)]}' { "log": [ { "commit": "85f0fec12c58509b0e3717ad07427aa508a2d869", "tree": "091d87d82546752230b79cbecf8f5475d84ec5ec", "parents": [ "dd62bc3058313ef183aeb22d9de2297cb486dd8d" ], "author": { "name": "Eric Biggers", "email": "ebiggers@google.com", "time": "Sat Feb 03 20:30:56 2018 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Mar 28 18:39:20 2018 +0200" }, "message": "libata: fix length validation of ATAPI-relayed SCSI commands\n\ncommit 058f58e235cbe03e923b30ea7c49995a46a8725f upstream.\n\nsyzkaller reported a crash in ata_bmdma_fill_sg() when writing to\n/dev/sg1. The immediate cause was that the ATA command\u0027s scatterlist\nwas not DMA-mapped, which causes \u0027pi - 1\u0027 to underflow, resulting in a\nwrite to \u0027qc-\u003eap-\u003ebmdma_prd[0xffffffff]\u0027.\n\nStrangely though, the flag ATA_QCFLAG_DMAMAP was set in qc-\u003eflags. The\nroot cause is that when __ata_scsi_queuecmd() is preparing to relay a\nSCSI command to an ATAPI device, it doesn\u0027t correctly validate the CDB\nlength before copying it into the 16-byte buffer \u0027cdb\u0027 in \u0027struct\nata_queued_cmd\u0027. Namely, it validates the fixed CDB length expected\nbased on the SCSI opcode but not the actual CDB length, which can be\nlarger due to the use of the SG_NEXT_CMD_LEN ioctl. Since \u0027flags\u0027 is\nthe next member in ata_queued_cmd, a buffer overflow corrupts it.\n\nFix it by requiring that the actual CDB length be \u003c\u003d 16 (ATAPI_CDB_LEN).\n\n[Really it seems the length should be required to be \u003c\u003d dev-\u003ecdb_len,\nbut the current behavior seems to have been intentionally introduced by\ncommit 607126c2a21c (\"libata-scsi: be tolerant of 12-byte ATAPI commands\nin 16-byte CDBs\") to work around a userspace bug in mplayer. Probably\nthe workaround is no longer needed (mplayer was fixed in 2007), but\ncontinuing to allow lengths to up 16 appears harmless for now.]\n\nHere\u0027s a reproducer that works in QEMU when /dev/sg1 refers to the\nCD-ROM drive that qemu-system-x86_64 creates by default:\n\n #include \u003cfcntl.h\u003e\n #include \u003csys/ioctl.h\u003e\n #include \u003cunistd.h\u003e\n\n #define SG_NEXT_CMD_LEN 0x2283\n\n int main()\n {\n\t char buf[53] \u003d { [36] \u003d 0x7e, [52] \u003d 0x02 };\n\t int fd \u003d open(\"/dev/sg1\", O_RDWR);\n\t ioctl(fd, SG_NEXT_CMD_LEN, \u0026(int){ 17 });\n\t write(fd, buf, sizeof(buf));\n }\n\nThe crash was:\n\n BUG: unable to handle kernel paging request at ffff8cb97db37ffc\n IP: ata_bmdma_fill_sg drivers/ata/libata-sff.c:2623 [inline]\n IP: ata_bmdma_qc_prep+0xa4/0xc0 drivers/ata/libata-sff.c:2727\n PGD fb6c067 P4D fb6c067 PUD 0\n Oops: 0002 [#1] SMP\n CPU: 1 PID: 150 Comm: syz_ata_bmdma_q Not tainted 4.15.0-next-20180202 #99\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-20171110_100015-anatol 04/01/2014\n [...]\n Call Trace:\n ata_qc_issue+0x100/0x1d0 drivers/ata/libata-core.c:5421\n ata_scsi_translate+0xc9/0x1a0 drivers/ata/libata-scsi.c:2024\n __ata_scsi_queuecmd drivers/ata/libata-scsi.c:4326 [inline]\n ata_scsi_queuecmd+0x8c/0x210 drivers/ata/libata-scsi.c:4375\n scsi_dispatch_cmd+0xa2/0xe0 drivers/scsi/scsi_lib.c:1727\n scsi_request_fn+0x24c/0x530 drivers/scsi/scsi_lib.c:1865\n __blk_run_queue_uncond block/blk-core.c:412 [inline]\n __blk_run_queue+0x3a/0x60 block/blk-core.c:432\n blk_execute_rq_nowait+0x93/0xc0 block/blk-exec.c:78\n sg_common_write.isra.7+0x272/0x5a0 drivers/scsi/sg.c:806\n sg_write+0x1ef/0x340 drivers/scsi/sg.c:677\n __vfs_write+0x31/0x160 fs/read_write.c:480\n vfs_write+0xa7/0x160 fs/read_write.c:544\n SYSC_write fs/read_write.c:589 [inline]\n SyS_write+0x4d/0xc0 fs/read_write.c:581\n do_syscall_64+0x5e/0x110 arch/x86/entry/common.c:287\n entry_SYSCALL_64_after_hwframe+0x21/0x86\n\nFixes: 607126c2a21c (\"libata-scsi: be tolerant of 12-byte ATAPI commands in 16-byte CDBs\")\nReported-by: syzbot+1ff6f9fcc3c35f1c72a95e26528c8e7e3276e4da@syzkaller.appspotmail.com\nCc: \u003cstable@vger.kernel.org\u003e # v2.6.24+\nSigned-off-by: Eric Biggers \u003cebiggers@google.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "dd62bc3058313ef183aeb22d9de2297cb486dd8d", "tree": "2ba003ced59cb9ca4fd4516bc5baabf9a5f30579", "parents": [ "bdbd9153899061cc9aacfc376b26a2224850c61a" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Mar 15 17:02:34 2018 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Mar 28 18:39:20 2018 +0200" }, "message": "Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174\n\ncommit f44cb4b19ed40b655c2d422c9021ab2c2625adb6 upstream.\n\nThe Atheros 1525/QCA6174 BT doesn\u0027t seem working properly on the\nrecent kernels, as it tries to load a wrong firmware\nar3k/AthrBT_0x00000200.dfu and it fails.\n\nThis seems to have been a problem for some time, and the known\nworkaround is to apply BTUSB_QCA_ROM quirk instead of BTUSB_ATH3012.\n\nThe device in question is:\n\nT: Bus\u003d01 Lev\u003d01 Prnt\u003d01 Port\u003d09 Cnt\u003d03 Dev#\u003d 4 Spd\u003d12 MxCh\u003d 0\nD: Ver\u003d 1.10 Cls\u003de0(wlcon) Sub\u003d01 Prot\u003d01 MxPS\u003d64 #Cfgs\u003d 1\nP: Vendor\u003d0cf3 ProdID\u003d3004 Rev\u003d 0.01\nC:* #Ifs\u003d 2 Cfg#\u003d 1 Atr\u003de0 MxPwr\u003d100mA\nI:* If#\u003d 0 Alt\u003d 0 #EPs\u003d 3 Cls\u003de0(wlcon) Sub\u003d01 Prot\u003d01 Driver\u003dbtusb\nE: Ad\u003d81(I) Atr\u003d03(Int.) MxPS\u003d 16 Ivl\u003d1ms\nE: Ad\u003d82(I) Atr\u003d02(Bulk) MxPS\u003d 64 Ivl\u003d0ms\nE: Ad\u003d02(O) Atr\u003d02(Bulk) MxPS\u003d 64 Ivl\u003d0ms\nI:* If#\u003d 1 Alt\u003d 0 #EPs\u003d 2 Cls\u003de0(wlcon) Sub\u003d01 Prot\u003d01 Driver\u003dbtusb\nE: Ad\u003d83(I) Atr\u003d01(Isoc) MxPS\u003d 0 Ivl\u003d1ms\nE: Ad\u003d03(O) Atr\u003d01(Isoc) MxPS\u003d 0 Ivl\u003d1ms\nI: If#\u003d 1 Alt\u003d 1 #EPs\u003d 2 Cls\u003de0(wlcon) Sub\u003d01 Prot\u003d01 Driver\u003dbtusb\nE: Ad\u003d83(I) Atr\u003d01(Isoc) MxPS\u003d 9 Ivl\u003d1ms\nE: Ad\u003d03(O) Atr\u003d01(Isoc) MxPS\u003d 9 Ivl\u003d1ms\nI: If#\u003d 1 Alt\u003d 2 #EPs\u003d 2 Cls\u003de0(wlcon) Sub\u003d01 Prot\u003d01 Driver\u003dbtusb\nE: Ad\u003d83(I) Atr\u003d01(Isoc) MxPS\u003d 17 Ivl\u003d1ms\nE: Ad\u003d03(O) Atr\u003d01(Isoc) MxPS\u003d 17 Ivl\u003d1ms\nI: If#\u003d 1 Alt\u003d 3 #EPs\u003d 2 Cls\u003de0(wlcon) Sub\u003d01 Prot\u003d01 Driver\u003dbtusb\nE: Ad\u003d83(I) Atr\u003d01(Isoc) MxPS\u003d 25 Ivl\u003d1ms\nE: Ad\u003d03(O) Atr\u003d01(Isoc) MxPS\u003d 25 Ivl\u003d1ms\nI: If#\u003d 1 Alt\u003d 4 #EPs\u003d 2 Cls\u003de0(wlcon) Sub\u003d01 Prot\u003d01 Driver\u003dbtusb\nE: Ad\u003d83(I) Atr\u003d01(Isoc) MxPS\u003d 33 Ivl\u003d1ms\nE: Ad\u003d03(O) Atr\u003d01(Isoc) MxPS\u003d 33 Ivl\u003d1ms\nI: If#\u003d 1 Alt\u003d 5 #EPs\u003d 2 Cls\u003de0(wlcon) Sub\u003d01 Prot\u003d01 Driver\u003dbtusb\nE: Ad\u003d83(I) Atr\u003d01(Isoc) MxPS\u003d 49 Ivl\u003d1ms\nE: Ad\u003d03(O) Atr\u003d01(Isoc) MxPS\u003d 49 Ivl\u003d1ms\n\nBugzilla: http://bugzilla.opensuse.org/show_bug.cgi?id\u003d1082504\nReported-by: Ivan Levshin \u003civan.levshin@microfocus.com\u003e\nTested-by: Ivan Levshin \u003civan.levshin@microfocus.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "bdbd9153899061cc9aacfc376b26a2224850c61a", "tree": "ef7096127035f20cab4a4929ab05a33e396b8504", "parents": [ "8f0dd27b3db01e7785038ea9a711f210067ee6ae" ], "author": { "name": "Chen-Yu Tsai", "email": "wens@csie.org", "time": "Sat Feb 17 21:05:04 2018 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Mar 28 18:39:20 2018 +0200" }, "message": "clk: sunxi-ng: a31: Fix CLK_OUT_* clock ops\n\ncommit 5682e268350f9eccdbb04006605c1b7068a7b323 upstream.\n\nWhen support for the A31/A31s CCU was first added, the clock ops for\nthe CLK_OUT_* clocks was set to the wrong type. The clocks are MP-type,\nbut the ops was set for div (M) clocks. This went unnoticed until now.\nThis was because while they are different clocks, their data structures\naligned in a way that ccu_div_ops would access the second ccu_div_internal\nand ccu_mux_internal structures, which were valid, if not incorrect.\n\nFurthermore, the use of these CLK_OUT_* was for feeding a precise 32.768\nkHz clock signal to the WiFi chip. This was achievable by using the parent\nwith the same clock rate and no divider. So the incorrect divider setting\ndid not affect this usage.\n\nCommit 946797aa3f08 (\"clk: sunxi-ng: Support fixed post-dividers on MP\nstyle clocks\") added a new field to the ccu_mp structure, which broke\nthe aforementioned alignment. Now the system crashes as div_ops tries\nto look up a nonexistent table.\n\nReported-by: Philipp Rossak \u003cembed3d@gmail.com\u003e\nTested-by: Philipp Rossak \u003cembed3d@gmail.com\u003e\nFixes: c6e6c96d8fa6 (\"clk: sunxi-ng: Add A31/A31s clocks\")\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Chen-Yu Tsai \u003cwens@csie.org\u003e\nSigned-off-by: Maxime Ripard \u003cmaxime.ripard@bootlin.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8f0dd27b3db01e7785038ea9a711f210067ee6ae", "tree": "fd4ceb95cb0d7eee2b83d2f72e5486289a81d071", "parents": [ "beb9ece1db9cabbe01b297e7df2e4d6769dad8bc" ], "author": { "name": "Boris Brezillon", "email": "boris.brezillon@bootlin.com", "time": "Thu Feb 08 14:43:36 2018 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Mar 28 18:39:20 2018 +0200" }, "message": "clk: bcm2835: Protect sections updating shared registers\n\ncommit 7997f3b2df751aab0b8e60149b226a32966c41ac upstream.\n\nCM_PLLx and A2W_XOSC_CTRL registers are accessed by different clock\nhandlers and must be accessed with -\u003eregs_lock held.\nUpdate the sections where this protection is missing.\n\nFixes: 41691b8862e2 (\"clk: bcm2835: Add support for programming the audio domain clocks\")\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Boris Brezillon \u003cboris.brezillon@bootlin.com\u003e\nReviewed-by: Eric Anholt \u003ceric@anholt.net\u003e\nSigned-off-by: Stephen Boyd \u003csboyd@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "beb9ece1db9cabbe01b297e7df2e4d6769dad8bc", "tree": "0167124b4c98fc8e8fa28e5e230d92d5f7a674d3", "parents": [ "3ba5143bbbed8bd0ab2ee85a46f1165ff3039232" ], "author": { "name": "Boris Brezillon", "email": "boris.brezillon@bootlin.com", "time": "Thu Feb 08 14:43:35 2018 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Mar 28 18:39:19 2018 +0200" }, "message": "clk: bcm2835: Fix ana-\u003emaskX definitions\n\ncommit 49012d1bf5f78782d398adb984a080a88ba42965 upstream.\n\nana-\u003emaskX values are already \u0027~\u0027-ed in bcm2835_pll_set_rate(). Remove\nthe \u0027~\u0027 in the definition to fix ANA setup.\n\nNote that this commit fixes a long standing bug preventing one from\nusing an HDMI display if it\u0027s plugged after the FW has booted Linux.\nThis is because PLLH is used by the HDMI encoder to generate the pixel\nclock.\n\nFixes: 41691b8862e2 (\"clk: bcm2835: Add support for programming the audio domain clocks\")\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Boris Brezillon \u003cboris.brezillon@bootlin.com\u003e\nReviewed-by: Eric Anholt \u003ceric@anholt.net\u003e\nSigned-off-by: Stephen Boyd \u003csboyd@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "3ba5143bbbed8bd0ab2ee85a46f1165ff3039232", "tree": "a47641a283b1ace3cbf92af6b8ffe72d37b15fe0", "parents": [ "d2327a25e43a7843d65f5bab3daeb833c5caf63f" ], "author": { "name": "Hans de Goede", "email": "hdegoede@redhat.com", "time": "Fri Mar 02 11:36:32 2018 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Mar 28 18:39:19 2018 +0200" }, "message": "ahci: Add PCI-id for the Highpoint Rocketraid 644L card\n\ncommit 28b2182dad43f6f8fcbd167539a26714fd12bd64 upstream.\n\nLike the Highpoint Rocketraid 642L and cards using a Marvel 88SE9235\ncontroller in general, this RAID card also supports AHCI mode and short\nof a custom driver, this is the only way to make it work under Linux.\n\nNote that even though the card is called to 644L, it has a product-id\nof 0x0645.\n\nCc: stable@vger.kernel.org\nBugLink: https://bugzilla.redhat.com/show_bug.cgi?id\u003d1534106\nSigned-off-by: Hans de Goede \u003chdegoede@redhat.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nAcked-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d2327a25e43a7843d65f5bab3daeb833c5caf63f", "tree": "339f507d88d481e9a42164c8b24f7107d8982809", "parents": [ "d8963938399a4b066448dd2a8dd100fb4e91fef8" ], "author": { "name": "Hans de Goede", "email": "hdegoede@redhat.com", "time": "Fri Mar 02 11:36:33 2018 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Mar 28 18:39:19 2018 +0200" }, "message": "PCI: Add function 1 DMA alias quirk for Highpoint RocketRAID 644L\n\ncommit 1903be8222b7c278ca897c129ce477c1dd6403a8 upstream.\n\nThe Highpoint RocketRAID 644L uses a Marvel 88SE9235 controller, as with\nother Marvel controllers this needs a function 1 DMA alias quirk.\n\nNote the RocketRAID 642L uses the same Marvel 88SE9235 controller and\nalready is listed with a function 1 DMA alias quirk.\n\nCc: stable@vger.kernel.org\nBugLink: https://bugzilla.redhat.com/show_bug.cgi?id\u003d1534106\nSigned-off-by: Hans de Goede \u003chdegoede@redhat.com\u003e\nAcked-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d8963938399a4b066448dd2a8dd100fb4e91fef8", "tree": "4a2c6ddaa66f4896446e04b71bc547e4e616e4e3", "parents": [ "ff0b03a460b12bcafa0cccd6c2dd8ce89340d986" ], "author": { "name": "Evgeniy Didin", "email": "Evgeniy.Didin@synopsys.com", "time": "Wed Mar 14 22:30:51 2018 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Mar 28 18:39:19 2018 +0200" }, "message": "mmc: dw_mmc: fix falling from idmac to PIO mode when dw_mci_reset occurs\n\ncommit 47b7de2f6c18f75d1f2716efe752cba43f32a626 upstream.\n\nIt was found that in IDMAC mode after soft-reset driver switches\nto PIO mode.\n\nThat\u0027s what happens in case of DTO timeout overflow calculation failure:\n1. soft-reset is called\n2. driver restarts dma\n3. descriptors states are checked, one of descriptor is owned by the IDMAC.\n4. driver can\u0027t use DMA and then switches to PIO mode.\n\nFailure was already fixed in:\nhttps://www.spinics.net/lists/linux-mmc/msg48125.html.\n\nBehaviour while soft-reset is not something we except or\neven want to happen. So we switch from dw_mci_idmac_reset\nto dw_mci_idmac_init, so descriptors are cleaned before starting dma.\n\nAnd while at it explicitly zero des0 which otherwise might\ncontain garbage as being allocated by dmam_alloc_coherent().\n\nSigned-off-by: Evgeniy Didin \u003cEvgeniy.Didin@synopsys.com\u003e\nCc: Jaehoon Chung \u003cjh80.chung@samsung.com\u003e\nCc: Ulf Hansson \u003culf.hansson@linaro.org\u003e\nCc: Andy Shevchenko \u003candy.shevchenko@gmail.com\u003e\nCc: Jisheng Zhang \u003cJisheng.Zhang@synaptics.com\u003e\nCc: Shawn Lin \u003cshawn.lin@rock-chips.com\u003e\nCc: Alexey Brodkin \u003cabrodkin@synopsys.com\u003e\nCc: Eugeniy Paltsev \u003cEugeniy.Paltsev@synopsys.com\u003e\nCc: linux-snps-arc@lists.infradead.org\nCc: \u003cstable@vger.kernel.org\u003e # 4.4+\nSigned-off-by: Ulf Hansson \u003culf.hansson@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ff0b03a460b12bcafa0cccd6c2dd8ce89340d986", "tree": "1654ff43b1254913eebc2d3da1c1dcbee6dcd9b7", "parents": [ "789697007799297173bfb388cc7a71417b31273a" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Sat Mar 17 22:40:18 2018 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Mar 28 18:39:19 2018 +0200" }, "message": "ALSA: hda/realtek - Always immediately update mute LED with pin VREF\n\ncommit e40bdb03d3cd7da66bd0bc1e40cbcfb49351265c upstream.\n\nSome HP laptops have a mute mute LED controlled by a pin VREF. The\nRealtek codec driver updates the VREF via vmaster hook by calling\nsnd_hda_set_pin_ctl_cache().\n\nThis works fine as long as the driver is running in a normal mode.\nHowever, when the VREF change happens during the codec being in\nruntime PM suspend, the regmap access will skip and postpone the\nactual register change. This ends up with the unchanged LED status\nuntil the next runtime PM resume even if you change the Master mute\nswitch. (Interestingly, the machine keeps the LED status even after\nthe codec goes into D3 -- but it\u0027s another story.)\n\nFor improving this usability, let the driver temporarily powering up /\ndown only during the pin VREF change. This can be achieved easily by\nwrapping the call with snd_hda_power_up_pm() / *_down_pm().\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id\u003d199073\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "789697007799297173bfb388cc7a71417b31273a", "tree": "1f9889a6509ccc2fa22bc74a108174199a83dbad", "parents": [ "d44f3ad7b06b84cff1c9f74efa3e4305c7b3e177" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Mar 22 10:40:27 2018 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Mar 28 18:39:19 2018 +0200" }, "message": "ALSA: aloop: Fix access to not-yet-ready substream via cable\n\ncommit 8e6b1a72a75bb5067ccb6b56d8ca4aa3a300a64e upstream.\n\nIn loopback_open() and loopback_close(), we assign and release the\nsubstream object to the corresponding cable in a racy way. It\u0027s\nneither locked nor done in the right position. The open callback\nassigns the substream before its preparation finishes, hence the other\nside of the cable may pick it up, which may lead to the invalid memory\naccess.\n\nThis patch addresses these: move the assignment to the end of the open\ncallback, and wrap with cable-\u003elock for avoiding concurrent accesses.\n\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d44f3ad7b06b84cff1c9f74efa3e4305c7b3e177", "tree": "274cfd7725d4738478d4d0c98d7bd64d395fb401", "parents": [ "b1d25da581e5f36c5a6cea0fca7db3bb2b6573ad" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Mar 22 08:56:06 2018 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Mar 28 18:39:19 2018 +0200" }, "message": "ALSA: aloop: Sync stale timer before release\n\ncommit 67a01afaf3d34893cf7d2ea19b34555d6abb7cb0 upstream.\n\nThe aloop driver tries to stop the pending timer via timer_del() in\nthe trigger callback and in the close callback. The former is\ncorrect, as it\u0027s an atomic operation, while the latter expects that\nthe timer gets really removed and proceeds the resource releases after\nthat. But timer_del() doesn\u0027t synchronize, hence the running timer\nmay still access the released resources.\n\nA similar situation can be also seen in the prepare callback after\ntrigger(STOP) where the prepare tries to re-initialize the things\nwhile a timer is still running.\n\nThe problems like the above are seen indirectly in some syzkaller\nreports (although it\u0027s not 100% clear whether this is the only cause,\nas the race condition is quite narrow and not always easy to\ntrigger).\n\nFor addressing these issues, this patch adds the explicit alls of\ntimer_del_sync() in some places, so that the pending timer is properly\nkilled / synced.\n\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b1d25da581e5f36c5a6cea0fca7db3bb2b6573ad", "tree": "40e4dcf801d5cc05b32eeab0cc97f5febc24037b", "parents": [ "055c49dcf10fe7db6087037abb87728e7dc84192" ], "author": { "name": "Kirill Marinushkin", "email": "k.marinushkin@gmail.com", "time": "Mon Mar 19 07:11:08 2018 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Mar 28 18:39:19 2018 +0200" }, "message": "ALSA: usb-audio: Fix parsing descriptor of UAC2 processing unit\n\ncommit a6618f4aedb2b60932d766bd82ae7ce866e842aa upstream.\n\nCurrently, the offsets in the UAC2 processing unit descriptor are\ncalculated incorrectly. It causes an issue when connecting the device which\nprovides such a feature:\n\n~~~~\n[84126.724420] usb 1-1.3.1: invalid Processing Unit descriptor (id 18)\n~~~~\n\nAfter this patch is applied, the UAC2 processing unit inits w/o this error.\n\nFixes: 23caaf19b11e (\"ALSA: usb-mixer: Add support for Audio Class v2.0\")\nSigned-off-by: Kirill Marinushkin \u003ck.marinushkin@gmail.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "055c49dcf10fe7db6087037abb87728e7dc84192", "tree": "133ed65759255d17454fc1fc96324cdade726628", "parents": [ "3eaa5de1101627899c0cfb986588a969969fdabc" ], "author": { "name": "Michael Nosthoff", "email": "committed@heine.so", "time": "Fri Mar 09 10:02:45 2018 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Mar 28 18:39:19 2018 +0200" }, "message": "iio: st_pressure: st_accel: pass correct platform data to init\n\ncommit 8b438686a001db64c21782d04ef68111e53c45d9 upstream.