info and driver accesses memory which is not\nours.\n\nGiven the fact that fib4 does not defer operations and therefore it does\nnot need copy, just pass the pointer down to drivers as it was done\nbefore.\n\nFixes: 850d0cbc91 (\"switchdev: remove pointers from switchdev objects\")\nSigned-off-by: Jiri Pirko \u003cjiri@mellanox.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "6a58f3e12e8e5c330940b38cc8c98d52171aefa8", "tree": "c073f48db61f9d47c9a02e45e04940f51302f398", "parents": [ "49543942beb1b9ca95709d6cfa67708932aa4d11" ], "author": { "name": "Richard Alpe", "email": "richard.alpe@ericsson.com", "time": "Tue May 17 16:57:37 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:16 2016 -0700" }, "message": "tipc: fix nametable publication field in nl compat\n\n[ Upstream commit 03aaaa9b941e136757b55c4cf775aab6068dfd94 ]\n\nThe publication field of the old netlink API should contain the\npublication key and not the publication reference.\n\nFixes: 44a8ae94fd55 (tipc: convert legacy nl name table dump to nl compat)\nSigned-off-by: Richard Alpe \u003crichard.alpe@ericsson.com\u003e\nAcked-by: Jon Maloy \u003cjon.maloy@ericsson.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "49543942beb1b9ca95709d6cfa67708932aa4d11", "tree": "cd5082f583d89270ba113731a72d918b6e2e9bb9", "parents": [ "23cdd8c3cbe9d790f23d7f9ae14e9b828f56f69c" ], "author": { "name": "Herbert Xu", "email": "herbert@gondor.apana.org.au", "time": "Mon May 16 17:28:16 2016 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:16 2016 -0700" }, "message": "netlink: Fix dump skb leak/double free\n\n[ Upstream commit 92964c79b357efd980812c4de5c1fd2ec8bb5520 ]\n\nWhen we free cb-\u003eskb after a dump, we do it after releasing the\nlock. This means that a new dump could have started in the time\nbeing and we\u0027ll end up freeing their skb instead of ours.\n\nThis patch saves the skb and module before we unlock so we free\nthe right memory.\n\nFixes: 16b304f3404f (\"netlink: Eliminate kmalloc in netlink dump operation.\")\nReported-by: Baozeng Ding \u003csploving1@gmail.com\u003e\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nAcked-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "23cdd8c3cbe9d790f23d7f9ae14e9b828f56f69c", "tree": "a505d305cf376d78c12186241b50eadd57d1f502", "parents": [ "c54c115da7214a41a697180964cf6d7a5a50b599" ], "author": { "name": "Richard Alpe", "email": "richard.alpe@ericsson.com", "time": "Mon May 16 11:14:54 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:16 2016 -0700" }, "message": "tipc: check nl sock before parsing nested attributes\n\n[ Upstream commit 45e093ae2830cd1264677d47ff9a95a71f5d9f9c ]\n\nMake sure the socket for which the user is listing publication exists\nbefore parsing the socket netlink attributes.\n\nPrior to this patch a call without any socket caused a NULL pointer\ndereference in tipc_nl_publ_dump().\n\nTested-and-reported-by: Baozeng Ding \u003csploving1@gmail.com\u003e\nSigned-off-by: Richard Alpe \u003crichard.alpe@ericsson.com\u003e\nAcked-by: Jon Maloy \u003cjon.maloy@ericsson.cm\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "c54c115da7214a41a697180964cf6d7a5a50b599", "tree": "dc65650ac5586257f214b7cc6f1c04d2b6ac216c", "parents": [ "0dec8c0d67c64401d97122e4eba347ccc5850622" ], "author": { "name": "Ewan D. Milne", "email": "emilne@redhat.com", "time": "Tue May 31 09:42:29 2016 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:16 2016 -0700" }, "message": "scsi: Add QEMU CD-ROM to VPD Inquiry Blacklist\n\ncommit fbd83006e3e536fcb103228d2422ea63129ccb03 upstream.\n\nLinux fails to boot as a guest with a QEMU CD-ROM:\n\n[ 4.439488] ata2.00: ATAPI: QEMU CD-ROM, 0.8.2, max UDMA/100\n[ 4.443649] ata2.00: configured for MWDMA2\n[ 4.450267] scsi 1:0:0:0: CD-ROM QEMU QEMU CD-ROM 0.8. PQ: 0 ANSI: 5\n[ 4.464317] ata2.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x6 frozen\n[ 4.464319] ata2.00: BMDMA stat 0x5\n[ 4.464339] ata2.00: cmd a0/01:00:00:00:01/00:00:00:00:00/a0 tag 0 dma 16640 in\n[ 4.464339] Inquiry 12 01 00 00 ff 00res 48/20:02:00:24:00/00:00:00:00:00/a0 Emask 0x2 (HSM violation)\n[ 4.464341] ata2.00: status: { DRDY DRQ }\n[ 4.465864] ata2: soft resetting link\n[ 4.625971] ata2.00: configured for MWDMA2\n[ 4.628290] ata2: EH complete\n[ 4.646670] ata2.