)]}' { "log": [ { "commit": "00cef7a5e0766f0f4bedc9da1c80fbe992cf68ef", "tree": "cf6eee93fbfe7eb5bfbc934f26391c69aa454f5c", "parents": [ "aa34e62c2f0d4a105606971a1eb666f22338993b" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Wed Aug 28 17:33:37 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Apr 14 06:44:16 2014 -0700" }, "message": "workqueue: cond_resched() after processing each work item\n\ncommit b22ce2785d97423846206cceec4efee0c4afd980 upstream.\n\nIf !PREEMPT, a kworker running work items back to back can hog CPU.\nThis becomes dangerous when a self-requeueing work item which is\nwaiting for something to happen races against stop_machine. Such\nself-requeueing work item would requeue itself indefinitely hogging\nthe kworker and CPU it\u0027s running on while stop_machine would wait for\nthat CPU to enter stop_machine while preventing anything else from\nhappening on all other CPUs. The two would deadlock.\n\nJamie Liu reports that this deadlock scenario exists around\nscsi_requeue_run_queue() and libata port multiplier support, where one\nport may exclude command processing from other ports. With the right\ntiming, scsi_requeue_run_queue() can end up requeueing itself trying\nto execute an IO which is asked to be retried while another device has\nan exclusive access, which in turn can\u0027t make forward progress due to\nstop_machine.\n\nFix it by invoking cond_resched() after executing each work item.\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReported-by: Jamie Liu \u003cjamieliu@google.com\u003e\nReferences: http://thread.gmane.org/gmane.linux.kernel/1552567\n[bwh: Backported to 3.2: adjust context]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Qiang Huang \u003ch.huangqiang@huawei.com\u003e\nCc: Li Zefan \u003clizefan@huawei.com\u003e\nCc: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "aa34e62c2f0d4a105606971a1eb666f22338993b", "tree": "0dff0ab9129f77e0e510a1c82c29027751959313", "parents": [ "0df19efa7549d47aa906b8316665e46366b56061" ], "author": { "name": "Bu, Yitian", "email": "ybu@qti.qualcomm.com", "time": "Mon Feb 18 12:53:37 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Apr 14 06:44:16 2014 -0700" }, "message": "printk: Fix rq-\u003elock vs logbuf_lock unlock lock inversion\n\ncommit dbda92d16f8655044e082930e4e9d244b87fde77 upstream.\n\ncommit 07354eb1a74d1 (\"locking printk: Annotate logbuf_lock as raw\")\nreintroduced a lock inversion problem which was fixed in commit\n0b5e1c5255 (\"printk: Release console_sem after logbuf_lock\"). This\nhappened probably when fixing up patch rejects.\n\nRestore the ordering and unlock logbuf_lock before releasing\nconsole_sem.\n\nSigned-off-by: ybu \u003cybu@qti.qualcomm.com\u003e\nCc: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nLink: http://lkml.kernel.org/r/E807E903FE6CBE4D95E420FBFCC273B827413C@nasanexd01h.na.qualcomm.com\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n[bwh: Backported to 3.2: adjust context]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Qiang Huang \u003ch.huangqiang@huawei.com\u003e\nCc: Li Zefan \u003clizefan@huawei.com\u003e\nCc: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0df19efa7549d47aa906b8316665e46366b56061", "tree": "d2fd1a086837d4050a88062036f72ce49a0e63ec", "parents": [ "c45821f729ca087f87aa9ea08ffe964584a0d605" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Wed Jun 12 14:04:46 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Apr 14 06:44:15 2014 -0700" }, "message": "audit: wait_for_auditd() should use TASK_UNINTERRUPTIBLE\n\ncommit f000cfdde5de4fc15dead5ccf524359c07eadf2b upstream.\n\naudit_log_start() does wait_for_auditd() in a loop until\naudit_backlog_wait_time passes or audit_skb_queue has a room.\n\nIf signal_pending() is true this becomes a busy-wait loop, schedule() in\nTASK_INTERRUPTIBLE won\u0027t block.\n\nThanks to Guy for fully investigating and explaining the problem.\n\n(akpm: that\u0027ll cause the system to lock up on a non-preemptible\nuniprocessor kernel)\n\n(Guy: \"Our customer was in fact running a uniprocessor machine, and they\nreported a system hang.\")\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nReported-by: Guy Streeter \u003cstreeter@redhat.com\u003e\nCc: Eric Paris \u003ceparis@redhat.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n[bwh: Backported to 3.2: adjust context, indentation]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Qiang Huang \u003ch.huangqiang@huawei.com\u003e\nCc: Li Zefan \u003clizefan@huawei.com\u003e\nCc: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c45821f729ca087f87aa9ea08ffe964584a0d605", "tree": "a5d9068eb4e5492364e23d4936508ce853d063db", "parents": [ "4ca2cf4abaae2bda2feea8ec5eb0d18723a43553" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Wed Feb 27 17:05:02 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Apr 14 06:44:15 2014 -0700" }, "message": "idr: fix top layer handling\n\ncommit 326cf0f0f308933c10236280a322031f0097205d upstream.\n\nMost functions in idr fail to deal with the high bits when the idr\ntree grows to the maximum height.\n\n* idr_get_empty_slot() stops growing idr tree once the depth reaches\n MAX_IDR_LEVEL - 1, which is one depth shallower than necessary to\n cover the whole range. The function doesn\u0027t even notice that it\n didn\u0027t grow the tree enough and ends up allocating the wrong ID\n given sufficiently high @starting_id.\n\n For example, on 64 bit, if the starting id is 0x7fffff01,\n idr_get_empty_slot() will grow the tree 5 layer deep, which only\n covers the 30 bits and then proceed to allocate as if the bit 30\n wasn\u0027t specified. It ends up allocating 0x3fffff01 without the bit\n 30 but still returns 0x7fffff01.\n\n* __idr_remove_all() will not remove anything if the tree is fully\n grown.\n\n* idr_find() can\u0027t find anything if the tree is fully grown.\n\n* idr_for_each() and idr_get_next() can\u0027t iterate anything if the tree\n is fully grown.\n\nFix it by introducing idr_max() which returns the maximum possible ID\ngiven the depth of tree and replacing the id limit checks in all\naffected places.\n\nAs the idr_layer pointer array pa[] needs to be 1 larger than the\nmaximum depth, enlarge pa[] arrays by one.\n\nWhile this plugs the discovered issues, the whole code base is\nhorrible and in desparate need of rewrite. It\u0027s fragile like hell,\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nCc: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n[bwh: Backported to 3.2:\n - Adjust context\n - s/MAX_IDR_LEVEL/MAX_LEVEL/; s/MAX_IDR_SHIFT/MAX_ID_SHIFT/\n - Drop change to idr_alloc()]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Qiang Huang \u003ch.huangqiang@huawei.com\u003e\nCc: Li Zefan \u003clizefan@huawei.com\u003e\nCc: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n\n" }, { "commit": "4ca2cf4abaae2bda2feea8ec5eb0d18723a43553", "tree": "318fbdbbd9c63746859c4048c16d207949f11268", "parents": [ "7ae240637ab3477a59d062412f5cf4f84f5de2f9" ], "author": { "name": "Artem Bityutskiy", "email": "artem.bityutskiy@linux.intel.com", "time": "Mon Dec 17 16:03:17 2012 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Apr 14 06:44:15 2014 -0700" }, "message": "proc: pid/status: show all supplementary groups\n\ncommit 8d238027b87e654be552eabdf492042a34c5c300 upstream.\n\nWe display a list of supplementary group for each process in\n/proc/\u003cpid\u003e/status. However, we show only the first 32 groups, not all of\nthem.\n\nAlthough this is rare, but sometimes processes do have more than 32\nsupplementary groups, and this kernel limitation breaks user-space apps\nthat rely on the group list in /proc/\u003cpid\u003e/status.\n\nNumber 32 comes from the internal NGROUPS_SMALL macro which defines the\nlength for the internal kernel \"small\" groups buffer. There is no\napparent reason to limit to this value.\n\nThis patch removes the 32 groups printing limit.\n\nThe Linux kernel limits the amount of supplementary groups by NGROUPS_MAX,\nwhich is currently set to 65536. And this is the maximum count of groups\nwe may possibly print.\n\nSigned-off-by: Artem Bityutskiy \u003cartem.bityutskiy@linux.intel.com\u003e\nAcked-by: Serge E. Hallyn \u003cserge.hallyn@ubuntu.com\u003e\nAcked-by: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n[bwh: Backported to 3.2: adjust context]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Qiang Huang \u003ch.huangqiang@huawei.com\u003e\nCc: Li Zefan \u003clizefan@huawei.com\u003e\nCc: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7ae240637ab3477a59d062412f5cf4f84f5de2f9", "tree": "fb349c7ccbbc268108ff1f3f73ab8285157b51ba", "parents": [ "8b0da794d8fb4cc4ba410d4bb66fcd0feea0c7d1" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 03 11:59:21 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 03 11:59:21 2014 -0700" }, "message": "Linux 3.4.86\n" }, { "commit": "8b0da794d8fb4cc4ba410d4bb66fcd0feea0c7d1", "tree": "dd4df886ec5088bca8dce334a11b4b3ce055c040", "parents": [ "b681ef527f15d5c8995fcf87084fca69473ab946" ], "author": { "name": "Daniel Borkmann", "email": "dborkman@redhat.com", "time": "Mon Jan 06 00:57:54 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 03 11:58:46 2014 -0700" }, "message": "netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages\n\ncommit b22f5126a24b3b2f15448c3f2a254fc10cbc2b92 upstream.\n\nSome occurences in the netfilter tree use skb_header_pointer() in\nthe following way ...\n\n struct dccp_hdr _dh, *dh;\n ...\n skb_header_pointer(skb, dataoff, sizeof(_dh), \u0026dh);\n\n... where dh itself is a pointer that is being passed as the copy\nbuffer. Instead, we need to use \u0026_dh as the forth argument so that\nwe\u0027re copying the data into an actual buffer that sits on the stack.\n\nCurrently, we probably could overwrite memory on the stack (e.g.\nwith a possibly mal-formed DCCP packet), but unintentionally, as\nwe only want the buffer to be placed into _dh variable.\n\nFixes: 2bc780499aa3 (\"[NETFILTER]: nf_conntrack: add DCCP protocol support\")\nSigned-off-by: Daniel Borkmann \u003cdborkman@redhat.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b681ef527f15d5c8995fcf87084fca69473ab946", "tree": "ae8ca770f805ecef11811b7d1a3a04a3f02d4cc0", "parents": [ "3fcaab061bf7be1419da581e8b0200fcd4ffe751" ], "author": { "name": "Artem Fetishev", "email": "artem_fetishev@epam.com", "time": "Fri Mar 28 13:33:39 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 03 11:58:46 2014 -0700" }, "message": "x86: fix boot on uniprocessor systems\n\ncommit 825600c0f20e595daaa7a6dd8970f84fa2a2ee57 upstream.\n\nOn x86 uniprocessor systems topology_physical_package_id() returns -1\nwhich causes rapl_cpu_prepare() to leave rapl_pmu variable uninitialized\nwhich leads to GPF in rapl_pmu_init().\n\nSee arch/x86/kernel/cpu/perf_event_intel_rapl.c.\n\nIt turns out that physical_package_id and core_id can actually be\nretreived for uniprocessor systems too. Enabling them also fixes\nrapl_pmu code.\n\nSigned-off-by: Artem Fetishev \u003cartem_fetishev@epam.com\u003e\nCc: Stephane Eranian \u003ceranian@google.com\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: \"H. Peter Anvin\" \u003chpa@zytor.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "3fcaab061bf7be1419da581e8b0200fcd4ffe751", "tree": "c8fc69dd09d772174e2d8ef6f1c98082558c8b64", "parents": [ "969ba04278bdb82e3444a66ead67606430832db0" ], "author": { "name": "Hans de Goede", "email": "hdegoede@redhat.com", "time": "Fri Mar 28 01:01:38 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 03 11:58:46 2014 -0700" }, "message": "Input: synaptics - add manual min/max quirk for ThinkPad X240\n\ncommit 8a0435d958fb36d93b8df610124a0e91e5675c82 upstream.\n\nThis extends Benjamin Tissoires manual min/max quirk table with support for\nthe ThinkPad X240.\n\nSigned-off-by: Hans de Goede \u003chdegoede@redhat.com\u003e\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "969ba04278bdb82e3444a66ead67606430832db0", "tree": "d6aed040517f950e051f813f650ecf8ce973c094", "parents": [ "ff624a813eef9f51a8d4f3dd8e4f12db9286433d" ], "author": { "name": "Benjamin Tissoires", "email": "benjamin.tissoires@redhat.com", "time": "Fri Mar 28 00:43:00 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 03 11:58:46 2014 -0700" }, "message": "Input: synaptics - add manual min/max quirk\n\ncommit 421e08c41fda1f0c2ff6af81a67b491389b653a5 upstream.\n\nThe new Lenovo Haswell series (-40\u0027s) contains a new Synaptics touchpad.\nHowever, these new Synaptics devices report bad axis ranges.\nUnder Windows, it is not a problem because the Windows driver uses RMI4\nover SMBus to talk to the device. Under Linux, we are using the PS/2\nfallback interface and it occurs the reported ranges are wrong.\n\nOf course, it would be too easy to have only one range for the whole\nseries, each touchpad seems to be calibrated in a different way.\n\nWe can not use SMBus to get the actual range because I suspect the firmware\nwill switch into the SMBus mode and stop talking through PS/2 (this is the\ncase for hybrid HID over I2C / PS/2 Synaptics touchpads).\n\nSo as a temporary solution (until RMI4 land into upstream), start a new\nlist of quirks with the min/max manually set.\n\nSigned-off-by: Benjamin Tissoires \u003cbenjamin.tissoires@redhat.com\u003e\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ff624a813eef9f51a8d4f3dd8e4f12db9286433d", "tree": "e73f38857a8ca7bad5a5e0c71f7b7e3c817d0630", "parents": [ "3876a0de0e42e33a0008d4f245474f789eae8499" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Sun Mar 30 10:20:01 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 03 11:58:46 2014 -0700" }, "message": "ext4: atomically set inode-\u003ei_flags in ext4_set_inode_flags()\n\ncommit 00a1a053ebe5febcfc2ec498bd894f035ad2aa06 upstream.\n\nUse cmpxchg() to atomically set i_flags instead of clearing out the\nS_IMMUTABLE, S_APPEND, etc. flags and then setting them from the\nEXT4_IMMUTABLE_FL, EXT4_APPEND_FL flags, since this opens up a race\nwhere an immutable file has the immutable flag cleared for a brief\nwindow of time.