\n\nCommit 7383d44b added a pointer pdata which get set to the default\nplatform_data when non was defined in the device. But it did not\npass this pointer to the st_sensors_init_sensor call but still\nused the maybe uninitialized platform_data from dev.\n\nThis breaks initialization when no platform_data is given and\nthe optional st,drdy-int-pin devicetree option is not set.\n\nThis commit fixes this.\n\nCc: stable@vger.kernel.org\nFixes: 7383d44b (\"iio: st_pressure: st_accel: Initialise sensor platform data properly\")\nSigned-off-by: Michael Nosthoff \u003ccommitted@heine.so\u003e\nSigned-off-by: Jonathan Cameron \u003cJonathan.Cameron@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "3eaa5de1101627899c0cfb986588a969969fdabc", "tree": "50962239e0859aadfc3367a04dcf1de899d90bf5", "parents": [ "24f70aa804cd7f8fee4353cf4990997d1c8375ae" ], "author": { "name": "NeilBrown", "email": "neil@brown.name", "time": "Tue Mar 20 19:29:51 2018 +1100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Mar 28 18:39:18 2018 +0200" }, "message": "MIPS: ralink: Remove ralink_halt()\n\ncommit 891731f6a5dbe508d12443175a7e166a2fba616a upstream.\n\nralink_halt() does nothing that machine_halt() doesn\u0027t already do, so it\nadds no value.\n\nIt actually causes incorrect behaviour due to the \"unreachable()\" at the\nend. This tells the compiler that the end of the function will never be\nreached, which isn\u0027t true. The compiler responds by not adding a\n\u0027return\u0027 instruction, so control simply moves on to whatever bytes come\nafterwards in memory. In my tested, that was the ralink_restart()\nfunction. This means that an attempt to \u0027halt\u0027 the machine would\nactually cause a reboot.\n\nSo remove ralink_halt() so that a \u0027halt\u0027 really does halt.\n\nFixes: c06e836ada59 (\"MIPS: ralink: adds reset code\")\nSigned-off-by: NeilBrown \u003cneil@brown.name\u003e\nCc: John Crispin \u003cjohn@phrozen.org\u003e\nCc: Ralf Baechle \u003cralf@linux-mips.org\u003e\nCc: linux-mips@linux-mips.org\nCc: \u003cstable@vger.kernel.org\u003e # 3.9+\nPatchwork: https://patchwork.linux-mips.org/patch/18851/\nSigned-off-by: James Hogan \u003cjhogan@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "24f70aa804cd7f8fee4353cf4990997d1c8375ae", "tree": "a7003b7c78d4e11f51ecbea14be812dc782b7d90", "parents": [ "8dd5c0c47332c67a04830e3842d4d6282f1824fd" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:27 2018 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:27 2018 +0100" }, "message": "Linux 4.9.90\n" }, { "commit": "8dd5c0c47332c67a04830e3842d4d6282f1824fd", "tree": "852168d10c590c45c37227c013a217eacaf67687", "parents": [ "805cbd500ee258f8c8e5c0c709389fffd70994eb" ], "author": { "name": "Krzysztof Opasiak", "email": "kopasiak90@gmail.com", "time": "Tue Jan 24 03:27:24 2017 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:27 2018 +0100" }, "message": "usb: gadget: f_hid: fix: Move IN request allocation to set_alt()\n\ncommit 749494b6bdbbaf0899aa1c62a1ad74cd747bce47 upstream.\n\nSince commit: ba1582f22231 (\"usb: gadget: f_hid: use alloc_ep_req()\")\nwe cannot allocate any requests in bind() as we check if we should\nalign request buffer based on endpoint descriptor which is assigned\nin set_alt().\n\nAllocating request in bind() function causes a NULL pointer\ndereference.\n\nThis commit moves allocation of IN request from bind() to set_alt()\nto prevent this issue.\n\nFixes: ba1582f22231 (\"usb: gadget: f_hid: use alloc_ep_req()\")\nCc: stable@vger.kernel.org\nTested-by: David Lechner \u003cdavid@lechnology.com\u003e\nSigned-off-by: Krzysztof Opasiak \u003ck.opasiak@samsung.com\u003e\nSigned-off-by: Felipe Balbi \u003cfelipe.balbi@linux.intel.com\u003e\nCc: Bin Liu \u003cb-liu@ti.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "805cbd500ee258f8c8e5c0c709389fffd70994eb", "tree": "2263a9e275c7e905e1cc72ae5377927b0b7c3d94", "parents": [ "e3fb6525c99c2ac9940953f421e4e7d1e354b0e6" ], "author": { "name": "Leon Romanovsky", "email": "leonro@mellanox.com", "time": "Tue Mar 13 18:37:27 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:27 2018 +0100" }, "message": "RDMA/ucma: Don\u0027t allow join attempts for unsupported AF family\n\ncommit 0c81ffc60d5280991773d17e84bda605387148b1 upstream.\n\nUsers can provide garbage while calling to ucma_join_ip_multicast(),\nit will indirectly cause to rdma_addr_size() return 0, making the\ncall to ucma_process_join(), which had the right checks, but it is\nbetter to check the input as early as possible.\n\nThe following crash from syzkaller revealed it.\n\nkernel BUG at lib/string.c:1052!\ninvalid opcode: 0000 [#1] SMP KASAN Dumping ftrace buffer:\n (ftrace buffer empty)\nModules linked in:\nCPU: 0 PID: 4113 Comm: syz-executor0 Not tainted 4.16.0-rc5+ #261\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nRIP: 0010:fortify_panic+0x13/0x20 lib/string.c:1051\nRSP: 0018:ffff8801ca81f8f0 EFLAGS: 00010286\nRAX: 0000000000000022 RBX: 1ffff10039503f23 RCX: 0000000000000000\nRDX: 0000000000000022 RSI: 1ffff10039503ed3 RDI: ffffed0039503f12\nRBP: ffff8801ca81f8f0 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000006 R11: 0000000000000000 R12: ffff8801ca81f998\nR13: ffff8801ca81f938 R14: ffff8801ca81fa58 R15: 000000000000fa00\nFS: 0000000000000000(0000) GS:ffff8801db200000(0063) knlGS:000000000a12a900\nCS: 0010 DS: 002b ES: 002b CR0: 0000000080050033\nCR2: 0000000008138024 CR3: 00000001cbb58004 CR4: 00000000001606f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n memcpy include/linux/string.h:344 [inline]\n ucma_join_ip_multicast+0x36b/0x3b0 drivers/infiniband/core/ucma.c:1421\n ucma_write+0x2d6/0x3d0 drivers/infiniband/core/ucma.c:1633\n __vfs_write+0xef/0x970 fs/read_write.c:480\n vfs_write+0x189/0x510 fs/read_write.c:544\n SYSC_write fs/read_write.c:589 [inline]\n SyS_write+0xef/0x220 fs/read_write.c:581\n do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]\n do_fast_syscall_32+0x3ec/0xf9f arch/x86/entry/common.c:392\n entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139\nRIP: 0023:0xf7f9ec99\nRSP: 002b:00000000ff8172cc EFLAGS: 00000282 ORIG_RAX: 0000000000000004\nRAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020000100\nRDX: 0000000000000063 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\nCode: 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b 48 89 df e8 42 2c e3 fb eb de\n55 48 89 fe 48 c7 c7 80 75 98 86 48 89 e5 e8 85 95 94 fb \u003c0f\u003e 0b 90 90 90 90\n90 90 90 90 90 90 90 55 48 89 e5 41 57 41 56\nRIP: fortify_panic+0x13/0x20 lib/string.c:1051 RSP: ffff8801ca81f8f0\n\nFixes: 5bc2b7b397b0 (\"RDMA/ucma: Allow user space to specify AF_IB when joining multicast\")\nReported-by: \u003csyzbot+2287ac532caa81900a4e@syzkaller.appspotmail.com\u003e\nSigned-off-by: Leon Romanovsky \u003cleonro@mellanox.com\u003e\nReviewed-by: Sean Hefty \u003csean.hefty@intel.com\u003e\nSigned-off-by: Doug Ledford \u003cdledford@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e3fb6525c99c2ac9940953f421e4e7d1e354b0e6", "tree": "ccec9ee25f701b0323c5e75632fbca094c89d866", "parents": [ "bbdfb44745abd2daa8af06e553d7628570daf250" ], "author": { "name": "Leon Romanovsky", "email": "leonro@mellanox.com", "time": "Tue Mar 13 11:43:23 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:27 2018 +0100" }, "message": "RDMA/ucma: Fix access to non-initialized CM_ID object\n\ncommit 7688f2c3bbf55e52388e37ac5d63ca471a7712e1 upstream.\n\nThe attempt to join multicast group without ensuring that CMA device\nexists will lead to the following crash reported by syzkaller.\n\n[ 64.076794] BUG: KASAN: null-ptr-deref in rdma_join_multicast+0x26e/0x12c0\n[ 64.076797] Read of size 8 at addr 00000000000000b0 by task join/691\n[ 64.076797]\n[ 64.076800] CPU: 1 PID: 691 Comm: join Not tainted 4.16.0-rc1-00219-gb97853b65b93 #23\n[ 64.076802] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.0-0-g63451fca13-prebuilt.qemu-proj4\n[ 64.076803] Call Trace:\n[ 64.076809] dump_stack+0x5c/0x77\n[ 64.076817] kasan_report+0x163/0x380\n[ 64.085859] ? rdma_join_multicast+0x26e/0x12c0\n[ 64.086634] rdma_join_multicast+0x26e/0x12c0\n[ 64.087370] ? rdma_disconnect+0xf0/0xf0\n[ 64.088579] ? __radix_tree_replace+0xc3/0x110\n[ 64.089132] ? node_tag_clear+0x81/0xb0\n[ 64.089606] ? idr_alloc_u32+0x12e/0x1a0\n[ 64.090517] ? __fprop_inc_percpu_max+0x150/0x150\n[ 64.091768] ? tracing_record_taskinfo+0x10/0xc0\n[ 64.092340] ? idr_alloc+0x76/0xc0\n[ 64.092951] ? idr_alloc_u32+0x1a0/0x1a0\n[ 64.093632] ? ucma_process_join+0x23d/0x460\n[ 64.094510] ucma_process_join+0x23d/0x460\n[ 64.095199] ? ucma_migrate_id+0x440/0x440\n[ 64.095696] ? futex_wake+0x10b/0x2a0\n[ 64.096159] ucma_join_multicast+0x88/0xe0\n[ 64.096660] ? ucma_process_join+0x460/0x460\n[ 64.097540] ? _copy_from_user+0x5e/0x90\n[ 64.098017] ucma_write+0x174/0x1f0\n[ 64.098640] ? ucma_resolve_route+0xf0/0xf0\n[ 64.099343] ? rb_erase_cached+0x6c7/0x7f0\n[ 64.099839] __vfs_write+0xc4/0x350\n[ 64.100622] ? perf_syscall_enter+0xe4/0x5f0\n[ 64.101335] ? kernel_read+0xa0/0xa0\n[ 64.103525] ? perf_sched_cb_inc+0xc0/0xc0\n[ 64.105510] ? syscall_exit_register+0x2a0/0x2a0\n[ 64.107359] ? __switch_to+0x351/0x640\n[ 64.109285] ? fsnotify+0x899/0x8f0\n[ 64.111610] ? fsnotify_unmount_inodes+0x170/0x170\n[ 64.113876] ? __fsnotify_update_child_dentry_flags+0x30/0x30\n[ 64.115813] ? ring_buffer_record_is_on+0xd/0x20\n[ 64.117824] ? __fget+0xa8/0xf0\n[ 64.119869] vfs_write+0xf7/0x280\n[ 64.122001] SyS_write+0xa1/0x120\n[ 64.124213] ? SyS_read+0x120/0x120\n[ 64.126644] ? SyS_read+0x120/0x120\n[ 64.128563] do_syscall_64+0xeb/0x250\n[ 64.130732] entry_SYSCALL_64_after_hwframe+0x21/0x86\n[ 64.132984] RIP: 0033:0x7f5c994ade99\n[ 64.135699] RSP: 002b:00007f5c99b97d98 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\n[ 64.138740] RAX: ffffffffffffffda RBX: 00000000200001e4 RCX: 00007f5c994ade99\n[ 64.141056] RDX: 00000000000000a0 RSI: 00000000200001c0 RDI: 0000000000000015\n[ 64.143536] RBP: 00007f5c99b97ec0 R08: 0000000000000000 R09: 0000000000000000\n[ 64.146017] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5c99b97fc0\n[ 64.148608] R13: 0000000000000000 R14: 00007fff660e1c40 R15: 00007f5c99b989c0\n[ 64.151060]\n[ 64.153703] Disabling lock debugging due to kernel taint\n[ 64.156032] BUG: unable to handle kernel NULL pointer dereference at 00000000000000b0\n[ 64.159066] IP: rdma_join_multicast+0x26e/0x12c0\n[ 64.161451] PGD 80000001d0298067 P4D 80000001d0298067 PUD 1dea39067 PMD 0\n[ 64.164442] Oops: 0000 [#1] SMP KASAN PTI\n[ 64.166817] CPU: 1 PID: 691 Comm: join Tainted: G B 4.16.0-rc1-00219-gb97853b65b93 #23\n[ 64.170004] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.0-0-g63451fca13-prebuilt.qemu-proj4\n[ 64.174985] RIP: 0010:rdma_join_multicast+0x26e/0x12c0\n[ 64.177246] RSP: 0018:ffff8801c8207860 EFLAGS: 00010282\n[ 64.179901] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff94789522\n[ 64.183344] RDX: 1ffffffff2d50fa5 RSI: 0000000000000297 RDI: 0000000000000297\n[ 64.186237] RBP: ffff8801c8207a50 R08: 0000000000000000 R09: ffffed0039040ea7\n[ 64.189328] R10: 0000000000000001 R11: ffffed0039040ea6 R12: 0000000000000000\n[ 64.192634] R13: 0000000000000000 R14: ffff8801e2022800 R15: ffff8801d4ac2400\n[ 64.196105] FS: 00007f5c99b98700(0000) GS:ffff8801e5d00000(0000) knlGS:0000000000000000\n[ 64.199211] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 64.202046] CR2: 00000000000000b0 CR3: 00000001d1c48004 CR4: 00000000003606a0\n[ 64.205032] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 64.208221] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[ 64.211554] Call Trace:\n[ 64.213464] ? rdma_disconnect+0xf0/0xf0\n[ 64.216124] ? __radix_tree_replace+0xc3/0x110\n[ 64.219337] ? node_tag_clear+0x81/0xb0\n[ 64.222140] ? idr_alloc_u32+0x12e/0x1a0\n[ 64.224422] ? __fprop_inc_percpu_max+0x150/0x150\n[ 64.226588] ? tracing_record_taskinfo+0x10/0xc0\n[ 64.229763] ? idr_alloc+0x76/0xc0\n[ 64.232186] ? idr_alloc_u32+0x1a0/0x1a0\n[ 64.234505] ? ucma_process_join+0x23d/0x460\n[ 64.237024] ucma_process_join+0x23d/0x460\n[ 64.240076] ? ucma_migrate_id+0x440/0x440\n[ 64.243284] ? futex_wake+0x10b/0x2a0\n[ 64.245302] ucma_join_multicast+0x88/0xe0\n[ 64.247783] ? ucma_process_join+0x460/0x460\n[ 64.250841] ? _copy_from_user+0x5e/0x90\n[ 64.253878] ucma_write+0x174/0x1f0\n[ 64.257008] ? ucma_resolve_route+0xf0/0xf0\n[ 64.259877] ? rb_erase_cached+0x6c7/0x7f0\n[ 64.262746] __vfs_write+0xc4/0x350\n[ 64.265537] ? perf_syscall_enter+0xe4/0x5f0\n[ 64.267792] ? kernel_read+0xa0/0xa0\n[ 64.270358] ? perf_sched_cb_inc+0xc0/0xc0\n[ 64.272575] ? syscall_exit_register+0x2a0/0x2a0\n[ 64.275367] ? __switch_to+0x351/0x640\n[ 64.277700] ? fsnotify+0x899/0x8f0\n[ 64.280530] ? fsnotify_unmount_inodes+0x170/0x170\n[ 64.283156] ? __fsnotify_update_child_dentry_flags+0x30/0x30\n[ 64.286182] ? ring_buffer_record_is_on+0xd/0x20\n[ 64.288749] ? __fget+0xa8/0xf0\n[ 64.291136] vfs_write+0xf7/0x280\n[ 64.292972] SyS_write+0xa1/0x120\n[ 64.294965] ? SyS_read+0x120/0x120\n[ 64.297474] ? SyS_read+0x120/0x120\n[ 64.299751] do_syscall_64+0xeb/0x250\n[ 64.301826] entry_SYSCALL_64_after_hwframe+0x21/0x86\n[ 64.304352] RIP: 0033:0x7f5c994ade99\n[ 64.306711] RSP: 002b:00007f5c99b97d98 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\n[ 64.309577] RAX: ffffffffffffffda RBX: 00000000200001e4 RCX: 00007f5c994ade99\n[ 64.312334] RDX: 00000000000000a0 RSI: 00000000200001c0 RDI: 0000000000000015\n[ 64.315783] RBP: 00007f5c99b97ec0 R08: 0000000000000000 R09: 0000000000000000\n[ 64.318365] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5c99b97fc0\n[ 64.320980] R13: 0000000000000000 R14: 00007fff660e1c40 R15: 00007f5c99b989c0\n[ 64.323515] Code: e8 e8 79 08 ff 4c 89 ff 45 0f b6 a7 b8 01 00 00 e8 68 7c 08 ff 49 8b 1f 4d 89 e5 49 c1 e4 04 48 8\n[ 64.330753] RIP: rdma_join_multicast+0x26e/0x12c0 RSP: ffff8801c8207860\n[ 64.332979] CR2: 00000000000000b0\n[ 64.335550] ---[ end trace 0c00c17a408849c1 ]---\n\nReported-by: \u003csyzbot+e6aba77967bd72cbc9d6@syzkaller.appspotmail.com\u003e\nFixes: c8f6a362bf3e (\"RDMA/cma: Add multicast communication support\")\nSigned-off-by: Leon Romanovsky \u003cleonro@mellanox.com\u003e\nReviewed-by: Sean Hefty \u003csean.hefty@intel.com\u003e\nSigned-off-by: Doug Ledford \u003cdledford@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "bbdfb44745abd2daa8af06e553d7628570daf250", "tree": "65289e1789d9bdef0e034094ecdd189b0b4dbb10", "parents": [ "971e09c7be1c051272663cd552c4a815d6f7a151" ], "author": { "name": "Jerome Brunet", "email": "jbrunet@baylibre.com", "time": "Wed Feb 14 14:43:36 2018 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:26 2018 +0100" }, "message": "clk: migrate the count of orphaned clocks at init\n\ncommit 99652a469df19086d594e8e89757d4081a812789 upstream.\n\nThe orphan clocks reparents should migrate any existing count from the\norphan clock to its new acestor clocks, otherwise we may have\ninconsistent counts in the tree and end-up with gated critical clocks\n\nAssuming we have two clocks, A and B.\n* Clock A has CLK_IS_CRITICAL flag set.\n* Clock B is an ancestor of A which can gate. Clock B gate is left\n enabled by the bootloader.\n\nStep 1: Clock A is registered. Since it is a critical clock, it is\nenabled. The clock being still an orphan, no parent are enabled.\n\nStep 2: Clock B is registered and reparented to clock A (potentially\nthrough several other clocks). We are now in situation where the enable\ncount of clock A is 1 while the enable count of its ancestors is 0, which\nis not good.\n\nStep 3: in lateinit, clk_disable_unused() is called, the enable_count of\nclock B being 0, clock B is gated and and critical clock A actually gets\ndisabled.\n\nThis situation was found while adding fdiv_clk gates to the meson8b\nplatform. These clocks parent clk81 critical clock, which is the mother\nof all peripheral clocks in this system. Because of the issue described\nhere, the system is crashing when clk_disable_unused() is called.\n\nThe situation is solved by reverting\ncommit f8f8f1d04494 (\"clk: Don\u0027t touch hardware when reparenting during registration\").\nTo avoid breaking again the situation described in this commit\ndescription, enabling critical clock should be done before walking the\norphan list. This way, a parent critical clock may not be accidentally\ndisabled due to the CLK_OPS_PARENT_ENABLE mechanism.\n\nFixes: f8f8f1d04494 (\"clk: Don\u0027t touch hardware when reparenting during registration\")\nCc: Stephen Boyd \u003csboyd@codeaurora.org\u003e\nCc: Shawn Guo \u003cshawnguo@kernel.org\u003e\nCc: Dong Aisheng \u003caisheng.dong@nxp.com\u003e\nSigned-off-by: Jerome Brunet \u003cjbrunet@baylibre.com\u003e\nTested-by: Marek Szyprowski \u003cm.szyprowski@samsung.com\u003e\nTested-by: Heiko Stuebner \u003cheiko@sntech.de\u003e\nSigned-off-by: Michael Turquette \u003cmturquette@baylibre.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "971e09c7be1c051272663cd552c4a815d6f7a151", "tree": "2716f53b608d6b0e0b8bb4d5fae23a6a0198e03e", "parents": [ "e2ee1a1843e5cf0e4040d006d6895262e47332d4" ], "author": { "name": "Boris Pismenny", "email": "borisp@mellanox.com", "time": "Thu Mar 08 15:51:40 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:26 2018 +0100" }, "message": "IB/mlx5: Fix out-of-bounds read in create_raw_packet_qp_rq\n\ncommit 2c292dbb398ee46fc1343daf6c3cf9715a75688e upstream.\n\nAdd a check for the length of the qpin structure to prevent out-of-bounds reads\n\nBUG: KASAN: slab-out-of-bounds in create_raw_packet_qp+0x114c/0x15e2\nRead of size 8192 at addr ffff880066b99290 by task syz-executor3/549\n\nCPU: 3 PID: 549 Comm: syz-executor3 Not tainted 4.15.0-rc2+ #27 Hardware\nname: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org 04/01/2014\nCall Trace:\n dump_stack+0x8d/0xd4\n print_address_description+0x73/0x290\n kasan_report+0x25c/0x370\n ? create_raw_packet_qp+0x114c/0x15e2\n memcpy+0x1f/0x50\n create_raw_packet_qp+0x114c/0x15e2\n ? create_raw_packet_qp_tis.isra.28+0x13d/0x13d\n ? lock_acquire+0x370/0x370\n create_qp_common+0x2245/0x3b50\n ? destroy_qp_user.isra.47+0x100/0x100\n ? kasan_kmalloc+0x13d/0x170\n ? sched_clock_cpu+0x18/0x180\n ? fs_reclaim_acquire.part.15+0x5/0x30\n ? __lock_acquire+0xa11/0x1da0\n ? sched_clock_cpu+0x18/0x180\n ? kmem_cache_alloc_trace+0x17e/0x310\n ? mlx5_ib_create_qp+0x30e/0x17b0\n mlx5_ib_create_qp+0x33d/0x17b0\n ? sched_clock_cpu+0x18/0x180\n ? create_qp_common+0x3b50/0x3b50\n ? lock_acquire+0x370/0x370\n ? __radix_tree_lookup+0x180/0x220\n ? uverbs_try_lock_object+0x68/0xc0\n ? rdma_lookup_get_uobject+0x114/0x240\n create_qp.isra.5+0xce4/0x1e20\n ? ib_uverbs_ex_create_cq_cb+0xa0/0xa0\n ? copy_ah_attr_from_uverbs.isra.2+0xa00/0xa00\n ? ib_uverbs_cq_event_handler+0x160/0x160\n ? __might_fault+0x17c/0x1c0\n ib_uverbs_create_qp+0x21b/0x2a0\n ? ib_uverbs_destroy_cq+0x2e0/0x2e0\n ib_uverbs_write+0x55a/0xad0\n ? ib_uverbs_destroy_cq+0x2e0/0x2e0\n ? ib_uverbs_destroy_cq+0x2e0/0x2e0\n ? ib_uverbs_open+0x760/0x760\n ? futex_wake+0x147/0x410\n ? check_prev_add+0x1680/0x1680\n ? do_futex+0x3d3/0xa60\n ? sched_clock_cpu+0x18/0x180\n __vfs_write+0xf7/0x5c0\n ? ib_uverbs_open+0x760/0x760\n ? kernel_read+0x110/0x110\n ? lock_acquire+0x370/0x370\n ? __fget+0x264/0x3b0\n vfs_write+0x18a/0x460\n SyS_write+0xc7/0x1a0\n ? SyS_read+0x1a0/0x1a0\n ? trace_hardirqs_on_thunk+0x1a/0x1c\n entry_SYSCALL_64_fastpath+0x18/0x85\nRIP: 0033:0x4477b9\nRSP: 002b:00007f1822cadc18 EFLAGS: 00000292 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000004477b9\nRDX: 0000000000000070 RSI: 000000002000a000 RDI: 0000000000000005\nRBP: 0000000000708000 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000292 R12: 00000000ffffffff\nR13: 0000000000005d70 R14: 00000000006e6e30 R15: 0000000020010ff0\n\nAllocated by task 549:\n __kmalloc+0x15e/0x340\n kvmalloc_node+0xa1/0xd0\n create_user_qp.isra.46+0xd42/0x1610\n create_qp_common+0x2e63/0x3b50\n mlx5_ib_create_qp+0x33d/0x17b0\n create_qp.isra.5+0xce4/0x1e20\n ib_uverbs_create_qp+0x21b/0x2a0\n ib_uverbs_write+0x55a/0xad0\n __vfs_write+0xf7/0x5c0\n vfs_write+0x18a/0x460\n SyS_write+0xc7/0x1a0\n entry_SYSCALL_64_fastpath+0x18/0x85\n\nFreed by task 368:\n kfree+0xeb/0x2f0\n kernfs_fop_release+0x140/0x180\n __fput+0x266/0x700\n task_work_run+0x104/0x180\n exit_to_usermode_loop+0xf7/0x110\n syscall_return_slowpath+0x298/0x370\n entry_SYSCALL_64_fastpath+0x83/0x85\n\nThe buggy address belongs to the object at ffff880066b99180 which\nbelongs to the cache kmalloc-512 of size 512 The buggy address is\nlocated 272 bytes inside of 512-byte region [ffff880066b99180,\nffff880066b99380) The buggy address belongs to the page:\npage:000000006040eedd count:1 mapcount:0 mapping: (null)\nindex:0x0 compound_mapcount: 0\nflags: 0x4000000000008100(slab|head)\nraw: 4000000000008100 0000000000000000 0000000000000000 0000000180190019\nraw: ffffea00019a7500 0000000b0000000b ffff88006c403080 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff880066b99180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff880066b99200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n\u003effff880066b99280: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n ^\n ffff880066b99300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n ffff880066b99380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n\nCc: syzkaller \u003csyzkaller@googlegroups.com\u003e\nFixes: 0fb2ed66a14c (\"IB/mlx5: Add create and destroy functionality for Raw Packet QP\")\nSigned-off-by: Boris Pismenny \u003cborisp@mellanox.com\u003e\nSigned-off-by: Leon Romanovsky \u003cleon@kernel.org\u003e\nSigned-off-by: Doug Ledford \u003cdledford@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e2ee1a1843e5cf0e4040d006d6895262e47332d4", "tree": "7fb49e6931c29cdd14d95a79a9736cd42df83280", "parents": [ "559205f2899596550b0ea19f733b59b557cc6c1e" ], "author": { "name": "Boris Pismenny", "email": "borisp@mellanox.com", "time": "Thu Mar 08 15:51:41 2018 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:26 2018 +0100" }, "message": "IB/mlx5: Fix integer overflows in mlx5_ib_create_srq\n\ncommit c2b37f76485f073f020e60b5954b6dc4e55f693c upstream.