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x6 frozen\n[ 4.646671] ata2.00: BMDMA stat 0x5\n[ 4.646683] ata2.00: cmd a0/01:00:00:00:01/00:00:00:00:00/a0 tag 0 dma 16640 in\n[ 4.646683] Inquiry 12 01 00 00 ff 00res 48/20:02:00:24:00/00:00:00:00:00/a0 Emask 0x2 (HSM violation)\n[ 4.646685] ata2.00: status: { DRDY DRQ }\n[ 4.648193] ata2: soft resetting link\n\n...\n\nFix this by suppressing VPD inquiry for this device.\n\nSigned-off-by: Ewan D. Milne \u003cemilne@redhat.com\u003e\nReported-by: Jan Stancek \u003cjstancek@redhat.com\u003e\nTested-by: Jan Stancek \u003cjstancek@redhat.com\u003e\nReviewed-by: Johannes Thumshirn \u003cjthumshirn@suse.de\u003e\nSigned-off-by: Martin K. Petersen \u003cmartin.petersen@oracle.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0dec8c0d67c64401d97122e4eba347ccc5850622", "tree": "097a50947e94e9dc78759be648d6eb4edfd3380a", "parents": [ "ba760d4302e4fce130007b8bdbce7fcafc9bd9a9" ], "author": { "name": "James Bottomley", "email": "James.Bottomley@HansenPartnership.com", "time": "Fri May 13 12:04:06 2016 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 24 10:18:16 2016 -0700" }, "message": "scsi_lib: correctly retry failed zero length REQ_TYPE_FS commands\n\ncommit a621bac3044ed6f7ec5fa0326491b2d4838bfa93 upstream.\n\nWhen SCSI was written, all commands coming from the filesystem\n(REQ_TYPE_FS commands) had data. This meant that our signal for needing\nto complete the command was the number of bytes completed being equal to\nthe number of bytes in the request. Unfortunately, with the advent of\nflush barriers, we can now get zero length REQ_TYPE_FS commands, which\nconfuse this logic because they satisfy the condition every time. This\nmeans they never get retried even for retryable conditions, like UNIT\nATTENTION because we complete them early assuming they\u0027re done. Fix\nthis by special casing the early completion condition to recognise zero\nlength commands with errors and let them drop through to the retry code.\n\nReported-by: Sebastian Parschauer \u003cs.parschauer@gmx.de\u003e\nSigned-off-by: James E.J. Bottomley \u003cjejb@linux.vnet.ibm.com\u003e\nTested-by: Jack Wang \u003cjinpu.wang@profitbricks.com\u003e\nSigned-off-by: Martin K. Petersen \u003cmartin.petersen@oracle.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ba760d4302e4fce130007b8bdbce7fcafc9bd9a9", "tree": "1db5d450579321deacc9e81a7122f340126eabff", "parents": [ "55f6ddfceef32eb9d7174ad5a74e473ef76cfe3b" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Jun 07 18:14:51 2016 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Jun 07 18:14:51 2016 -0700" }, "message": "Linux 4.4.13\n" }, { "commit": "55f6ddfceef32eb9d7174ad5a74e473ef76cfe3b", "tree": "c44586c4d8b5e1cc6330bc49395b4b0dfaee58b6", "parents": [ "063b0dc8b46e56efa480bc2640fe01024f709482" ], "author": { "name": "Dave Chinner", "email": "dchinner@redhat.com", "time": "Tue Jan 12 07:04:01 2016 +1100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Jun 07 18:14:38 2016 -0700" }, "message": "xfs: handle dquot buffer readahead in log recovery correctly\n\ncommit 7d6a13f023567d573ac362502bb702eda716e654 upstream.\n\nWhen we do dquot readahead in log recovery, we do not use a verifier\nas the underlying buffer may not have dquots in it. e.g. the\nallocation operation hasn\u0027t yet been replayed. Hence we do not want\nto fail recovery because we detect an operation to be replayed has\nnot been run yet. This problem was addressed for inodes in commit\nd891400 (\"xfs: inode buffers may not be valid during recovery\nreadahead\") but the problem was not recognised to exist for dquots\nand their buffers as the dquot readahead did not have a verifier.\n\nThe result of not using a verifier is that when the buffer is then\nnext read to replay a dquot modification, the dquot buffer verifier\nwill only be attached to the buffer if *readahead is not complete*.\nHence we can read the buffer, replay the dquot changes and then add\nit to the delwri submission list without it having a verifier\nattached to it. This then generates warnings in xfs_buf_ioapply(),\nwhich catches and warns about this case.