\n\nReported-by: John Sullivan \u003cjsrhbz@kanargh.force9.co.uk\u003e\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "3876a0de0e42e33a0008d4f245474f789eae8499", "tree": "726db705ebe8826d564ee3bed4b40b72f2be5daa", "parents": [ "72cb2a7f426ad822758cb2560f0522f6412f578e" ], "author": { "name": "Samuel Thibault", "email": "samuel.thibault@ens-lyon.org", "time": "Wed Jan 02 02:37:40 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 03 11:58:45 2014 -0700" }, "message": "staging: speakup: Prefix externally-visible symbols\n\ncommit ca2beaf84d9678c12b17d92623f0e90829d6ca13 upstream.\n\nThis prefixes all externally-visible symbols of speakup with \"spk_\".\n\nSigned-off-by: Samuel Thibault \u003csamuel.thibault@ens-lyon.org\u003e\nCc: Kamal Mostafa \u003ckamal@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "72cb2a7f426ad822758cb2560f0522f6412f578e", "tree": "e594b003b5de098b2fef90dba0ee6c9f0471f7e3", "parents": [ "79dd68bfe15ac3da7e76d2db7fdbccc74026e97f" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 30 21:40:45 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 30 21:40:45 2014 -0700" }, "message": "Linux 3.4.85\n" }, { "commit": "79dd68bfe15ac3da7e76d2db7fdbccc74026e97f", "tree": "fe7565578679b86f9fe3ddb2298ce95fb39fbf6a", "parents": [ "ebaacf5c50f552d1bab829451d9bda5eb55fe337" ], "author": { "name": "Konstantin Khlebnikov", "email": "k.khlebnikov@samsung.com", "time": "Wed Mar 26 14:12:19 2014 +0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 30 21:40:31 2014 -0700" }, "message": "ipc/msg: fix race around refcount\n\n[fixed differently in 6062a8dc0517bce23e3c2f7d2fea5e22411269a3 upstream.]\n\nIn older kernels (before v3.10) ipc_rcu_hdr-\u003erefcount was non-atomic int.\nThere was possuble double-free bug: do_msgsnd() calls ipc_rcu_putref() under\nmsq-\u003eq_perm-\u003elock and RCU, while freequeue() calls it while it holds only\n\u0027rw_mutex\u0027, so there is no sinchronization between them. Two function\ndecrements \u00272\u0027 non-atomically, they both can get \u00270\u0027 as result.\n\ndo_msgsnd()\t\t\t\t\tfreequeue()\n\nmsq \u003d msg_lock_check(ns, msqid);\n...\nipc_rcu_getref(msq);\nmsg_unlock(msq);\nschedule();\n\t\t\t\t\t\t(caller locks spinlock)\n\t\t\t\t\t\texpunge_all(msq, -EIDRM);\n\t\t\t\t\t\tss_wakeup(\u0026msq-\u003eq_senders, 1);\n\t\t\t\t\t\tmsg_rmid(ns, msq);\n\t\t\t\t\t\tmsg_unlock(msq);\nipc_lock_by_ptr(\u0026msq-\u003eq_perm);\nipc_rcu_putref(msq);\t\t\t\tipc_rcu_putref(msq);\n\u003c both may get get --(...)-\u003erefcount \u003d\u003d 0 \u003e\n\nThis patch locks ipc_lock and RCU around ipc_rcu_putref in freequeue.\n( RCU protects memory for spin_unlock() )\n\nSimilar bugs might be in other users of ipc_rcu_putref().\n\nIn the mainline this has been fixed in v3.10 indirectly in commmit\n6062a8dc0517bce23e3c2f7d2fea5e22411269a3\n(\"ipc,sem: fine grained locking for semtimedop\") by Rik van Riel.\nThat commit optimized locking and converted refcount into atomic.\n\nI\u0027m not sure that anybody should care about this bug: it\u0027s very-very unlikely\nand no longer exists in actual mainline. I\u0027ve found this just by looking into\nthe code, probably this never happens in real life.\n\nSigned-off-by: Konstantin Khlebnikov \u003ck.khlebnikov@samsung.com\u003e\n" }, { "commit": "ebaacf5c50f552d1bab829451d9bda5eb55fe337", "tree": "a1c00bace48620e1263881e59164869e80045a7f", "parents": [ "edc36cf320fc69bdf8906cd2de6aef5fe62e77b2" ], "author": { "name": "Sarah Sharp", "email": "sarah.a.sharp@linux.intel.com", "time": "Fri Jan 17 15:38:12 2014 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 30 21:40:31 2014 -0700" }, "message": "xhci: Fix resume issues on Renesas chips in Samsung laptops\n\ncommit 1aa9578c1a9450fb21501c4f549f5b1edb557e6d upstream.\n\nDon Zickus \u003cdzickus@redhat.com\u003e writes:\n\nSome co-workers of mine bought Samsung laptops that had mostly usb3 ports.\nThose ports did not resume correctly (the driver would timeout communicating\nand fail). This led to frustration as suspend/resume is a common use for\nlaptops.\n\nPoking around, I applied the reset on resume quirk to this chipset and the\nresume started working. Reloading the xhci_hcd module had been the temporary\nworkaround.\n\nSigned-off-by: Sarah Sharp \u003csarah.a.sharp@linux.intel.com\u003e\nReported-by: Don Zickus \u003cdzickus@redhat.com\u003e\nTested-by: Prarit Bhargava \u003cprarit@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "edc36cf320fc69bdf8906cd2de6aef5fe62e77b2", "tree": "af4ea1c7513b268ebb847c49cf60a8fb33f63a70", "parents": [ "86bbe6ac6eab65ac4346882cb26d91e8ca6c975d" ], "author": { "name": "Marcelo Tosatti", "email": "mtosatti@redhat.com", "time": "Fri Jan 03 17:00:51 2014 -0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 30 21:40:31 2014 -0700" }, "message": "KVM: VMX: fix use after free of vmx-\u003eloaded_vmcs\n\ncommit 26a865f4aa8e66a6d94958de7656f7f1b03c6c56 upstream.\n\nAfter free_loaded_vmcs executes, the \"loaded_vmcs\" structure\nis kfreed, and now vmx-\u003eloaded_vmcs points to a kfreed area.\nSubsequent free_loaded_vmcs then attempts to manipulate\nvmx-\u003eloaded_vmcs.\n\nSwitch the order to avoid the problem.\n\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d1047892\n\nReviewed-by: Jan Kiszka \u003cjan.kiszka@siemens.com\u003e\nSigned-off-by: Marcelo Tosatti \u003cmtosatti@redhat.com\u003e\nCc: Josh Boyer \u003cjwboyer@fedoraproject.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "86bbe6ac6eab65ac4346882cb26d91e8ca6c975d", "tree": "fdba8440bad4a3583526741d2c91c6630de925d0", "parents": [ "037a05761d3ad2e7cbd417b421031a82de7f5c9f" ], "author": { "name": "Marcelo Tosatti", "email": "mtosatti@redhat.com", "time": "Thu Dec 19 15:28:51 2013 -0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 30 21:40:31 2014 -0700" }, "message": "KVM: MMU: handle invalid root_hpa at __direct_map\n\ncommit 989c6b34f6a9480e397b170cc62237e89bf4fdb9 upstream.\n\nIt is possible for __direct_map to be called on invalid root_hpa\n(-1), two examples:\n\n1) try_async_pf -\u003e can_do_async_pf\n -\u003e vmx_interrupt_allowed -\u003e nested_vmx_vmexit\n2) vmx_handle_exit -\u003e vmx_interrupt_allowed -\u003e nested_vmx_vmexit\n\nThen to load_vmcs12_host_state and kvm_mmu_reset_context.\n\nCheck for this possibility, let fault exception be regenerated.\n\nBZ: https://bugzilla.redhat.com/show_bug.cgi?id\u003d924916\n\nSigned-off-by: Marcelo Tosatti \u003cmtosatti@redhat.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\nCc: Josh Boyer \u003cjwboyer@fedoraproject.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "037a05761d3ad2e7cbd417b421031a82de7f5c9f", "tree": "429d0137069bce36f6d823fac4616da0ddfa11f9", "parents": [ "a4d65b8421e38d420fcdaeb50feced86f3f6a5c5" ], "author": { "name": "Hans de Goede", "email": "hdegoede@redhat.com", "time": "Mon Dec 16 07:09:25 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 30 21:40:30 2014 -0700" }, "message": "Input: elantech - improve clickpad detection\n\ncommit c15bdfd5b9831e4cab8cfc118243956e267dd30e upstream.\n\nThe current assumption in the elantech driver that hw version 3 touchpads\nare never clickpads and hw version 4 touchpads are always clickpads is\nwrong.\n\nThere are several bug reports for this, ie:\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d1030802\nhttp://superuser.com/questions/619582/right-elantech-touchpad-button-not-working-in-linux\n\nI\u0027ve spend a couple of hours wading through various bugzillas, launchpads\nand forum posts to create a list of fw-versions and capabilities for\ndifferent laptop models to find a good method to differentiate between\nclickpads and versions with separate hardware buttons.\n\nWhich shows that a device being a clickpad is reliable indicated by bit 12\nbeing set in the fw_version. I\u0027ve included the gathered list inside the\ndriver, so that we\u0027ve this info at hand if we need to revisit this later.\n\nSigned-off-by: Hans de Goede \u003chdegoede@redhat.com\u003e\nReviewed-by: Benjamin Tissoires \u003cbenjamin.tissoires@redhat.com\u003e\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\nCc: Josh Boyer \u003cjwboyer@fedoraproject.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a4d65b8421e38d420fcdaeb50feced86f3f6a5c5", "tree": "43131fc14eba33ee0b8f98b606517ba746547f95", "parents": [ "714c034f82f17dd89b8b112375038d91bde4e129" ], "author": { "name": "Rob Herring", "email": "rob.herring@calxeda.com", "time": "Sat Aug 17 20:12:57 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 30 21:40:30 2014 -0700" }, "message": "ARM: move outer_cache declaration out of ifdef\n\ncommit 0b53c11d533a8f6688d73fad0baf67dd08ec1b90 upstream.\n\nMove the outer_cache declaration of the CONFIG_OUTER_CACHE ifdef so that\nouter_cache can be used inside IS_ENABLED condition.\n\nSigned-off-by: Rob Herring \u003crob.herring@calxeda.com\u003e\nCc: Russell King \u003clinux@arm.linux.org.uk\u003e\nSigned-off-by: Ian Campbell \u003cian.campbell@citrix.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "714c034f82f17dd89b8b112375038d91bde4e129", "tree": "046ea144d720862e9d526a0511145d1adcf6e55c", "parents": [ "e78970f0d78cd83382381a6876534424f1d95da4" ], "author": { "name": "Jean Delvare", "email": "jdelvare@suse.de", "time": "Tue Feb 25 09:43:13 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 30 21:40:30 2014 -0700" }, "message": "i7300_edac: Fix device reference count\n\ncommit 75135da0d68419ef8a925f4c1d5f63d8046e314d upstream.\n\npci_get_device() decrements the reference count of \"from\" (last\nargument) so when we break off the loop successfully we have only one\ndevice reference - and we don\u0027t know which device we have. If we want\na reference to each device, we must take them explicitly and let\nthe pci_get_device() walk complete to avoid duplicate references.\n\nThis is serious, as over-putting device references will cause\nthe device to eventually disappear. Without this fix, the kernel\ncrashes after a few insmod/rmmod cycles.\n\nTested on an Intel S7000FC4UR system with a 7300 chipset.\n\nSigned-off-by: Jean Delvare \u003cjdelvare@suse.de\u003e\nLink: http://lkml.kernel.org/r/20140224111656.09bbb7ed@endymion.delvare\nCc: Mauro Carvalho Chehab \u003cm.chehab@samsung.com\u003e\nCc: Doug Thompson \u003cdougthompson@xmission.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Borislav Petkov \u003cbp@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e78970f0d78cd83382381a6876534424f1d95da4", "tree": "cf6dcce0971580ca4546c1e5f645212d67d6fcc3", "parents": [ "c502e92f7cd92bd80ac0e754842d68fe3c2601f6" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Mon Jan 13 22:05:23 2014 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 30 21:40:30 2014 -0700" }, "message": "p54: clamp properly instead of just truncating\n\ncommit 608cfbe4abaf76e9d732efd7ed1cfa3998163d91 upstream.\n\nThe call to clamp_t() first truncates the variable signed 8 bit and as a\nresult, the actual clamp is a no-op.\n\nFixes: 0d78156eef1d (\u0027p54: improve site survey\u0027)\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c502e92f7cd92bd80ac0e754842d68fe3c2601f6", "tree": "efde5725cacbad032751f9192fb463f89e054622", "parents": [ "5f0a3f764bd1905f8579d781aff4c757d5d0978b" ], "author": { "name": "Ben Hutchings", "email": "ben@decadent.org.uk", "time": "Thu Dec 05 14:37:35 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 30 21:40:30 2014 -0700" }, "message": "deb-pkg: Fix cross-building linux-headers package\n\ncommit f8ce239dfc7ba9add41d9ecdc5e7810738f839fa upstream.\n\nbuilddeb generates a control file that says the linux-headers package\ncan only be built for the build system primary architecture. This\nbreaks cross-building configurations. We should use $debarch for this\ninstead.\n\nSince $debarch is not yet set when generating the control file, set\nArchitecture: any and use control file variables to fill in the\ndescription.\n\nFixes: cd8d60a20a45 (\u0027kbuild: create linux-headers package in deb-pkg\u0027)\nReported-and-tested-by: \"Niew, Sh.\" \u003cshniew@gmail.com\u003e\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Michal Marek \u003cmmarek@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5f0a3f764bd1905f8579d781aff4c757d5d0978b", "tree": "4f02562ebac387d12162cae8ec55053b62e24eff", "parents": [ "904855a5c90e491a1700e7e6a9268ee00d9bdf39" ], "author": { "name": "Alexei Starovoitov", "email": "ast@plumgrid.com", "time": "Mon Mar 10 15:56:51 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 30 21:40:30 2014 -0700" }, "message": "x86: bpf_jit: support negative offsets\n\ncommit fdfaf64e75397567257e1051931f9a3377360665 upstream.\n\nCommit a998d4342337 claimed to introduce negative offset support to x86 jit,\nbut it couldn\u0027t be working, since at the time of the execution\nof LD+ABS or LD+IND instructions via call into\nbpf_internal_load_pointer_neg_helper() the %edx (3rd argument of this func)\nhad junk value instead of access size in bytes (1 or 2 or 4).\n\nStore size into %edx instead of %ecx (what original commit intended to do)\n\nFixes: a998d4342337 (\"bpf jit: Let the x86 jit handle negative offsets\")\nSigned-off-by: Alexei Starovoitov \u003cast@plumgrid.com\u003e\nCc: Jan Seiffert \u003ckaffeemonster@googlemail.com\u003e\nCc: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "904855a5c90e491a1700e7e6a9268ee00d9bdf39", "tree": "3bf6efb83d7bf162def5a34e655f26b9a63061b5", "parents": [ "542a39ac9dd4586a3b74958cadacb47aea3444b0" ], "author": { "name": "Ben Hutchings", "email": "ben@decadent.org.uk", "time": "Tue Mar 25 17:28:22 2014 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 30 21:40:30 2014 -0700" }, "message": "iwlwifi: Complete backport of \"iwlwifi: always copy first 16 bytes of commands\"\n\nLinux 3.4.83 included an incomplete backport of commit\n8a964f44e01ad3bbc208c3e80d931ba91b9ea786 (\u0027iwlwifi: always copy first\n16 bytes of commands\u0027) which causes a regression for this driver.\nThis is the missing piece.