\n\nThis patch validates user provided input to prevent integer overflow due\nto integer manipulation in the mlx5_ib_create_srq function.\n\nCc: syzkaller \u003csyzkaller@googlegroups.com\u003e\nFixes: e126ba97dba9 (\"mlx5: Add driver for Mellanox Connect-IB adapters\")\nSigned-off-by: Boris Pismenny \u003cborisp@mellanox.com\u003e\nSigned-off-by: Leon Romanovsky \u003cleon@kernel.org\u003e\nSigned-off-by: Doug Ledford \u003cdledford@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "559205f2899596550b0ea19f733b59b557cc6c1e", "tree": "84063128a234eea78d0771c943a9c2ed3c080393", "parents": [ "bc0e7313d869e2f67b83e099d540c295a4493281" ], "author": { "name": "Vignesh R", "email": "vigneshr@ti.com", "time": "Tue Dec 19 12:51:16 2017 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:26 2018 +0100" }, "message": "dmaengine: ti-dma-crossbar: Fix event mapping for TPCC_EVT_MUX_60_63\n\n\n[ Upstream commit d087f15786021a9605b20f4c678312510be4cac1 ]\n\nRegister layout of a typical TPCC_EVT_MUX_M_N register is such that the\nlowest numbered event is at the lowest byte address and highest numbered\nevent at highest byte address. But TPCC_EVT_MUX_60_63 register layout is\ndifferent, in that the lowest numbered event is at the highest address\nand highest numbered event is at the lowest address. Therefore, modify\nti_am335x_xbar_write() to handle TPCC_EVT_MUX_60_63 register\naccordingly.\n\nSigned-off-by: Vignesh R \u003cvigneshr@ti.com\u003e\nSigned-off-by: Peter Ujfalusi \u003cpeter.ujfalusi@ti.com\u003e\nSigned-off-by: Vinod Koul \u003cvinod.koul@intel.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "bc0e7313d869e2f67b83e099d540c295a4493281", "tree": "23825b5e447138ba2732cdb34e737eb0c48473d7", "parents": [ "c53ae7d94e9a79eb6e589d02d4b1fc40fbfa5b45" ], "author": { "name": "Sergej Sawazki", "email": "sergej@taudac.com", "time": "Tue Jul 25 23:21:02 2017 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:26 2018 +0100" }, "message": "clk: si5351: Rename internal plls to avoid name collisions\n\n\n[ Upstream commit cdba9a4fb0b53703959ac861e415816cb61aded4 ]\n\nThis drivers probe fails due to a clock name collision if a clock named\n\u0027plla\u0027 or \u0027pllb\u0027 is already registered when registering this drivers\ninternal plls.\n\nFix it by renaming internal plls to avoid name collisions.\n\nCc: Sebastian Hesselbarth \u003csebastian.hesselbarth@gmail.com\u003e\nCc: Rabeeh Khoury \u003crabeeh@solid-run.com\u003e\nSigned-off-by: Sergej Sawazki \u003csergej@taudac.com\u003e\nSigned-off-by: Stephen Boyd \u003csboyd@codeaurora.org\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "c53ae7d94e9a79eb6e589d02d4b1fc40fbfa5b45", "tree": "5ff77737ec964cec9c15bf882e8317fc38a654fd", "parents": [ "9fd65f85db4565a3c8ad5728dad3e894cf4ffd11" ], "author": { "name": "Lars-Peter Clausen", "email": "lars@metafoo.de", "time": "Tue Sep 05 11:32:40 2017 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:26 2018 +0100" }, "message": "clk: axi-clkgen: Correctly handle nocount bit in recalc_rate()\n\n\n[ Upstream commit 063578dc5f407f67d149133818efabe457daafda ]\n\nIf the nocount bit is set the divider is bypassed and the settings for the\ndivider count should be ignored and a divider value of 1 should be assumed.\nHandle this correctly in the driver recalc_rate() callback.\n\nWhile the driver sets up the part so that the read back dividers values\nyield the correct result the power-on reset settings of the part might not\nreflect this and hence calling e.g. clk_get_rate() without prior calls to\nclk_set_rate() will yield the wrong result.\n\nSigned-off-by: Lars-Peter Clausen \u003clars@metafoo.de\u003e\nSigned-off-by: Stephen Boyd \u003csboyd@codeaurora.org\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "9fd65f85db4565a3c8ad5728dad3e894cf4ffd11", "tree": "c5ce37ba98a74c033f5492b0c7cec23424cf5d3a", "parents": [ "eeed4cf828189504c053c584ae70333c426a5bc2" ], "author": { "name": "Stephen Boyd", "email": "sboyd@codeaurora.org", "time": "Thu Nov 02 00:36:09 2017 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:26 2018 +0100" }, "message": "clk: Don\u0027t touch hardware when reparenting during registration\n\n\n[ Upstream commit f8f8f1d04494d3a6546bee3f0618c4dba31d7b72 ]\n\nThe orphan clocks reparent operation shouldn\u0027t touch the hardware\nif clocks are enabled, otherwise it may get a chance to disable a\nnewly registered critical clock which triggers the warning below.\n\nAssuming we have two clocks: A and B, B is the parent of A.\nClock A has flag: CLK_OPS_PARENT_ENABLE\nClock B has flag: CLK_IS_CRITICAL\n\nStep 1:\nClock A is registered, then it becomes orphan.\n\nStep 2:\nClock B is registered. Before clock B reach the critical clock enable\noperation, orphan A will find the newly registered parent B and do\nreparent operation, then parent B will be finally disabled in\n__clk_set_parent_after() due to CLK_OPS_PARENT_ENABLE flag as there\u0027s\nstill no users of B which will then trigger the following warning.\n\nWARNING: CPU: 0 PID: 0 at drivers/clk/clk.c:597 clk_core_disable+0xb4/0xe0\nModules linked in:\nCPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.11.0-rc1-00056-gdff1f66-dirty #1373\nHardware name: Generic DT based system\nBacktrace:\n[\u003cc010c4bc\u003e] (dump_backtrace) from [\u003cc010c764\u003e] (show_stack+0x18/0x1c)\n r6:600000d3 r5:00000000 r4:c0e26358 r3:00000000\n[\u003cc010c74c\u003e] (show_stack) from [\u003cc040599c\u003e] (dump_stack+0xb4/0xe8)\n[\u003cc04058e8\u003e] (dump_stack) from [\u003cc0125c94\u003e] (__warn+0xd8/0x104)\n r10:c0c21cd0 r9:c048aa78 r8:00000255 r7:00000009 r6:c0c1cd90 r5:00000000\n r4:00000000 r3:c0e01d34\n[\u003cc0125bbc\u003e] (__warn) from [\u003cc0125d74\u003e] (warn_slowpath_null+0x28/0x30)\n r9:00000000 r8:ef00bf80 r7:c165ac4c r6:ef00bf80 r5:ef00bf80 r4:ef00bf80\n[\u003cc0125d4c\u003e] (warn_slowpath_null) from [\u003cc048aa78\u003e] (clk_core_disable+0xb4/0xe0)\n[\u003cc048a9c4\u003e] (clk_core_disable) from [\u003cc048be88\u003e] (clk_core_disable_lock+0x20/0x2c)\n r4:000000d3 r3:c0e0af00\n[\u003cc048be68\u003e] (clk_core_disable_lock) from [\u003cc048c224\u003e] (clk_core_disable_unprepare+0x14/0x28)\n r5:00000000 r4:ef00bf80\n[\u003cc048c210\u003e] (clk_core_disable_unprepare) from [\u003cc048c270\u003e] (__clk_set_parent_after+0x38/0x54)\n r4:ef00bd80 r3:000010a0\n[\u003cc048c238\u003e] (__clk_set_parent_after) from [\u003cc048daa8\u003e] (clk_register+0x4d0/0x648)\n r6:ef00d500 r5:ef00bf80 r4:ef00bd80 r3:ef00bfd4\n[\u003cc048d5d8\u003e] (clk_register) from [\u003cc048dc30\u003e] (clk_hw_register+0x10/0x1c)\n r9:00000000 r8:00000003 r7:00000000 r6:00000824 r5:00000001 r4:ef00d500\n[\u003cc048dc20\u003e] (clk_hw_register) from [\u003cc048e698\u003e] (_register_divider+0xcc/0x120)\n[\u003cc048e5cc\u003e] (_register_divider) from [\u003cc048e730\u003e] (clk_register_divider+0x44/0x54)\n r10:00000004 r9:00000003 r8:00000001 r7:00000000 r6:00000003 r5:00000001\n r4:f0810030\n[\u003cc048e6ec\u003e] (clk_register_divider) from [\u003cc0d3ff58\u003e] (imx7ulp_clocks_init+0x558/0xe98)\n r7:c0e296f8 r6:c165c808 r5:00000000 r4:c165c808\n[\u003cc0d3fa00\u003e] (imx7ulp_clocks_init) from [\u003cc0d24db0\u003e] (of_clk_init+0x118/0x1e0)\n r10:00000001 r9:c0e01f68 r8:00000000 r7:c0e01f60 r6:ef7f8974 r5:ef0035c0\n r4:00000006\n[\u003cc0d24c98\u003e] (of_clk_init) from [\u003cc0d04a50\u003e] (time_init+0x2c/0x38)\n r10:efffed40 r9:c0d61a48 r8:c0e78000 r7:c0e07900 r6:ffffffff r5:c0e78000\n r4:00000000\n[\u003cc0d04a24\u003e] (time_init) from [\u003cc0d00b8c\u003e] (start_kernel+0x218/0x394)\n[\u003cc0d00974\u003e] (start_kernel) from [\u003c6000807c\u003e] (0x6000807c)\n r10:00000000 r9:410fc075 r8:6000406a r7:c0e0c930 r6:c0d61a44 r5:c0e07918\n r4:c0e78294\n\nWe know that the clk isn\u0027t enabled with any sort of prepare_count\nhere so we don\u0027t need to enable anything to prevent a race. And\nwe\u0027re holding the prepare mutex so set_rate/set_parent can\u0027t race\nhere either. Based on an earlier patch by Dong Aisheng.\n\nFixes: fc8726a2c021 (\"clk: core: support clocks which requires parents enable (part 2)\")\nCc: Michael Turquette \u003cmturquette@baylibre.com\u003e\nCc: Shawn Guo \u003cshawnguo@kernel.org\u003e\nReported-by: Dong Aisheng \u003caisheng.dong@nxp.com\u003e\nSigned-off-by: Stephen Boyd \u003csboyd@codeaurora.org\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "eeed4cf828189504c053c584ae70333c426a5bc2", "tree": "e12668e2223e40d44a926e0751b745f3c4eb89c9", "parents": [ "64d5c600648eab27c8b76189e0eb263f346448b3" ], "author": { "name": "Benjamin Coddington", "email": "bcodding@redhat.com", "time": "Tue Dec 19 09:35:25 2017 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:26 2018 +0100" }, "message": "nfsd4: permit layoutget of executable-only files\n\n\n[ Upstream commit 66282ec1cf004c09083c29cb5e49019037937bbd ]\n\nClients must be able to read a file in order to execute it, and for pNFS\nthat means the client needs to be able to perform a LAYOUTGET on the file.\n\nThis behavior for executable-only files was added for OPEN in commit\na043226bc140 \"nfsd4: permit read opens of executable-only files\".\n\nThis fixes up xfstests generic/126 on block/scsi layouts.\n\nSigned-off-by: Benjamin Coddington \u003cbcodding@redhat.com\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "64d5c600648eab27c8b76189e0eb263f346448b3", "tree": "29bb6dca954ee9671fb1be1f82aa5f3f46e13d2e", "parents": [ "dc445b384679db0c811d789958963962f963767f" ], "author": { "name": "Joel Stanley", "email": "joel@jms.id.au", "time": "Mon Dec 18 23:27:03 2017 +1030" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:26 2018 +0100" }, "message": "ARM: dts: aspeed-evb: Add unit name to memory node\n\n\n[ Upstream commit e40ed274489a5f516da120186578eb379b452ac6 ]\n\nFixes a warning when building with W\u003d1.\n\nAll of the ASPEED device trees build without warnings now.\n\nSigned-off-by: Joel Stanley \u003cjoel@jms.id.au\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "dc445b384679db0c811d789958963962f963767f", "tree": "4b1e8e91544de8b0f76cc067f8df9da5c5498cb6", "parents": [ "1139d77d8a7f9aa6b6ae0a1c902f94775dad2f52" ], "author": { "name": "Anton Vasilyev", "email": "vasilyev@ispras.ru", "time": "Tue Aug 08 18:56:37 2017 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:26 2018 +0100" }, "message": "RDMA/ocrdma: Fix permissions for OCRDMA_RESET_STATS\n\n\n[ Upstream commit 744820869166c8c78be891240cf5f66e8a333694 ]\n\nDebugfs file reset_stats is created with S_IRUSR permissions,\nbut ocrdma_dbgfs_ops_read() doesn\u0027t support OCRDMA_RESET_STATS,\nwhereas ocrdma_dbgfs_ops_write() supports only OCRDMA_RESET_STATS.\n\nThe patch fixes misstype with permissions.\n\nFound by Linux Driver Verification project (linuxtesting.org).\n\nSigned-off-by: Anton Vasilyev \u003cvasilyev@ispras.ru\u003e\nAcked-by: Selvin Xavier \u003cselvin.xavier@broadcom.com\u003e\nSigned-off-by: Jason Gunthorpe \u003cjgg@mellanox.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "1139d77d8a7f9aa6b6ae0a1c902f94775dad2f52", "tree": "2ccf4431992895ff4f3a8e389f043ebb559b3939", "parents": [ "62088f53b14ff275c32e5c9efb95dbab9e8423c8" ], "author": { "name": "Alexey Kodanev", "email": "alexey.kodanev@oracle.com", "time": "Tue Dec 19 16:59:21 2017 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:25 2018 +0100" }, "message": "ip6_vti: adjust vti mtu according to mtu of lower device\n\n\n[ Upstream commit 53c81e95df1793933f87748d36070a721f6cb287 ]\n\nLTP/udp6_ipsec_vti tests fail when sending large UDP datagrams over\nip6_vti that require fragmentation and the underlying device has an\nMTU smaller than 1500 plus some extra space for headers. This happens\nbecause ip6_vti, by default, sets MTU to ETH_DATA_LEN and not updating\nit depending on a destination address or link parameter. Further\nattempts to send UDP packets may succeed because pmtu gets updated on\nICMPV6_PKT_TOOBIG in vti6_err().\n\nIn case the lower device has larger MTU size, e.g. 9000, ip6_vti works\nbut not using the possible maximum size, output packets have 1500 limit.\n\nThe above cases require manual MTU setup after ip6_vti creation. However\nip_vti already updates MTU based on lower device with ip_tunnel_bind_dev().\n\nHere is the example when the lower device MTU is set to 9000:\n\n # ip a sh ltp_ns_veth2\n ltp_ns_veth2@if7: \u003cBROADCAST,MULTICAST,UP,LOWER_UP\u003e mtu 9000 ...\n inet 10.0.0.2/24 scope global ltp_ns_veth2\n inet6 fd00::2/64 scope global\n\n # ip li add vti6 type vti6 local fd00::2 remote fd00::1\n # ip li show vti6\n vti6@NONE: \u003cPOINTOPOINT,NOARP\u003e mtu 1500 ...\n link/tunnel6 fd00::2 peer fd00::1\n\nAfter the patch:\n # ip li add vti6 type vti6 local fd00::2 remote fd00::1\n # ip li show vti6\n vti6@NONE: \u003cPOINTOPOINT,NOARP\u003e mtu 8832 ...\n link/tunnel6 fd00::2 peer fd00::1\n\nReported-by: Petr Vorel \u003cpvorel@suse.cz\u003e\nSigned-off-by: Alexey Kodanev \u003calexey.kodanev@oracle.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "62088f53b14ff275c32e5c9efb95dbab9e8423c8", "tree": "d360528f4f680b96f3610833e8930ee12de6c573", "parents": [ "f03b94ef0e8792e06a0212912b1117f26cdc6dda" ], "author": { "name": "Jerry Snitselaar", "email": "jsnitsel@redhat.com", "time": "Wed Dec 20 09:48:56 2017 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:25 2018 +0100" }, "message": "iommu/vt-d: clean up pr_irq if request_threaded_irq fails\n\n\n[ Upstream commit 72d548113881dd32bf7f0b221d031e6586468437 ]\n\nIt is unlikely request_threaded_irq will fail, but if it does for some\nreason we should clear iommu-\u003epr_irq in the error path. Also\nintel_svm_finish_prq shouldn\u0027t try to clean up the page request\ninterrupt if pr_irq is 0. Without these, if request_threaded_irq were\nto fail the following occurs:\n\nfail with no fixes:\n\n[ 0.683147] ------------[ cut here ]------------\n[ 0.683148] NULL pointer, cannot free irq\n[ 0.683158] WARNING: CPU: 1 PID: 1 at kernel/irq/irqdomain.c:1632 irq_domain_free_irqs+0x126/0x140\n[ 0.683160] Modules linked in:\n[ 0.683163] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.15.0-rc2 #3\n[ 0.683165] Hardware name: /NUC7i3BNB, BIOS BNKBL357.86A.0036.2017.0105.1112 01/05/2017\n[ 0.683168] RIP: 0010:irq_domain_free_irqs+0x126/0x140\n[ 0.683169] RSP: 0000:ffffc90000037ce8 EFLAGS: 00010292\n[ 0.683171] RAX: 000000000000001d RBX: ffff880276283c00 RCX: ffffffff81c5e5e8\n[ 0.683172] RDX: 0000000000000001 RSI: 0000000000000096 RDI: 0000000000000246\n[ 0.683174] RBP: ffff880276283c00 R08: 0000000000000000 R09: 000000000000023c\n[ 0.683175] R10: 0000000000000007 R11: 0000000000000000 R12: 000000000000007a\n[ 0.683176] R13: 0000000000000001 R14: 0000000000000000 R15: 0000010010000000\n[ 0.683178] FS: 0000000000000000(0000) GS:ffff88027ec80000(0000) knlGS:0000000000000000\n[ 0.683180] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 0.683181] CR2: 0000000000000000 CR3: 0000000001c09001 CR4: 00000000003606e0\n[ 0.683182] Call Trace:\n[ 0.683189] intel_svm_finish_prq+0x3c/0x60\n[ 0.683191] free_dmar_iommu+0x1ac/0x1b0\n[ 0.683195] init_dmars+0xaaa/0xaea\n[ 0.683200] ? klist_next+0x19/0xc0\n[ 0.683203] ? pci_do_find_bus+0x50/0x50\n[ 0.683205] ? pci_get_dev_by_id+0x52/0x70\n[ 0.683208] intel_iommu_init+0x498/0x5c7\n[ 0.683211] pci_iommu_init+0x13/0x3c\n[ 0.683214] ? e820__memblock_setup+0x61/0x61\n[ 0.683217] do_one_initcall+0x4d/0x1a0\n[ 0.683220] kernel_init_freeable+0x186/0x20e\n[ 0.683222] ? set_debug_rodata+0x11/0x11\n[ 0.683225] ? rest_init+0xb0/0xb0\n[ 0.683226] kernel_init+0xa/0xff\n[ 0.683229] ret_from_fork+0x1f/0x30\n[ 0.683259] Code: 89 ee 44 89 e7 e8 3b e8 ff ff 5b 5d 44 89 e7 44 89 ee 41 5c 41 5d 41 5e e9 a8 84 ff ff 48 c7 c7 a8 71 a7 81 31 c0 e8 6a d3 f9 ff \u003c0f\u003e ff 5b 5d 41 5c 41 5d 41 5\ne c3 0f 1f 44 00 00 66 2e 0f 1f 84\n[ 0.683285] ---[ end trace f7650e42792627ca ]---\n\nwith iommu-\u003epr_irq \u003d 0, but no check in intel_svm_finish_prq:\n\n[ 0.669561] ------------[ cut here ]------------\n[ 0.669563] Trying to free already-free IRQ 0\n[ 0.669573] WARNING: CPU: 3 PID: 1 at kernel/irq/manage.c:1546 __free_irq+0xa4/0x2c0\n[ 0.669574] Modules linked in:\n[ 0.669577] CPU: 3 PID: 1 Comm: swapper/0 Not tainted 4.15.0-rc2 #4\n[ 0.669579] Hardware name: /NUC7i3BNB, BIOS BNKBL357.86A.0036.2017.0105.1112 01/05/2017\n[ 0.669581] RIP: 0010:__free_irq+0xa4/0x2c0\n[ 0.669582] RSP: 0000:ffffc90000037cc0 EFLAGS: 00010082\n[ 0.669584] RAX: 0000000000000021 RBX: 0000000000000000 RCX: ffffffff81c5e5e8\n[ 0.669585] RDX: 0000000000000001 RSI: 0000000000000086 RDI: 0000000000000046\n[ 0.669587] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000023c\n[ 0.669588] R10: 0000000000000007 R11: 0000000000000000 R12: ffff880276253960\n[ 0.669589] R13: ffff8802762538a4 R14: ffff880276253800 R15: ffff880276283600\n[ 0.669593] FS: 0000000000000000(0000) GS:ffff88027ed80000(0000) knlGS:0000000000000000\n[ 0.669594] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 0.669596] CR2: 0000000000000000 CR3: 0000000001c09001 CR4: 00000000003606e0\n[ 0.669602] Call Trace:\n[ 0.669616] free_irq+0x30/0x60\n[ 0.669620] intel_svm_finish_prq+0x34/0x60\n[ 0.669623] free_dmar_iommu+0x1ac/0x1b0\n[ 0.669627] init_dmars+0xaaa/0xaea\n[ 0.669631] ? klist_next+0x19/0xc0\n[ 0.669634] ? pci_do_find_bus+0x50/0x50\n[ 0.669637] ? pci_get_dev_by_id+0x52/0x70\n[ 0.669639] intel_iommu_init+0x498/0x5c7\n[ 0.669642] pci_iommu_init+0x13/0x3c\n[ 0.669645] ? e820__memblock_setup+0x61/0x61\n[ 0.669648] do_one_initcall+0x4d/0x1a0\n[ 0.669651] kernel_init_freeable+0x186/0x20e\n[ 0.669653] ? set_debug_rodata+0x11/0x11\n[ 0.669656] ? rest_init+0xb0/0xb0\n[ 0.669658] kernel_init+0xa/0xff\n[ 0.669661] ret_from_fork+0x1f/0x30\n[ 0.669662] Code: 7a 08 75 0e e9 c3 01 00 00 4c 39 7b 08 74 57 48 89 da 48 8b 5a 18 48 85 db 75 ee 89 ee 48 c7 c7 78 67 a7 81 31 c0 e8 4c 37 fa ff \u003c0f\u003e ff 48 8b 34 24 4c 89 ef e\n8 0e 4c 68 00 49 8b 46 40 48 8b 80\n[ 0.669688] ---[ end trace 58a470248700f2fc ]---\n\nCc: Alex Williamson \u003calex.williamson@redhat.com\u003e\nCc: Joerg Roedel \u003cjoro@8bytes.org\u003e\nCc: Ashok Raj \u003cashok.raj@intel.com\u003e\nSigned-off-by: Jerry Snitselaar \u003cjsnitsel@redhat.com\u003e\nReviewed-by: Ashok Raj \u003cashok.raj@intel.com\u003e\nSigned-off-by: Alex Williamson \u003calex.williamson@redhat.