\n\nFix this and make it handle the same readahead verifier error cases\nas for inode buffers by adding a new readahead verifier that has a\nwrite operation as well as a read operation that marks the buffer as\nnot done if any corruption is detected. Also make sure we don\u0027t run\nreadahead if the dquot buffer has been marked as cancelled by\nrecovery.\n\nThis will result in readahead either succeeding and the buffer\nhaving a valid write verifier, or readahead failing and the buffer\nstate requiring the subsequent read to resubmit the IO with the new\nverifier. In either case, this will result in the buffer always\nending up with a valid write verifier on it.\n\nNote: we also need to fix the inode buffer readahead error handling\nto mark the buffer with EIO. Brian noticed the code I copied from\nthere wrong during review, so fix it at the same time. Add comments\nlinking the two functions that handle readahead verifier errors\ntogether so we don\u0027t forget this behavioural link in future.\n\nSigned-off-by: Dave Chinner \u003cdchinner@redhat.com\u003e\nReviewed-by: Brian Foster \u003cbfoster@redhat.com\u003e\nSigned-off-by: Dave Chinner \u003cdavid@fromorbit.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "063b0dc8b46e56efa480bc2640fe01024f709482", "tree": "0922afd6b3f0ef31c7629de994f53bf5026ad5ac", "parents": [ "21cfd6cc64f531fa2d96eaa7b816af4ed7428227" ], "author": { "name": "Eric Sandeen", "email": "sandeen@redhat.com", "time": "Mon Jan 04 16:10:19 2016 +1100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Jun 07 18:14:38 2016 -0700" }, "message": "xfs: print name of verifier if it fails\n\ncommit 233135b763db7c64d07b728a9c66745fb0376275 upstream.\n\nThis adds a name to each buf_ops structure, so that if\na verifier fails we can print the type of verifier that\nfailed it. Should be a slight debugging aid, I hope.\n\nSigned-off-by: Eric Sandeen \u003csandeen@redhat.com\u003e\nReviewed-by: Brian Foster \u003cbfoster@redhat.com\u003e\nSigned-off-by: Dave Chinner \u003cdavid@fromorbit.com\u003e\nCc: Holger Hoffstätte \u003cholger@applied-asynchrony.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "21cfd6cc64f531fa2d96eaa7b816af4ed7428227", "tree": "b7a47b38bab21981a7771c79de3c08c7afa94bc7", "parents": [ "baa7a74d6df5e67d62045ad6d7dbe1942bbbbefe" ], "author": { "name": "Dave Chinner", "email": "dchinner@redhat.com", "time": "Wed May 18 13:54:23 2016 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Jun 07 18:14:38 2016 -0700" }, "message": "xfs: skip stale inodes in xfs_iflush_cluster\n\ncommit 7d3aa7fe970791f1a674b14572a411accf2f4d4e upstream.\n\nWe don\u0027t write back stale inodes so we should skip them in\nxfs_iflush_cluster, too.\n\nSigned-off-by: Dave Chinner \u003cdchinner@redhat.com\u003e\nReviewed-by: Brian Foster \u003cbfoster@redhat.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Dave Chinner \u003cdavid@fromorbit.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "baa7a74d6df5e67d62045ad6d7dbe1942bbbbefe", "tree": "01d1884deb206616e3099b630472ba7275e95dde", "parents": [ "7dc8f21bd5afbabb086891b3a9d0930883bed793" ], "author": { "name": "Dave Chinner", "email": "dchinner@redhat.com", "time": "Wed May 18 13:54:22 2016 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Jun 07 18:14:38 2016 -0700" }, "message": "xfs: fix inode validity check in xfs_iflush_cluster\n\ncommit 51b07f30a71c27405259a0248206ed4e22adbee2 upstream.\n\nSome careless idiot(*) wrote crap code in commit 1a3e8f3 (\"xfs:\nconvert inode cache lookups to use RCU locking\") back in late 2010,\nand so xfs_iflush_cluster checks the wrong inode for whether it is\nstill valid under RCU protection. Fix it to lock and check the\ncorrect inode.\n\n(*) Careless-idiot: Dave Chinner \u003cdchinner@redhat.com\u003e\n\nDiscovered-by: Brain Foster \u003cbfoster@redhat.com\u003e\nSigned-off-by: Dave Chinner \u003cdchinner@redhat.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Dave Chinner \u003cdavid@fromorbit.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7dc8f21bd5afbabb086891b3a9d0930883bed793", "tree": "5b4ee91a516235292e4c88cb9271b25753f218af", "parents": [ "d7d92ca7dd363153407b19c749ce9a9ea1f46fcb" ], "author": { "name": "Dave Chinner", "email": "dchinner@redhat.com", "time": "Wed May 18 13:53:42 2016 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Jun 07 18:14:38 2016 -0700" }, "message": "xfs: xfs_iflush_cluster fails to abort on error\n\ncommit b1438f477934f5a4d5a44df26f3079a7575d5946 upstream.