\n\nReported-by: Andreas Sturmlechner \u003candreas.sturmlechner@gmail.com\u003e\nCc: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nCc: Emmanuel Grumbach \u003cemmanuel.grumbach@intel.com\u003e\nCc: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nCc: Andres Bertens \u003cabertensu@yahoo.com\u003e\nTested-by: Andreas Sturmlechner \u003candreas.sturmlechner@gmail.com\u003e\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\n\n" }, { "commit": "542a39ac9dd4586a3b74958cadacb47aea3444b0", "tree": "401f3aa9de02b0fb4a8e3dcd96fe52473933a68c", "parents": [ "40dea3bd3714383856a1bf90a4c91d4cc2ef44d4" ], "author": { "name": "Josh Durgin", "email": "josh.durgin@inktank.com", "time": "Tue Dec 10 09:35:13 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 30 21:40:30 2014 -0700" }, "message": "libceph: resend all writes after the osdmap loses the full flag\n\ncommit 9a1ea2dbff11547a8e664f143c1ffefc586a577a upstream.\n\nWith the current full handling, there is a race between osds and\nclients getting the first map marked full. If the osd wins, it will\nreturn -ENOSPC to any writes, but the client may already have writes\nin flight. This results in the client getting the error and\npropagating it up the stack. For rbd, the block layer turns this into\nEIO, which can cause corruption in filesystems above it.\n\nTo avoid this race, osds are being changed to drop writes that came\nfrom clients with an osdmap older than the last osdmap marked full.\nIn order for this to work, clients must resend all writes after they\nencounter a full -\u003e not full transition in the osdmap. osds will wait\nfor an updated map instead of processing a request from a client with\na newer map, so resent writes will not be dropped by the osd unless\nthere is another not full -\u003e full transition.\n\nThis approach requires both osds and clients to be fixed to avoid the\nrace. Old clients talking to osds with this fix may hang instead of\nreturning EIO and potentially corrupting an fs. New clients talking to\nold osds have the same behavior as before if they encounter this race.\n\nFixes: http://tracker.ceph.com/issues/6938\n\nReviewed-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Josh Durgin \u003cjosh.durgin@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "40dea3bd3714383856a1bf90a4c91d4cc2ef44d4", "tree": "7970d2ca384fa80f0a56487d337a8b40062fa33d", "parents": [ "b1cee752ee0c04f424cb71ba0c8013c793008296" ], "author": { "name": "Charles Keepax", "email": "ckeepax@opensource.wolfsonmicro.com", "time": "Wed Mar 19 12:59:39 2014 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 30 21:40:29 2014 -0700" }, "message": "ALSA: compress: Pass through return value of open ops callback\n\ncommit 749d32237bf39e6576dd95bfdf24e4378e51716c upstream.\n\nThe snd_compr_open function would always return 0 even if the compressed\nops open function failed, obviously this is incorrect. Looks like this\nwas introduced by a small typo in:\n\ncommit a0830dbd4e42b38aefdf3fb61ba5019a1a99ea85\nALSA: Add a reference counter to card instance\n\nThis patch returns the value from the compressed op as it should.\n\nSigned-off-by: Charles Keepax \u003cckeepax@opensource.wolfsonmicro.com\u003e\nAcked-by: Vinod Koul \u003cvinod.koul@intel.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b1cee752ee0c04f424cb71ba0c8013c793008296", "tree": "5ff0fa64a81c57a0b362e21ff9b36cd2a9944aec", "parents": [ "7c0a02e992288885502a4795d42c99e3a2ee7141" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:38:33 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:38:33 2014 -0700" }, "message": "Linux 3.4.84\n" }, { "commit": "7c0a02e992288885502a4795d42c99e3a2ee7141", "tree": "60b7388e4ebadf6710593dbac98800cd23f27109", "parents": [ "212b46549b387fb63b81d0209c3d4db9df4c985f" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@linux.vnet.ibm.com", "time": "Sat Jul 27 03:53:54 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:08 2014 -0700" }, "message": "jiffies: Avoid undefined behavior from signed overflow\n\ncommit 5a581b367b5df0531265311fc681c2abd377e5e6 upstream.\n\nAccording to the C standard 3.4.3p3, overflow of a signed integer results\nin undefined behavior. This commit therefore changes the definitions\nof time_after(), time_after_eq(), time_after64(), and time_after_eq64()\nto avoid this undefined behavior. The trick is that the subtraction\nis done using unsigned arithmetic, which according to 6.2.5p9 cannot\noverflow because it is defined as modulo arithmetic. This has the added\n(though admittedly quite small) benefit of shortening four lines of code\nby four characters each.\n\nNote that the C standard considers the cast from unsigned to\nsigned to be implementation-defined, see 6.3.1.3p3. However, on a\ntwo\u0027s-complement system, an implementation that defines anything other\nthan a reinterpretation of the bits is free to come to me, and I will be\nhappy to act as a witness for its being committed to an insane asylum.\n(Although I have nothing against saturating arithmetic or signals in some\ncases, these things really should not be the default when compiling an\noperating-system kernel.)\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@linux.vnet.ibm.com\u003e\nCc: John Stultz \u003cjohn.stultz@linaro.org\u003e\nCc: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\nCc: Arnd Bergmann \u003carnd@arndb.de\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCc: Kevin Easton \u003ckevin@guarana.org\u003e\n[ paulmck: Included time_after64() and time_after_eq64(), as suggested\n by Eric Dumazet, also fixed commit message.]\nReviewed-by: Josh Triplett \u003cjosh@joshtriplett.org\u003e\nRuchi Kandoi \u003ckandoiruchi@google.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "212b46549b387fb63b81d0209c3d4db9df4c985f", "tree": "31a712fac4615756d7539dba06c8447265820e42", "parents": [ "dba79490e526dbca167e41b46745f168c356ffe5" ], "author": { "name": "Roman Volkov", "email": "v1ron@mail.ru", "time": "Fri Jan 24 16:18:11 2014 +0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:08 2014 -0700" }, "message": "ALSA: oxygen: modify adjust_dg_dac_routing function\n\ncommit 1f91ecc14deea9461aca93273d78871ec4d98fcd upstream.\n\nWhen selecting the audio output destinations (headphones,\nFP headphones, multichannel output), the channel routing\nshould be changed depending on what destination selected.\nAlso unnecessary I2S channels are digitally muted. This\nfunction called when the user selects the destination\nin the ALSA mixer.\n\nSigned-off-by: Roman Volkov \u003cv1ron@mail.ru\u003e\nSigned-off-by: Clemens Ladisch \u003cclemens@ladisch.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n\n" }, { "commit": "dba79490e526dbca167e41b46745f168c356ffe5", "tree": "3f630b1ad10a6192b5d03ba9932c0a53dfce3a5e", "parents": [ "7c1de3509ed50e5091ee1344689e6c0552943787" ], "author": { "name": "Filipe David Borba Manana", "email": "fdmanana@gmail.com", "time": "Sat Feb 08 15:47:46 2014 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:08 2014 -0700" }, "message": "Btrfs: fix data corruption when reading/updating compressed extents\n\ncommit a2aa75e18a21b21952dc6daa9bac7c9f4426f81f upstream.\n\nWhen using a mix of compressed file extents and prealloc extents, it\nis possible to fill a page of a file with random, garbage data from\nsome unrelated previous use of the page, instead of a sequence of zeroes.\n\nA simple sequence of steps to get into such case, taken from the test\ncase I made for xfstests, is:\n\n _scratch_mkfs\n _scratch_mount \"-o compress-force\u003dlzo\"\n $XFS_IO_PROG -f -c \"pwrite -S 0x06 -b 18670 266978 18670\" $SCRATCH_MNT/foobar\n $XFS_IO_PROG -c \"falloc 26450 665194\" $SCRATCH_MNT/foobar\n $XFS_IO_PROG -c \"truncate 542872\" $SCRATCH_MNT/foobar\n $XFS_IO_PROG -c \"fsync\" $SCRATCH_MNT/foobar\n\nThis results in the following file items in the fs tree:\n\n item 4 key (257 INODE_ITEM 0) itemoff 15879 itemsize 160\n inode generation 6 transid 6 size 542872 block group 0 mode 100600\n item 5 key (257 INODE_REF 256) itemoff 15863 itemsize 16\n inode ref index 2 namelen 6 name: foobar\n item 6 key (257 EXTENT_DATA 0) itemoff 15810 itemsize 53\n extent data disk byte 0 nr 0 gen 6\n extent data offset 0 nr 24576 ram 266240\n extent compression 0\n item 7 key (257 EXTENT_DATA 24576) itemoff 15757 itemsize 53\n prealloc data disk byte 12849152 nr 241664 gen 6\n prealloc data offset 0 nr 241664\n item 8 key (257 EXTENT_DATA 266240) itemoff 15704 itemsize 53\n extent data disk byte 12845056 nr 4096 gen 6\n extent data offset 0 nr 20480 ram 20480\n extent compression 2\n item 9 key (257 EXTENT_DATA 286720) itemoff 15651 itemsize 53\n prealloc data disk byte 13090816 nr 405504 gen 6\n prealloc data offset 0 nr 258048\n\nThe on disk extent at offset 266240 (which corresponds to 1 single disk block),\ncontains 5 compressed chunks of file data. Each of the first 4 compress 4096\nbytes of file data, while the last one only compresses 3024 bytes of file data.\nTherefore a read into the file region [285648 ; 286720[ (length \u003d 4096 - 3024 \u003d\n1072 bytes) should always return zeroes (our next extent is a prealloc one).\n\nThe solution here is the compression code path to zero the remaining (untouched)\nbytes of the last page it uncompressed data into, as the information about how\nmuch space the file data consumes in the last page is not known in the upper layer\nfs/btrfs/extent_io.c:__do_readpage(). In __do_readpage we were correctly zeroing\nthe remainder of the page but only if it corresponds to the last page of the inode\nand if the inode\u0027s size is not a multiple of the page size.\n\nThis would cause not only returning random data on reads, but also permanently\nstoring random data when updating parts of the region that should be zeroed.\nFor the example above, it means updating a single byte in the region [285648 ; 286720[\nwould store that byte correctly but also store random data on disk.\n\nA test case for xfstests follows soon.\n\nSigned-off-by: Filipe David Borba Manana \u003cfdmanana@gmail.com\u003e\nSigned-off-by: Chris Mason \u003cclm@fb.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7c1de3509ed50e5091ee1344689e6c0552943787", "tree": "85c22effaa1f9895520542b6495e6014ef883ce3", "parents": [ "3ce68dc6e9d3126c33a52879f9d0d45da670bfc0" ], "author": { "name": "Ales Novak", "email": "alnovak@suse.cz", "time": "Thu Feb 27 11:03:30 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:08 2014 -0700" }, "message": "SCSI: storvsc: NULL pointer dereference fix\n\ncommit b12bb60d6c350b348a4e1460cd68f97ccae9822e upstream.\n\nIf the initialization of storvsc fails, the storvsc_device_destroy()\ncauses NULL pointer dereference.\n\nstorvsc_bus_scan()\n scsi_scan_target()\n __scsi_scan_target()\n scsi_probe_and_add_lun(hostdata\u003dNULL)\n scsi_alloc_sdev(hostdata\u003dNULL)\n\n\t sdev-\u003ehostdata \u003d hostdata\n\n\t now the host allocation fails\n\n __scsi_remove_device(sdev)\n\n\t calls sdev-\u003ehost-\u003ehostt-\u003eslave_destroy() \u003d\u003d\n\t storvsc_device_destroy(sdev)\n\t access of sdev-\u003ehostdata-\u003erequest_mempool\n\nSigned-off-by: Ales Novak \u003calnovak@suse.cz\u003e\nSigned-off-by: Thomas Abraham \u003ctabraham@suse.com\u003e\nReviewed-by: Jiri Kosina \u003cjkosina@suse.cz\u003e\nAcked-by: K. Y. Srinivasan \u003ckys@microsoft.com\u003e\nSigned-off-by: James Bottomley \u003cJBottomley@Parallels.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "3ce68dc6e9d3126c33a52879f9d0d45da670bfc0", "tree": "52b422180646c03b5f8352cd90ef8fe1b5abbbfd", "parents": [ "d9e8942e554ef56cdfb4166fac2245f40faa1299" ], "author": { "name": "Giridhar Malavali", "email": "giridhar.malavali@qlogic.com", "time": "Wed Feb 26 04:15:12 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:07 2014 -0700" }, "message": "SCSI: qla2xxx: Poll during initialization for ISP25xx and ISP83xx\n\ncommit b77ed25c9f8402e8b3e49e220edb4ef09ecfbb53 upstream.\n\nSigned-off-by: Giridhar Malavali \u003cgiridhar.malavali@qlogic.com\u003e\nSigned-off-by: Saurav Kashyap \u003csaurav.kashyap@qlogic.com\u003e\nSigned-off-by: James Bottomley \u003cJBottomley@Parallels.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d9e8942e554ef56cdfb4166fac2245f40faa1299", "tree": "6f0a5961afda3def5d7aa6cd8d12f1fcc688bd2d", "parents": [ "ff441dfac9b76ec26200b999c34ff09ecfe05672" ], "author": { "name": "Lukasz Dorau", "email": "lukasz.dorau@intel.com", "time": "Thu Feb 06 12:23:20 2014 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:07 2014 -0700" }, "message": "SCSI: isci: correct erroneous for_each_isci_host macro\n\ncommit c59053a23d586675c25d789a7494adfdc02fba57 upstream.\n\nIn the first place, the loop \u0027for\u0027 in the macro \u0027for_each_isci_host\u0027\n(drivers/scsi/isci/host.h:314) is incorrect, because it accesses\nthe 3rd element of 2 element array. After the 2nd iteration it executes\nthe instruction:\n ihost \u003d to_pci_info(pdev)-\u003ehosts[2]\n(while the size of the \u0027hosts\u0027 array equals 2) and reads an\nout of range element.\n\nIn the second place, this loop is incorrectly optimized by GCC v4.8\n(see http://marc.info/?l\u003dlinux-kernel\u0026m\u003d138998871911336\u0026w\u003d2).\nAs a result, on platforms with two SCU controllers,\nthe loop is executed more times than it can be (for i\u003d0,1 and 2).\nIt causes kernel panic during entering the S3 state\nand the following oops after \u0027rmmod isci\u0027:\n\nBUG: unable to handle kernel NULL pointer dereference at (null)\nIP: [\u003cffffffff8131360b\u003e] __list_add+0x1b/0xc0\nOops: 0000 [#1] SMP\nRIP: 0010:[\u003cffffffff8131360b\u003e] [\u003cffffffff8131360b\u003e] __list_add+0x1b/0xc0\nCall Trace:\n [\u003cffffffff81661b84\u003e] __mutex_lock_slowpath+0x114/0x1b0\n [\u003cffffffff81661c3f\u003e] mutex_lock+0x1f/0x30\n [\u003cffffffffa03e97cb\u003e] sas_disable_events+0x1b/0x50 [libsas]\n [\u003cffffffffa03e9818\u003e] sas_unregister_ha+0x18/0x60 [libsas]\n [\u003cffffffffa040316e\u003e] isci_unregister+0x1e/0x40 [isci]\n [\u003cffffffffa0403efd\u003e] isci_pci_remove+0x5d/0x100 [isci]\n [\u003cffffffff813391cb\u003e] pci_device_remove+0x3b/0xb0\n [\u003cffffffff813fbf7f\u003e] __device_release_driver+0x7f/0xf0\n [\u003cffffffff813fc8f8\u003e] driver_detach+0xa8/0xb0\n [\u003cffffffff813fbb8b\u003e] bus_remove_driver+0x9b/0x120\n [\u003cffffffff813fcf2c\u003e] driver_unregister+0x2c/0x50\n [\u003cffffffff813381f3\u003e] pci_unregister_driver+0x23/0x80\n [\u003cffffffffa04152f8\u003e] isci_exit+0x10/0x1e [isci]\n [\u003cffffffff810d199b\u003e] SyS_delete_module+0x16b/0x2d0\n [\u003cffffffff81012a21\u003e] ? do_notify_resume+0x61/0xa0\n [\u003cffffffff8166ce29\u003e] system_call_fastpath+0x16/0x1b\n\nThe loop has been corrected.