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f03b94ef0e8792e06a0212912b1117f26cdc6dda", "tree": "b2aaf27e35ade7b251a50e883858af892fd891b1", "parents": [ "bd6552cfc5f7fce149a9bda2a5438a486db14831" ], "author": { "name": "Brian Norris", "email": "briannorris@chromium.org", "time": "Tue Dec 12 09:43:43 2017 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:25 2018 +0100" }, "message": "pinctrl: rockchip: enable clock when reading pin direction register\n\n\n[ Upstream commit 5c9d8c4f6b8168738a26bcf288516cc3a0886810 ]\n\nWe generally leave the GPIO clock disabled, unless an interrupt is\nrequested or we\u0027re accessing IO registers. We forgot to do this for the\n-\u003eget_direction() callback, which means we can sometimes [1] get\nincorrect results [2] from, e.g., /sys/kernel/debug/gpio.\n\nEnable the clock, so we get the right results!\n\n[1] Sometimes, because many systems have 1 or mor interrupt requested on\neach GPIO bank, so they always leave their clock on.\n\n[2] Incorrect, meaning the register returns 0, and so we interpret that\nas \"input\".\n\nSigned-off-by: Brian Norris \u003cbriannorris@chromium.org\u003e\nReviewed-by: Heiko Stuebner \u003cheiko@sntech.de\u003e\nSigned-off-by: Linus Walleij \u003clinus.walleij@linaro.org\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "bd6552cfc5f7fce149a9bda2a5438a486db14831", "tree": "d510b70f91149bf760685a392759991410c9b8ca", "parents": [ "ba936f25f95378142e854cc70e35375a452815a9" ], "author": { "name": "Florian Fainelli", "email": "f.fainelli@gmail.com", "time": "Wed Mar 01 10:32:57 2017 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:25 2018 +0100" }, "message": "pinctrl: Really force states during suspend/resume\n\n\n[ Upstream commit 981ed1bfbc6c4660b2ddaa8392893e20a6255048 ]\n\nIn case a platform only defaults a \"default\" set of pins, but not a\n\"sleep\" set of pins, and this particular platform suspends and resumes\nin a way that the pin states are not preserved by the hardware, when we\nresume, we would call pinctrl_single_resume() -\u003e pinctrl_force_default()\n-\u003e pinctrl_select_state() and the first thing we do is check that the\npins state is the same as before, and do nothing.\n\nIn order to fix this, decouple the actual state change from\npinctrl_select_state() and move it pinctrl_commit_state(), while keeping\nthe p-\u003estate \u003d\u003d state check in pinctrl_select_state() not to change the\ncaller assumptions. pinctrl_force_sleep() and pinctrl_force_default()\nare updated to bypass the state check by calling pinctrl_commit_state().\n\n[Linus Walleij]\nThe forced pin control states are currently only used in some pin\ncontroller drivers that grab their own reference to their own pins.\nThis is equal to the pin control hogs: pins taken by pin control\ndevices since there are no corresponding device in the Linux device\nhierarchy, such as memory controller lines or unused GPIO lines,\nor GPIO lines that are used orthogonally from the GPIO subsystem\nbut pincontrol-wise managed as hogs (non-strict mode, allowing\nsimultaneous use by GPIO and pin control). For this case forcing\nthe state from the drivers\u0027 suspend()/resume() callbacks makes\nsense and should semantically match the name of the function.\n\nFixes: 6e5e959dde0d (\"pinctrl: API changes to support multiple states per device\")\nSigned-off-by: Florian Fainelli \u003cf.fainelli@gmail.com\u003e\nReviewed-by: Andy Shevchenko \u003candy.shevchenko@gmail.com\u003e\nSigned-off-by: Linus Walleij \u003clinus.walleij@linaro.org\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ba936f25f95378142e854cc70e35375a452815a9", "tree": "2957b8020531cdfbc960aee664d97fed482871cc", "parents": [ "d69cf8561fb995be0e72da6c92e206f342707d67" ], "author": { "name": "Robert Walker", "email": "robert.walker@arm.com", "time": "Mon Dec 18 11:05:44 2017 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:25 2018 +0100" }, "message": "coresight: Fix disabling of CoreSight TPIU\n\n\n[ Upstream commit 11595db8e17faaa05fadc25746c870e31276962f ]\n\nThe CoreSight TPIU should be disabled when tracing to other sinks to allow\nthem to operate at full bandwidth.\n\nThis patch fixes tpiu_disable_hw() to correctly disable the TPIU by\nconfiguring the TPIU to stop on flush, initiating a manual flush, waiting\nfor the flush to complete and then waits for the TPIU to indicate it has\nstopped.\n\nSigned-off-by: Robert Walker \u003crobert.walker@arm.com\u003e\nTested-by: Mike Leach \u003cmike.leach@linaro.org\u003e\nSigned-off-by: Mathieu Poirier \u003cmathieu.poirier@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d69cf8561fb995be0e72da6c92e206f342707d67", "tree": "eab4e951f277070a312273a0139bdc88fa9f07a2", "parents": [ "abb3ee3ac5926b271af968737026674f24a90743" ], "author": { "name": "Sahara", "email": "keun-o.park@darkmatter.ae", "time": "Wed Dec 13 09:10:48 2017 +0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:25 2018 +0100" }, "message": "pty: cancel pty slave port buf\u0027s work in tty_release\n\n\n[ Upstream commit 2b022ab7542df60021ab57854b3faaaf42552eaf ]\n\nIn case that CONFIG_SLUB_DEBUG is on and pty is used, races between\nrelease_one_tty and flush_to_ldisc work threads may happen and lead\nto use-after-free condition on tty-\u003elink-\u003eport. Because SLUB_DEBUG\nis turned on, freed tty-\u003elink-\u003eport is filled with POISON_FREE value.\nSo far without SLUB_DEBUG, port was filled with zero and flush_to_ldisc\ncould return without a problem by checking if tty is NULL.\n\nCPU 0 CPU 1\n----- -----\nrelease_tty pty_write\n cancel_work_sync(tty) to \u003d tty-\u003elink\n tty_kref_put(tty-\u003elink) tty_schedule_flip(to-\u003eport)\n \u003c\u003c workqueue \u003e\u003e ...\n release_one_tty ...\n pty_cleanup ...\n kfree(tty-\u003elink-\u003eport) \u003c\u003c workqueue \u003e\u003e\n flush_to_ldisc\n tty \u003d READ_ONCE(port-\u003eitty)\n tty is 0x6b6b6b6b6b6b6b6b\n !!PANIC!! access tty-\u003eldisc\n\n Unable to handle kernel paging request at virtual address 6b6b6b6b6b6b6b93\n pgd \u003d ffffffc0eb1c3000\n [6b6b6b6b6b6b6b93] *pgd\u003d0000000000000000, *pud\u003d0000000000000000\n ------------[ cut here ]------------\n Kernel BUG at ffffff800851154c [verbose debug info unavailable]\n Internal error: Oops - BUG: 96000004 [#1] PREEMPT SMP\n CPU: 3 PID: 265 Comm: kworker/u8:9 Tainted: G W 3.18.31-g0a58eeb #1\n Hardware name: Qualcomm Technologies, Inc. MSM 8996pro v1.1 + PMI8996 Carbide (DT)\n Workqueue: events_unbound flush_to_ldisc\n task: ffffffc0ed610ec0 ti: ffffffc0ed624000 task.ti: ffffffc0ed624000\n PC is at ldsem_down_read_trylock+0x0/0x4c\n LR is at tty_ldisc_ref+0x24/0x4c\n pc : [\u003cffffff800851154c\u003e] lr : [\u003cffffff800850f6c0\u003e] pstate: 80400145\n sp : ffffffc0ed627cd0\n x29: ffffffc0ed627cd0 x28: 0000000000000000\n x27: ffffff8009e05000 x26: ffffffc0d382cfa0\n x25: 0000000000000000 x24: ffffff800a012f08\n x23: 0000000000000000 x22: ffffffc0703fbc88\n x21: 6b6b6b6b6b6b6b6b x20: 6b6b6b6b6b6b6b93\n x19: 0000000000000000 x18: 0000000000000001\n x17: 00e80000f80d6f53 x16: 0000000000000001\n x15: 0000007f7d826fff x14: 00000000000000a0\n x13: 0000000000000000 x12: 0000000000000109\n x11: 0000000000000000 x10: 0000000000000000\n x9 : ffffffc0ed624000 x8 : ffffffc0ed611580\n x7 : 0000000000000000 x6 : ffffff800a42e000\n x5 : 00000000000003fc x4 : 0000000003bd1201\n x3 : 0000000000000001 x2 : 0000000000000001\n x1 : ffffff800851004c x0 : 6b6b6b6b6b6b6b93\n\nSigned-off-by: Sahara \u003ckeun-o.park@darkmatter.ae\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "abb3ee3ac5926b271af968737026674f24a90743", "tree": "3edc15618c60ba9092c7f0a6e5c676e2441b4916", "parents": [ "4ae338d139874259807f686738b02cb25a863535" ], "author": { "name": "Peter Ujfalusi", "email": "peter.ujfalusi@ti.com", "time": "Fri Sep 29 14:49:49 2017 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:25 2018 +0100" }, "message": "drm/omap: DMM: Check for DMM readiness after successful transaction commit\n\n\n[ Upstream commit b7ea6b286c4051e043f691781785e3c4672f014a ]\n\nCheck the status of the DMM engine after it is reported that the\ntransaction was completed as in rare cases the engine might not reached a\nworking state.\n\nThe wait_status() will print information in case the DMM is not reached the\nexpected state and the dmm_txn_commit() will return with an error code to\nmake sure that we are not continuing with a broken setup.\n\nSigned-off-by: Peter Ujfalusi \u003cpeter.ujfalusi@ti.com\u003e\nSigned-off-by: Tomi Valkeinen \u003ctomi.valkeinen@ti.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4ae338d139874259807f686738b02cb25a863535", "tree": "a299580ee6a581665acba5f8e43f0aa48ececcbe", "parents": [ "87408eb1eae7c59e81e6e3efeadde168d3b3f130" ], "author": { "name": "H. Nikolaus Schaller", "email": "hns@goldelico.com", "time": "Tue Nov 28 16:48:54 2017 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:25 2018 +0100" }, "message": "omapdrm: panel: fix compatible vendor string for td028ttec1\n\n\n[ Upstream commit c1b9d4c75cd549e08bd0596d7f9dcc20f7f6e8fa ]\n\nThe vendor name was \"toppoly\" but other panels and the vendor list\nhave defined it as \"tpo\". So let\u0027s fix it in driver and bindings.\n\nWe keep the old definition in parallel to stay compatible with\npotential older DTB setup.\n\nSigned-off-by: H. Nikolaus Schaller \u003chns@goldelico.com\u003e\nSigned-off-by: Tomi Valkeinen \u003ctomi.valkeinen@ti.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "87408eb1eae7c59e81e6e3efeadde168d3b3f130", "tree": "35a0578634329d426c24dc0aa2bf08ff622479a2", "parents": [ "eba1940e654b8218c08ac575edb24865c1dc32c0" ], "author": { "name": "Bjorn Helgaas", "email": "bhelgaas@google.com", "time": "Fri Dec 01 11:06:39 2017 -0600" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:25 2018 +0100" }, "message": "vgacon: Set VGA struct resource types\n\n\n[ Upstream commit c82084117f79bcae085e40da526253736a247120 ]\n\nSet the resource type when we reserve VGA-related I/O port resources.\n\nThe resource code doesn\u0027t actually look at the type, so it inserts\nresources without a type in the tree correctly even without this change.\nBut if we ever print a resource without a type, it looks like this:\n\n vga+ [??? 0x000003c0-0x000003df flags 0x0]\n\nSetting the type means it will be printed correctly as:\n\n vga+ [io 0x000003c0-0x000003df]\n\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "eba1940e654b8218c08ac575edb24865c1dc32c0", "tree": "8aaca5a0fd46b9a17afa179c66fc7a08833ff4ec", "parents": [ "37c704e0ec7f33599866d41921379ffa8d8a7a9e" ], "author": { "name": "Bharat Potnuri", "email": "bharat@chelsio.com", "time": "Tue Nov 28 23:58:07 2017 +0530" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:25 2018 +0100" }, "message": "iser-target: avoid reinitializing rdma contexts for isert commands\n\n\n[ Upstream commit 66f53e6f5400578bae58db0c06d85a8820831f40 ]\n\nisert commands that failed during isert_rdma_rw_ctx_post() are queued to\nQueue-Full(QF) queue and are scheduled to be reposted during queue-full\nqueue processing. During this reposting, the rdma contexts are initialised\nagain in isert_rdma_rw_ctx_post(), which is leaking significant memory.\n\nunreferenced object 0xffff8830201d9640 (size 64):\n comm \"kworker/0:2\", pid 195, jiffies 4295374851 (age 4528.436s)\n hex dump (first 32 bytes):\n 00 60 8b cb 2e 00 00 00 00 10 00 00 00 00 00 00 .`..............\n 00 90 e3 cb 2e 00 00 00 00 10 00 00 00 00 00 00 ................\n backtrace:\n [\u003cffffffff8170711e\u003e] kmemleak_alloc+0x4e/0xb0\n [\u003cffffffff811f8ba5\u003e] __kmalloc+0x125/0x2b0\n [\u003cffffffffa046b24f\u003e] rdma_rw_ctx_init+0x15f/0x6f0 [ib_core]\n [\u003cffffffffa07ab644\u003e] isert_rdma_rw_ctx_post+0xc4/0x3c0 [ib_isert]\n [\u003cffffffffa07ad972\u003e] isert_put_datain+0x112/0x1c0 [ib_isert]\n [\u003cffffffffa07dddce\u003e] lio_queue_data_in+0x2e/0x30 [iscsi_target_mod]\n [\u003cffffffffa076c322\u003e] target_qf_do_work+0x2b2/0x4b0 [target_core_mod]\n [\u003cffffffff81080c3b\u003e] process_one_work+0x1db/0x5d0\n [\u003cffffffff8108107d\u003e] worker_thread+0x4d/0x3e0\n [\u003cffffffff81088667\u003e] kthread+0x117/0x150\n [\u003cffffffff81713fa7\u003e] ret_from_fork+0x27/0x40\n [\u003cffffffffffffffff\u003e] 0xffffffffffffffff\n\nHere is patch to use the older rdma contexts while reposting\nthe isert commands intead of reinitialising them.\n\nSigned-off-by: Potnuri Bharat Teja \u003cbharat@chelsio.com\u003e\nReviewed-by: Sagi Grimberg \u003csagi@grimberg.me\u003e\nSigned-off-by: Jason Gunthorpe \u003cjgg@mellanox.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "37c704e0ec7f33599866d41921379ffa8d8a7a9e", "tree": "ef474ae3c1493077af97b78e5b8c3997ef557b88", "parents": [ "211a1e9f5efc7eafbe24ddb5601c71e5325db435" ], "author": { "name": "Artemy Kovalyov", "email": "artemyko@mellanox.com", "time": "Tue Nov 14 14:51:59 2017 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:24 2018 +0100" }, "message": "IB/umem: Fix use of npages/nmap fields\n\n\n[ Upstream commit edf1a84fe37c51290e2c88154ecaf48dadff3d27 ]\n\nIn ib_umem structure npages holds original number of sg entries, while\nnmap is number of DMA blocks returned by dma_map_sg.\n\nFixes: c5d76f130b28 (\u0027IB/core: Add umem function to read data from user-space\u0027)\nSigned-off-by: Artemy Kovalyov \u003cartemyko@mellanox.com\u003e\nSigned-off-by: Leon Romanovsky \u003cleon@kernel.org\u003e\nSigned-off-by: Jason Gunthorpe \u003cjgg@mellanox.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "211a1e9f5efc7eafbe24ddb5601c71e5325db435", "tree": "c3b23877acf92436f05f1d45f523647bbc4e413c", "parents": [ "15e113da626f0c91cb003c597c1be57eac5fd576" ], "author": { "name": "Parav Pandit", "email": "parav@mellanox.com", "time": "Tue Nov 14 14:51:55 2017 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:24 2018 +0100" }, "message": "RDMA/cma: Use correct size when writing netlink stats\n\n\n[ Upstream commit 7baaa49af3716fb31877c61f59b74d029ce15b75 ]\n\nThe code was using the src size when formatting the dst. They are almost\ncertainly the same value but it reads wrong.\n\nFixes: ce117ffac2e9 (\"RDMA/cma: Export AF_IB statistics\")\nSigned-off-by: Parav Pandit \u003cparav@mellanox.com\u003e\nReviewed-by: Daniel Jurgens \u003cdanielj@mellanox.com\u003e\nSigned-off-by: Leon Romanovsky \u003cleon@kernel.org\u003e\nSigned-off-by: Jason Gunthorpe \u003cjgg@mellanox.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "15e113da626f0c91cb003c597c1be57eac5fd576", "tree": "d4b1a63822fed16bf9fbda780ffc92a6c16eb551", "parents": [ "963f3129a189213876200d46e5698638d44c5e11" ], "author": { "name": "Erez Shitrit", "email": "erezsh@mellanox.com", "time": "Tue Nov 14 14:51:53 2017 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:24 2018 +0100" }, "message": "IB/ipoib: Avoid memory leak if the SA returns a different DGID\n\n\n[ Upstream commit 439000892ee17a9c92f1e4297818790ef8bb4ced ]\n\nThe ipoib path database is organized around DGIDs from the LLADDR, but the\nSA is free to return a different GID when asked for path. This causes a\nbug because the SA\u0027s modified DGID is copied into the database key, even\nthough it is no longer the correct lookup key, causing a memory leak and\nother malfunctions.\n\nEnsure the database key does not change after the SA query completes.\n\nDemonstration of the bug is as follows\nipoib wants to send to GID fe80:0000:0000:0000:0002:c903:00ef:5ee2, it\ncreates new record in the DB with that gid as a key, and issues a new\nrequest to the SM.\nNow, the SM from some reason returns path-record with other SGID (for\nexample, 2001:0000:0000:0000:0002:c903:00ef:5ee2 that contains the local\nsubnet prefix) now ipoib will overwrite the current entry with the new\none, and if new request to the original GID arrives ipoib will not find\nit in the DB (was overwritten) and will create new record that in its\nturn will also be overwritten by the response from the SM, and so on\ntill the driver eats all the device memory.\n\nSigned-off-by: Erez Shitrit \u003cerezsh@mellanox.com\u003e\nSigned-off-by: Leon Romanovsky \u003cleon@kernel.org\u003e\nSigned-off-by: Jason Gunthorpe \u003cjgg@mellanox.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "963f3129a189213876200d46e5698638d44c5e11", "tree": "a1a7b4371e082f87f34ced89ff0ee74dd0aed6ac", "parents": [ "e7425b35a374cc25c18654c76ff7a88835e11380" ], "author": { "name": "Daniel Drake", "email": "drake@endlessm.com", "time": "Tue Dec 12 10:49:02 2017 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:24 2018 +0100" }, "message": "mmc: avoid removing non-removable hosts during suspend\n\n\n[ Upstream commit de8dcc3d2c0e08e5068ee1e26fc46415c15e3637 ]\n\nThe Weibu F3C MiniPC has an onboard AP6255 module, presenting\ntwo SDIO functions on a single MMC host (Bluetooth/btsdio and\nWiFi/brcmfmac), and the mmc layer correctly detects this as\nnon-removable.\n\nAfter suspend/resume, the wifi and bluetooth interfaces disappear\nand do not get probed again.\n\nThe conditions here are:\n\n 1. During suspend, we reach mmc_pm_notify()\n\n 2. mmc_pm_notify() calls mmc_sdio_pre_suspend() to see if we can\n suspend the SDIO host. However, mmc_sdio_pre_suspend() returns\n -ENOSYS because btsdio_driver does not have a suspend method.\n\n 3. mmc_pm_notify() proceeds to remove the card\n\n 4. Upon resume, mmc_rescan() does nothing with this host, because of\n the rescan_entered check which aims to only scan a non-removable\n device a single time (i.e. during boot).\n\nFix the loss of functionality by detecting that we are unable to\nsuspend a non-removable host, so avoid the forced removal in that\ncase. The comment above this function already indicates that this\ncode was only intended for removable devices.\n\nSigned-off-by: Daniel Drake \u003cdrake@endlessm.com\u003e\nSigned-off-by: Ulf Hansson \u003culf.hansson@linaro.org\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "e7425b35a374cc25c18654c76ff7a88835e11380", "tree": "ee144c135b10def3ce1ec9c1e762640b874ec49b", "parents": [ "2d443c9ee9f71fb37f5dac530b868b1ea27d202e" ], "author": { "name": "Logan Gunthorpe", "email": "logang@deltatee.com", "time": "Tue Dec 05 16:30:51 2017 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:24 2018 +0100" }, "message": "drm/tilcdc: ensure nonatomic iowrite64 is not used\n\n\n[ Upstream commit 4e5ca2d930aa8714400aedf4bf1dc959cb04280f ]\n\nAdd a check to ensure iowrite64 is only used if it is atomic.\n\nIt was decided in [1] that the tilcdc driver should not be using an\natomic operation (so it was left out of this patchset). However, it turns\nout that through the drm code, a nonatomic header is actually included:\n\ninclude/linux/io-64-nonatomic-lo-hi.h\nis included from include/drm/drm_os_linux.h:9:0,\n from include/drm/drmP.h:74,\n from include/drm/drm_modeset_helper.h:26,\n from include/drm/drm_atomic_helper.h:33,\n from drivers/gpu/drm/tilcdc/tilcdc_crtc.c:19:\n\nAnd thus, without this change, this patchset would inadvertantly\nchange the behaviour of the tilcdc driver.\n\n[1] lkml.kernel.org/r/CAK8P3a2HhO_zCnsTzq7hmWSz5La5Thu19FWZpun16iMnyyNreQ@mail.gmail.com\n\nSigned-off-by: Logan Gunthorpe \u003clogang@deltatee.com\u003e\nReviewed-by: Andy Shevchenko \u003candy.shevchenko@gmail.com\u003e\nCc: Jyri Sarha \u003cjsarha@ti.com\u003e\nCc: Arnd Bergmann \u003carnd@arndb.de\u003e\nCc: Tomi Valkeinen \u003ctomi.valkeinen@ti.com\u003e\nCc: David Airlie \u003cairlied@linux.ie\u003e\nSigned-off-by: Jyri Sarha \u003cjsarha@ti.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "2d443c9ee9f71fb37f5dac530b868b1ea27d202e", "tree": "2e9850ed502af90e74d2c6b87bea559a79d091e5", "parents": [ "236738a6df2c87a8e3d5553ba93b7465cd9a0f4c" ], "author": { "name": "Kedareswara rao Appana", "email": "appana.durga.rao@xilinx.com", "time": "Thu Dec 07 10:54:28 2017 +0530" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:24 2018 +0100" }, "message": "dmaengine: zynqmp_dma: Fix race condition in the probe\n\n\n[ Upstream commit 5ba080aada5e739165e0f38d5cc3b04c82b323c8 ]\n\nIncase of interrupt property is not present,\nDriver is trying to free an invalid irq,\nThis patch fixes it by adding a check before freeing the irq.\n\nSigned-off-by: Kedareswara rao Appana \u003cappanad@xilinx.com\u003e\nSigned-off-by: Vinod Koul \u003cvinod.koul@intel.