\n\nWhen a failure due to an inode buffer occurs, the error handling\nfails to abort the inode writeback correctly. This can result in the\ninode being reclaimed whilst still in the AIL, leading to\nuse-after-free situations as well as filesystems that cannot be\nunmounted as the inode log items left in the AIL never get removed.\n\nFix this by ensuring fatal errors from xfs_imap_to_bp() result in\nthe inode flush being aborted correctly.\n\nReported-by: Shyam Kaushik \u003cshyam@zadarastorage.com\u003e\nDiagnosed-by: Shyam Kaushik \u003cshyam@zadarastorage.com\u003e\nTested-by: Shyam Kaushik \u003cshyam@zadarastorage.com\u003e\nSigned-off-by: Dave Chinner \u003cdchinner@redhat.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Dave Chinner \u003cdavid@fromorbit.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d7d92ca7dd363153407b19c749ce9a9ea1f46fcb", "tree": "03fc91685c785aa70fb2b0c69fb74eff7e903b7e", "parents": [ "ec86bfec23e3e5d92ac5e6242f074c92f127d6ef" ], "author": { "name": "Dave Chinner", "email": "dchinner@redhat.com", "time": "Wed Apr 06 07:06:20 2016 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Jun 07 18:14:38 2016 -0700" }, "message": "xfs: Don\u0027t wrap growfs AGFL indexes\n\ncommit ad747e3b299671e1a53db74963cc6c5f6cdb9f6d upstream.\n\nCommit 96f859d (\"libxfs: pack the agfl header structure so\nXFS_AGFL_SIZE is correct\") allowed the freelist to use the empty\nslot at the end of the freelist on 64 bit systems that was not\nbeing used due to sizeof() rounding up the structure size.\n\nThis has caused versions of xfs_repair prior to 4.5.0 (which also\nhas the fix) to report this as a corruption once the filesystem has\nbeen grown. Older kernels can also have problems (seen from a whacky\ncontainer/vm management environment) mounting filesystems grown on a\nsystem with a newer kernel than the vm/container it is deployed on.\n\nTo avoid this problem, change the initial free list indexes not to\nwrap across the end of the AGFL, hence avoiding the initialisation\nof agf_fllast to the last index in the AGFL.\n\nSigned-off-by: Dave Chinner \u003cdchinner@redhat.com\u003e\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nSigned-off-by: Dave Chinner \u003cdavid@fromorbit.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ec86bfec23e3e5d92ac5e6242f074c92f127d6ef", "tree": "13d4b2657e550191239244e9756cf845440567ee", "parents": [ "8edc7f04694d0fd243425e65299ee6ec10259b4f" ], "author": { "name": "Eric Sandeen", "email": "sandeen@redhat.com", "time": "Wed Apr 06 07:05:41 2016 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Jun 07 18:14:38 2016 -0700" }, "message": "xfs: disallow rw remount on fs with unknown ro-compat features\n\ncommit d0a58e833931234c44e515b5b8bede32bd4e6eed upstream.\n\nToday, a kernel which refuses to mount a filesystem read-write\ndue to unknown ro-compat features can still transition to read-write\nvia the remount path. The old kernel is most likely none the wiser,\nbecause it\u0027s unaware of the new feature, and isn\u0027t using it. However,\nwriting to the filesystem may well corrupt metadata related to that\nnew feature, and moving to a newer kernel which understand the feature\nwill have problems.\n\nRight now the only ro-compat feature we have is the free inode btree,\nwhich showed up in v3.16. It would be good to push this back to\nall the active stable kernels, I think, so that if anyone is using\nnewer mkfs (which enables the finobt feature) with older kernel\nreleases, they\u0027ll be protected.\n\nSigned-off-by: Eric Sandeen \u003csandeen@redhat.com\u003e\nReviewed-by: Bill O\u0027Donnell \u003cbillodo@redhat.com\u003e\nReviewed-by: Dave Chinner \u003cdchinner@redhat.com\u003e\nSigned-off-by: Dave Chinner \u003cdavid@fromorbit.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8edc7f04694d0fd243425e65299ee6ec10259b4f", "tree": "1e93d19206d5f642d443ba8bb03e8835e2118665", "parents": [ "4b2fb17654ef0ffd08b92293a09c5ead0499e2ef" ], "author": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Mon Apr 25 17:35:30 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Jun 07 18:14:38 2016 -0700" }, "message": "gcov: disable tree-loop-im to reduce stack usage\n\ncommit c87bf431448b404a6ef5fbabd74c0e3e42157a7f upstream.