\nThis patch fixes kernel panic during entering the S3 state\nand the above oops.\n\nSigned-off-by: Lukasz Dorau \u003clukasz.dorau@intel.com\u003e\nReviewed-by: Maciej Patelczyk \u003cmaciej.patelczyk@intel.com\u003e\nTested-by: Lukasz Dorau \u003clukasz.dorau@intel.com\u003e\nSigned-off-by: Dan Williams \u003cdan.j.williams@intel.com\u003e\nSigned-off-by: James Bottomley \u003cJBottomley@Parallels.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ff441dfac9b76ec26200b999c34ff09ecfe05672", "tree": "0006c36a5ecfb611a1c9094733bd4a8909ad1c02", "parents": [ "f8d17b6ff32a85be53f8055af5b35dc0cb96f62a" ], "author": { "name": "Dan Williams", "email": "dan.j.williams@intel.com", "time": "Thu Feb 06 12:23:01 2014 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:07 2014 -0700" }, "message": "SCSI: isci: fix reset timeout handling\n\ncommit ddfadd7736b677de2d4ca2cd5b4b655368c85a7a upstream.\n\nRemove an erroneous BUG_ON() in the case of a hard reset timeout. The\nreset timeout handler puts the port into the \"awaiting link-up\" state.\nThe timeout causes the device to be disconnected and we need to be in\nthe awaiting link-up state to re-connect the port. The BUG_ON() made\nthe incorrect assumption that resets never timeout and we always\ncomplete the reset in the \"resetting\" state.\n\nTesting this patch also uncovered that libata continues to attempt to\nreset the port long after the driver has torn down the context. Once\nthe driver has committed to abandoning the link it must indicate to\nlibata that recovery ends by returning -ENODEV from\n-\u003elldd_I_T_nexus_reset().\n\nAcked-by: Lukasz Dorau \u003clukasz.dorau@intel.com\u003e\nReported-by: David Milburn \u003cdmilburn@redhat.com\u003e\nReported-by: Xun Ni \u003cxun.ni@intel.com\u003e\nTested-by: Xun Ni \u003cxun.ni@intel.com\u003e\nSigned-off-by: Dan Williams \u003cdan.j.williams@intel.com\u003e\nSigned-off-by: James Bottomley \u003cJBottomley@Parallels.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f8d17b6ff32a85be53f8055af5b35dc0cb96f62a", "tree": "ac6074accf2fec2e6f6317bb2fa76c370b89f379", "parents": [ "5e764c599eb843a09e8c1f3aa6d4d86acd59c31c" ], "author": { "name": "Marc Kleine-Budde", "email": "mkl@pengutronix.de", "time": "Fri Feb 28 14:52:01 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:07 2014 -0700" }, "message": "can: flexcan: flexcan_open(): fix error path if flexcan_chip_start() fails\n\ncommit 7e9e148af01ef388efb6e2490805970be4622792 upstream.\n\nIf flexcan_chip_start() in flexcan_open() fails, the interrupt is not freed,\nthis patch adds the missing cleanup.\n\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5e764c599eb843a09e8c1f3aa6d4d86acd59c31c", "tree": "0af470a3c3aadd820f7f72fd44966e1ba1872d07", "parents": [ "6b4741d6d9a5347e4bff4eaad1bb68621d841592" ], "author": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Thu Mar 13 10:44:34 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:07 2014 -0700" }, "message": "vmxnet3: fix building without CONFIG_PCI_MSI\n\ncommit 0a8d8c446b5429d15ff2d48f46e00d8a08552303 upstream.\n\nSince commit d25f06ea466e \"vmxnet3: fix netpoll race condition\",\nthe vmxnet3 driver fails to build when CONFIG_PCI_MSI is disabled,\nbecause it unconditionally references the vmxnet3_msix_rx()\nfunction.\n\nTo fix this, use the same #ifdef in the caller that exists around\nthe function definition.\n\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nCc: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nCc: Shreyas Bhatewara \u003csbhatewara@vmware.com\u003e\nCc: \"VMware, Inc.\" \u003cpv-drivers@vmware.com\u003e\nCc: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\nAcked-by: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6b4741d6d9a5347e4bff4eaad1bb68621d841592", "tree": "092f4cfcc1b192f984eba4c5742f6e19f45e67e7", "parents": [ "18bd55f61fa9f46082820741d753b3b919244d8a" ], "author": { "name": "Neil Horman", "email": "nhorman@tuxdriver.com", "time": "Mon Mar 10 06:55:55 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:07 2014 -0700" }, "message": "vmxnet3: fix netpoll race condition\n\ncommit d25f06ea466ea521b563b76661180b4e44714ae6 upstream.\n\nvmxnet3\u0027s netpoll driver is incorrectly coded. It directly calls\nvmxnet3_do_poll, which is the driver internal napi poll routine. As the netpoll\ncontroller method doesn\u0027t block real napi polls in any way, there is a potential\nfor race conditions in which the netpoll controller method and the napi poll\nmethod run concurrently. The result is data corruption causing panics such as this\none recently observed:\nPID: 1371 TASK: ffff88023762caa0 CPU: 1 COMMAND: \"rs:main Q:Reg\"\n #0 [ffff88023abd5780] machine_kexec at ffffffff81038f3b\n #1 [ffff88023abd57e0] crash_kexec at ffffffff810c5d92\n #2 [ffff88023abd58b0] oops_end at ffffffff8152b570\n #3 [ffff88023abd58e0] die at ffffffff81010e0b\n #4 [ffff88023abd5910] do_trap at ffffffff8152add4\n #5 [ffff88023abd5970] do_invalid_op at ffffffff8100cf95\n #6 [ffff88023abd5a10] invalid_op at ffffffff8100bf9b\n [exception RIP: vmxnet3_rq_rx_complete+1968]\n RIP: ffffffffa00f1e80 RSP: ffff88023abd5ac8 RFLAGS: 00010086\n RAX: 0000000000000000 RBX: ffff88023b5dcee0 RCX: 00000000000000c0\n RDX: 0000000000000000 RSI: 00000000000005f2 RDI: ffff88023b5dcee0\n RBP: ffff88023abd5b48 R8: 0000000000000000 R9: ffff88023a3b6048\n R10: 0000000000000000 R11: 0000000000000002 R12: ffff8802398d4cd8\n R13: ffff88023af35140 R14: ffff88023b60c890 R15: 0000000000000000\n ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018\n #7 [ffff88023abd5b50] vmxnet3_do_poll at ffffffffa00f204a [vmxnet3]\n #8 [ffff88023abd5b80] vmxnet3_netpoll at ffffffffa00f209c [vmxnet3]\n #9 [ffff88023abd5ba0] netpoll_poll_dev at ffffffff81472bb7\n\nThe fix is to do as other drivers do, and have the poll controller call the top\nhalf interrupt handler, which schedules a napi poll properly to recieve frames\n\nTested by myself, successfully.\n\nSigned-off-by: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nCC: Shreyas Bhatewara \u003csbhatewara@vmware.com\u003e\nCC: \"VMware, Inc.\" \u003cpv-drivers@vmware.com\u003e\nCC: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\nReviewed-by: Shreyas N Bhatewara \u003csbhatewara@vmware.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "18bd55f61fa9f46082820741d753b3b919244d8a", "tree": "3b7dbb24858d36e878cc2a0045fcfb8cab35f240", "parents": [ "7dab50632efb9ed42ee352c3588a3e107dff66bb" ], "author": { "name": "Radim Krčmář", "email": "rkrcmar@redhat.com", "time": "Tue Mar 11 19:11:18 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:07 2014 -0700" }, "message": "KVM: SVM: fix cr8 intercept window\n\ncommit 596f3142d2b7be307a1652d59e7b93adab918437 upstream.\n\nWe always disable cr8 intercept in its handler, but only re-enable it\nif handling KVM_REQ_EVENT, so there can be a window where we do not\nintercept cr8 writes, which allows an interrupt to disrupt a higher\npriority task.\n\nFix this by disabling intercepts in the same function that re-enables\nthem when needed. This fixes BSOD in Windows 2008.\n\nSigned-off-by: Radim Krčmář \u003crkrcmar@redhat.com\u003e\nReviewed-by: Marcelo Tosatti \u003cmtosatti@redhat.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7dab50632efb9ed42ee352c3588a3e107dff66bb", "tree": "cf7714a92bf1a47bc9327b4f760d5f710b45e67c", "parents": [ "bfe635e52ede4c72819099b0fce72e28eec6e6c6" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Mar 06 18:09:52 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:06 2014 -0700" }, "message": "drm/radeon/atom: select the proper number of lanes in transmitter setup\n\ncommit d03874c881a049a50e12f285077ab1f9fc2686e1 upstream.\n\nWe need to check for DVI vs. HDMI when setting up duallink since\nHDMI is single link only. Fixes 4k modes on newer asics.\n\nbug:\nhttps://bugs.freedesktop.org/show_bug.cgi?id\u003d75223\n\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "bfe635e52ede4c72819099b0fce72e28eec6e6c6", "tree": "b842fdd41d924e7b37de51da999fa8d68ce21cd8", "parents": [ "e877d416818ff7439d01f88bf6d70131a27f730e" ], "author": { "name": "Artem Fetishev", "email": "artem_fetishev@epam.com", "time": "Mon Mar 10 15:49:45 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:06 2014 -0700" }, "message": "fs/proc/base.c: fix GPF in /proc/$PID/map_files\n\ncommit 70335abb2689c8cd5df91bf2d95a65649addf50b upstream.\n\nThe expected logic of proc_map_files_get_link() is either to return 0\nand initialize \u0027path\u0027 or return an error and leave \u0027path\u0027 uninitialized.\n\nBy the time dname_to_vma_addr() returns 0 the corresponding vma may have\nalready be gone. In this case the path is not initialized but the\nreturn value is still 0. This results in \u0027general protection fault\u0027\ninside d_path().\n\nSteps to reproduce:\n\n CONFIG_CHECKPOINT_RESTORE\u003dy\n\n fd \u003d open(...);\n while (1) {\n mmap(fd, ...);\n munmap(fd, ...);\n }\n\n ls -la /proc/$PID/map_files\n\nAddresses https://bugzilla.kernel.org/show_bug.cgi?id\u003d68991\n\nSigned-off-by: Artem Fetishev \u003cartem_fetishev@epam.com\u003e\nSigned-off-by: Aleksandr Terekhov \u003caleksandr_terekhov@epam.com\u003e\nReported-by: \u003cwiebittewas@gmail.com\u003e\nAcked-by: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nAcked-by: Cyrill Gorcunov \u003cgorcunov@openvz.org\u003e\nReviewed-by: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e877d416818ff7439d01f88bf6d70131a27f730e", "tree": "fccf0e75c2259f7581b0c0de91b072c99e2fbdea", "parents": [ "02a4ed4a5b0febad6f129e65ab9ae4794b51a61b" ], "author": { "name": "Trond Myklebust", "email": "trond.myklebust@primarydata.com", "time": "Sun Mar 02 22:03:12 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:06 2014 -0700" }, "message": "NFS: Fix a delegation callback race\n\ncommit 755a48a7a4eb05b9c8424e3017d947b2961a60e0 upstream.\n\nThe clean-up in commit 36281caa839f ended up removing a NULL pointer check\nthat is needed in order to prevent an Oops in\nnfs_async_inode_return_delegation().\n\nReported-by: \"Yan, Zheng\" \u003czheng.z.yan@intel.com\u003e\nLink: http://lkml.kernel.org/r/5313E9F6.2020405@intel.com\nFixes: 36281caa839f (NFSv4: Further clean-ups of delegation stateid validation)\nSigned-off-by: Trond Myklebust \u003ctrond.myklebust@primarydata.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "02a4ed4a5b0febad6f129e65ab9ae4794b51a61b", "tree": "7785c54fc625bfc0032b5f45ada5dd24164a46d8", "parents": [ "f8637162b3632012f6d418076e84701086fb83b5" ], "author": { "name": "Michele Baldessari", "email": "michele@acksyn.org", "time": "Fri Mar 07 16:34:29 2014 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:06 2014 -0700" }, "message": "libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for Seagate Momentus SpinPoint M8 (2BA30001)\n\ncommit b28a613e9138e4b3a64649bd60b13436f4b4b49b upstream.\n\nVia commit 87809942d3fa \"libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk\nfor Seagate Momentus SpinPoint M8\" we added a quirk for disks named\n\"ST1000LM024 HN-M101MBB\" with firmware revision \"2AR10001\".\n\nAs reported on https://bugzilla.redhat.com/show_bug.cgi?id\u003d1073901,\nwe need to also add firmware revision 2BA30001 as it is broken as well.\n\nReported-by: Nicholas \u003carealityfarbetween@googlemail.com\u003e\nSigned-off-by: Michele Baldessari \u003cmichele@acksyn.org\u003e\nTested-by: Guilherme Amadio \u003cguilherme.amadio@gmail.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f8637162b3632012f6d418076e84701086fb83b5", "tree": "4ddbc92b65d7d0a88a3154ca97a98cb89426d153", "parents": [ "f37058b88772ed4de812d1716634649ee1e6480e" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Mar 07 10:19:57 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:06 2014 -0700" }, "message": "firewire: don\u0027t use PREPARE_DELAYED_WORK\n\ncommit 70044d71d31d6973665ced5be04ef39ac1c09a48 upstream.\n\nPREPARE_[DELAYED_]WORK() are being phased out. They have few users\nand a nasty surprise in terms of reentrancy guarantee as workqueue\nconsiders work items to be different if they don\u0027t have the same work\nfunction.\n\nfirewire core-device and sbp2 have been been multiplexing work items\nwith multiple work functions. Introduce fw_device_workfn() and\nsbp2_lu_workfn() which invoke fw_device-\u003eworkfn and\nsbp2_logical_unit-\u003eworkfn respectively and always use the two\nfunctions as the work functions and update the users to set the\n-\u003eworkfn fields instead of overriding work functions using\nPREPARE_DELAYED_WORK().\n\nThis fixes a variety of possible regressions since a2c1c57be8d9\n\"workqueue: consider work function when searching for busy work items\"\ndue to which fw_workqueue lost its required non-reentrancy property.\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nAcked-by: Stefan Richter \u003cstefanr@s5r6.in-berlin.de\u003e\nCc: linux1394-devel@lists.sourceforge.net\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f37058b88772ed4de812d1716634649ee1e6480e", "tree": "f18ce74ce734779947cbde687780d2d168583fe8", "parents": [ "a299804140325db7b93173419b0724056b60f34d" ], "author": { "name": "Stefan Richter", "email": "stefanr@s5r6.in-berlin.de", "time": "Tue Feb 18 22:25:15 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:06 2014 -0700" }, "message": "firewire: net: fix use after free\n\ncommit 8987583366ae9e03c306c2b7d73bdb952df1d08d upstream.\n\nCommit 8408dc1c14c1 \"firewire: net: use dev_printk API\" introduced a\nuse-after-free in a failure path. fwnet_transmit_packet_failed(ptask)\nmay free ptask, then the dev_err() call dereferenced it. The fix is\nstraightforward; simply reorder the two calls.\n\nReported-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: Stefan Richter \u003cstefanr@s5r6.in-berlin.