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "236738a6df2c87a8e3d5553ba93b7465cd9a0f4c", "tree": "18c168907280d7c5c66c2f07e1415e50dca548e0", "parents": [ "6ad31f858328e0c4257c3b0367271d7e99d16af2" ], "author": { "name": "Shawn Nematbakhsh", "email": "shawnn@chromium.org", "time": "Fri Sep 08 13:50:11 2017 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:24 2018 +0100" }, "message": "platform/chrome: Use proper protocol transfer function\n\n\n[ Upstream commit d48b8c58c57f6edbe2965f0a5f62c5cf9593ca96 ]\n\npkt_xfer should be used for protocol v3, and cmd_xfer otherwise. We had\none instance of these functions correct, but not the second, fall-back\ncase. We use the fall-back only when the first command returns an\nIN_PROGRESS status, which is only used on some EC firmwares where we\ndon\u0027t want to constantly poll the bus, but instead back off and\nsleep/retry for a little while.\n\nFixes: 2c7589af3c4d (\"mfd: cros_ec: add proto v3 skeleton\")\nSigned-off-by: Shawn Nematbakhsh \u003cshawnn@chromium.org\u003e\nSigned-off-by: Brian Norris \u003cbriannorris@chromium.org\u003e\nReviewed-by: Javier Martinez Canillas \u003cjavier@osg.samsung.com\u003e\nSigned-off-by: Benson Leung \u003cbleung@chromium.org\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "6ad31f858328e0c4257c3b0367271d7e99d16af2", "tree": "b4016a55e00f180a2a2b2da525810fdd870a1cfc", "parents": [ "32dc29cf72e866fafca3a12ea821954632a0edca" ], "author": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Mon Sep 25 09:17:01 2017 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:24 2018 +0100" }, "message": "watchdog: Fix potential kref imbalance when opening watchdog\n\n\n[ Upstream commit 4bcd615fad6adddc68b058d498b30a9e0e0db77a ]\n\nIf a watchdog driver\u0027s open function sets WDOG_HW_RUNNING with the\nexpectation that the watchdog can not be stopped, but then stops the\nwatchdog anyway in its stop function, kref_get() wil not be called in\nwatchdog_open(). If the watchdog then stops on close, WDOG_HW_RUNNING\nwill be cleared and kref_put() will be called, causing a kref imbalance.\nAs result the character device data structure will be released, which in\nturn will cause the system to crash on the next call to watchdog_open().\n\nFixes: ee142889e32f5 (\"watchdog: Introduce WDOG_HW_RUNNING flag\")\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\nSigned-off-by: Wim Van Sebroeck \u003cwim@iguana.be\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "32dc29cf72e866fafca3a12ea821954632a0edca", "tree": "5f7d97f9455be98b3c15a8f2415f3965991844bf", "parents": [ "a50521b04da98f22d1223b8396144d48427ff2fb" ], "author": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Mon Dec 04 15:49:48 2017 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:24 2018 +0100" }, "message": "cros_ec: fix nul-termination for firmware build info\n\n\n[ Upstream commit 50a0d71a5d20e1d3eff1d974fdc8559ad6d74892 ]\n\nAs gcc-8 reports, we zero out the wrong byte:\n\ndrivers/platform/chrome/cros_ec_sysfs.c: In function \u0027show_ec_version\u0027:\ndrivers/platform/chrome/cros_ec_sysfs.c:190:12: error: array subscript 4294967295 is above array bounds of \u0027uint8_t[]\u0027 [-Werror\u003darray-bounds]\n\nThis changes the code back to what it did before changing to a\nzero-length array structure.\n\nFixes: a841178445bb (\"mfd: cros_ec: Use a zero-length array for command data\")\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nSigned-off-by: Benson Leung \u003cbleung@chromium.org\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "a50521b04da98f22d1223b8396144d48427ff2fb", "tree": "3a3b4811b2f4622950af4313f854f4bd80e48a5b", "parents": [ "8ee96dfd01bcab79e50a596c9d5142e0bf05c787" ], "author": { "name": "Stefan Potyra", "email": "Stefan.Potyra@elektrobit.com", "time": "Wed Dec 06 16:46:12 2017 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:23 2018 +0100" }, "message": "serial: 8250_dw: Disable clock on error\n\n\n[ Upstream commit 8af016aa5a27c6a2505460eb4d83f1e70c38dc43 ]\n\nIf there is no clock rate for uartclk defined, disable the previously\nenabled clock again.\n\nFound by Linux Driver Verification project (linuxtesting.org).\n\nFixes: 23f5b3fdd04e serial: 8250_dw: only get the clock rate in one place\nSigned-off-by: Stefan Potyra \u003cStefan.Potyra@elektrobit.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "8ee96dfd01bcab79e50a596c9d5142e0bf05c787", "tree": "65908080cada843d6fb3ee4ddfc3ad4c5f21a812", "parents": [ "034371788a56304c2836eb58706b9e2f04387359" ], "author": { "name": "Bjørn Mork", "email": "bjorn@mork.no", "time": "Thu Dec 14 19:55:50 2017 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:23 2018 +0100" }, "message": "qmi_wwan: set FLAG_SEND_ZLP to avoid network initiated disconnect\n\n\n[ Upstream commit 245d21190aec547c0de64f70c0e6de871c185a24 ]\n\nIt has been reported that the dummy byte we add to avoid\nZLPs can be forwarded by the modem to the PGW/GGSN, and that\nsome operators will drop the connection if this happens.\n\nIn theory, QMI devices are based on CDC ECM and should as such\nboth support ZLPs and silently ignore the dummy byte. The latter\nassumption failed. Let\u0027s test out the first.\n\nSigned-off-by: Bjørn Mork \u003cbjorn@mork.no\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "034371788a56304c2836eb58706b9e2f04387359", "tree": "54490a2c00ac2f71589f5c83b6e7f4de99738410", "parents": [ "bb32772bc409f3cb0a40c318a5dda37f177107c3" ], "author": { "name": "Ron Economos", "email": "w6rz@comcast.net", "time": "Mon Dec 11 19:51:53 2017 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:23 2018 +0100" }, "message": "media: [RESEND] media: dvb-frontends: Add delay to Si2168 restart\n\n\n[ Upstream commit 380a6c86457573aa42d27ae11e025eb25941a0b7 ]\n\nOn faster CPUs a delay is required after the resume command and the restart command. Without the delay, the restart command often returns -EREMOTEIO and the Si2168 does not restart.\n\nNote that this patch fixes the same issue as https://patchwork.linuxtv.org/patch/44304/, but I believe my udelay() fix addresses the actual problem.\n\nSigned-off-by: Ron Economos \u003cw6rz@comcast.net\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cmchehab@s-opensource.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "bb32772bc409f3cb0a40c318a5dda37f177107c3", "tree": "11b3ae647c606de256b12f2aba603fb1c5d8d340", "parents": [ "a20f36c59b459881d6ecf30eb6b34c461e81d5b5" ], "author": { "name": "Balaji Pothunoori", "email": "bpothuno@qti.qualcomm.com", "time": "Thu Dec 07 16:58:04 2017 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:23 2018 +0100" }, "message": "ath10k: handling qos at STA side based on AP WMM enable/disable\n\n\n[ Upstream commit 07ffb4497360ae8789f05555fec8171ee952304d ]\n\nData packets are not sent by STA in case of STA joined to\nnon QOS AP (WMM disabled AP). This is happening because of STA\nis sending data packets to firmware from host with qos enabled\nalong with non qos queue value(TID \u003d 16).\nDue to qos enabled, firmware is discarding the packet.\n\nThis patch fixes this issue by updating the qos based on station\nWME capability field if WMM is disabled in AP.\n\nThis patch is required by 10.4 family chipsets like\nQCA4019/QCA9888/QCA9884/QCA99X0.\nFirmware Versoin : 10.4-3.5.1-00018.\n\nFor 10.2.4 family chipsets QCA988X/QCA9887 and QCA6174 this patch\nhas no effect.\n\nSigned-off-by: Balaji Pothunoori \u003cbpothuno@qti.qualcomm.com\u003e\nSigned-off-by: Kalle Valo \u003ckvalo@qca.qualcomm.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "a20f36c59b459881d6ecf30eb6b34c461e81d5b5", "tree": "9ff96ae7940d4228acd6370b81759ef274424ebd", "parents": [ "1f13ef920ad0ceccf22ba1d309f84d55608ef4eb" ], "author": { "name": "Christophe JAILLET", "email": "christophe.jaillet@wanadoo.fr", "time": "Thu Sep 21 19:23:56 2017 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:23 2018 +0100" }, "message": "media: bt8xx: Fix err \u0027bt878_probe()\u0027\n\n\n[ Upstream commit 45392ff6881dbe56d41ef0b17c2e576065f8ffa1 ]\n\nThis is odd to call \u0027pci_disable_device()\u0027 in an error path before a\ncoresponding successful \u0027pci_enable_device()\u0027.\n\nReturn directly instead.\n\nFixes: 77e0be12100a (\"V4L/DVB (4176): Bug-fix: Fix memory overflow\")\n\nSigned-off-by: Christophe JAILLET \u003cchristophe.jaillet@wanadoo.fr\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cmchehab@s-opensource.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "1f13ef920ad0ceccf22ba1d309f84d55608ef4eb", "tree": "a975d615446bcf031e2c6d5c53ef50ac6bae2b59", "parents": [ "7c06c3dd3af35953963cb54b4cbecc327fc81b2e" ], "author": { "name": "Tsang-Shian Lin", "email": "thlin@realtek.com", "time": "Sat Dec 09 11:37:10 2017 -0600" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:23 2018 +0100" }, "message": "rtlwifi: rtl_pci: Fix the bug when inactiveps is enabled.\n\n\n[ Upstream commit b7573a0a27bfa8270dea9b145448f6884b7cacc1 ]\n\nReset the driver current tx read/write index to zero when inactiveps\nnic out of sync with HW state. Wrong driver tx read/write index will\ncause Tx fail.\n\nSigned-off-by: Tsang-Shian Lin \u003cthlin@realtek.com\u003e\nSigned-off-by: Ping-Ke Shih \u003cpkshih@realtek.com\u003e\nSigned-off-by: Larry Finger \u003cLarry.Finger@lwfinger.net\u003e\nCc: Yan-Hsuan Chuang \u003cyhchuang@realtek.com\u003e\nCc: Birming Chiu \u003cbirming@realtek.com\u003e\nCc: Shaofu \u003cshaofu@realtek.com\u003e\nCc: Steven Ting \u003csteventing@realtek.com\u003e\nSigned-off-by: Kalle Valo \u003ckvalo@codeaurora.org\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7c06c3dd3af35953963cb54b4cbecc327fc81b2e", "tree": "d1efac79b58c1a5826859dd57777a55a46763204", "parents": [ "af302f2d047a4dccb501bfd7c74b7537e35ea4bf" ], "author": { "name": "Geert Uytterhoeven", "email": "geert@linux-m68k.org", "time": "Wed Nov 29 09:47:33 2017 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:23 2018 +0100" }, "message": "RDMA/iwpm: Fix uninitialized error code in iwpm_send_mapinfo()\n\n\n[ Upstream commit 302d6424e4a293a5761997e6c9fc3dfb1e4c355f ]\n\nWith gcc-4.1.2:\n\n drivers/infiniband/core/iwpm_util.c: In function ‘iwpm_send_mapinfo’:\n drivers/infiniband/core/iwpm_util.c:647: warning: ‘ret’ may be used uninitialized in this function\n\nIndeed, if nl_client is not found in any of the scanned has buckets, ret\nwill be used uninitialized.\n\nPreinitialize ret to -EINVAL to fix this.\n\nFixes: 30dc5e63d6a5ad24 (\"RDMA/core: Add support for iWARP Port Mapper user space service\")\nSigned-off-by: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\nReviewed-by: Tatyana Nikolova \u003ctatyana.e.nikolova@intel.com\u003e\nSigned-off-by: Jason Gunthorpe \u003cjgg@mellanox.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "af302f2d047a4dccb501bfd7c74b7537e35ea4bf", "tree": "9770bd70fd4651aaaf8bb39a684049ec247a90ae", "parents": [ "bac8b847be924575031d0486b2c53ccad7c910b8" ], "author": { "name": "Prakash Kamliya", "email": "pkamliya@codeaurora.org", "time": "Mon Dec 04 19:10:15 2017 +0530" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:23 2018 +0100" }, "message": "drm/msm: fix leak in failed get_pages\n\n\n[ Upstream commit 62e3a3e342af3c313ab38603811ecdb1fcc79edb ]\n\nget_pages doesn\u0027t keep a reference of the pages allocated\nwhen it fails later in the code path. This can lead to\na memory leak. Keep reference of the allocated pages so\nthat it can be freed when msm_gem_free_object gets called\nlater during cleanup.\n\nSigned-off-by: Prakash Kamliya \u003cpkamliya@codeaurora.org\u003e\nSigned-off-by: Sharat Masetty \u003csmasetty@codeaurora.org\u003e\nSigned-off-by: Rob Clark \u003crobdclark@gmail.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "bac8b847be924575031d0486b2c53ccad7c910b8", "tree": "a6404084ac7d47aa075e533b6aea8ef602df953c", "parents": [ "dadb6c1a8d889b5cab5ff6ed44db9cdb445467e7" ], "author": { "name": "Gustavo A. R. Silva", "email": "garsilva@embeddedor.com", "time": "Mon Nov 20 09:00:55 2017 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:22 2018 +0100" }, "message": "media: c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt\n\n\n[ Upstream commit baed3c4bc4c13de93e0dba0a26d601411ebcb389 ]\n\n_channel_ is being dereferenced before it is null checked, hence there is a\npotential null pointer dereference. Fix this by moving the pointer dereference\nafter _channel_ has been null checked.\n\nThis issue was detected with the help of Coccinelle.\n\nFixes: c5f5d0f99794 (\"[media] c8sectpfe: STiH407/10 Linux DVB demux support\")\n\nSigned-off-by: Gustavo A. R. Silva \u003cgarsilva@embeddedor.com\u003e\nAcked-by: Patrice Chotard \u003cpatrice.chotard@st.com\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cmchehab@s-opensource.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "dadb6c1a8d889b5cab5ff6ed44db9cdb445467e7", "tree": "b4e7cef4b6a46599f7f8e0baaf4a29203ca44d8c", "parents": [ "f37dc00bace9e9deb2c3db35fc7bf815dbf0c913" ], "author": { "name": "Loic Poulain", "email": "loic.poulain@linaro.org", "time": "Wed Nov 22 15:03:17 2017 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:22 2018 +0100" }, "message": "Bluetooth: btqcomsmd: Fix skb double free corruption\n\n\n[ Upstream commit 67b8fbead4685b36d290a0ef91c6ddffc4920ec9 ]\n\nIn case of hci send frame failure, skb is still owned\nby the caller (hci_core) and then should not be freed.\n\nThis fixes crash on dragonboard-410c when sending SCO\npacket. skb is freed by both btqcomsmd and hci_core.\n\nFixes: 1511cc750c3d (\"Bluetooth: Introduce Qualcomm WCNSS SMD based HCI driver\")\nSigned-off-by: Loic Poulain \u003cloic.poulain@linaro.org\u003e\nSigned-off-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f37dc00bace9e9deb2c3db35fc7bf815dbf0c913", "tree": "e3124e2b41514e09ceb1f6878a35e2b130a0a4e7", "parents": [ "18dd7b964c01ac44497471f4ea3f4c0c663eab55" ], "author": { "name": "Loic Poulain", "email": "loic.poulain@linaro.org", "time": "Mon Nov 06 12:16:56 2017 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:22 2018 +0100" }, "message": "Bluetooth: hci_qca: Avoid setup failure on missing rampatch\n\n\n[ Upstream commit ba8f3597900291a93604643017fff66a14546015 ]\n\nAssuming that the original code idea was to enable in-band sleeping\nonly if the setup_rome method returns succes and run in \u0027standard\u0027\nmode otherwise, we should not return setup_rome return value which\nmakes qca_setup fail if no rampatch/nvm file found.\n\nThis fixes BT issue on the dragonboard-820C p4 which includes the\nfollowing QCA controller:\nhci0: Product:0x00000008\nhci0: Patch :0x00000111\nhci0: ROM :0x00000302\nhci0: SOC :0x00000044\n\nSince there is no rampatch for this controller revision, just make\nit work as is.\n\nSigned-off-by: Loic Poulain \u003cloic.poulain@linaro.org\u003e\nSigned-off-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "18dd7b964c01ac44497471f4ea3f4c0c663eab55", "tree": "aa1ef61e88fca29226a1856ddbe3162e7c0dc86c", "parents": [ "85e598bc1514ba0d161cc0960017ca3b7b1c1640" ], "author": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Thu May 04 15:05:26 2017 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:22 2018 +0100" }, "message": "block/mq: Cure cpu hotplug lock inversion\n\n\n[ Upstream commit eabe06595d62cfa9278e2cd012df614bc68a7042 ]\n\nBy poking at /debug/sched_features I triggered the following splat:\n\n [] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n [] WARNING: possible circular locking dependency detected\n [] 4.11.0-00873-g964c8b7-dirty #694 Not tainted\n [] ------------------------------------------------------\n [] bash/2109 is trying to acquire lock:\n [] (cpu_hotplug_lock.rw_sem){++++++}, at: [\u003cffffffff8120cb8b\u003e] static_key_slow_dec+0x1b/0x50\n []\n [] but task is already holding lock:\n [] (\u0026sb-\u003es_type-\u003ei_mutex_key#4){+++++.}, at: [\u003cffffffff81140216\u003e] sched_feat_write+0x86/0x170\n []\n [] which lock already depends on the new lock.\n []\n []\n [] the existing dependency chain (in reverse order) is:\n []\n [] -\u003e #2 (\u0026sb-\u003es_type-\u003ei_mutex_key#4){+++++.}:\n [] lock_acquire+0x100/0x210\n [] down_write+0x28/0x60\n [] start_creating+0x5e/0xf0\n [] debugfs_create_dir+0x13/0x110\n [] blk_mq_debugfs_register+0x21/0x70\n [] blk_mq_register_dev+0x64/0xd0\n [] blk_register_queue+0x6a/0x170\n [] device_add_disk+0x22d/0x440\n [] loop_add+0x1f3/0x280\n [] loop_init+0x104/0x142\n [] do_one_initcall+0x43/0x180\n [] kernel_init_freeable+0x1de/0x266\n [] kernel_init+0xe/0x100\n [] ret_from_fork+0x31/0x40\n []\n [] -\u003e #1 (all_q_mutex){+.+.+.}:\n [] lock_acquire+0x100/0x210\n [] __mutex_lock+0x6c/0x960\n [] mutex_lock_nested+0x1b/0x20\n [] blk_mq_init_allocated_queue+0x37c/0x4e0\n [] blk_mq_init_queue+0x3a/0x60\n [] loop_add+0xe5/0x280\n [] loop_init+0x104/0x142\n [] do_one_initcall+0x43/0x180\n [] kernel_init_freeable+0x1de/0x266\n [] kernel_init+0xe/0x100\n [] ret_from_fork+0x31/0x40\n\n [] *** DEADLOCK ***\n []\n [] 3 locks held by bash/2109:\n [] #0: (sb_writers#11){.+.+.+}, at: [\u003cffffffff81292bcd\u003e] vfs_write+0x17d/0x1a0\n [] #1: (debugfs_srcu){......}, at: [\u003cffffffff8155a90d\u003e] full_proxy_write+0x5d/0xd0\n [] #2: (\u0026sb-\u003es_type-\u003ei_mutex_key#4){+++++.}, at: [\u003cffffffff81140216\u003e] sched_feat_write+0x86/0x170\n []\n [] stack backtrace:\n [] CPU: 9 PID: 2109 Comm: bash Not tainted 4.11.0-00873-g964c8b7-dirty #694\n [] Hardware name: Intel Corporation S2600GZ/S2600GZ, BIOS SE5C600.86B.02.02.0002.122320131210 12/23/2013\n [] Call Trace:\n\n [] lock_acquire+0x100/0x210\n [] get_online_cpus+0x2a/0x90\n [] static_key_slow_dec+0x1b/0x50\n [] static_key_disable+0x20/0x30\n [] sched_feat_write+0x131/0x170\n [] full_proxy_write+0x97/0xd0\n [] __vfs_write+0x28/0x120\n [] vfs_write+0xb5/0x1a0\n [] SyS_write+0x49/0xa0\n [] entry_SYSCALL_64_fastpath+0x23/0xc2\n\nThis is because of the cpu hotplug lock rework. Break the chain at #1\nby reversing the lock acquisition order. This way i_mutex_key#4 no\nlonger depends on cpu_hotplug_lock and things are good.\n\nCc: Jens Axboe \u003caxboe@kernel.dk\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Jens Axboe \u003caxboe@fb.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "85e598bc1514ba0d161cc0960017ca3b7b1c1640", "tree": "df40a8342effdd9c507f823b4879c424420d7e89", "parents": [ "975760baa6e74d57502909b5dd0f01507187c6ff" ], "author": { "name": "Kim Phillips", "email": "kim.phillips@arm.com", "time": "Wed May 03 13:14:02 2017 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:22 2018 +0100" }, "message": "perf tests kmod-path: Don\u0027t fail if compressed modules aren\u0027t supported\n\n\n[ Upstream commit 805b151a1afd24414706a7f6ae275fbb9649be74 ]\n\n__kmod_path__parse() uses is_supported_compression() to determine and\nparse out compressed module file extensions. On systems without zlib,\nthis test fails and __kmod_path__parse() continues to strcmp \"ko\" with\n\"gz\". Don\u0027t do this on those systems.\n\nSigned-off-by: Kim Phillips \u003ckim.phillips@arm.com\u003e\nCc: Alexander Shishkin \u003calexander.shishkin@linux.intel.com\u003e\nCc: Jiri Olsa \u003cjolsa@kernel.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nFixes: 3c8a67f50a1e (\"perf tools: Add kmod_path__parse function\")\nLink: http://lkml.kernel.org/r/20170503131402.c66e314460026c80cd787b34@arm.com\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "975760baa6e74d57502909b5dd0f01507187c6ff", "tree": "bfcf9813234295128a62172c7f77dfe61c126668", "parents": [ "0e37c9f8d3f5a77cfebca019a25478ce7e2f7874" ], "author": { "name": "Michael Mera", "email": "dev@michaelmera.com", "time": "Mon Apr 24 16:11:57 2017 +0900" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:22 2018 +0100" }, "message": "ath10k: fix out of bounds access to local buffer\n\n\n[ Upstream commit a16703aaeaedec7a8bee5be5522c7c3e75478951 ]\n\nDuring write to debugfs file simulate_fw_crash, fixed-size local buffer\n\u0027buf\u0027 is accessed and modified at index \u0027count-1\u0027, where \u0027count\u0027 is the\nsize of the write (so potentially out of bounds).\nThis patch fixes this problem.\n\nSigned-off-by: Michael Mera \u003cdev@michaelmera.com\u003e\nSigned-off-by: Kalle Valo \u003ckvalo@qca.qualcomm.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "0e37c9f8d3f5a77cfebca019a25478ce7e2f7874", "tree": "24fc1bbdd22c02062c807d7756301425fff60f5a", "parents": [ "a06dfdb14333c5b7e8069339fb5561debe5068e4" ], "author": { "name": "Moritz Fischer", "email": "mdf@kernel.org", "time": "Mon Apr 24 15:05:12 2017 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:22 2018 +0100" }, "message": "rtc: ds1374: wdt: Fix stop/start ioctl always returning -EINVAL\n\n\n[ Upstream commit 538c08f4c89580fc644e2bc64e0a4b86c925da4e ]\n\nThe WDIOC_SETOPTIONS case in the watchdog ioctl would alwayss falls\nthrough to the -EINVAL case. This is wrong since thew watchdog does\nactually get stopped or started correctly.