\n\nEnabling CONFIG_GCOV_PROFILE_ALL produces us a lot of warnings like\n\nlib/lz4/lz4hc_compress.c: In function \u0027lz4_compresshcctx\u0027:\nlib/lz4/lz4hc_compress.c:514:1: warning: the frame size of 1504 bytes is larger than 1024 bytes [-Wframe-larger-than\u003d]\n\nAfter some investigation, I found that this behavior started with gcc-4.9,\nand opened https://gcc.gnu.org/bugzilla/show_bug.cgi?id\u003d69702.\nA suggested workaround for it is to use the -fno-tree-loop-im\nflag that turns off one of the optimization stages in gcc, so the\ncode runs a little slower but does not use excessive amounts\nof stack.\n\nWe could make this conditional on the gcc version, but I could not\nfind an easy way to do this in Kbuild and the benefit would be\nfairly small, given that most of the gcc version in production are\naffected now.\n\nI\u0027m marking this for \u0027stable\u0027 backports because it addresses a bug\nwith code generation in gcc that exists in all kernel versions\nwith the affected gcc releases.\n\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nAcked-by: Peter Oberparleiter \u003coberpar@linux.vnet.ibm.com\u003e\nSigned-off-by: Michal Marek \u003cmmarek@suse.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "4b2fb17654ef0ffd08b92293a09c5ead0499e2ef", "tree": "3b9741130009efd57a16e1e8b2ed92c27dea8199", "parents": [ "7d0b494532b703da654f96389804f491a6594bbb" ], "author": { "name": "Srinivas Pandruvada", "email": "srinivas.pandruvada@linux.intel.com", "time": "Sat May 14 20:09:52 2016 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Jun 07 18:14:37 2016 -0700" }, "message": "scripts/package/Makefile: rpmbuild add support of RPMOPTS\n\ncommit 65a9f31c5042e5bb50d30ed8ae374044be561054 upstream.\n\nAfter commit 21a59991ce0c (\"scripts/package/Makefile: rpmbuild is needed\nfor rpm targets\"), it is no longer possible to specify RPMOPTS.\nFor example, we can no longer able to control _topdir using the following\nmake command.\nmake RPMOPTS\u003d\"--define \u0027_topdir /home/xyz/workspace/\u0027\" binrpm-pkg\n\nFixes: 21a59991ce0c (\"scripts/package/Makefile: rpmbuild is needed for rpm targets\")\nSigned-off-by: Srinivas Pandruvada \u003csrinivas.pandruvada@linux.intel.com\u003e\nSigned-off-by: Michal Marek \u003cmmarek@suse.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7d0b494532b703da654f96389804f491a6594bbb", "tree": "3f45f831ae6a3cfb80fe86f620b0c4d267904968", "parents": [ "98c28450538d0a191d031cce8852e568b62a1127" ], "author": { "name": "Ville Syrjälä", "email": "ville.syrjala@linux.intel.com", "time": "Thu May 26 15:16:25 2016 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Jun 07 18:14:37 2016 -0700" }, "message": "dma-debug: avoid spinlock recursion when disabling dma-debug\n\ncommit 3017cd63f26fc655d56875aaf497153ba60e9edf upstream.\n\nWith netconsole (at least) the pr_err(\"... disablingn\") call can\nrecurse back into the dma-debug code, where it\u0027ll try to grab\nfree_entries_lock again. Avoid the problem by doing the printk after\ndropping the lock.\n\nLink: http://lkml.kernel.org/r/1463678421-18683-1-git-send-email-ville.syrjala@linux.intel.com\nSigned-off-by: Ville Syrjälä \u003cville.syrjala@linux.intel.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "98c28450538d0a191d031cce8852e568b62a1127", "tree": "66dca65214907d6b49b9a01f65526be9a23e2993", "parents": [ "8b8de1c9295cafcc9a9b85b3287acac7d948fb63" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Fri May 20 23:09:49 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Jun 07 18:14:37 2016 -0700" }, "message": "PM / sleep: Handle failures in device_suspend_late() consistently\n\ncommit 3a17fb329da68cb00558721aff876a80bba2fdb9 upstream.\n\nGrygorii Strashko reports:\n\n The PM runtime will be left disabled for the device if its\n .suspend_late() callback fails and async suspend is not allowed\n for this device. In this case device will not be added in\n dpm_late_early_list and dpm_resume_early() will ignore this\n device, as result PM runtime will be disabled for it forever\n (side effect: after 8 subsequent failures for the same device\n the PM runtime will be reenabled due to disable_depth overflow).