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a299804140325db7b93173419b0724056b60f34d", "tree": "bd83dcad3466c51e0f3a731ec15b5b09be562814", "parents": [ "c5ad4fdec0ae15d197508185643c68470868121d" ], "author": { "name": "Steven Rostedt (Red Hat)", "email": "rostedt@goodmis.org", "time": "Wed Feb 26 13:37:38 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:06 2014 -0700" }, "message": "tracing: Do not add event files for modules that fail tracepoints\n\ncommit 45ab2813d40d88fc575e753c38478de242d03f88 upstream.\n\nIf a module fails to add its tracepoints due to module tainting, do not\ncreate the module event infrastructure in the debugfs directory. As the events\nwill not work and worse yet, they will silently fail, making the user wonder\nwhy the events they enable do not display anything.\n\nHaving a warning on module load and the events not visible to the users\nwill make the cause of the problem much clearer.\n\nLink: http://lkml.kernel.org/r/20140227154923.265882695@goodmis.org\n\nFixes: 6d723736e472 \"tracing/events: add support for modules to TRACE_EVENT\"\nAcked-by: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nCc: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c5ad4fdec0ae15d197508185643c68470868121d", "tree": "d665cfe6c40a7e0f950aefbba227fcd691e2416e", "parents": [ "b46741f24d1c0d0d8dcfb3c63439338d2dc0337e" ], "author": { "name": "Li Zefan", "email": "lizefan@huawei.com", "time": "Thu Feb 27 18:19:36 2014 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:05 2014 -0700" }, "message": "cpuset: fix a race condition in __cpuset_node_allowed_softwall()\n\ncommit 99afb0fd5f05aac467ffa85c36778fec4396209b upstream.\n\nIt\u0027s not safe to access task\u0027s cpuset after releasing task_lock().\nHolding callback_mutex won\u0027t help.\n\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b46741f24d1c0d0d8dcfb3c63439338d2dc0337e", "tree": "e5c655ff39f3806adcd5601e44dcc67a49e74e04", "parents": [ "bb7d79fc8250eaa01ac6f82f9001ffcec0e7ca36" ], "author": { "name": "Chuansheng Liu", "email": "chuansheng.liu@intel.com", "time": "Mon Feb 24 11:29:50 2014 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:05 2014 -0700" }, "message": "genirq: Remove racy waitqueue_active check\n\ncommit c685689fd24d310343ac33942e9a54a974ae9c43 upstream.\n\nWe hit one rare case below:\n\nT1 calling disable_irq(), but hanging at synchronize_irq()\nalways;\nThe corresponding irq thread is in sleeping state;\nAnd all CPUs are in idle state;\n\nAfter analysis, we found there is one possible scenerio which\ncauses T1 is waiting there forever:\nCPU0 CPU1\n synchronize_irq()\n wait_event()\n spin_lock()\n atomic_dec_and_test(\u0026threads_active)\n insert the __wait into queue\n spin_unlock()\n if(waitqueue_active)\n atomic_read(\u0026threads_active)\n wake_up()\n\nHere after inserted the __wait into queue on CPU0, and before\ntest if queue is empty on CPU1, there is no barrier, it maybe\ncause it is not visible for CPU1 immediately, although CPU0 has\nupdated the queue list.\nIt is similar for CPU0 atomic_read() threads_active also.\n\nSo we\u0027d need one smp_mb() before waitqueue_active.that, but removing\nthe waitqueue_active() check solves it as wel l and it makes\nthings simple and clear.\n\nSigned-off-by: Chuansheng Liu \u003cchuansheng.liu@intel.com\u003e\nCc: Xiaoming Wang \u003cxiaoming.wang@intel.com\u003e\nLink: http://lkml.kernel.org/r/1393212590-32543-1-git-send-email-chuansheng.liu@intel.com\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "bb7d79fc8250eaa01ac6f82f9001ffcec0e7ca36", "tree": "f47328fcbd89c9bcb6b9a83570cb781538bfa0cd", "parents": [ "8271b4d83a6f070ba1cd3a6e4fab36dcf7c2207a" ], "author": { "name": "Daniel J Blueman", "email": "daniel@numascale.com", "time": "Thu Mar 13 19:43:01 2014 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:05 2014 -0700" }, "message": "x86/amd/numa: Fix northbridge quirk to assign correct NUMA node\n\ncommit 847d7970defb45540735b3fb4e88471c27cacd85 upstream.\n\nFor systems with multiple servers and routed fabric, all\nnorthbridges get assigned to the first server. Fix this by also\nusing the node reported from the PCI bus. For single-fabric\nsystems, the northbriges are on PCI bus 0 by definition, which\nare on NUMA node 0 by definition, so this is invarient on most\nsystems.\n\nTested on fam10h and fam15h single and multi-fabric systems and\ncandidate for stable.\n\nSigned-off-by: Daniel J Blueman \u003cdaniel@numascale.com\u003e\nAcked-by: Steffen Persvold \u003csp@numascale.com\u003e\nAcked-by: Borislav Petkov \u003cbp@suse.de\u003e\nLink: http://lkml.kernel.org/r/1394710981-3596-1-git-send-email-daniel@numascale.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8271b4d83a6f070ba1cd3a6e4fab36dcf7c2207a", "tree": "7006c8d5ac5d8d7f9eddba6d9945c073d52dea63", "parents": [ "ec012303c26a1d4d6251d74401ee290a063154ac" ], "author": { "name": "Linus Walleij", "email": "linus.walleij@linaro.org", "time": "Tue Feb 25 22:41:41 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:05 2014 -0700" }, "message": "ARM: 7991/1: sa1100: fix compile problem on Collie\n\ncommit 052450fdc55894a39fbae93d9bbe43947956f663 upstream.\n\nDue to a problem in the MFD Kconfig it was not possible to\ncompile the UCB battery driver for the Collie SA1100 system,\nin turn making it impossible to compile in the battery driver.\n(See patch \"mfd: include all drivers in subsystem menu\".)\n\nAfter fixing the MFD Kconfig (separate patch) a compile error\nappears in the Collie battery driver due to the \u003cmach/collie.h\u003e\nimplicitly requiring \u003cmach/hardware.h\u003e through \u003clinux/gpio.h\u003e\nvia \u003cmach/gpio.h\u003e prior to commit\n40ca061b \"ARM: 7841/1: sa1100: remove complex GPIO interface\".\n\nFix this up by including the required header into\n\u003cmach/collie.h\u003e.\n\nCc: Andrea Adami \u003candrea.adami@gmail.com\u003e\nCc: Dmitry Eremin-Solenikov \u003cdbaryshkov@gmail.com\u003e\nSigned-off-by: Linus Walleij \u003clinus.walleij@linaro.org\u003e\nSigned-off-by: Russell King \u003crmk+kernel@arm.linux.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ec012303c26a1d4d6251d74401ee290a063154ac", "tree": "06dc009625aad9d096171235430c17775c1ec8f8", "parents": [ "377f8ac2e07858b912ca791e6a80c3290986ffc1" ], "author": { "name": "Anton Blanchard", "email": "anton@samba.org", "time": "Tue Mar 04 08:31:24 2014 +1100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:05 2014 -0700" }, "message": "powerpc: Align p_dyn, p_rela and p_st symbols\n\ncommit a5b2cf5b1af424ee3dd9e3ce6d5cea18cb927e67 upstream.\n\nThe 64bit relocation code places a few symbols in the text segment.\nThese symbols are only 4 byte aligned where they need to be 8 byte\naligned. Add an explicit alignment.\n\nSigned-off-by: Anton Blanchard \u003canton@samba.org\u003e\nTested-by: Laurent Dufour \u003cldufour@linux.vnet.ibm.com\u003e\nSigned-off-by: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "377f8ac2e07858b912ca791e6a80c3290986ffc1", "tree": "5d72bfac0d37297ff82cba2e68e8e9130264b4bb", "parents": [ "99792c01fe46e0c8d9ccdf6cdefa2061a7ea7f36" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Mar 05 12:34:39 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:05 2014 -0700" }, "message": "ALSA: usb-audio: Add quirk for Logitech Webcam C500\n\ncommit e805ca8b0a9b6c91099c0eaa4b160a1196a4ae25 upstream.\n\nLogitech C500 (046d:0807) needs the same workaround like other\nLogitech Webcams.\n\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "99792c01fe46e0c8d9ccdf6cdefa2061a7ea7f36", "tree": "a7f904ac0cf00af62186be5885ebfcde9b12cc37", "parents": [ "cf828d9fed64eda7a0b3aefd90d1eb2fada2b544" ], "author": { "name": "Roman Volkov", "email": "v1ron@mail.ru", "time": "Fri Jan 24 16:18:14 2014 +0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:05 2014 -0700" }, "message": "ALSA: oxygen: Xonar DG(X): capture from I2S channel 1, not 2\n\ncommit 3dd77654fb1d7f68b9739f3039bad8dbbc0739f8 upstream.\n\nActually CS4245 connected to the I2S channel 1 for\ncapture, not channel 2. Otherwise capturing and\nplayback does not work for CS4245.\n\nSigned-off-by: Roman Volkov \u003cv1ron@mail.ru\u003e\nSigned-off-by: Clemens Ladisch \u003cclemens@ladisch.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "cf828d9fed64eda7a0b3aefd90d1eb2fada2b544", "tree": "ee0bfd2c1fe41616ee99911656be1c61d94295ec", "parents": [ "c7fc368e0c6b01aef43d00fcfd59159f0acdf0cd" ], "author": { "name": "Rob Clark", "email": "rclark@redhat.com", "time": "Wed Mar 12 10:59:37 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:04 2014 -0700" }, "message": "drm/ttm: don\u0027t oops if no invalidate_caches()\n\ncommit 9ef7506f7eff3fc42724269f62e30164c141661f upstream.\n\nA few of the simpler TTM drivers (cirrus, ast, mgag200) do not implement\nthis function. Yet can end up somehow with an evicted bo:\n\n BUG: unable to handle kernel NULL pointer dereference at (null)\n IP: [\u003c (null)\u003e] (null)\n PGD 16e761067 PUD 16e6cf067 PMD 0\n Oops: 0010 [#1] SMP\n Modules linked in: bnep bluetooth rfkill fuse ip6t_rpfilter ip6t_REJECT ipt_REJECT xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw iptable_filter ip_tables sg btrfs zlib_deflate raid6_pq xor dm_queue_length iTCO_wdt iTCO_vendor_support coretemp kvm dcdbas dm_service_time microcode serio_raw pcspkr lpc_ich mfd_core i7core_edac edac_core ses enclosure ipmi_si ipmi_msghandler shpchp acpi_power_meter mperf nfsd auth_rpcgss nfs_acl lockd uinput sunrpc dm_multipath xfs libcrc32c ata_generic pata_acpi sr_mod cdrom\n sd_mod usb_storage mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit lpfc drm_kms_helper ttm crc32c_intel ata_piix bfa drm ixgbe libata i2c_core mdio crc_t10dif ptp crct10dif_common pps_core scsi_transport_fc dca scsi_tgt megaraid_sas bnx2 dm_mirror dm_region_hash dm_log dm_mod\n CPU: 16 PID: 2572 Comm: X Not tainted 3.10.0-86.el7.x86_64 #1\n Hardware name: Dell Inc. PowerEdge R810/0H235N, BIOS 0.3.0 11/14/2009\n task: ffff8801799dabc0 ti: ffff88016c884000 task.ti: ffff88016c884000\n RIP: 0010:[\u003c0000000000000000\u003e] [\u003c (null)\u003e] (null)\n RSP: 0018:ffff88016c885ad8 EFLAGS: 00010202\n RAX: ffffffffa04e94c0 RBX: ffff880178937a20 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000240004 RDI: ffff880178937a00\n RBP: ffff88016c885b60 R08: 00000000000171a0 R09: ffff88007cf171a0\n R10: ffffea0005842540 R11: ffffffff810487b9 R12: ffff880178937b30\n R13: ffff880178937a00 R14: ffff88016c885b78 R15: ffff880179929400\n FS: 00007f81ba2ef980(0000) GS:ffff88007cf00000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000000000 CR3: 000000016e763000 CR4: 00000000000007e0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n Stack:\n ffffffffa0306fae ffff8801799295c0 0000000000260004 0000000000000001\n ffff88016c885b60 ffffffffa0307669 00ff88007cf17738 ffff88017cf17700\n ffff880178937a00 ffff880100000000 ffff880100000000 0000000079929400\n Call Trace:\n [\u003cffffffffa0306fae\u003e] ? ttm_bo_handle_move_mem+0x54e/0x5b0 [ttm]\n [\u003cffffffffa0307669\u003e] ? ttm_bo_mem_space+0x169/0x340 [ttm]\n [\u003cffffffffa0307bd7\u003e] ttm_bo_move_buffer+0x117/0x130 [ttm]\n [\u003cffffffff81130001\u003e] ? perf_event_init_context+0x141/0x220\n [\u003cffffffffa0307cb1\u003e] ttm_bo_validate+0xc1/0x130 [ttm]\n [\u003cffffffffa04e7377\u003e] mgag200_bo_pin+0x87/0xc0 [mgag200]\n [\u003cffffffffa04e56c4\u003e] mga_crtc_cursor_set+0x474/0xbb0 [mgag200]\n [\u003cffffffff811971d2\u003e] ? __mem_cgroup_commit_charge+0x152/0x3b0\n [\u003cffffffff815c4182\u003e] ? mutex_lock+0x12/0x2f\n [\u003cffffffffa0201433\u003e] drm_mode_cursor_common+0x123/0x170 [drm]\n [\u003cffffffffa0205231\u003e] drm_mode_cursor_ioctl+0x41/0x50 [drm]\n [\u003cffffffffa01f5ca2\u003e] drm_ioctl+0x502/0x630 [drm]\n [\u003cffffffff815cbab4\u003e] ? __do_page_fault+0x1f4/0x510\n [\u003cffffffff8101cb68\u003e] ? __restore_xstate_sig+0x218/0x4f0\n [\u003cffffffff811b4445\u003e] do_vfs_ioctl+0x2e5/0x4d0\n [\u003cffffffff8124488e\u003e] ? file_has_perm+0x8e/0xa0\n [\u003cffffffff811b46b1\u003e] SyS_ioctl+0x81/0xa0\n [\u003cffffffff815d05d9\u003e] system_call_fastpath+0x16/0x1b\n Code: Bad RIP value.\n RIP [\u003c (null)\u003e] (null)\n RSP \u003cffff88016c885ad8\u003e\n CR2: 0000000000000000\n\nSigned-off-by: Rob Clark \u003crclark@redhat.com\u003e\nReviewed-by: Jérôme Glisse \u003cjglisse@redhat.com\u003e\nReviewed-by: Thomas Hellstrom \u003cthellstrom@vmware.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c7fc368e0c6b01aef43d00fcfd59159f0acdf0cd", "tree": "cde42c449e128d6c912f56df6ff783f2efa72558", "parents": [ "8509583a3094c4dfc1448e0b2fbadfb5b436378f" ], "author": { "name": "Amitkumar Karwar", "email": "akarwar@marvell.com", "time": "Tue Mar 04 18:43:13 2014 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:04 2014 -0700" }, "message": "mwifiex: copy AP\u0027s HT capability info correctly\n\ncommit c99b1861c232e1f641f13b8645e0febb3712cc71 upstream.\n\nWhile preparing association request, intersection of device\u0027s HT\ncapability information and corresponding fields advertised by AP\nis used.\n\nThis patch fixes an error while copying this field from AP\u0027s\nbeacon.\n\nSigned-off-by: Amitkumar Karwar \u003cakarwar@marvell.com\u003e\nSigned-off-by: Bing Zhao \u003cbzhao@marvell.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8509583a3094c4dfc1448e0b2fbadfb5b436378f", "tree": "29442ff965acfe3addd3b5655f51a7b84f55bd66", "parents": [ "46a5a5493360f995b834eb3b828eb59da4604509" ], "author": { "name": "Sujith Manoharan", "email": "c_manoha@qca.qualcomm.com", "time": "Fri Feb 14 08:15:20 2014 +0530" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:04 2014 -0700" }, "message": "ath9k: Fix ETSI compliance for AR9462 2.0\n\ncommit b3050248c167871ca52cfdb2ce78aa2460249346 upstream.\n\nThe minimum CCA power threshold values have to be adjusted\nfor existing cards to be in compliance with new regulations.\nNewer cards will make use of the values obtained from EEPROM,\nsupport for this was added earlier. To make sure that cards\nthat are already in use and don\u0027t have proper values in EEPROM,\ndo not violate regulations, use the initvals instead.\n\nReported-by: Jeang Daniel \u003cdyjeong@qca.qualcomm.com\u003e\nSigned-off-by: Sujith Manoharan \u003cc_manoha@qca.qualcomm.