\n\nFixes: 920f91e50c5b (\"drivers/rtc/rtc-ds1374.c: add watchdog support\")\nSigned-off-by: Moritz Fischer \u003cmdf@kernel.org\u003e\nSigned-off-by: Alexandre Belloni \u003calexandre.belloni@free-electrons.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "a06dfdb14333c5b7e8069339fb5561debe5068e4", "tree": "bf2c23e81140f5e1622e1479c411129463c6917d", "parents": [ "0b42ce075d8ed11259b36cdbed99bbab8f1f69f1" ], "author": { "name": "Moritz Fischer", "email": "mdf@kernel.org", "time": "Mon Apr 24 15:05:11 2017 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:22 2018 +0100" }, "message": "rtc: ds1374: wdt: Fix issue with timeout scaling from secs to wdt ticks\n\n\n[ Upstream commit 453d0744f6c6ca3f9749b8c57c2e85b5b9f52514 ]\n\nThe issue is that the internal counter that triggers the watchdog reset\nis actually running at 4096 Hz instead of 1Hz, therefore the value\ngiven by userland (in sec) needs to be multiplied by 4096 to get the\ncorrect behavior.\n\nFixes: 920f91e50c5b (\"drivers/rtc/rtc-ds1374.c: add watchdog support\")\nSigned-off-by: Moritz Fischer \u003cmdf@kernel.org\u003e\nSigned-off-by: Alexandre Belloni \u003calexandre.belloni@free-electrons.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "0b42ce075d8ed11259b36cdbed99bbab8f1f69f1", "tree": "138c4a305f448fa44c48398732e4c908f692ca78", "parents": [ "82d938a9ed8e8d880dfd7e4def4adc1578e2710e" ], "author": { "name": "Naoya Horiguchi", "email": "n-horiguchi@ah.jp.nec.com", "time": "Wed May 03 14:56:22 2017 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:21 2018 +0100" }, "message": "mm: hwpoison: call shake_page() after try_to_unmap() for mlocked page\n\n\n[ Upstream commit 286c469a988fbaf68e3a97ddf1e6c245c1446968 ]\n\nMemory error handler calls try_to_unmap() for error pages in various\nstates. If the error page is a mlocked page, error handling could fail\nwith \"still referenced by 1 users\" message. This is because the page is\nlinked to and stays in lru cache after the following call chain.\n\n try_to_unmap_one\n page_remove_rmap\n clear_page_mlock\n putback_lru_page\n lru_cache_add\n\nmemory_failure() calls shake_page() to hanlde the similar issue, but\ncurrent code doesn\u0027t cover because shake_page() is called only before\ntry_to_unmap(). So this patches adds shake_page().\n\nFixes: 23a003bfd23ea9ea0b7756b920e51f64b284b468 (\"mm/madvise: pass return code of memory_failure() to userspace\")\nLink: http://lkml.kernel.org/r/20170417055948.GM31394@yexl-desktop\nLink: http://lkml.kernel.org/r/1493197841-23986-3-git-send-email-n-horiguchi@ah.jp.nec.com\nSigned-off-by: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCc: Xiaolong Ye \u003cxiaolong.ye@intel.com\u003e\nCc: Chen Gong \u003cgong.chen@linux.intel.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "82d938a9ed8e8d880dfd7e4def4adc1578e2710e", "tree": "7e22e5c44554b7e272ebf6b77b650f29c6ef9165", "parents": [ "7eb0b7339722ec570a47503f0d7b14d9c14b8d86" ], "author": { "name": "David Rientjes", "email": "rientjes@google.com", "time": "Wed May 03 14:53:02 2017 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:21 2018 +0100" }, "message": "mm, vmstat: suppress pcp stats for unpopulated zones in zoneinfo\n\n\n[ Upstream commit 7dfb8bf3b9caef4049bee51d2c22e1c3a311d483 ]\n\nAfter \"mm, vmstat: print non-populated zones in zoneinfo\",\n/proc/zoneinfo will show unpopulated zones.\n\nThe per-cpu pageset statistics are not relevant for unpopulated zones\nand can be potentially lengthy, so supress them when they are not\ninteresting.\n\nAlso moves lowmem reserve protection information above pcp stats since\nit is relevant for all zones per vm.lowmem_reserve_ratio.\n\nLink: http://lkml.kernel.org/r/alpine.DEB.2.10.1703061400500.46428@chino.kir.corp.google.com\nSigned-off-by: David Rientjes \u003crientjes@google.com\u003e\nCc: Anshuman Khandual \u003ckhandual@linux.vnet.ibm.com\u003e\nCc: Vlastimil Babka \u003cvbabka@suse.cz\u003e\nCc: Mel Gorman \u003cmgorman@techsingularity.net\u003e\nCc: Johannes Weiner \u003channes@cmpxchg.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7eb0b7339722ec570a47503f0d7b14d9c14b8d86", "tree": "45e346786587d119b88dbdf0c5d1224fe9df9d40", "parents": [ "31da33dd8ed44ec5c5d72630644c06905c2be7c5" ], "author": { "name": "Johannes Weiner", "email": "hannes@cmpxchg.org", "time": "Wed May 03 14:51:54 2017 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:21 2018 +0100" }, "message": "mm: fix check for reclaimable pages in PF_MEMALLOC reclaim throttling\n\n\n[ Upstream commit d450abd81b081d45adb12f303a07dd44b15eb1bc ]\n\nPF_MEMALLOC direct reclaimers get throttled on a node when the sum of\nall free pages in each zone fall below half the min watermark. During\nthe summation, we want to exclude zones that don\u0027t have reclaimables.\nChecking the same pgdat over and over again doesn\u0027t make sense.\n\nFixes: 599d0c954f91 (\"mm, vmscan: move LRU lists to node\")\nLink: http://lkml.kernel.org/r/20170228214007.5621-3-hannes@cmpxchg.org\nSigned-off-by: Johannes Weiner \u003channes@cmpxchg.org\u003e\nAcked-by: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Jia He \u003chejianet@gmail.com\u003e\nCc: Mel Gorman \u003cmgorman@suse.de\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "31da33dd8ed44ec5c5d72630644c06905c2be7c5", "tree": "30037ce03b6fc574a6b4944f4cd48d300dc33526", "parents": [ "b2a863dba3defce5f37af95007999ce9f48f8af6" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Mon May 01 21:43:43 2017 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:21 2018 +0100" }, "message": "cifs: small underflow in cnvrtDosUnixTm()\n\n\n[ Upstream commit 564277eceeca01e02b1ef3e141cfb939184601b4 ]\n\nJanuary is month 1. There is no zero-th month. If someone passes a\nzero month then it means we read from one space before the start of the\ntotal_days_of_prev_months[] array.\n\nWe may as well also be strict about days as well.\n\nFixes: 1bd5bbcb6531 (\"[CIFS] Legacy time handling for Win9x and OS/2 part 1\")\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: Steve French \u003csmfrench@gmail.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b2a863dba3defce5f37af95007999ce9f48f8af6", "tree": "f0db80e87b9c5e4c48288878f6e7d4a6c5bcf4fe", "parents": [ "1b9c9549b2c9814d35b22fa817466226d9fbb8e5" ], "author": { "name": "Timmy Li", "email": "lixiaoping3@huawei.com", "time": "Tue May 02 10:46:52 2017 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:21 2018 +0100" }, "message": "net: hns: fix ethtool_get_strings overflow in hns driver\n\n\n[ Upstream commit 412b65d15a7f8a93794653968308fc100f2aa87c ]\n\nhns_get_sset_count() returns HNS_NET_STATS_CNT and the data space allocated\nis not enough for ethtool_get_strings(), which will cause random memory\ncorruption.\n\nWhen SLAB and DEBUG_SLAB are both enabled, memory corruptions like the\nthe following can be observed without this patch:\n[ 43.115200] Slab corruption (Not tainted): Acpi-ParseExt start\u003dffff801fb0b69030, len\u003d80\n[ 43.115206] Redzone: 0x9f911029d006462/0x5f78745f31657070.\n[ 43.115208] Last user: [\u003c5f7272655f746b70\u003e](0x5f7272655f746b70)\n[ 43.115214] 010: 70 70 65 31 5f 74 78 5f 70 6b 74 00 6b 6b 6b 6b ppe1_tx_pkt.kkkk\n[ 43.115217] 030: 70 70 65 31 5f 74 78 5f 70 6b 74 5f 6f 6b 00 6b ppe1_tx_pkt_ok.k\n[ 43.115218] Next obj: start\u003dffff801fb0b69098, len\u003d80\n[ 43.115220] Redzone: 0x706d655f6f666966/0x9f911029d74e35b.\n[ 43.115229] Last user: [\u003cffff0000084b11b0\u003e](acpi_os_release_object+0x28/0x38)\n[ 43.115231] 000: 74 79 00 6b 6b 6b 6b 6b 70 70 65 31 5f 74 78 5f ty.kkkkkppe1_tx_\n[ 43.115232] 010: 70 6b 74 5f 65 72 72 5f 63 73 75 6d 5f 66 61 69 pkt_err_csum_fai\n\nSigned-off-by: Timmy Li \u003clixiaoping3@huawei.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "1b9c9549b2c9814d35b22fa817466226d9fbb8e5", "tree": "05378e180b27949a8939eb89adf5423ee66718b0", "parents": [ "e22a6754abda4ab563fce3f3241e71a8c917c979" ], "author": { "name": "Trond Myklebust", "email": "trond.myklebust@primarydata.com", "time": "Mon May 01 17:06:56 2017 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:21 2018 +0100" }, "message": "pNFS: Fix a deadlock when coalescing writes and returning the layout\n\n\n[ Upstream commit 61f454e30c18a28924e96be12592c0d5e24bcc81 ]\n\nConsider the following deadlock:\n\nProcess P1\tProcess P2\t\tProcess P3\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\t\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\t\t\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\t\t\t\t\tlock_page(page)\n\n\t\tlseg \u003d pnfs_update_layout(inode)\n\nlo \u003d NFS_I(inode)-\u003elayout\npnfs_error_mark_layout_for_return(lo)\n\n\t\tlock_page(page)\n\n\t\t\t\t\tlseg \u003d pnfs_update_layout(inode)\n\nIn this scenario,\n- P1 has declared the layout to be in error, but P2 holds a reference to\n a layout segment on that inode, so the layoutreturn is deferred.\n- P2 is waiting for a page lock held by P3.\n- P3 is asking for a new layout segment, but is blocked waiting\n for the layoutreturn.\n\nThe fix is to ensure that pnfs_error_mark_layout_for_return() does\nnot set the NFS_LAYOUT_RETURN flag, which blocks P3. Instead, we allow\nthe latter to call LAYOUTGET so that it can make progress and unblock\nP2.\n\nSigned-off-by: Trond Myklebust \u003ctrond.myklebust@primarydata.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "e22a6754abda4ab563fce3f3241e71a8c917c979", "tree": "12e0bd51237ffffcc390081095560f720873ffb8", "parents": [ "e5ea3b04080c790a1d8a1ec2e8526bebb66f497b" ], "author": { "name": "Alexey Khoroshilov", "email": "khoroshilov@ispras.ru", "time": "Tue May 02 13:47:53 2017 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:21 2018 +0100" }, "message": "sm501fb: don\u0027t return zero on failure path in sm501fb_start()\n\n\n[ Upstream commit dc85e9a87420613b3129d5cc5ecd79c58351c546 ]\n\nIf fbmem iomemory mapping failed, sm501fb_start() breaks off\ninitialization, deallocates resources, but returns zero.\nAs a result, double deallocation can happen in sm501fb_stop().\n\nFound by Linux Driver Verification project (linuxtesting.org).\n\nSigned-off-by: Alexey Khoroshilov \u003ckhoroshilov@ispras.ru\u003e\nCc: Tomi Valkeinen \u003ctomi.valkeinen@ti.com\u003e\nSigned-off-by: Bartlomiej Zolnierkiewicz \u003cb.zolnierkie@samsung.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "e5ea3b04080c790a1d8a1ec2e8526bebb66f497b", "tree": "0f2023dc83e556c97484119056fe5425f4d42996", "parents": [ "51174d2553d33d574c159098c94a10050762ee4c" ], "author": { "name": "Maksim Salau", "email": "maksim.salau@gmail.com", "time": "Tue May 02 13:47:53 2017 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:21 2018 +0100" }, "message": "video: fbdev: udlfb: Fix buffer on stack\n\n\n[ Upstream commit 45f580c42e5c125d55dbd8099750a1998de3d917 ]\n\nAllocate buffers on HEAP instead of STACK for local array\nthat is to be sent using usb_control_msg().\n\nSigned-off-by: Maksim Salau \u003cmaksim.salau@gmail.com\u003e\nCc: Bernie Thompson \u003cbernie@plugable.com\u003e\nCc: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\nSigned-off-by: Bartlomiej Zolnierkiewicz \u003cb.zolnierkie@samsung.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "51174d2553d33d574c159098c94a10050762ee4c", "tree": "9340e6f7f4ed9e4af08febf2ef883dd7330eeac9", "parents": [ "f29bc9dc0bef0cb6f3ca069d96fbd535439d1680" ], "author": { "name": "Vitaly Kuznetsov", "email": "vkuznets@redhat.com", "time": "Tue Mar 14 18:35:43 2017 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:21 2018 +0100" }, "message": "x86/xen: split xen_smp_prepare_boot_cpu()\n\n\n[ Upstream commit a2d1078a35f9a38ae888aa6147e4ca32666154a1 ]\n\nSplit xen_smp_prepare_boot_cpu() into xen_pv_smp_prepare_boot_cpu() and\nxen_hvm_smp_prepare_boot_cpu() to support further splitting of smp.c.\n\nSigned-off-by: Vitaly Kuznetsov \u003cvkuznets@redhat.com\u003e\nReviewed-by: Juergen Gross \u003cjgross@suse.com\u003e\nSigned-off-by: Juergen Gross \u003cjgross@suse.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f29bc9dc0bef0cb6f3ca069d96fbd535439d1680", "tree": "4547ad14ec8d7559923db0a18f3f87f25143d3d8", "parents": [ "9935f862199bf7ddc2d26fad089b756fab0ad816" ], "author": { "name": "Dmitry Monakhov", "email": "dmonakhov@openvz.org", "time": "Fri Mar 31 19:53:35 2017 +0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:20 2018 +0100" }, "message": "tcm_fileio: Prevent information leak for short reads\n\n\n[ Upstream commit f11b55d13563e9428c88c873f4f03a6bef11ec0a ]\n\nIf we failed to read data from backing file (probably because some one\ntruncate file under us), we must zerofill cmd\u0027s data, otherwise it will\nbe returned as is. Most likely cmd\u0027s data are unitialized pages from\npage cache. This result in information leak.\n\n(Change BUG_ON into -EINVAL se_cmd failure - nab)\n\ntestcase: https://github.com/dmonakhov/xfstests/commit/e11a1b7b907ca67b1be51a1594025600767366d5\nSigned-off-by: Dmitry Monakhov \u003cdmonakhov@openvz.org\u003e\nSigned-off-by: Nicholas Bellinger \u003cnab@linux-iscsi.org\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "9935f862199bf7ddc2d26fad089b756fab0ad816", "tree": "203ec3fec3b205f13981b58b0b2b3f394eae9727", "parents": [ "a9b90d80db0e53ce4fe06a1ffe12ac683f7b06c9" ], "author": { "name": "Sergei Trofimovich", "email": "slyfox@gentoo.org", "time": "Mon May 01 11:51:55 2017 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:20 2018 +0100" }, "message": "ia64: fix module loading for gcc-5.4\n\n\n[ Upstream commit a25fb8508c1b80dce742dbeaa4d75a1e9f2c5617 ]\n\nStarting from gcc-5.4+ gcc generates MLX instructions in more cases to\nrefer local symbols:\n\n https://gcc.gnu.org/PR60465\n\nThat caused ia64 module loader to choke on such instructions:\n\n fuse: invalid slot number 1 for IMM64\n\nThe Linux kernel used to handle only case where relocation pointed to\nslot\u003d2 instruction in the bundle. That limitation was fixed in linux by\ncommit 9c184a073bfd (\"[IA64] Fix 2.6 kernel for the new ia64 assembler\")\nSee\n\n http://sources.redhat.com/bugzilla/show_bug.cgi?id\u003d1433\n\nThis change lifts the slot\u003d2 restriction from the kernel module loader.\n\nTested on \u0027fuse\u0027 and \u0027btrfs\u0027 kernel modules.\n\nCc: Markus Elfring \u003celfring@users.sourceforge.net\u003e\nCc: H J Lu \u003chjl.tools@gmail.com\u003e\nCc: Fenghua Yu \u003cfenghua.yu@intel.com\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nBug: https://bugs.gentoo.org/601014\nTested-by: Émeric MASCHINO \u003cemeric.maschino@gmail.com\u003e\nSigned-off-by: Sergei Trofimovich \u003cslyfox@gentoo.org\u003e\nSigned-off-by: Tony Luck \u003ctony.luck@intel.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "a9b90d80db0e53ce4fe06a1ffe12ac683f7b06c9", "tree": "fa78bc34eb684d19d3489c2857cd362ea2159df4", "parents": [ "2710fb8f0c828656a147870dccc5164c0f0c48ea" ], "author": { "name": "Hans de Goede", "email": "hdegoede@redhat.com", "time": "Sun Apr 30 22:54:16 2017 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:20 2018 +0100" }, "message": "ACPI / power: Delay turning off unused power resources after suspend\n\n\n[ Upstream commit 8ece1d83346bcc431090d59a2184276192189cdd ]\n\nCommit 660b1113e0f3 (ACPI / PM: Fix consistency check for power resources\nduring resume) introduced a check for ACPI power resources which have\nbeen turned on by the BIOS during suspend and turns these back off again.\n\nThis is causing problems on a Dell Venue Pro 11 7130 (i5-4300Y) it causes\nthe following messages to show up in dmesg:\n\n[ 131.014605] ACPI: Waking up from system sleep state S3\n[ 131.150271] acpi LNXPOWER:07: Turning OFF\n[ 131.150323] acpi LNXPOWER:06: Turning OFF\n[ 131.150911] acpi LNXPOWER:00: Turning OFF\n[ 131.169014] ACPI : EC: interrupt unblocked\n[ 131.181811] xhci_hcd 0000:00:14.0: System wakeup disabled by ACPI\n[ 133.535728] pci_raw_set_power_state: 76 callbacks suppressed\n[ 133.535735] iwlwifi 0000:01:00.0: Refused to change power state,\n currently in D3\n[ 133.597672] PM: noirq resume of devices complete after 2428.891 msecs\n\nFollowed by a bunch of iwlwifi errors later on and the pcie device\ndropping from the bus (acpiphp thinks it has been unplugged).\n\nDisabling the turning off of unused power resources fixes this. Instead\nof adding a quirk for this system, this commit fixes this by moving the\ndisabling of unused power resources to later in the resume sequence\nwhen the iwlwifi card has been moved out of D3 so the ref_count for\nits power resource no longer is 0.\n\nThis new behavior seems to match the intend of the original commit which\ncommit-msg says: \"(... which means that no devices are going to need them\nany time soon) and we should turn them off\".\n\nThis also avoids power resources which we need when bringing devices out\nof D3 from getting bounced off and then back on again.\n\nSigned-off-by: Hans de Goede \u003chdegoede@redhat.com\u003e\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "2710fb8f0c828656a147870dccc5164c0f0c48ea", "tree": "98f25c5364a87d6f233b141a11409233249e92a3", "parents": [ "9002e49554da9e3a4d70b2c18e7603d6fcefdbfe" ], "author": { "name": "Shaohua Li", "email": "shli@fb.com", "time": "Mon May 01 12:15:07 2017 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:20 2018 +0100" }, "message": "md/raid10: skip spare disk as \u0027first\u0027 disk\n\n\n[ Upstream commit b506335e5d2b4ec687dde392a3bdbf7601778f1d ]\n\nCommit 6f287ca(md/raid10: reset the \u0027first\u0027 at the end of loop) ignores\na case in reshape, the first rdev could be a spare disk, which shouldn\u0027t\nbe accounted as the first disk since it doesn\u0027t include the offset info.\n\nFix: 6f287ca(md/raid10: reset the \u0027first\u0027 at the end of loop)\nCc: Guoqing Jiang \u003cgqjiang@suse.com\u003e\nCc: NeilBrown \u003cneilb@suse.com\u003e\nSigned-off-by: Shaohua Li \u003cshli@fb.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "9002e49554da9e3a4d70b2c18e7603d6fcefdbfe", "tree": "7c2a6aed40318a2c655dd0912ce4dcc653393f89", "parents": [ "edc0bfd6e2276e3d53dc3ebb7f454d1b940e4967" ], "author": { "name": "Johannes Thumshirn", "email": "jthumshirn@suse.de", "time": "Thu Apr 06 14:49:44 2017 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:20 2018 +0100" }, "message": "IB/rxe: Don\u0027t clamp residual length to mtu\n\n\n[ Upstream commit d52418502e288b5c7e9e2e6cf1de5f1d3d79d2e1 ]\n\nWhen reading a RDMA WRITE FIRST packet we copy the DMA length from the RDMA\nheader into the qp-\u003eresp.resid variable for later use. Later in check_rkey()\nwe clamp it to the MTU if the packet is an RDMA WRITE packet and has a\nresidual length bigger than the MTU. Later in write_data_in() we subtract the\npayload of the packet from the residual length. If the packet happens to have a\npayload of exactly the MTU size we end up with a residual length of 0 despite\nthe packet not being the last in the conversation. When the next packet in the\nconversation arrives, we don\u0027t have any residual length left and thus set the QP\ninto an error state.\n\nThis broke NVMe over Fabrics functionality over rdma_rxe.ko\n\nThe patch was verified using the following test.\n\n # echo eth0 \u003e /sys/module/rdma_rxe/parameters/add\n # nvme connect -t rdma -a 192.168.155.101 -s 1023 -n nvmf-test\n # mkfs.xfs -fK /dev/nvme0n1\n meta-data\u003d/dev/nvme0n1 isize\u003d256 agcount\u003d4, agsize\u003d65536 blks\n \u003d sectsz\u003d4096 attr\u003d2, projid32bit\u003d1\n \u003d crc\u003d0 finobt\u003d0, sparse\u003d0\n data \u003d bsize\u003d4096 blocks\u003d262144, imaxpct\u003d25\n \u003d sunit\u003d0 swidth\u003d0 blks\n naming \u003dversion 2 bsize\u003d4096 ascii-ci\u003d0 ftype\u003d1\n log \u003dinternal log bsize\u003d4096 blocks\u003d2560, version\u003d2\n \u003d sectsz\u003d4096 sunit\u003d1 blks, lazy-count\u003d1\n realtime \u003dnone extsz\u003d4096 blocks\u003d0, rtextents\u003d0\n # mount /dev/nvme0n1 /tmp/\n [ 148.923263] XFS (nvme0n1): Mounting V4 Filesystem\n [ 148.961196] XFS (nvme0n1): Ending clean mount\n # dd if\u003d/dev/urandom of\u003dtest.bin bs\u003d1M count\u003d128\n 128+0 records in\n 128+0 records out\n 134217728 bytes (134 MB, 128 MiB) copied, 0.437991 s, 306 MB/s\n # sha256sum test.bin\n cde42941f045efa8c4f0f157ab6f29741753cdd8d1cff93a6b03649d83c4129a test.bin\n # cp test.bin /tmp/\n sha256sum /tmp/test.bin\n cde42941f045efa8c4f0f157ab6f29741753cdd8d1cff93a6b03649d83c4129a /tmp/test.bin\n\nSigned-off-by: Johannes Thumshirn \u003cjthumshirn@suse.de\u003e\nCc: Hannes Reinecke \u003chare@suse.de\u003e\nCc: Sagi Grimberg \u003csagi@grimberg.me\u003e\nCc: Max Gurtovoy \u003cmaxg@mellanox.com\u003e\nAcked-by: Moni Shoua \u003cmonis@mellanox.com\u003e\nSigned-off-by: Doug Ledford \u003cdledford@redhat.