\n\nTo fix this problem, add devices to dpm_late_early_list regardless\nof whether or not device_suspend_late() returns errors for them.\n\nThat will ensure failures in there to be handled consistently for\nall devices regardless of their async suspend/resume status.\n\nReported-by: Grygorii Strashko \u003cgrygorii.strashko@ti.com\u003e\nTested-by: Grygorii Strashko \u003cgrygorii.strashko@ti.com\u003e\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8b8de1c9295cafcc9a9b85b3287acac7d948fb63", "tree": "ef13eb1cfee7c98afaa45f40670ec9ca4e3c8745", "parents": [ "12aa7d95f4882d21cd337d4f6fd40859cac67688" ], "author": { "name": "Nicolai Stange", "email": "nicstange@gmail.com", "time": "Thu May 05 19:46:19 2016 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Jun 07 18:14:37 2016 -0700" }, "message": "ext4: silence UBSAN in ext4_mb_init()\n\ncommit 935244cd54b86ca46e69bc6604d2adfb1aec2d42 upstream.\n\nCurrently, in ext4_mb_init(), there\u0027s a loop like the following:\n\n do {\n ...\n offset +\u003d 1 \u003c\u003c (sb-\u003es_blocksize_bits - i);\n i++;\n } while (i \u003c\u003d sb-\u003es_blocksize_bits + 1);\n\nNote that the updated offset is used in the loop\u0027s next iteration only.\n\nHowever, at the last iteration, that is at i \u003d\u003d sb-\u003es_blocksize_bits + 1,\nthe shift count becomes equal to (unsigned)-1 \u003e 31 (c.f. C99 6.5.7(3))\nand UBSAN reports\n\n UBSAN: Undefined behaviour in fs/ext4/mballoc.c:2621:15\n shift exponent 4294967295 is too large for 32-bit type \u0027int\u0027\n [...]\n Call Trace:\n [\u003cffffffff818c4d25\u003e] dump_stack+0xbc/0x117\n [\u003cffffffff818c4c69\u003e] ? _atomic_dec_and_lock+0x169/0x169\n [\u003cffffffff819411ab\u003e] ubsan_epilogue+0xd/0x4e\n [\u003cffffffff81941cac\u003e] __ubsan_handle_shift_out_of_bounds+0x1fb/0x254\n [\u003cffffffff81941ab1\u003e] ? __ubsan_handle_load_invalid_value+0x158/0x158\n [\u003cffffffff814b6dc1\u003e] ? kmem_cache_alloc+0x101/0x390\n [\u003cffffffff816fc13b\u003e] ? ext4_mb_init+0x13b/0xfd0\n [\u003cffffffff814293c7\u003e] ? create_cache+0x57/0x1f0\n [\u003cffffffff8142948a\u003e] ? create_cache+0x11a/0x1f0\n [\u003cffffffff821c2168\u003e] ? mutex_lock+0x38/0x60\n [\u003cffffffff821c23ab\u003e] ? mutex_unlock+0x1b/0x50\n [\u003cffffffff814c26ab\u003e] ? put_online_mems+0x5b/0xc0\n [\u003cffffffff81429677\u003e] ? kmem_cache_create+0x117/0x2c0\n [\u003cffffffff816fcc49\u003e] ext4_mb_init+0xc49/0xfd0\n [...]\n\nObserve that the mentioned shift exponent, 4294967295, equals (unsigned)-1.\n\nUnless compilers start to do some fancy transformations (which at least\nGCC 6.0.0 doesn\u0027t currently do), the issue is of cosmetic nature only: the\nsuch calculated value of offset is never used again.\n\nSilence UBSAN by introducing another variable, offset_incr, holding the\nnext increment to apply to offset and adjust that one by right shifting it\nby one position per loop iteration.\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id\u003d114701\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id\u003d112161\n\nSigned-off-by: Nicolai Stange \u003cnicstange@gmail.com\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "12aa7d95f4882d21cd337d4f6fd40859cac67688", "tree": "8feed21772662ea43aadd8fe145e8e8d43c7da89", "parents": [ "b2601bb015a7681fb44bd7a2f15760b2396d0de7" ], "author": { "name": "Nicolai Stange", "email": "nicstange@gmail.com", "time": "Thu May 05 17:38:03 2016 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Jun 07 18:14:37 2016 -0700" }, "message": "ext4: address UBSAN warning in mb_find_order_for_block()\n\ncommit b5cb316cdf3a3f5f6125412b0f6065185240cfdc upstream.\n\nCurrently, in mb_find_order_for_block(), there\u0027s a loop like the following:\n\n while (order \u003c\u003d e4b-\u003ebd_blkbits + 1) {\n ...\n bb +\u003d 1 \u003c\u003c (e4b-\u003ebd_blkbits - order);\n }\n\nNote that the updated bb is used in the loop\u0027s next iteration only.\n\nHowever, at the last iteration, that is at order \u003d\u003d e4b-\u003ebd_blkbits + 1,\nthe shift count becomes negative (c.f. C99 6.5.7(3)) and UBSAN reports\n\n UBSAN: Undefined behaviour in fs/ext4/mballoc.c:1281:11\n shift exponent -1 is negative\n [...]