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "46a5a5493360f995b834eb3b828eb59da4604509", "tree": "5ec7e16130aa75ab7fae3380598a5173d5a07bb0", "parents": [ "18684dfb8483c9bbd3cc4ecefc1d9784d8158608" ], "author": { "name": "Emmanuel Grumbach", "email": "emmanuel.grumbach@intel.com", "time": "Thu Feb 20 09:22:11 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:04 2014 -0700" }, "message": "mac80211: fix AP powersave TX vs. wakeup race\n\ncommit 1d147bfa64293b2723c4fec50922168658e613ba upstream.\n\nThere is a race between the TX path and the STA wakeup: while\na station is sleeping, mac80211 buffers frames until it wakes\nup, then the frames are transmitted. However, the RX and TX\npath are concurrent, so the packet indicating wakeup can be\nprocessed while a packet is being transmitted.\n\nThis can lead to a situation where the buffered frames list\nis emptied on the one side, while a frame is being added on\nthe other side, as the station is still seen as sleeping in\nthe TX path.\n\nAs a result, the newly added frame will not be send anytime\nsoon. It might be sent much later (and out of order) when the\nstation goes to sleep and wakes up the next time.\n\nAdditionally, it can lead to the crash below.\n\nFix all this by synchronising both paths with a new lock.\nBoth path are not fastpath since they handle PS situations.\n\nIn a later patch we\u0027ll remove the extra skb queue locks to\nreduce locking overhead.\n\nBUG: unable to handle kernel\nNULL pointer dereference at 000000b0\nIP: [\u003cff6f1791\u003e] ieee80211_report_used_skb+0x11/0x3e0 [mac80211]\n*pde \u003d 00000000\nOops: 0000 [#1] SMP DEBUG_PAGEALLOC\nEIP: 0060:[\u003cff6f1791\u003e] EFLAGS: 00210282 CPU: 1\nEIP is at ieee80211_report_used_skb+0x11/0x3e0 [mac80211]\nEAX: e5900da0 EBX: 00000000 ECX: 00000001 EDX: 00000000\nESI: e41d00c0 EDI: e5900da0 EBP: ebe458e4 ESP: ebe458b0\n DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068\nCR0: 8005003b CR2: 000000b0 CR3: 25a78000 CR4: 000407d0\nDR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000\nDR6: ffff0ff0 DR7: 00000400\nProcess iperf (pid: 3934, ti\u003debe44000 task\u003de757c0b0 task.ti\u003debe44000)\niwlwifi 0000:02:00.0: I iwl_pcie_enqueue_hcmd Sending command LQ_CMD (#4e), seq: 0x0903, 92 bytes at 3[3]:9\nStack:\n e403b32c ebe458c4 00200002 00200286 e403b338 ebe458cc c10960bb e5900da0\n ff76a6ec ebe458d8 00000000 e41d00c0 e5900da0 ebe458f0 ff6f1b75 e403b210\n ebe4598c ff723dc1 00000000 ff76a6ec e597c978 e403b758 00000002 00000002\nCall Trace:\n [\u003cff6f1b75\u003e] ieee80211_free_txskb+0x15/0x20 [mac80211]\n [\u003cff723dc1\u003e] invoke_tx_handlers+0x1661/0x1780 [mac80211]\n [\u003cff7248a5\u003e] ieee80211_tx+0x75/0x100 [mac80211]\n [\u003cff7249bf\u003e] ieee80211_xmit+0x8f/0xc0 [mac80211]\n [\u003cff72550e\u003e] ieee80211_subif_start_xmit+0x4fe/0xe20 [mac80211]\n [\u003cc149ef70\u003e] dev_hard_start_xmit+0x450/0x950\n [\u003cc14b9aa9\u003e] sch_direct_xmit+0xa9/0x250\n [\u003cc14b9c9b\u003e] __qdisc_run+0x4b/0x150\n [\u003cc149f732\u003e] dev_queue_xmit+0x2c2/0xca0\n\nReported-by: Yaara Rozenblum \u003cyaara.rozenblum@intel.com\u003e\nSigned-off-by: Emmanuel Grumbach \u003cemmanuel.grumbach@intel.com\u003e\nReviewed-by: Stanislaw Gruszka \u003csgruszka@redhat.com\u003e\n[reword commit log, use a separate lock]\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "18684dfb8483c9bbd3cc4ecefc1d9784d8158608", "tree": "585c4eba8211ab76bd62987e258bfc463a60162d", "parents": [ "fc8927f2d373d522e85ca497e9f6755f564b42ce" ], "author": { "name": "Daniel Borkmann", "email": "dborkman@redhat.com", "time": "Mon Mar 03 17:23:04 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:04 2014 -0700" }, "message": "net: sctp: fix sctp_sf_do_5_1D_ce to verify if we/peer is AUTH capable\n\n[ Upstream commit ec0223ec48a90cb605244b45f7c62de856403729 ]\n\nRFC4895 introduced AUTH chunks for SCTP; during the SCTP\nhandshake RANDOM; CHUNKS; HMAC-ALGO are negotiated (CHUNKS\nbeing optional though):\n\n ---------- INIT[RANDOM; CHUNKS; HMAC-ALGO] ----------\u003e\n \u003c------- INIT-ACK[RANDOM; CHUNKS; HMAC-ALGO] ---------\n -------------------- COOKIE-ECHO --------------------\u003e\n \u003c-------------------- COOKIE-ACK ---------------------\n\nA special case is when an endpoint requires COOKIE-ECHO\nchunks to be authenticated:\n\n ---------- INIT[RANDOM; CHUNKS; HMAC-ALGO] ----------\u003e\n \u003c------- INIT-ACK[RANDOM; CHUNKS; HMAC-ALGO] ---------\n ------------------ AUTH; COOKIE-ECHO ----------------\u003e\n \u003c-------------------- COOKIE-ACK ---------------------\n\nRFC4895, section 6.3. Receiving Authenticated Chunks says:\n\n The receiver MUST use the HMAC algorithm indicated in\n the HMAC Identifier field. If this algorithm was not\n specified by the receiver in the HMAC-ALGO parameter in\n the INIT or INIT-ACK chunk during association setup, the\n AUTH chunk and all the chunks after it MUST be discarded\n and an ERROR chunk SHOULD be sent with the error cause\n defined in Section 4.1. [...] If no endpoint pair shared\n key has been configured for that Shared Key Identifier,\n all authenticated chunks MUST be silently discarded. [...]\n\n When an endpoint requires COOKIE-ECHO chunks to be\n authenticated, some special procedures have to be followed\n because the reception of a COOKIE-ECHO chunk might result\n in the creation of an SCTP association. If a packet arrives\n containing an AUTH chunk as a first chunk, a COOKIE-ECHO\n chunk as the second chunk, and possibly more chunks after\n them, and the receiver does not have an STCB for that\n packet, then authentication is based on the contents of\n the COOKIE-ECHO chunk. In this situation, the receiver MUST\n authenticate the chunks in the packet by using the RANDOM\n parameters, CHUNKS parameters and HMAC_ALGO parameters\n obtained from the COOKIE-ECHO chunk, and possibly a local\n shared secret as inputs to the authentication procedure\n specified in Section 6.3. If authentication fails, then\n the packet is discarded. If the authentication is successful,\n the COOKIE-ECHO and all the chunks after the COOKIE-ECHO\n MUST be processed. If the receiver has an STCB, it MUST\n process the AUTH chunk as described above using the STCB\n from the existing association to authenticate the\n COOKIE-ECHO chunk and all the chunks after it. [...]\n\nCommit bbd0d59809f9 introduced the possibility to receive\nand verification of AUTH chunk, including the edge case for\nauthenticated COOKIE-ECHO. On reception of COOKIE-ECHO,\nthe function sctp_sf_do_5_1D_ce() handles processing,\nunpacks and creates a new association if it passed sanity\nchecks and also tests for authentication chunks being\npresent. After a new association has been processed, it\ninvokes sctp_process_init() on the new association and\nwalks through the parameter list it received from the INIT\nchunk. It checks SCTP_PARAM_RANDOM, SCTP_PARAM_HMAC_ALGO\nand SCTP_PARAM_CHUNKS, and copies them into asoc-\u003epeer\nmeta data (peer_random, peer_hmacs, peer_chunks) in case\nsysctl -w net.sctp.auth_enable\u003d1 is set. If in INIT\u0027s\nSCTP_PARAM_SUPPORTED_EXT parameter SCTP_CID_AUTH is set,\npeer_random !\u003d NULL and peer_hmacs !\u003d NULL the peer is to be\nassumed asoc-\u003epeer.auth_capable\u003d1, in any other case\nasoc-\u003epeer.auth_capable\u003d0.\n\nNow, if in sctp_sf_do_5_1D_ce() chunk-\u003eauth_chunk is\navailable, we set up a fake auth chunk and pass that on to\nsctp_sf_authenticate(), which at latest in\nsctp_auth_calculate_hmac() reliably dereferences a NULL pointer\nat position 0..0008 when setting up the crypto key in\ncrypto_hash_setkey() by using asoc-\u003easoc_shared_key that is\nNULL as condition key_id \u003d\u003d asoc-\u003eactive_key_id is true if\nthe AUTH chunk was injected correctly from remote. This\nhappens no matter what net.sctp.auth_enable sysctl says.\n\nThe fix is to check for net-\u003esctp.auth_enable and for\nasoc-\u003epeer.auth_capable before doing any operations like\nsctp_sf_authenticate() as no key is activated in\nsctp_auth_asoc_init_active_key() for each case.\n\nNow as RFC4895 section 6.3 states that if the used HMAC-ALGO\npassed from the INIT chunk was not used in the AUTH chunk, we\nSHOULD send an error; however in this case it would be better\nto just silently discard such a maliciously prepared handshake\nas we didn\u0027t even receive a parameter at all. Also, as our\nendpoint has no shared key configured, section 6.3 says that\nMUST silently discard, which we are doing from now onwards.\n\nBefore calling sctp_sf_pdiscard(), we need not only to free\nthe association, but also the chunk-\u003eauth_chunk skb, as\ncommit bbd0d59809f9 created a skb clone in that case.\n\nI have tested this locally by using netfilter\u0027s nfqueue and\nre-injecting packets into the local stack after maliciously\nmodifying the INIT chunk (removing RANDOM; HMAC-ALGO param)\nand the SCTP packet containing the COOKIE_ECHO (injecting\nAUTH chunk before COOKIE_ECHO). Fixed with this patch applied.\n\nFixes: bbd0d59809f9 (\"[SCTP]: Implement the receive and verification of AUTH chunk\")\nSigned-off-by: Daniel Borkmann \u003cdborkman@redhat.com\u003e\nCc: Vlad Yasevich \u003cyasevich@gmail.com\u003e\nCc: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nAcked-by: Vlad Yasevich \u003cvyasevich@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "fc8927f2d373d522e85ca497e9f6755f564b42ce", "tree": "eee3b2dafaa41537cd0a4afffa5797d8098f08ec", "parents": [ "73c64222444db00a7f3b3cf933f76f2a2a866fb6" ], "author": { "name": "Michael Chan", "email": "mchan@broadcom.com", "time": "Fri Feb 28 15:05:10 2014 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:04 2014 -0700" }, "message": "tg3: Don\u0027t check undefined error bits in RXBD\n\n[ Upstream commit d7b95315cc7f441418845a165ee56df723941487 ]\n\nRedefine the RXD_ERR_MASK to include only relevant error bits. This fixes\na customer reported issue of randomly dropping packets on the 5719.\n\nSigned-off-by: Michael Chan \u003cmchan@broadcom.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "73c64222444db00a7f3b3cf933f76f2a2a866fb6", "tree": "330d454e15a36050240c4b9ffbb7ceb6828eaeb3", "parents": [ "6ba4d1d9112b3f6bf0f634870bb950b5b59fa86f" ], "author": { "name": "Jason Wang", "email": "jasowang@redhat.com", "time": "Fri Feb 21 13:08:04 2014 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:03 2014 -0700" }, "message": "virtio-net: alloc big buffers also when guest can receive UFO\n\n[ Upstream commit 0e7ede80d929ff0f830c44a543daa1acd590c749 ]\n\nWe should alloc big buffers also when guest can receive UFO\npackets to let the big packets fit into guest rx buffer.\n\nFixes 5c5167515d80f78f6bb538492c423adcae31ad65\n(virtio-net: Allow UFO feature to be set and advertised.)\n\nCc: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nCc: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nCc: Sridhar Samudrala \u003csri@us.ibm.com\u003e\nSigned-off-by: Jason Wang \u003cjasowang@redhat.com\u003e\nAcked-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nAcked-by: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "6ba4d1d9112b3f6bf0f634870bb950b5b59fa86f", "tree": "f6089b725009d95c6686bb6bb02022231c3f0a88", "parents": [ "efcb9185af1155146326a850aaa6617a5bb55172" ], "author": { "name": "George McCollister", "email": "george.mccollister@gmail.com", "time": "Tue Feb 18 17:56:51 2014 -0600" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:03 2014 -0700" }, "message": "sched: Fix double normalization of vruntime\n\ncommit 791c9e0292671a3bfa95286bb5c08129d8605618 upstream.\n\ndequeue_entity() is called when p-\u003eon_rq and sets se-\u003eon_rq \u003d 0\nwhich appears to guarentee that the !se-\u003eon_rq condition is met.\nIf the task has done set_current_state(TASK_INTERRUPTIBLE) without\nschedule() the second condition will be met and vruntime will be\nincorrectly adjusted twice.\n\nIn certain cases this can result in the task\u0027s vruntime never increasing\npast the vruntime of other tasks on the CFS\u0027 run queue, starving them of\nCPU time.\n\nThis patch changes switched_from_fair() to use !p-\u003eon_rq instead of\n!se-\u003eon_rq.\n\nI\u0027m able to cause a task with a priority of 120 to starve all other\ntasks with the same priority on an ARM platform running 3.2.51-rt72\nPREEMPT RT by writing one character at time to a serial tty (16550 UART)\nin a tight loop. I\u0027m also able to verify making this change corrects the\nproblem on that platform and kernel version.\n\nSigned-off-by: George McCollister \u003cgeorge.mccollister@gmail.com\u003e\nSigned-off-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nLink: http://lkml.kernel.org/r/1392767811-28916-1-git-send-email-george.mccollister@gmail.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "efcb9185af1155146326a850aaa6617a5bb55172", "tree": "cf8ec6d7b6ec1e3b19b2f0800c9c780056a9429b", "parents": [ "e7f76c836ca734a861b57aed10eb78b30c3a71c7" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Feb 10 15:18:55 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:03 2014 -0700" }, "message": "ocfs2 syncs the wrong range...\n\ncommit 1b56e98990bcdbb20b9fab163654b9315bf158e8 upstream.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e7f76c836ca734a861b57aed10eb78b30c3a71c7", "tree": "d73a346f2b6406bda56ef15d9988213a26f04ef5", "parents": [ "0c4f5371eb6b0566db53eb2437af2bbfc183e566" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Mon Mar 03 15:38:32 2014 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Mar 23 21:37:03 2014 -0700" }, "message": "ocfs2: fix quota file corruption\n\ncommit 15c34a760630ca2c803848fba90ca0646a9907dd upstream.\n\nGlobal quota files are accessed from different nodes. Thus we cannot\ncache offset of quota structure in the quota file after we drop our node\nreference count to it because after that moment quota structure may be\nfreed and reallocated elsewhere by a different node resulting in\ncorruption of quota file.\n\nFix the problem by clearing dq_off when we are releasing dquot structure.\nWe also remove the DB_READ_B handling because it is useless -\nDQ_ACTIVE_B is set iff DQ_READ_B is set.