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "edc0bfd6e2276e3d53dc3ebb7f454d1b940e4967", "tree": "881060f7f1f3b0b8c6b81c08b55d78857ac4ce15", "parents": [ "5b65f7d823f3ce0e6e46eb08b2d35972e6092699" ], "author": { "name": "Sebastian Reichel", "email": "sebastian.reichel@collabora.co.uk", "time": "Fri Apr 28 10:25:51 2017 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:20 2018 +0100" }, "message": "Input: twl4030-pwrbutton - use correct device for irq request\n\n\n[ Upstream commit 3071e9dd6cd3f2290d770117330f2c8b2e9a97e4 ]\n\nThe interrupt should be requested for the platform device\nand not for the input device.\n\nFixes: 7f9ce649d267 (\"Input: twl4030-pwrbutton - simplify driver using devm_*\")\nSigned-off-by: Sebastian Reichel \u003csebastian.reichel@collabora.co.uk\u003e\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "5b65f7d823f3ce0e6e46eb08b2d35972e6092699", "tree": "3c886377e1ddd051f91ca621cc55a52b1d8a911e", "parents": [ "9822cb80738a31f4e4821e385920547ddb95828e" ], "author": { "name": "Michael Trimarchi", "email": "michael@amarulasolutions.com", "time": "Tue Apr 25 15:18:05 2017 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:20 2018 +0100" }, "message": "power: supply: pda_power: move from timer to delayed_work\n\n\n[ Upstream commit 633e8799ddc09431be2744c4a1efdbda13af2b0b ]\n\nThis changed is needed to avoid locking problem during\nboot as shown:\n\n\u003c5\u003e[ 8.824096] Registering SWP/SWPB emulation handler\n\u003c6\u003e[ 8.977294] clock: disabling unused clocks to save power\n\u003c3\u003e[ 9.108154] BUG: sleeping function called from invalid context at kernel_albert/kernel/mutex.c:269\n\u003c3\u003e[ 9.122894] in_atomic(): 1, irqs_disabled(): 0, pid: 1, name: swapper/0\n\u003c4\u003e[ 9.130249] 3 locks held by swapper/0/1:\n\u003c4\u003e[ 9.134613] #0: (\u0026__lockdep_no_validate__){......}, at: [\u003cc0342430\u003e] __driver_attach+0x58/0xa8\n\u003c4\u003e[ 9.144500] #1: (\u0026__lockdep_no_validate__){......}, at: [\u003cc0342440\u003e] __driver_attach+0x68/0xa8\n\u003c4\u003e[ 9.154357] #2: (\u0026polling_timer){......}, at: [\u003cc0053770\u003e] run_timer_softirq+0x108/0x3ec\n\u003c4\u003e[ 9.163726] Backtrace:\n\u003c4\u003e[ 9.166473] [\u003cc001269c\u003e] (dump_backtrace+0x0/0x114) from [\u003cc067e5f0\u003e] (dump_stack+0x20/0x24)\n\u003c4\u003e[ 9.175811] r6:00203230 r5:0000010d r4:d782e000 r3:60000113\n\u003c4\u003e[ 9.182250] [\u003cc067e5d0\u003e] (dump_stack+0x0/0x24) from [\u003cc007441c\u003e] (__might_sleep+0x10c/0x128)\n\u003c4\u003e[ 9.191650] [\u003cc0074310\u003e] (__might_sleep+0x0/0x128) from [\u003cc0688f60\u003e] (mutex_lock_nested+0x34/0x36c)\n\u003c4\u003e[ 9.201660] r5:c02d5350 r4:d79a0c64\n\u003c4\u003e[ 9.205688] [\u003cc0688f2c\u003e] (mutex_lock_nested+0x0/0x36c) from [\u003cc02d5350\u003e] (regulator_set_current_limit+0x30/0x118)\n\u003c4\u003e[ 9.217071] [\u003cc02d5320\u003e] (regulator_set_current_limit+0x0/0x118) from [\u003cc0435ce0\u003e] (update_charger+0x84/0xc4)\n\u003c4\u003e[ 9.228027] r7:d782fb20 r6:00000101 r5:c1767e94 r4:00000000\n\u003c4\u003e[ 9.234436] [\u003cc0435c5c\u003e] (update_charger+0x0/0xc4) from [\u003cc0435d40\u003e] (psy_changed+0x20/0x48)\n\u003c4\u003e[ 9.243804] r5:d782e000 r4:c1767e94\n\u003c4\u003e[ 9.247802] [\u003cc0435d20\u003e] (psy_changed+0x0/0x48) from [\u003cc0435dec\u003e] (polling_timer_func+0x84/0xb8)\n\u003c4\u003e[ 9.257537] r4:c1767e94 r3:00000002\n\u003c4\u003e[ 9.261566] [\u003cc0435d68\u003e] (polling_timer_func+0x0/0xb8) from [\u003cc00537e4\u003e] (run_timer_softirq+0x17c/0x3ec)\n\u003c4\u003e[ 9.272033] r4:c1767eb0 r3:00000000\n\u003c4\u003e[ 9.276062] [\u003cc0053668\u003e] (run_timer_softirq+0x0/0x3ec) from [\u003cc004b000\u003e] (__do_softirq+0xf0/0x298)\n\u003c4\u003e[ 9.286010] [\u003cc004af10\u003e] (__do_softirq+0x0/0x298) from [\u003cc004b650\u003e] (irq_exit+0x98/0xa0)\n\u003c4\u003e[ 9.295013] [\u003cc004b5b8\u003e] (irq_exit+0x0/0xa0) from [\u003cc000edbc\u003e] (handle_IRQ+0x60/0xc0)\n\u003c4\u003e[ 9.303680] r4:c1194e98 r3:c00bc778\n\u003c4\u003e[ 9.307708] [\u003cc000ed5c\u003e] (handle_IRQ+0x0/0xc0) from [\u003cc0008504\u003e] (gic_handle_irq+0x34/0x68)\n\u003c4\u003e[ 9.316955] r8:000ac383 r7:d782fc3c r6:d782fc08 r5:c11936c4 r4:e0802100\n\u003c4\u003e[ 9.324310] r3:c026ba48\n\u003c4\u003e[ 9.327301] [\u003cc00084d0\u003e] (gic_handle_irq+0x0/0x68) from [\u003cc068c2c0\u003e] (__irq_svc+0x40/0x74)\n\u003c4\u003e[ 9.336456] Exception stack(0xd782fc08 to 0xd782fc50)\n\u003c4\u003e[ 9.342041] fc00: d6e30e6c ac383627 00000000 ac383417 ea19c000 ea200000\n\u003c4\u003e[ 9.351104] fc20: beffffff 00000667 000ac383 d6e30670 d6e3066c d782fc94 d782fbe8 d782fc50\n\u003c4\u003e[ 9.360168] fc40: c026ba48 c001d1f0 00000113 ffffffff\n\nFixes: b2998049cfae (\"[BATTERY] pda_power platform driver\")\nSigned-off-by: Michael Trimarchi \u003cmichael@amarulasolutions.com\u003e\nSigned-off-by: Anthony Brandon \u003canthony@amarulasolutions.com\u003e\nSigned-off-by: Sebastian Reichel \u003csebastian.reichel@collabora.co.uk\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "9822cb80738a31f4e4821e385920547ddb95828e", "tree": "e8811d31d5480a61e9ca4de823ce2912f3be5003", "parents": [ "5ac685af62fb165a8bec3ca26c0c180e4de04929" ], "author": { "name": "Pan Bian", "email": "bianpan2016@163.com", "time": "Mon Apr 24 16:22:08 2017 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:20 2018 +0100" }, "message": "power: supply: isp1704: Fix unchecked return value of devm_kzalloc\n\n\n[ Upstream commit 8b20839988f1ed5e534b270f3776709b640dc7e0 ]\n\nFunction devm_kzalloc() will return a NULL pointer. However, in function\nisp1704_charger_probe(), the return value of devm_kzalloc() is directly\nused without validation. This may result in a bad memory access bug.\n\nFixes: 34a109610e2a (\"isp1704_charger: Add DT support\")\nSigned-off-by: Pan Bian \u003cbianpan2016@163.com\u003e\nReviewed-by: Pali Rohár \u003cpali.rohar@gmail.com\u003e\nSigned-off-by: Sebastian Reichel \u003csebastian.reichel@collabora.co.uk\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "5ac685af62fb165a8bec3ca26c0c180e4de04929", "tree": "47673c1a04dee8e3921854e1ec8c9e3c0bee5f63", "parents": [ "909dbba2106f370d93bb4b6dc7520a8ef7791f08" ], "author": { "name": "Hans de Goede", "email": "hdegoede@redhat.com", "time": "Fri Apr 14 18:52:33 2017 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:19 2018 +0100" }, "message": "power: supply: bq24190_charger: Add disable-reset device-property\n\n\n[ Upstream commit 6cf62a3b97e78ba41d31390e59a1ddc98a9e3622 ]\n\nAllow platform-code to disable the reset on probe and suspend/resume\nby setting a \"disable-reset\" boolean device property on the device.\n\nThere are several reasons why the platform-code may want to disable\nthe reset on probe and suspend/resume:\n\n1) Resetting the charger should never be necessary it should always have\nsane values programmed. If it is running with invalid values while we\nare not running (system turned off or suspended) there is a big problem\nas that may lead to overcharging the battery.\n\n2) The reset in suspend() is meant to put the charger back into default\nmode, but this is not necessary and not a good idea. If the charger has\nbeen programmed with a higher max charge_current / charge_voltage then\nputting it back in default-mode will reset those to the safe power-on\ndefaults, leading to slower charging, or charging to a lower voltage\n(and thus not using the full capacity) while suspended which is\nundesirable. Reprogramming the max charge_current / charge_voltage\nafter the reset will not help here as that will put the charger back\nin host mode and start the i2c watchdog if the host then does not do\nanything for 40s (iow if we\u0027re suspended for more then 40s) the watchdog\nexpires resetting the device to default-mode, including resetting all\nthe registers to there safe power-on defaults. So the only way to keep\nusing custom charge settings while suspending is to keep the charger in\nits normal running state with the i2c watchdog disabled. This is fine\nas the charger will still automatically switch from constant current\nto constant voltage and stop charging when the battery is full.\n\n3) Besides never being necessary resetting the charger also causes\nproblems on systems where the charge voltage limit is set higher then the\nreset value, if this is the case and the charger is reset while charging\nand the battery voltage is between the 2 voltages, then about half the\ntime the charger gets confused and claims to be charging (REG08 contains\n0x64) but in reality the charger has decoupled itself from VBUS (Q1 off)\nand is drawing 0A from VBUS, leaving the system running from the battery.\n\nThis last problem is happening on a GPD-win mini PC with a bq24292i\ncharger chip combined with a max17047 fuel-gauge and a LiHV battery.\nI\u0027ve checked and TI does not list any errata for the bq24292i which\ncould explain this (there are no errata at all).\n\nCc: Liam Breck \u003ckernel@networkimprov.net\u003e\nCc: Tony Lindgren \u003ctony@atomide.com\u003e\nSigned-off-by: Hans de Goede \u003chdegoede@redhat.com\u003e\nAcked-by: Liam Breck \u003ckernel@networkimprov.net\u003e\nSigned-off-by: Sebastian Reichel \u003csebastian.reichel@collabora.co.uk\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "909dbba2106f370d93bb4b6dc7520a8ef7791f08", "tree": "7efe7c4077865feb04d3b37732c1c7bc94a88e6a", "parents": [ "498d02453e734133baff5ae24d54bf2b72abb179" ], "author": { "name": "Scott Wood", "email": "swood@redhat.com", "time": "Fri Apr 28 19:17:41 2017 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:19 2018 +0100" }, "message": "bnx2x: Align RX buffers\n\n\n[ Upstream commit 9b70de6d0266888b3743f03802502e43131043c8 ]\n\nThe bnx2x driver is not providing proper alignment on the receive buffers it\npasses to build_skb(), causing skb_shared_info to be misaligned.\nskb_shared_info contains an atomic, and while PPC normally supports\nunaligned accesses, it does not support unaligned atomics.\n\nAligning the size of rx buffers will ensure that page_frag_alloc() returns\naligned addresses.\n\nThis can be reproduced on PPC by setting the network MTU to 1450 (or other\nnon-multiple-of-4) and then generating sufficient inbound network traffic\n(one or two large \"wget\"s usually does it), producing the following oops:\n\nUnable to handle kernel paging request for unaligned access at address 0xc00000ffc43af656\nFaulting instruction address: 0xc00000000080ef8c\nOops: Kernel access of bad area, sig: 7 [#1]\nSMP NR_CPUS\u003d2048\nNUMA\nPowerNV\nModules linked in: vmx_crypto powernv_rng rng_core powernv_op_panel leds_powernv led_class nfsd ip_tables x_tables autofs4 xfs lpfc bnx2x mdio libcrc32c crc_t10dif crct10dif_generic crct10dif_common\nCPU: 104 PID: 0 Comm: swapper/104 Not tainted 4.11.0-rc8-00088-g4c761da #2\ntask: c00000ffd4892400 task.stack: c00000ffd4920000\nNIP: c00000000080ef8c LR: c00000000080eee8 CTR: c0000000001f8320\nREGS: c00000ffffc33710 TRAP: 0600 Not tainted (4.11.0-rc8-00088-g4c761da)\nMSR: 9000000000009033 \u003cSF,HV,EE,ME,IR,DR,RI,LE\u003e\n CR: 24082042 XER: 00000000\nCFAR: c00000000080eea0 DAR: c00000ffc43af656 DSISR: 00000000 SOFTE: 1\nGPR00: c000000000907f64 c00000ffffc33990 c000000000dd3b00 c00000ffcaf22100\nGPR04: c00000ffcaf22e00 0000000000000000 0000000000000000 0000000000000000\nGPR08: 0000000000b80008 c00000ffc43af636 c00000ffc43af656 0000000000000000\nGPR12: c0000000001f6f00 c00000000fe1a000 000000000000049f 000000000000c51f\nGPR16: 00000000ffffef33 0000000000000000 0000000000008a43 0000000000000001\nGPR20: c00000ffc58a90c0 0000000000000000 000000000000dd86 0000000000000000\nGPR24: c000007fd0ed10c0 00000000ffffffff 0000000000000158 000000000000014a\nGPR28: c00000ffc43af010 c00000ffc9144000 c00000ffcaf22e00 c00000ffcaf22100\nNIP [c00000000080ef8c] __skb_clone+0xdc/0x140\nLR [c00000000080eee8] __skb_clone+0x38/0x140\nCall Trace:\n[c00000ffffc33990] [c00000000080fb74] skb_clone+0x74/0x110 (unreliable)\n[c00000ffffc339c0] [c000000000907f64] packet_rcv+0x144/0x510\n[c00000ffffc33a40] [c000000000827b64] __netif_receive_skb_core+0x5b4/0xd80\n[c00000ffffc33b00] [c00000000082b2bc] netif_receive_skb_internal+0x2c/0xc0\n[c00000ffffc33b40] [c00000000082c49c] napi_gro_receive+0x11c/0x260\n[c00000ffffc33b80] [d000000066483d68] bnx2x_poll+0xcf8/0x17b0 [bnx2x]\n[c00000ffffc33d00] [c00000000082babc] net_rx_action+0x31c/0x480\n[c00000ffffc33e10] [c0000000000d5a44] __do_softirq+0x164/0x3d0\n[c00000ffffc33f00] [c0000000000d60a8] irq_exit+0x108/0x120\n[c00000ffffc33f20] [c000000000015b98] __do_irq+0x98/0x200\n[c00000ffffc33f90] [c000000000027f14] call_do_irq+0x14/0x24\n[c00000ffd4923a90] [c000000000015d94] do_IRQ+0x94/0x110\n[c00000ffd4923ae0] [c000000000008d90] hardware_interrupt_common+0x150/0x160\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "498d02453e734133baff5ae24d54bf2b72abb179", "tree": "fd710a54569109a9f85b032591aa4959858e42fe", "parents": [ "9c8cd2a87247a9561536345715ef63143551f0c9" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Fri Apr 28 15:56:09 2017 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:19 2018 +0100" }, "message": "qed: Unlock on error in qed_vf_pf_acquire()\n\n\n[ Upstream commit 66117a9d9a8ca948680d6554769ef9e88f936954 ]\n\nMy static checker complains that we\u0027re holding a mutex on this error\npath. Let\u0027s goto exit instead of returning directly.\n\nFixes: b0bccb69eba3 (\"qed: Change locking scheme for VF channel\")\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nAcked-by: Yuval Mintz \u003cYuval.Mintz@cavium.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "9c8cd2a87247a9561536345715ef63143551f0c9", "tree": "56708648a0285435fdae620e4347c8afb8e29d41", "parents": [ "b5d95e85b20634f58c2d57f4041222a9adefd282" ], "author": { "name": "Jiri Benc", "email": "jbenc@redhat.com", "time": "Thu Apr 27 21:24:35 2017 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:19 2018 +0100" }, "message": "vxlan: correctly handle ipv6.disable module parameter\n\n\n[ Upstream commit d074bf9600443403aa24fbc12c1f18eadc90f5aa ]\n\nWhen IPv6 is compiled but disabled at runtime, __vxlan_sock_add returns\n-EAFNOSUPPORT. For metadata based tunnels, this causes failure of the whole\noperation of bringing up the tunnel.\n\nIgnore failure of IPv6 socket creation for metadata based tunnels caused by\nIPv6 not being available.\n\nFixes: b1be00a6c39f (\"vxlan: support both IPv4 and IPv6 sockets in a single vxlan device\")\nSigned-off-by: Jiri Benc \u003cjbenc@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b5d95e85b20634f58c2d57f4041222a9adefd282", "tree": "fedf7f257bc1ca07c9f11188b837ba9b2a49515b", "parents": [ "bbb952d00c8b254890e1cef7f7b7d23874c3aaa9" ], "author": { "name": "Dean Jenkins", "email": "Dean_Jenkins@mentor.com", "time": "Fri Apr 28 13:57:26 2017 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:19 2018 +0100" }, "message": "Bluetooth: hci_ldisc: Add protocol check to hci_uart_tx_wakeup()\n\n\n[ Upstream commit 2d6f1da168e1d62c47f7d50135ac4cbd8411dcb1 ]\n\nBefore attempting to schedule a work-item onto hu-\u003ewrite_work in\nhci_uart_tx_wakeup(), check that the Data Link protocol layer is\nstill bound to the HCI UART driver.\n\nFailure to perform this protocol check causes a race condition between\nthe work queue hu-\u003ewrite_work running hci_uart_write_work() and the\nData Link protocol layer being unbound (closed) in hci_uart_tty_close().\n\nNote hci_uart_tty_close() does have a \"cancel_work_sync(\u0026hu-\u003ewrite_work)\"\nbut it is ineffective because it cannot prevent work-items being added\nto hu-\u003ewrite_work after cancel_work_sync() has run.\n\nTherefore, add a check for HCI_UART_PROTO_READY into hci_uart_tx_wakeup()\nwhich prevents scheduling of the work queue when HCI_UART_PROTO_READY\nis in the clear state. However, note a small race condition remains\nbecause the hci_uart_tx_wakeup() thread can run in parallel with the\nhci_uart_tty_close() thread so it is possible that a schedule of\nhu-\u003ewrite_work can occur when HCI_UART_PROTO_READY is cleared. A complete\nsolution needs locking of the threads which is implemented in a future\ncommit.\n\nSigned-off-by: Dean Jenkins \u003cDean_Jenkins@mentor.com\u003e\nSigned-off-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "bbb952d00c8b254890e1cef7f7b7d23874c3aaa9", "tree": "ccd2b1789e393b9bb8f1dc4dfde5fc4f4b85547b", "parents": [ "949b9dc1818a100941ed63c5147059a5f64c7987" ], "author": { "name": "Dean Jenkins", "email": "Dean_Jenkins@mentor.com", "time": "Fri Apr 28 13:57:25 2017 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:19 2018 +0100" }, "message": "Bluetooth: hci_ldisc: Add protocol check to hci_uart_dequeue()\n\n\n[ Upstream commit 048e1bd3a27fbeb84ccdff52e165370c1339a193 ]\n\nBefore attempting to dequeue a Data Link protocol encapsulated message,\ncheck that the Data Link protocol is still bound to the HCI UART driver.\nThis makes the code consistent with the usage of the other proto\nfunction pointers.\n\nTherefore, add a check for HCI_UART_PROTO_READY into hci_uart_dequeue()\nand return NULL if the Data Link protocol is not bound.\n\nThis is needed for robustness as there is a scheduling race condition.\nhci_uart_write_work() is scheduled to run via work queue hu-\u003ewrite_work\nfrom hci_uart_tx_wakeup(). Therefore, there is a delay between\nscheduling hci_uart_write_work() to run and hci_uart_dequeue() running\nwhereby the Data Link protocol layer could become unbound during the\nscheduling delay. In this case, without the check, the call to the\nunbound Data Link protocol layer dequeue function can crash.\n\nIt is noted that hci_uart_tty_close() has a\n\"cancel_work_sync(\u0026hu-\u003ewrite_work)\" statement but this only reduces\nthe window of the race condition because it is possible for a new\nwork-item to be added to work queue hu-\u003ewrite_work after the call to\ncancel_work_sync(). For example, Data Link layer retransmissions can\nbe added to the work queue after the cancel_work_sync() has finished.\n\nSigned-off-by: Dean Jenkins \u003cDean_Jenkins@mentor.com\u003e\nSigned-off-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "949b9dc1818a100941ed63c5147059a5f64c7987", "tree": "c2222f2d038257a58579aadb0757276427adab1e", "parents": [ "b0d0441f2a6ae3dc20ee4a6871d48178c17911a7" ], "author": { "name": "Valentin Longchamp", "email": "valentin.longchamp@keymile.com", "time": "Fri Feb 17 11:29:45 2017 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:19 2018 +0100" }, "message": "soc/fsl/qe: round brg_freq to 1kHz granularity\n\n\n[ Upstream commit 2ccf80b7566cc035d903dd0ac5d7ebd25c2c1060 ]\n\nBecause of integer computation rounding in u-boot (that sets the QE\nbrg-frequency DTS prop), the clk value is 99999999 Hz even though it is\n100 MHz.\n\nWhen setting brg clks that are exact divisors of 100 MHz, this small\ndiffernce plays a role and can result in lower clks to be output (for\ninstance 20 MHz - divide by 5 - results in 16.666 MHz - divide by 6).\n\nThis patch fixes that by \"forcing\" the brg_clk to the nearest kHz when\nthe difference is below 2 integer rounding errors (i.e. 4).\n\nSigned-off-by: Valentin Longchamp \u003cvalentin.longchamp@keymile.com\u003e\nSigned-off-by: Scott Wood \u003coss@buserror.net\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b0d0441f2a6ae3dc20ee4a6871d48178c17911a7", "tree": "8c92e37495adbc8468674cedc15622478a74609d", "parents": [ "b1b6f948b41cb69fe4ac81f49eb218df9399507c" ], "author": { "name": "Christophe Leroy", "email": "christophe.leroy@c-s.fr", "time": "Tue Feb 07 10:05:09 2017 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:19 2018 +0100" }, "message": "net: ethernet: ucc_geth: fix MEM_PART_MURAM mode\n\n\n[ Upstream commit 8b8642af15ed14b9a7a34d3401afbcc274533e13 ]\n\nSince commit 5093bb965a163 (\"powerpc/QE: switch to the cpm_muram\nimplementation\"), muram area is not part of immrbar mapping anymore\nso immrbar_virt_to_phys() is not usable anymore.