\n Call Trace:\n [\u003cffffffff818c4d35\u003e] dump_stack+0xbc/0x117\n [\u003cffffffff818c4c79\u003e] ? _atomic_dec_and_lock+0x169/0x169\n [\u003cffffffff819411bb\u003e] ubsan_epilogue+0xd/0x4e\n [\u003cffffffff81941cbc\u003e] __ubsan_handle_shift_out_of_bounds+0x1fb/0x254\n [\u003cffffffff81941ac1\u003e] ? __ubsan_handle_load_invalid_value+0x158/0x158\n [\u003cffffffff816e93a0\u003e] ? ext4_mb_generate_from_pa+0x590/0x590\n [\u003cffffffff816502c8\u003e] ? ext4_read_block_bitmap_nowait+0x598/0xe80\n [\u003cffffffff816e7b7e\u003e] mb_find_order_for_block+0x1ce/0x240\n [...]\n\nUnless compilers start to do some fancy transformations (which at least\nGCC 6.0.0 doesn\u0027t currently do), the issue is of cosmetic nature only: the\nsuch calculated value of bb is never used again.\n\nSilence UBSAN by introducing another variable, bb_incr, holding the next\nincrement to apply to bb and adjust that one by right shifting it by one\nposition per loop iteration.\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id\u003d114701\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id\u003d112161\n\nSigned-off-by: Nicolai Stange \u003cnicstange@gmail.com\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b2601bb015a7681fb44bd7a2f15760b2396d0de7", "tree": "11bc7d14d1baba4c0b1e15a4ae492a7fd19bdb61", "parents": [ "b2044c3f8310ccac10122f2fa64f8ae574b4bfef" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu May 05 11:10:15 2016 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Jun 07 18:14:37 2016 -0700" }, "message": "ext4: fix oops on corrupted filesystem\n\ncommit 74177f55b70e2f2be770dd28684dd6d17106a4ba upstream.\n\nWhen filesystem is corrupted in the right way, it can happen\next4_mark_iloc_dirty() in ext4_orphan_add() returns error and we\nsubsequently remove inode from the in-memory orphan list. However this\ndeletion is done with list_del(\u0026EXT4_I(inode)-\u003ei_orphan) and thus we\nleave i_orphan list_head with a stale content. Later we can look at this\ncontent causing list corruption, oops, or other issues. The reported\ntrace looked like:\n\nWARNING: CPU: 0 PID: 46 at lib/list_debug.c:53 __list_del_entry+0x6b/0x100()\nlist_del corruption, 0000000061c1d6e0-\u003enext is LIST_POISON1\n0000000000100100)\nCPU: 0 PID: 46 Comm: ext4.exe Not tainted 4.1.0-rc4+ #250\nStack:\n 60462947 62219960 602ede24 62219960\n 602ede24 603ca293 622198f0 602f02eb\n 62219950 6002c12c 62219900 601b4d6b\nCall Trace:\n [\u003c6005769c\u003e] ? vprintk_emit+0x2dc/0x5c0\n [\u003c602ede24\u003e] ? printk+0x0/0x94\n [\u003c600190bc\u003e] show_stack+0xdc/0x1a0\n [\u003c602ede24\u003e] ? printk+0x0/0x94\n [\u003c602ede24\u003e] ? printk+0x0/0x94\n [\u003c602f02eb\u003e] dump_stack+0x2a/0x2c\n [\u003c6002c12c\u003e] warn_slowpath_common+0x9c/0xf0\n [\u003c601b4d6b\u003e] ? __list_del_entry+0x6b/0x100\n [\u003c6002c254\u003e] warn_slowpath_fmt+0x94/0xa0\n [\u003c602f4d09\u003e] ? __mutex_lock_slowpath+0x239/0x3a0\n [\u003c6002c1c0\u003e] ? warn_slowpath_fmt+0x0/0xa0\n [\u003c60023ebf\u003e] ? set_signals+0x3f/0x50\n [\u003c600a205a\u003e] ? kmem_cache_free+0x10a/0x180\n [\u003c602f4e88\u003e] ? mutex_lock+0x18/0x30\n [\u003c601b4d6b\u003e] __list_del_entry+0x6b/0x100\n [\u003c601177ec\u003e] ext4_orphan_del+0x22c/0x2f0\n [\u003c6012f27c\u003e] ? __ext4_journal_start_sb+0x2c/0xa0\n [\u003c6010b973\u003e] ? ext4_truncate+0x383/0x390\n [\u003c6010bc8b\u003e] ext4_write_begin+0x30b/0x4b0\n [\u003c6001bb50\u003e] ? copy_from_user+0x0/0xb0\n [\u003c601aa840\u003e] ? iov_iter_fault_in_readable+0xa0/0xc0\n [\u003c60072c4f\u003e] generic_perform_write+0xaf/0x1e0\n [\u003c600c4166\u003e] ? file_update_time+0x46/0x110\n [\u003c60072f0f\u003e] __generic_file_write_iter+0x18f/0x1b0\n [\u003c6010030f\u003e] ext4_file_write_iter+0x15f/0x470\n [\u003c60094e10\u003e] ? unlink_file_vma+0x0/0x70\n [\u003c6009b180\u003e] ? unlink_anon_vmas+0x0/0x260\n [\u003c6008f169\u003e] ? free_pgtables+0xb9/0x100\n [\u003c600a6030\u003e] __vfs_write+0xb0/0x130\n [\u003c600a61d5\u003e] vfs_write+0xa5/0x170\n [\u003c600a63d6\u003e] SyS_write+0x56/0xe0\n [\u003c6029fcb0\u003e] ? __libc_waitpid+0x0/0xa0\n [\u003c6001b698\u003e] handle_syscall+0x68/0x90\n [\u003c6002633d\u003e] userspace+0x4fd/0x600\n [\u003c6002274f\u003e] ? save_registers+0x1f/0x40\n [\u003c60028bd7\u003e] ? arch_prctl+0x177/0x1b0\n [\u003c60017bd5\u003e] fork_handler+0x85/0x90\n\nFix the problem by using list_del_init() as we always should with\ni_orphan list.