\n\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nCc: Goldwyn Rodrigues \u003crgoldwyn@suse.de\u003e\nCc: Joel Becker \u003cjlbec@evilplan.org\u003e\nReviewed-by: Mark Fasheh \u003cmfasheh@suse.de\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0c4f5371eb6b0566db53eb2437af2bbfc183e566", "tree": "c748c66f20dc5bceabb0015e97b9fd2a66f17699", "parents": [ "176485d0f36455db28edec5ab6581842c8d17203" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:41 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:41 2014 -0700" }, "message": "Linux 3.4.83\n" }, { "commit": "176485d0f36455db28edec5ab6581842c8d17203", "tree": "ed338474cb10469e2ed4d66ead04696ac3b33480", "parents": [ "20d700bc51e717c502e51c3fb857b03ba8f99f34" ], "author": { "name": "Emil Goode", "email": "emilgoode@gmail.com", "time": "Thu Feb 13 19:30:39 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:11 2014 -0700" }, "message": "net: asix: add missing flag to struct driver_info\n\ncommit d43ff4cd798911736fb39025ec8004284b1b0bc2 upstream.\n\nThe struct driver_info ax88178_info is assigned the function\nasix_rx_fixup_common as it\u0027s rx_fixup callback. This means that\nFLAG_MULTI_PACKET must be set as this function is cloning the\ndata and calling usbnet_skb_return. Not setting this flag leads\nto usbnet_skb_return beeing called a second time from within\nthe rx_process function in the usbnet module.\n\nSigned-off-by: Emil Goode \u003cemilgoode@gmail.com\u003e\nReported-by: Bjørn Mork \u003cbjorn@mork.no\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "20d700bc51e717c502e51c3fb857b03ba8f99f34", "tree": "3563726da58a418b6493c8324f513944ebbeedd7", "parents": [ "172ba81925a7f8fbec3c0f4146c28f223829e005" ], "author": { "name": "Lucas Stach", "email": "dev@lynxeye.de", "time": "Thu Feb 27 12:51:38 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:10 2014 -0700" }, "message": "net: asix: handle packets crossing URB boundaries\n\ncommit 8b5b6f5413e97c3e8bafcdd67553d508f4f698cd upstream.\n\nASIX AX88772B started to pack data even more tightly. Packets and the ASIX packet\nheader may now cross URB boundaries. To handle this we have to introduce\nsome state between individual calls to asix_rx_fixup().\n\nSigned-off-by: Lucas Stach \u003cdev@lynxeye.de\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n[ Emil: backported to 3.4: dropped changes to drivers/net/usb/ax88172a.c ]\nSigned-off-by: Emil Goode \u003cemilgoode@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "172ba81925a7f8fbec3c0f4146c28f223829e005", "tree": "878175b3c0bb16e7ba603dd6e9039d9d31cff319", "parents": [ "e87845b7d048925658199c863fe22b03e01e0438" ], "author": { "name": "Mark Cave-Ayland", "email": "mark.cave-ayland@ilande.co.uk", "time": "Thu Feb 27 09:53:03 2014 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:10 2014 -0700" }, "message": "rtlwifi: Fix endian error in extracting packet type\n\ncommit 0c5d63f0ab6728f05ddefa25aff55e31297f95e6 upstream.\n\nAll of the rtlwifi drivers have an error in the routine that tests if\nthe data is \"special\". If it is, the subsequant transmission will be\nat the lowest rate to enhance reliability. The 16-bit quantity is\nbig-endian, but was being extracted in native CPU mode. One of the\neffects of this bug is to inhibit association under some conditions\nas the TX rate is too high.\n\nBased on suggestions by Joe Perches, the entire routine is rewritten.\n\nOne of the local headers contained duplicates of some of the ETH_P_XXX\ndefinitions. These are deleted.\n\nSigned-off-by: Larry Finger \u003cLarry.Finger@lwfinger.net\u003e\nCc: Mark Cave-Ayland \u003cmark.cave-ayland@ilande.co.uk\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n[wujg: Backported to 3.4:\n - adjust context\n - remove rtlpriv-\u003eenter_ps \u003d false\n - use schedule_work(\u0026rtlpriv-\u003eworks.lps_leave_work)]\nSigned-off-by: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "e87845b7d048925658199c863fe22b03e01e0438", "tree": "0ff11e47e31dc240e65ab8986ffc03d6e2cb5caa", "parents": [ "60e691100e48fea19bf35b28aa886ec12c892bab" ], "author": { "name": "Emmanuel Grumbach", "email": "emmanuel.grumbach@intel.com", "time": "Thu Feb 27 09:53:02 2014 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:10 2014 -0700" }, "message": "iwlwifi: pcie: add SKUs for 6000, 6005 and 6235 series\n\ncommit 08a5dd3842f2ac61c6d69661d2d96022df8ae359 upstream.\n\nAdd some new PCI IDs to the table for 6000, 6005 and 6235 series.\n\nSigned-off-by: Emmanuel Grumbach \u003cemmanuel.grumbach@intel.com\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n[bwh: Backported to 3.2:\n - Adjust filenames\n - Drop const from struct iwl_cfg]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\n[wujg: Backported to 3.4:\n - Adjust context\n - Do not drop const from struct iwl_cfg]\nSigned-off-by: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "60e691100e48fea19bf35b28aa886ec12c892bab", "tree": "9d469f75f29181e4e9f426937d730ffcff88ed17", "parents": [ "b38b29d58fe03950b2ccd5eaa9af2acb3c1f084d" ], "author": { "name": "Stanislaw Gruszka", "email": "sgruszka@redhat.com", "time": "Thu Feb 27 09:53:01 2014 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:10 2014 -0700" }, "message": "iwlwifi: dvm: fix calling ieee80211_chswitch_done() with NULL\n\ncommit 9186a1fd9ed190739423db84bc344d258ef3e3d7 upstream.\n\nIf channel switch is pending and we remove interface we can\ncrash like showed below due to passing NULL vif to mac80211:\n\nBUG: unable to handle kernel paging request at fffffffffffff8cc\nIP: [\u003cffffffff8130924d\u003e] strnlen+0xd/0x40\nCall Trace:\n [\u003cffffffff8130ad2e\u003e] string.isra.3+0x3e/0xd0\n [\u003cffffffff8130bf99\u003e] vsnprintf+0x219/0x640\n [\u003cffffffff8130c481\u003e] vscnprintf+0x11/0x30\n [\u003cffffffff81061585\u003e] vprintk_emit+0x115/0x4f0\n [\u003cffffffff81657bd5\u003e] printk+0x61/0x63\n [\u003cffffffffa048987f\u003e] ieee80211_chswitch_done+0xaf/0xd0 [mac80211]\n [\u003cffffffffa04e7b34\u003e] iwl_chswitch_done+0x34/0x40 [iwldvm]\n [\u003cffffffffa04f83c3\u003e] iwlagn_commit_rxon+0x2a3/0xdc0 [iwldvm]\n [\u003cffffffffa04ebc50\u003e] ? iwlagn_set_rxon_chain+0x180/0x2c0 [iwldvm]\n [\u003cffffffffa04e5e76\u003e] iwl_set_mode+0x36/0x40 [iwldvm]\n [\u003cffffffffa04e5f0d\u003e] iwlagn_mac_remove_interface+0x8d/0x1b0 [iwldvm]\n [\u003cffffffffa0459b3d\u003e] ieee80211_do_stop+0x29d/0x7f0 [mac80211]\n\nThis is because we nulify ctx-\u003evif in iwlagn_mac_remove_interface()\nbefore calling some other functions that teardown interface. To fix\njust check ctx-\u003evif on iwl_chswitch_done(). We should not call\nieee80211_chswitch_done() as channel switch works were already canceled\nby mac80211 in ieee80211_do_stop() -\u003e ieee80211_mgd_stop().\n\nResolve:\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d979581\n\nReported-by: Lukasz Jagiello \u003cjagiello.lukasz@gmail.com\u003e\nSigned-off-by: Stanislaw Gruszka \u003csgruszka@redhat.com\u003e\nReviewed-by: Emmanuel Grumbach \u003cemmanuel.grumbach@intel.com\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n[bwh: Backported to 3.2: adjust context, filename]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\n[wujg: Backported to 3.4: - adjust context]\nSigned-off-by: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b38b29d58fe03950b2ccd5eaa9af2acb3c1f084d", "tree": "6b3382c42140b62454905e3845fe5f3b10cf99ba", "parents": [ "a41adefcefde57643b4fdf4696385e829fd265e3" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Feb 27 09:53:00 2014 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:10 2014 -0700" }, "message": "iwlwifi: dvm: don\u0027t send BT_CONFIG on devices w/o Bluetooth\n\ncommit 707aee401d2467baa785a697f40a6e2d9ee79ad5 upstream.\n\nThe BT_CONFIG command that is sent to the device during\nstartup will enable BT coex unless the module parameter\nturns it off, but on devices without Bluetooth this may\ncause problems, as reported in Redhat BZ 885407.\n\nFix this by sending the BT_CONFIG command only when the\ndevice has Bluetooth.\n\nReviewed-by: Emmanuel Grumbach \u003cemmanuel.grumbach@intel.com\u003e\nSigned-off-by: Johannes Berg \u003cjohannes@sipsolutions.net\u003e\n[bwh: Backported to 3.2:\n - Adjust filename\n - s/priv-\u003elib/priv-\u003ecfg/]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\n[wujg: Backported to 3.4:\n - s/priv-\u003ecfg/priv-\u003eshrd-\u003ecfg/]\nSigned-off-by: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "a41adefcefde57643b4fdf4696385e829fd265e3", "tree": "fee55eff99614b24dcdabc447e1d26b07f4ff49e", "parents": [ "f2da4cebeffec9908b92ecb131b1108c3ef43769" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Feb 27 09:52:59 2014 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:10 2014 -0700" }, "message": "iwlwifi: always copy first 16 bytes of commands\n\ncommit 8a964f44e01ad3bbc208c3e80d931ba91b9ea786 upstream.\n\nThe FH hardware will always write back to the scratch field\nin commands, even host commands not just TX commands, which\ncan overwrite parts of the command. This is problematic if\nthe command is re-used (with IWL_HCMD_DFL_NOCOPY) and can\ncause calibration issues.\n\nAddress this problem by always putting at least the first\n16 bytes into the buffer we also use for the command header\nand therefore make the DMA engine write back into this.\n\nFor commands that are smaller than 16 bytes also always map\nenough memory for the DMA engine to write back to.\n\nReviewed-by: Emmanuel Grumbach \u003cemmanuel.grumbach@intel.com\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n[bwh: Backported to 3.2:\n - Adjust context\n - Drop the IWL_HCMD_DFL_DUP handling\n - Fix descriptor addresses and lengths for tracepoint, but otherwise\n leave it unchanged]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\n[wujg: Backported to 3.4: adjust context]\nSigned-off-by: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f2da4cebeffec9908b92ecb131b1108c3ef43769", "tree": "75073b94bbb42f1ebb931030d88ff0fd49c44fc8", "parents": [ "af720fc6ae76ea10216ede42b48ee0550d65e36f" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Feb 27 09:52:58 2014 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:10 2014 -0700" }, "message": "iwlwifi: handle DMA mapping failures\n\ncommit 7c34158231b2eda8dcbd297be2bb1559e69cb433 upstream.\n\nThe RX replenish code doesn\u0027t handle DMA mapping failures,\nwhich will cause issues if there actually is a failure. This\nwas reported by Shuah Khan who found a DMA mapping framework\nwarning (\"device driver failed to check map error\").\n\nReported-by: Shuah Khan \u003cshuah.khan@hp.com\u003e\nReviewed-by: Emmanuel Grumbach \u003cemmanuel.grumbach@intel.com\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n[bwh: Backported to 3.2:\n - Adjust filename, context, indentation\n - Use bus(trans) instead of trans where necessary\n - Use hw_params(trans).rx_page_order instead of trans_pcie-\u003erx_page_order]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\n[wujg: Backported to 3.4:\n - Adjust context\n - Use trans instead of bus(trans)\n - Use hw_params(trans).rx_page_order instead of trans_pcie-\u003erx_page_order]\nSigned-off-by: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "af720fc6ae76ea10216ede42b48ee0550d65e36f", "tree": "0f02e938c7e15053bf5ca4d25a00a781db1dc0da", "parents": [ "8234281aea5f98e5216a01d4955ce44025e95212" ], "author": { "name": "Emmanuel Grumbach", "email": "emmanuel.grumbach@intel.com", "time": "Thu Feb 27 09:52:57 2014 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:09 2014 -0700" }, "message": "iwlwifi: don\u0027t handle masked interrupt\n\ncommit 25a172655f837bdb032e451f95441bb4acec51bb upstream.\n\nThis can lead to a panic if the driver isn\u0027t ready to\nhandle them. Since our interrupt line is shared, we can get\nan interrupt at any time (and CONFIG_DEBUG_SHIRQ checks\nthat even when the interrupt is being freed).\n\nIf the op_mode has gone away, we musn\u0027t call it. To avoid\nthis the transport disables the interrupts when the hw is\nstopped and the op_mode is leaving.\nIf there is an event that would cause an interrupt the INTA\nregister is updated regardless of the enablement of the\ninterrupts: even if the interrupts are disabled, the INTA\nwill be changed, but the device won\u0027t issue an interrupt.\nBut the ISR can be called at any time, so we ought ignore\nthe value in the INTA otherwise we can call the op_mode\nafter it was freed.\n\nI found this bug when the op_mode_start failed, and called\niwl_trans_stop_hw(trans, true). Then I played with the\nRFKILL button, and removed the module.\nWhile removing the module, the IRQ is freed, and the ISR is\ncalled (CONFIG_DEBUG_SHIRQ enabled). Panic.\n\nSigned-off-by: Emmanuel Grumbach \u003cemmanuel.grumbach@intel.com\u003e\nReviewed-by: Gregory Greenman \u003cgregory.greenman@intel.com\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n[bwh: Backported to 3.2:\n - Adjust context\n - Pass bus(trans), not trans, to iwl_{read,write}32()]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\n[wujg: Backported to 3.4:\n - adjust context\n - Pass trans to iwl_{read,write}32()}]\nSigned-off-by: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "8234281aea5f98e5216a01d4955ce44025e95212", "tree": "59c272acf46abd242dae6a40a9827072532a0d12", "parents": [ "3ece09975ce21d9aa9a64d34d7f1f6ea179e8b4d" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Feb 27 09:52:56 2014 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:09 2014 -0700" }, "message": "iwlwifi: protect SRAM debugfs\n\ncommit 4fc79db178f0a0ede479b4713e00df2d106028b3 upstream.\n\nIf the device is not started, we can\u0027t read its\nSRAM and attempting to do so will cause issues.\nProtect the debugfs read.\n\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n[wujg: Backported to 3.4: adjust context]\nSigned-off-by: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "3ece09975ce21d9aa9a64d34d7f1f6ea179e8b4d", "tree": "48014c8c1aa6e945dcab44339e83ba5a43d0fade", "parents": [ "537762453afa3d6e03751d116b4cc21971262f8a" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Feb 27 09:52:55 2014 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:09 2014 -0700" }, "message": "iwlwifi: fix flow handler debug code\n\ncommit 94543a8d4fb302817014981489f15cb3b92ec3c2 upstream.