\n\nFixes: 5093bb965a163 (\"powerpc/QE: switch to the cpm_muram implementation\")\nSigned-off-by: Christophe Leroy \u003cchristophe.leroy@c-s.fr\u003e\nAcked-by: David S. Miller \u003cdavem@davemloft.net\u003e\nAcked-by: Li Yang \u003cpku.leo@gmail.com\u003e\nSigned-off-by: Scott Wood \u003coss@buserror.net\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b1b6f948b41cb69fe4ac81f49eb218df9399507c", "tree": "f4dd58373e98220bc60c9a62f3e912e681ab57ea", "parents": [ "81ca30d9654a6035f0bef174bd7df541b3e94217" ], "author": { "name": "Emil Tantilov", "email": "emil.s.tantilov@intel.com", "time": "Thu Mar 30 20:49:02 2017 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:18 2018 +0100" }, "message": "ixgbevf: fix size of queue stats length\n\n\n[ Upstream commit f87fc44770f54ff1b54d44ae9cec11f10efeca02 ]\n\nIXGBEVF_QUEUE_STATS_LEN is based on ixgebvf_stats, not ixgbe_stats.\n\nThis change fixes a bug where ethtool -S displayed some empty fields.\n\nSigned-off-by: Emil Tantilov \u003cemil.s.tantilov@intel.com\u003e\nTested-by: Andrew Bowers \u003candrewx.bowers@intel.com\u003e\nSigned-off-by: Jeff Kirsher \u003cjeffrey.t.kirsher@intel.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "81ca30d9654a6035f0bef174bd7df541b3e94217", "tree": "e3fff887a53478e09277172302c7bd3281062844", "parents": [ "7be76fbbd25c4cd838125f8ea843d1fb1c657db0" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Sat Apr 29 20:12:16 2017 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:18 2018 +0100" }, "message": "jbd2: Fix lockdep splat with generic/270 test\n\n\n[ Upstream commit c52c47e4b4fbe4284602fc2ccbfc4a4d8dc05b49 ]\n\nI\u0027ve hit a lockdep splat with generic/270 test complaining that:\n\n3216.fsstress.b/3533 is trying to acquire lock:\n (jbd2_handle){++++..}, at: [\u003cffffffff813152e0\u003e] jbd2_log_wait_commit+0x0/0x150\n\nbut task is already holding lock:\n (jbd2_handle){++++..}, at: [\u003cffffffff8130bd3b\u003e] start_this_handle+0x35b/0x850\n\nThe underlying problem is that jbd2_journal_force_commit_nested()\n(called from ext4_should_retry_alloc()) may get called while a\ntransaction handle is started. In such case it takes care to not wait\nfor commit of the running transaction (which would deadlock) but only\nfor a commit of a transaction that is already committing (which is safe\nas that doesn\u0027t wait for any filesystem locks).\n\nIn fact there are also other callers of jbd2_log_wait_commit() that take\ncare to pass tid of a transaction that is already committing and for\nthose cases, the lockdep instrumentation is too restrictive and leading\nto false positive reports. Fix the problem by calling\njbd2_might_wait_for_commit() from jbd2_log_wait_commit() only if the\ntransaction isn\u0027t already committing.\n\nFixes: 1eaa566d368b214d99cbb973647c1b0b8102a9ae\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7be76fbbd25c4cd838125f8ea843d1fb1c657db0", "tree": "8270e4c40b383e6c7735446e152c492a8a8a67ce", "parents": [ "8112fa3c00c68f4407c970aeaa73a8e64c1e717b" ], "author": { "name": "Mario Kleiner", "email": "mario.kleiner.de@gmail.com", "time": "Mon Apr 24 01:59:34 2017 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:18 2018 +0100" }, "message": "drm/nouveau/kms: Increase max retries in scanout position queries.\n\n\n[ Upstream commit 60b95d709525e3ce1c51e1fc93175dcd1755d345 ]\n\nSo far we only allowed for 1 retry and just failed the query\n- and thereby high precision vblank timestamping - if we did\nnot get a reasonable result, as such a failure wasn\u0027t considered\nall too horrible. There are a few NVidia gpu models out there which\nmay need a bit more than 1 retry to get a successful query result\nunder some conditions.\n\nSince Linux 4.4 the update code for vblank counter and timestamp\nin drm_update_vblank_count() changed so that the implementation\nassumes that high precision vblank timestamping of a kms driver\neither consistently succeeds or consistently fails for a given\nvideo mode and encoder/connector combo. Iow. switching from success\nto fail or vice versa on a modeset or connector change is ok, but\nspurious temporary failure for a given setup can confuse the core\ncode and potentially cause bad miscounting of vblanks and confusion\nor hangs in userspace clients which rely on vblank stuff, e.g.,\ndesktop compositors.\n\nTherefore change the max retry count to a larger number - more than\nany gpu so far is known to need to succeed, but still low enough\nso that these queries which do also happen in vblank interrupt are\nstill fast enough to be not disastrously long if something would\ngo badly wrong with them.\n\nAs such sporadic retries only happen seldom even on affected gpu\u0027s,\nthis could mean a vblank irq could take a few dozen microseconds\nlonger every few hours of uptime -- better than a desktop compositor\nrandomly hanging every couple of hours or days of uptime in a hard\nto reproduce manner.\n\nSigned-off-by: Mario Kleiner \u003cmario.kleiner.de@gmail.com\u003e\nSigned-off-by: Ben Skeggs \u003cbskeggs@redhat.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "8112fa3c00c68f4407c970aeaa73a8e64c1e717b", "tree": "8e4b53e3a63b0f41cc41d154df357722bb9652ba", "parents": [ "ec4b63f5c0a47d01b92af90cd645f47e03f36a98" ], "author": { "name": "Chunming Zhou", "email": "David1.Zhou@amd.com", "time": "Mon Apr 24 17:09:15 2017 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:18 2018 +0100" }, "message": "drm/amdgpu: fix gpu reset crash\n\n\n[ Upstream commit 51687759be93fbc553f2727e86be25c38126ba93 ]\n\n[ 413.687439] BUG: unable to handle kernel NULL pointer dereference at 0000000000000548\n[ 413.687479] IP: [\u003cffffffff8109b175\u003e] to_live_kthread+0x5/0x60\n[ 413.687507] PGD 1efd12067\n[ 413.687519] PUD 1efd11067\n[ 413.687531] PMD 0\n\n[ 413.687543] Oops: 0000 [#1] SMP\n[ 413.687557] Modules linked in: amdgpu(OE) ttm(OE) drm_kms_helper(E) drm(E) i2c_algo_bit(E) fb_sys_fops(E) syscopyarea(E) sysfillrect(E) sysimgblt(E) rpcsec_gss_krb5(E) nfsv4(E) nfs(E) fscache(E) snd_hda_codec_realtek(E) snd_hda_codec_generic(E) snd_hda_codec_hdmi(E) snd_hda_intel(E) eeepc_wmi(E) snd_hda_codec(E) asus_wmi(E) snd_hda_core(E) sparse_keymap(E) snd_hwdep(E) video(E) snd_pcm(E) snd_seq_midi(E) joydev(E) snd_seq_midi_event(E) snd_rawmidi(E) snd_seq(E) snd_seq_device(E) snd_timer(E) kvm(E) irqbypass(E) crct10dif_pclmul(E) snd(E) crc32_pclmul(E) ghash_clmulni_intel(E) soundcore(E) aesni_intel(E) aes_x86_64(E) lrw(E) gf128mul(E) glue_helper(E) ablk_helper(E) cryptd(E) shpchp(E) serio_raw(E) i2c_piix4(E) 8250_dw(E) i2c_designware_platform(E) i2c_designware_core(E) mac_hid(E) binfmt_misc(E)\n[ 413.687894] parport_pc(E) ppdev(E) lp(E) parport(E) nfsd(E) auth_rpcgss(E) nfs_acl(E) lockd(E) grace(E) sunrpc(E) autofs4(E) hid_generic(E) usbhid(E) hid(E) psmouse(E) ahci(E) r8169(E) mii(E) libahci(E) wmi(E)\n[ 413.687989] CPU: 13 PID: 1134 Comm: kworker/13:2 Tainted: G OE 4.9.0-custom #4\n[ 413.688019] Hardware name: System manufacturer System Product Name/PRIME B350-PLUS, BIOS 0606 04/06/2017\n[ 413.688089] Workqueue: events amd_sched_job_timedout [amdgpu]\n[ 413.688116] task: ffff88020f9657c0 task.stack: ffffc90001a88000\n[ 413.688139] RIP: 0010:[\u003cffffffff8109b175\u003e] [\u003cffffffff8109b175\u003e] to_live_kthread+0x5/0x60\n[ 413.688171] RSP: 0018:ffffc90001a8bd60 EFLAGS: 00010282\n[ 413.688191] RAX: ffff88020f0073f8 RBX: ffff88020f000000 RCX: 0000000000000000\n[ 413.688217] RDX: 0000000000000001 RSI: ffff88020f9670c0 RDI: 0000000000000000\n[ 413.688243] RBP: ffffc90001a8bd78 R08: 0000000000000000 R09: 0000000000001000\n[ 413.688269] R10: 0000006051b11a82 R11: 0000000000000001 R12: 0000000000000000\n[ 413.688295] R13: ffff88020f002770 R14: ffff88020f004838 R15: ffff8801b23c2c60\n[ 413.688321] FS: 0000000000000000(0000) GS:ffff88021ef40000(0000) knlGS:0000000000000000\n[ 413.688352] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 413.688373] CR2: 0000000000000548 CR3: 00000001efd0f000 CR4: 00000000003406e0\n[ 413.688399] Stack:\n[ 413.688407] ffffffff8109b304 ffff88020f000000 0000000000000070 ffffc90001a8bdf0\n[ 413.688439] ffffffffa05ce29d ffffffffa052feb7 ffffffffa07b5820 ffffc90001a8bda0\n[ 413.688470] ffffffff00000018 ffff8801bb88f060 0000000001a8bdb8 ffff88021ef59280\n[ 413.688502] Call Trace:\n[ 413.688514] [\u003cffffffff8109b304\u003e] ? kthread_park+0x14/0x60\n[ 413.688555] [\u003cffffffffa05ce29d\u003e] amdgpu_gpu_reset+0x7d/0x670 [amdgpu]\n[ 413.688589] [\u003cffffffffa052feb7\u003e] ? drm_printk+0x97/0xa0 [drm]\n[ 413.688643] [\u003cffffffffa0698136\u003e] amdgpu_job_timedout+0x46/0x50 [amdgpu]\n[ 413.688700] [\u003cffffffffa06969e7\u003e] amd_sched_job_timedout+0x17/0x20 [amdgpu]\n[ 413.688727] [\u003cffffffff81095493\u003e] process_one_work+0x153/0x3f0\n[ 413.688751] [\u003cffffffff81095c5b\u003e] worker_thread+0x12b/0x4b0\n[ 413.688773] [\u003cffffffff8100392e\u003e] ? do_syscall_64+0x6e/0x180\n[ 413.688795] [\u003cffffffff81095b30\u003e] ? rescuer_thread+0x350/0x350\n[ 413.688818] [\u003cffffffff8100392e\u003e] ? do_syscall_64+0x6e/0x180\n[ 413.688839] [\u003cffffffff8109b423\u003e] kthread+0xd3/0xf0\n[ 413.688858] [\u003cffffffff8109b350\u003e] ? kthread_park+0x60/0x60\n[ 413.688881] [\u003cffffffff817e1ee5\u003e] ret_from_fork+0x25/0x30\n[ 413.688901] Code: 25 40 d3 00 00 48 8b 80 48 05 00 00 48 89 e5 5d 48 8b 40 c8 48 c1 e8 02 83 e0 01 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 \u003c48\u003e 8b b7 48 05 00 00 55 48 89 e5 48 85 f6 74 31 8b 97 f8 18 00\n[ 413.689045] RIP [\u003cffffffff8109b175\u003e] to_live_kthread+0x5/0x60\n[ 413.689064] RSP \u003cffffc90001a8bd60\u003e\n[ 413.689076] CR2: 0000000000000548\n[ 413.697985] ---[ end trace 0a314a64821f84e9 ]---\n\nThe root cause is some ring doesn\u0027t have scheduler, like KIQ ring\n\nReviewed-by: Christian König \u003cchristian.koenig@amd.com\u003e\nSigned-off-by: Chunming Zhou \u003cDavid1.Zhou@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ec4b63f5c0a47d01b92af90cd645f47e03f36a98", "tree": "4c49cdd715209f6848eb4f0870b41f609ded632c", "parents": [ "e9e5ad6b0ef2f00ba23f550c1347bbfb44b66e20" ], "author": { "name": "Hans de Goede", "email": "hdegoede@redhat.com", "time": "Fri Apr 21 13:48:08 2017 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:18 2018 +0100" }, "message": "ACPI / PMIC: xpower: Fix power_table addresses\n\n\n[ Upstream commit 2bde7c32b1db162692f05c6be066b5bcd3d9fdbe ]\n\nThe power table addresses should be contiguous, but there was a hole\nwhere 0x34 was missing. On most devices this is not a problem as\naddresses above 0x34 are used for the BUC# convertors which are not\nused in the DSDTs I\u0027ve access to but after the BUC# convertors\nthere is a field named GPI1 in the DSTDs, which does get used in some\ncases and ended up turning BUC6 on and off due to the wrong addresses,\nresulting in turning the entire device off (or causing it to reboot).\n\nRemoving the hole in the addresses fixes this, fixing one of my\nBay Trail tablets turning off while booting the mainline kernel.\n\nWhile at it add comments with the field names used in the DSDTs to\nmake it easier to compare the register and bits used at each address\nwith the datasheet.\n\nSigned-off-by: Hans de Goede \u003chdegoede@redhat.com\u003e\nReviewed-by: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "e9e5ad6b0ef2f00ba23f550c1347bbfb44b66e20", "tree": "204b71e07e560408d6d88767558087af8c97bdd9", "parents": [ "7c1c184bb571e696ffcd57ed43c65f8c91a6d03e" ], "author": { "name": "Robert Lippert", "email": "roblip@gmail.com", "time": "Thu Apr 20 16:49:47 2017 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:18 2018 +0100" }, "message": "ipmi/watchdog: fix wdog hang on panic waiting for ipmi response\n\n\n[ Upstream commit 2c1175c2e8e5487233cabde358a19577562ac83e ]\n\nCommit c49c097610fe (\"ipmi: Don\u0027t call receive handler in the\npanic context\") means that the panic_recv_free is not called during a\npanic and the atomic count does not drop to 0.\n\nFix this by only expecting one decrement of the atomic variable\nwhich comes from panic_smi_free.\n\nSigned-off-by: Robert Lippert \u003crlippert@google.com\u003e\nSigned-off-by: Corey Minyard \u003ccminyard@mvista.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7c1c184bb571e696ffcd57ed43c65f8c91a6d03e", "tree": "84bead976f62484916194c86cc37ac202d635fdf", "parents": [ "b38508b8e016e5017c3920000bd9233e0c4d3666" ], "author": { "name": "Oleksij Rempel", "email": "linux@rempel-privat.de", "time": "Fri Apr 28 16:19:49 2017 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:18 2018 +0100" }, "message": "platform/x86: asus-wmi: try to set als by default\n\n\n[ Upstream commit e9b615186805e2c18a0ac76aca62c1543ecfdbb8 ]\n\nsome laptops, for example ASUS UX330UAK, have brocken als_get function\nbut working als_set funktion. In this case, ALS will stay turned off.\n\n Method (WMNB, 3, Serialized)\n {\n\t ...\n If (Local0 \u003d\u003d 0x53545344)\n {\n\t\t...\n If (IIA0 \u003d\u003d 0x00050001)\n {\n If (!ALSP)\n {\n Return (0x02)\n }\n\n Local0 \u003d (GALS \u0026 0x10) \u003c\u003c\u003c---- bug,\n should be: (GALS () \u0026 0x10)\n If (Local0)\n {\n Return (0x00050001)\n }\n Else\n {\n Return (0x00050000)\n }\n }\n\n .....\n If (Local0 \u003d\u003d 0x53564544)\n {\n\t\t...\n If (IIA0 \u003d\u003d 0x00050001)\n {\n Return (ALSC (IIA1))\n }\n\n ......\n Method (GALS, 0, NotSerialized)\n {\n Local0 \u003d Zero\n Local0 |\u003d 0x20\n If (ALAE)\n {\n Local0 |\u003d 0x10\n }\n\n Local1 \u003d 0x0A\n Local1 \u003c\u003c\u003d 0x08\n Local0 |\u003d Local1\n Return (Local0)\n }\n\nSince it works without problems on Windows I assume ASUS WMI driver for Win\nnever trying to get ALS state, and instead it is setting it by default to ON.\n\nThis patch will do the same. Turn ALS on by default.\n\nSigned-off-by: Oleksij Rempel \u003clinux@rempel-privat.de\u003e\nSigned-off-by: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b38508b8e016e5017c3920000bd9233e0c4d3666", "tree": "d73462f000de1302d2cbb993c2258fa380e391bb", "parents": [ "566edbdefb71f4b4852aa3d8c55b79ebf3fc1f09" ], "author": { "name": "Tadeusz Struk", "email": "tadeusz.struk@intel.com", "time": "Fri Apr 28 10:40:02 2017 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:18 2018 +0100" }, "message": "IB/hfi1: Fix softlockup issue\n\n\n[ Upstream commit 22546b741af8355cd2e16739b6af4a8f17081839 ]\n\nSoft lockups can occur because the mad processing on different CPUs acquire\nthe spin lock dc8051_lock:\n\n[534552.835870] [\u003cffffffffa026f993\u003e] ? read_dev_port_cntr.isra.37+0x23/0x160 [hfi1]\n[534552.835880] [\u003cffffffffa02775af\u003e] read_dev_cntr+0x4f/0x60 [hfi1]\n[534552.835893] [\u003cffffffffa028d7cd\u003e] pma_get_opa_portstatus+0x64d/0x8c0 [hfi1]\n[534552.835904] [\u003cffffffffa0290e7d\u003e] hfi1_process_mad+0x48d/0x18c0 [hfi1]\n[534552.835908] [\u003cffffffff811dc1f1\u003e] ? __slab_free+0x81/0x2f0\n[534552.835936] [\u003cffffffffa024c34e\u003e] ? ib_mad_recv_done+0x21e/0xa30 [ib_core]\n[534552.835939] [\u003cffffffff811dd153\u003e] ? __kmalloc+0x1f3/0x240\n[534552.835947] [\u003cffffffffa024c3fb\u003e] ib_mad_recv_done+0x2cb/0xa30 [ib_core]\n[534552.835955] [\u003cffffffffa0237c85\u003e] __ib_process_cq+0x55/0xd0 [ib_core]\n[534552.835962] [\u003cffffffffa0237d70\u003e] ib_cq_poll_work+0x20/0x60 [ib_core]\n[534552.835964] [\u003cffffffff810a7f3b\u003e] process_one_work+0x17b/0x470\n[534552.835966] [\u003cffffffff810a8d76\u003e] worker_thread+0x126/0x410\n[534552.835969] [\u003cffffffff810a8c50\u003e] ? rescuer_thread+0x460/0x460\n[534552.835971] [\u003cffffffff810b052f\u003e] kthread+0xcf/0xe0\n[534552.835974] [\u003cffffffff810b0460\u003e] ? kthread_create_on_node+0x140/0x140\n[534552.835977] [\u003cffffffff81696418\u003e] ret_from_fork+0x58/0x90\n[534552.835980] [\u003cffffffff810b0460\u003e] ? kthread_create_on_node+0x140/0x140\n\nThis issue is made worse when the 8051 is busy and the reads take longer.\nFix by using a non-spinning lock procure.\n\nReviewed-by: Michael J. Ruhl \u003cmichael.j.ruhl@intel.com\u003e\nReviewed-by: Mike Marciszyn \u003cmike.marciniszyn@intel.com\u003e\nSigned-off-by: Tadeusz Struk \u003ctadeusz.struk@intel.com\u003e\nSigned-off-by: Dennis Dalessandro \u003cdennis.dalessandro@intel.com\u003e\nSigned-off-by: Doug Ledford \u003cdledford@redhat.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "566edbdefb71f4b4852aa3d8c55b79ebf3fc1f09", "tree": "3b4f43b24c18ce09e6849de7abe1118e4d40cc15", "parents": [ "b642685751f3b998721ea318792004d474fca5b0" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Thu Apr 27 12:14:20 2017 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:18 2018 +0100" }, "message": "IB/rdmavt: restore IRQs on error path in rvt_create_ah()\n\n\n[ Upstream commit f0bb2d44ca26b7090dc7bade8877b77005f07dfc ]\n\nWe need to call spin_unlock_irqrestore() instead of vanilla\nspin_unlock() on this error path.\n\nFixes: 119a8e708d16 (\"IB/rdmavt: Add AH to rdmavt\")\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nReviewed-by: Leon Romanovsky \u003cleonro@mellanox.com\u003e\nAcked-by: Dennis Dalessandro \u003cdennis.dalessandro@intel.com\u003e\nSigned-off-by: Doug Ledford \u003cdledford@redhat.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b642685751f3b998721ea318792004d474fca5b0", "tree": "728c6d86a66651d3986d60469357293a335ff54d", "parents": [ "c70c7be280448ad7dce9d74fb66c858de534383a" ], "author": { "name": "Kishon Vijay Abraham I", "email": "kishon@ti.com", "time": "Mon Mar 27 15:15:20 2017 +0530" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:18 2018 +0100" }, "message": "ARM: DRA7: clockdomain: Change the CLKTRCTRL of CM_PCIE_CLKSTCTRL to SW_WKUP\n\n\n[ Upstream commit 2c949ce38f4e81d7487f165fa3b8f77d74a2a6c4 ]\n\nThe PCIe programming sequence in TRM suggests CLKSTCTRL of PCIe should be\nset to SW_WKUP. There are no issues when CLKSTCTRL is set to HW_AUTO in RC\nmode. However in EP mode, the host system is not able to access the\nMEMSPACE and setting the CLKSTCTRL to SW_WKUP fixes it.\n\nAcked-by: Tony Lindgren \u003ctony@atomide.com\u003e\nSigned-off-by: Kishon Vijay Abraham I \u003ckishon@ti.com\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "c70c7be280448ad7dce9d74fb66c858de534383a", "tree": "7c54f9bc747ac7a6105ab1a71c90cd641585d160", "parents": [ "ff3d5600e2e6240869dd73e4c205108d672db7d7" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Fri Apr 28 15:57:56 2017 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:17 2018 +0100" }, "message": "netfilter: x_tables: unlock on error in xt_find_table_lock()\n\n\n[ Upstream commit 7dde07e9c53617549d67dd3e1d791496d0d3868e ]\n\nAccording to my static checker we should unlock here before the return.\nThat seems reasonable to me as well.\n\nFixes\" b9e69e127397 (\"netfilter: xtables: don\u0027t hook tables by default\")\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nAcked-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ff3d5600e2e6240869dd73e4c205108d672db7d7", "tree": "c6dee4e9e6b252bdd6a05f93d2050c1866a92908", "parents": [ "92db807f6c2e2a05f00689ca7f23351400abf541" ], "author": { "name": "yangbo lu", "email": "yangbo.lu@nxp.com", "time": "Thu Apr 20 14:58:29 2017 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Mar 24 11:00:17 2018 +0100" }, "message": "mmc: sdhci-of-esdhc: limit SD clock for ls1012a/ls1046a\n\n\n[ Upstream commit a627f025eb0534052ff451427c16750b3530634c ]\n\nThe ls1046a datasheet specified that the max SD clock frequency\nfor eSDHC SDR104/HS200 was 167MHz, and the ls1012a datasheet\nspecified it\u0027s 125MHz for ls1012a. So this patch is to add the\nlimitation.\n\nSigned-off-by: Yangbo Lu \u003cyangbo.lu@nxp.com\u003e\nAcked-by: Adrian Hunter \u003cadrian.hunter@intel.com\u003e\nSigned-off-by: Ulf Hansson \u003culf.hansson@linaro.org\u003e\nSigned-off-by: Sasha Levin \u003calexander.levin@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" } ], "next": "92db807f6c2e2a05f00689ca7f23351400abf541" }