\n\nReported-by: Vegard Nossum \u003cvegard.nossum@oracle.com\u003e\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b2044c3f8310ccac10122f2fa64f8ae574b4bfef", "tree": "98860efe6cdba2d0a875d1e6a3e6c526bf84713c", "parents": [ "c5ce389844f2686564e1217c94c4c3e92fab413d" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Sat Apr 30 00:49:54 2016 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Jun 07 18:14:37 2016 -0700" }, "message": "ext4: clean up error handling when orphan list is corrupted\n\ncommit 7827a7f6ebfcb7f388dc47fddd48567a314701ba upstream.\n\nInstead of just printing warning messages, if the orphan list is\ncorrupted, declare the file system is corrupted. If there are any\nreserved inodes in the orphaned inode list, declare the file system\ncorrupted and stop right away to avoid doing more potential damage to\nthe file system.\n\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c5ce389844f2686564e1217c94c4c3e92fab413d", "tree": "9f3372767a24bf4e89e5610efd3d0bba673ee3d2", "parents": [ "137bd12493e76f610aa56cee1e63e70b3707f6d8" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Sat Apr 30 00:48:54 2016 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Jun 07 18:14:37 2016 -0700" }, "message": "ext4: fix hang when processing corrupted orphaned inode list\n\ncommit c9eb13a9105e2e418f72e46a2b6da3f49e696902 upstream.\n\nIf the orphaned inode list contains inode #5, ext4_iget() returns a\nbad inode (since the bootloader inode should never be referenced\ndirectly). Because of the bad inode, we end up processing the inode\nrepeatedly and this hangs the machine.\n\nThis can be reproduced via:\n\n mke2fs -t ext4 /tmp/foo.img 100\n debugfs -w -R \"ssv last_orphan 5\" /tmp/foo.img\n mount -o loop /tmp/foo.img /mnt\n\n(But don\u0027t do this if you are using an unpatched kernel if you care\nabout the system staying functional. :-)\n\nThis bug was found by the port of American Fuzzy Lop into the kernel\nto find file system problems[1]. (Since it *only* happens if inode #5\nshows up on the orphan list --- 3, 7, 8, etc. won\u0027t do it, it\u0027s not\nsurprising that AFL needed two hours before it found it.)\n\n[1] http://events.linuxfoundation.org/sites/events/files/slides/AFL%20filesystem%20fuzzing%2C%20Vault%202016_0.pdf\n\nReported by: Vegard Nossum \u003cvegard.nossum@oracle.com\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "137bd12493e76f610aa56cee1e63e70b3707f6d8", "tree": "503ffee4b6da9d7d359e6fa7ee9bc44ed0328ca8", "parents": [ "d7d5e9bed91c75e765f9219a58199ce9bf5e3db3" ], "author": { "name": "Philipp Zabel", "email": "p.zabel@pengutronix.de", "time": "Thu May 12 15:00:44 2016 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Jun 07 18:14:37 2016 -0700" }, "message": "drm/imx: Match imx-ipuv3-crtc components using device node in platform data\n\ncommit 310944d148e3600dcff8b346bee7fa01d34903b1 upstream.\n\nThe component master driver imx-drm-core matches component devices using\ntheir of_node. Since commit 950b410dd1ab (\"gpu: ipu-v3: Fix imx-ipuv3-crtc\nmodule autoloading\"), the imx-ipuv3-crtc dev-\u003eof_node is not set during\nprobing. Before that, of_node was set and caused an of: modalias to be\nused instead of the platform: modalias, which broke module autoloading.\n\nOn the other hand, if dev-\u003eof_node is not set yet when the imx-ipuv3-crtc\nprobe function calls component_add, component matching in imx-drm-core\nfails. While dev-\u003eof_node will be set once the next component tries to\nbring up the component master, imx-drm-core component binding will never\nsucceed if one of the crtc devices is probed last.\n\nAdd of_node to the component platform data and match against the\npdata-\u003eof_node instead of dev-\u003eof_node in imx-drm-core to work around\nthis problem.\n\nFixes: 950b410dd1ab (\"gpu: ipu-v3: Fix imx-ipuv3-crtc module autoloading\")\nSigned-off-by: Philipp Zabel \u003cp.zabel@pengutronix.de\u003e\nTested-by: Fabio Estevam \u003cfabio.estevam@nxp.com\u003e\nTested-by: Lothar Waßmann \u003cLW@KARO-electronics.de\u003e\nTested-by: Heiko Schocher \u003chs@denx.de\u003e\nTested-by: Chris Ruehl \u003cchris.ruehl@gtsys.com.hk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" } ], "next": "d7d5e9bed91c75e765f9219a58199ce9bf5e3db3" }