\n\niwl_dbgfs_fh_reg_read() can cause crashes and/or\nBUG_ON in slub because the ifdefs are wrong, the\ncode in iwl_dump_fh() should use DEBUGFS, not\nDEBUG to protect the buffer writing code.\n\nAlso, while at it, clean up the arguments to the\nfunction, some code and make it generally safer.\n\nReported-by: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n[bwh: Backported to 3.2: adjust filenames and context]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\n[wujg: Backported to 3.4: adjust context]\nSigned-off-by: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "537762453afa3d6e03751d116b4cc21971262f8a", "tree": "19727998308a2f33fe4e46b3e72ef599136bb52b", "parents": [ "565ca886fed885e444f33ee66d8ae19f0ef4bbe3" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Jul 11 17:55:57 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:09 2014 -0700" }, "message": "ALSA: asihpi: Fix unlocked snd_pcm_stop() call\n\ncommit 60478295d6876619f8f47f6d1a5c25eaade69ee3 upstream.\n\nsnd_pcm_stop() must be called in the PCM substream lock context.\n\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nCc: Weng Meiling \u003cwengmeiling.weng@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "565ca886fed885e444f33ee66d8ae19f0ef4bbe3", "tree": "da94f1d3b04f1d443bbadfb81babb23a07aefe47", "parents": [ "eeb57ebb4820dad25f283ed0e875c6a0a498ba54" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Jul 11 18:02:38 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:09 2014 -0700" }, "message": "staging: line6: Fix unlocked snd_pcm_stop() call\n\ncommit 86f0b5b86d142b9323432fef078a6cf0fb5dda74 upstream.\n\nsnd_pcm_stop() must be called in the PCM substream lock context.\n\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Weng Meiling \u003cwengmeiling.weng@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "eeb57ebb4820dad25f283ed0e875c6a0a498ba54", "tree": "8c62e9a56d6e8e8107b5c7d795ff9141ca83eb1c", "parents": [ "a0f8b1ca745aa237d690740f662a4e71d000941a" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Jul 11 18:00:25 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:09 2014 -0700" }, "message": "ASoC: s6000: Fix unlocked snd_pcm_stop() call\n\ncommit 61be2b9a18ec70f3cbe3deef7a5f77869c71b5ae upstream.\n\nsnd_pcm_stop() must be called in the PCM substream lock context.\n\nAcked-by: Mark Brown \u003cbroonie@linaro.org\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Weng Meiling \u003cwengmeiling.weng@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a0f8b1ca745aa237d690740f662a4e71d000941a", "tree": "e74c4264748d0dac4cc2526d1bdc4153c4a57b2d", "parents": [ "475274c68b42752d252021714895b56ee43e52f4" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Jul 11 17:59:33 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:09 2014 -0700" }, "message": "ALSA: pxa2xx: Fix unlocked snd_pcm_stop() call\n\ncommit 46f6c1aaf790be9ea3c8ddfc8f235a5f677d08e2 upstream.\n\nsnd_pcm_stop() must be called in the PCM substream lock context.\n\nAcked-by: Mark Brown \u003cbroonie@linaro.org\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Weng Meiling \u003cwengmeiling.weng@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "475274c68b42752d252021714895b56ee43e52f4", "tree": "733004e0dd2620af6cdfe1eb9dcc2e1b04b18d7f", "parents": [ "0843fce1e56c02d0f6667b88a12e2846dac3352b" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Jul 11 17:58:47 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:08 2014 -0700" }, "message": "ALSA: usx2y: Fix unlocked snd_pcm_stop() call\n\ncommit 5be1efb4c2ed79c3d7c0cbcbecae768377666e84 upstream.\n\nsnd_pcm_stop() must be called in the PCM substream lock context.\n\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Weng Meiling \u003cwengmeiling.weng@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0843fce1e56c02d0f6667b88a12e2846dac3352b", "tree": "56520d09e44f6a781cdb43e78cd01734e91d0506", "parents": [ "2f6101666e02d58039bdedc4deb320ed02e2b558" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Jul 11 17:58:25 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:08 2014 -0700" }, "message": "ALSA: ua101: Fix unlocked snd_pcm_stop() call\n\ncommit 9538aa46c2427d6782aa10036c4da4c541605e0e upstream.\n\nsnd_pcm_stop() must be called in the PCM substream lock context.\n\nAcked-by: Clemens Ladisch \u003cclemens@ladisch.de\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Weng Meiling \u003cwengmeiling.weng@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2f6101666e02d58039bdedc4deb320ed02e2b558", "tree": "7b692561ca73e64e38c66efffb86464c3fcf7dbf", "parents": [ "593827efb8bfab1365124296a1059036fd7d6c9a" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Jul 11 17:57:55 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:08 2014 -0700" }, "message": "ALSA: 6fire: Fix unlocked snd_pcm_stop() call\n\ncommit 5b9ab3f7324a1b94a5a5a76d44cf92dfeb3b5e80 upstream.\n\nsnd_pcm_stop() must be called in the PCM substream lock context.\n\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Weng Meiling \u003cwengmeiling.weng@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "593827efb8bfab1365124296a1059036fd7d6c9a", "tree": "6cf2482355a00bb9b67388a6c4909ea60024efa0", "parents": [ "9e6114746b57adc3c6983b6cf96030372ed5d756" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Jul 11 17:56:56 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:08 2014 -0700" }, "message": "ALSA: atiixp: Fix unlocked snd_pcm_stop() call\n\ncommit cc7282b8d5abbd48c81d1465925d464d9e3eaa8f upstream.\n\nsnd_pcm_stop() must be called in the PCM substream lock context.\n\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Weng Meiling \u003cwengmeiling.weng@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9e6114746b57adc3c6983b6cf96030372ed5d756", "tree": "688d2862a0b2962da77a10e05d89ec4a72851456", "parents": [ "d17395ac947090c3258799207df8e574fd0ca7fd" ], "author": { "name": "Fabio Estevam", "email": "fabio.estevam@freescale.com", "time": "Thu Jul 04 20:01:02 2013 -0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:08 2014 -0700" }, "message": "ASoC: sglt5000: Fix the default value of CHIP_SSS_CTRL\n\ncommit 016fcab8ff46fca29375d484226ec91932aa4a07 upstream.\n\nAccording to the sgtl5000 reference manual, the default value of CHIP_SSS_CTRL\nis 0x10.\n\nReported-by: Oskar Schirmer \u003coskar@scara.com\u003e\nSigned-off-by: Fabio Estevam \u003cfabio.estevam@freescale.com\u003e\nSigned-off-by: Mark Brown \u003cbroonie@linaro.org\u003e\n[bwh: Backported to 3.2: format of register defaults array is different]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Weng Meiling \u003cwengmeiling.weng@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d17395ac947090c3258799207df8e574fd0ca7fd", "tree": "6cb3b90f1da2c7c91376da05a9413f53aa15ee19", "parents": [ "d4d811d55f75e02ae7beaea3dc611498bf2bf5fb" ], "author": { "name": "Sascha Hauer", "email": "s.hauer@pengutronix.de", "time": "Sun Mar 10 19:33:03 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:08 2014 -0700" }, "message": "ASoC: imx-ssi: Fix occasional AC97 reset failure\n\ncommit b6e51600f4e983e757b1b6942becaa1ae7d82e67 upstream.\n\nSigned-off-by: Sascha Hauer \u003cs.hauer@pengutronix.de\u003e\nSigned-off-by: Markus Pargmann \u003cmpa@pengutronix.de\u003e\nSigned-off-by: Mark Brown \u003cbroonie@opensource.wolfsonmicro.com\u003e\n[bwh: Backported to 3.2: adjust filename]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Weng Meiling \u003cwengmeiling.weng@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d4d811d55f75e02ae7beaea3dc611498bf2bf5fb", "tree": "e4c33ce76c4b650716915c57546a17591709c521", "parents": [ "e8d5ce17375e2ece50659f287ad1a3daf2335d7e" ], "author": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Wed May 22 12:57:24 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:08 2014 -0700" }, "message": "SUNRPC: Prevent an rpc_task wakeup race\n\ncommit a3c3cac5d31879cd9ae2de7874dc6544ca704aec upstream.\n\nThe lockless RPC_IS_QUEUED() test in __rpc_execute means that we need to\nbe careful about ordering the calls to rpc_test_and_set_running(task) and\nrpc_clear_queued(task). If we get the order wrong, then we may end up\ntesting the RPC_TASK_RUNNING flag after __rpc_execute() has looped\nand changed the state of the rpc_task.\n\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Weng Meiling \u003cwengmeiling.weng@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e8d5ce17375e2ece50659f287ad1a3daf2335d7e", "tree": "60dd6aa214387202d8c1308c4099d3d494c34516", "parents": [ "b7d2a5e8cfe2dde13c9d05e1d220c2fc66da3164" ], "author": { "name": "Jeff Layton", "email": "jlayton@redhat.com", "time": "Mon Jul 23 15:51:55 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:07 2014 -0700" }, "message": "sunrpc: clarify comments on rpc_make_runnable\n\ncommit 506026c3ec270e18402f0c9d33fee37482c23861 upstream.\n\nrpc_make_runnable is not generally called with the queue lock held, unless\nit\u0027s waking up a task that has been sitting on a waitqueue. This is safe\nwhen the task has not entered the FSM yet, but the comments don\u0027t really\nspell this out.\n\nSigned-off-by: Jeff Layton \u003cjlayton@redhat.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Weng Meiling \u003cwengmeiling.weng@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b7d2a5e8cfe2dde13c9d05e1d220c2fc66da3164", "tree": "1d10f385b8ef412638816763684f2d47c7cdb3ca", "parents": [ "62047439828b2f7c984b7471d00dc11a07a1452b" ], "author": { "name": "David Vrabel", "email": "david.vrabel@citrix.com", "time": "Thu Aug 15 13:21:07 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:07 2014 -0700" }, "message": "xen/events: mask events when changing their VCPU binding\n\ncommit 5e72fdb8d827560893642e85a251d339109a00f4 upstream.\n\ncommit 4704fe4f03a5ab27e3c36184af85d5000e0f8a48 upstream.\n\nWhen a event is being bound to a VCPU there is a window between the\nEVTCHNOP_bind_vpcu call and the adjustment of the local per-cpu masks\nwhere an event may be lost. The hypervisor upcalls the new VCPU but\nthe kernel thinks that event is still bound to the old VCPU and\nignores it.\n\nThere is even a problem when the event is being bound to the same VCPU\nas there is a small window beween the clear_bit() and set_bit() calls\nin bind_evtchn_to_cpu(). When scanning for pending events, the kernel\nmay read the bit when it is momentarily clear and ignore the event.\n\nAvoid this by masking the event during the whole bind operation.\n\nSigned-off-by: David Vrabel \u003cdavid.vrabel@citrix.com\u003e\nSigned-off-by: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\nReviewed-by: Jan Beulich \u003cjbeulich@suse.com\u003e\n[bwh: Backported to 3.2: remove the BM() cast]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Yijing Wang \u003cwangyijing@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "62047439828b2f7c984b7471d00dc11a07a1452b", "tree": "8d7b6bdb0ad435bc0f2a534a86359784981dd904", "parents": [ "23ced59b3765bc593712fda19af40658829db197" ], "author": { "name": "Konrad Rzeszutek Wilk", "email": "konrad.wilk@oracle.com", "time": "Wed Jan 23 16:54:32 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:07 2014 -0700" }, "message": "xen/blkback: Check for insane amounts of request on the ring (v6).\n\ncommit 9371cadbbcc7c00c81753b9727b19fb3bc74d458 upstream.\n\ncommit 8e3f8755545cc4a7f4da8e9ef76d6d32e0dca576 upstream.\n\nCheck that the ring does not have an insane amount of requests\n(more than there could fit on the ring).\n\nIf we detect this case we will stop processing the requests\nand wait until the XenBus disconnects the ring.\n\nThe existing check RING_REQUEST_CONS_OVERFLOW which checks for how\nmany responses we have created in the past (rsp_prod_pvt) vs\nrequests consumed (req_cons) and whether said difference is greater or\nequal to the size of the ring, does not catch this case.\n\nWha the condition does check if there is a need to process more\nas we still have a backlog of responses to finish. Note that both\nof those values (rsp_prod_pvt and req_cons) are not exposed on the\nshared ring.\n\nTo understand this problem a mini crash course in ring protocol\nresponse/request updates is in place.\n\nThere are four entries: req_prod and rsp_prod; req_event and rsp_event\nto track the ring entries. We are only concerned about the first two -\nwhich set the tone of this bug.\n\nThe req_prod is a value incremented by frontend for each request put\non the ring. Conversely the rsp_prod is a value incremented by the backend\nfor each response put on the ring (rsp_prod gets set by rsp_prod_pvt when\npushing the responses on the ring). Both values can\nwrap and are modulo the size of the ring (in block case that is 32).\nPlease see RING_GET_REQUEST and RING_GET_RESPONSE for the more details.\n\nThe culprit here is that if the difference between the\nreq_prod and req_cons is greater than the ring size we have a problem.\nFortunately for us, the \u0027__do_block_io_op\u0027 loop:\n\n\trc \u003d blk_rings-\u003ecommon.req_cons;\n\trp \u003d blk_rings-\u003ecommon.sring-\u003ereq_prod;\n\n\twhile (rc !\u003d rp) {\n\n\t\t..\n\t\tblk_rings-\u003ecommon.req_cons \u003d ++rc; /* before make_response() */\n\n\t}\n\nwill loop up to the point when rc \u003d\u003d rp. The macros inside of the\nloop (RING_GET_REQUEST) is smart and is indexing based on the modulo\nof the ring size. If the frontend has provided a bogus req_prod value\nwe will loop until the \u0027rc \u003d\u003d rp\u0027 - which means we could be processing\nalready processed requests (or responses) often.\n\nThe reason the RING_REQUEST_CONS_OVERFLOW is not helping here is\nb/c it only tracks how many responses we have internally produced\nand whether we would should process more. The astute reader will\nnotice that the macro RING_REQUEST_CONS_OVERFLOW provides two\narguments - more on this later.\n\nFor example, if we were to enter this function with these values:\n\n \tblk_rings-\u003ecommon.sring-\u003ereq_prod \u003d X+31415 (X is the value from\n\t\tthe last time __do_block_io_op was called).\n blk_rings-\u003ecommon.req_cons \u003d X\n blk_rings-\u003ecommon.rsp_prod_pvt \u003d X\n\nThe RING_REQUEST_CONS_OVERFLOW(\u0026blk_rings-\u003ecommon, blk_rings-\u003ecommon.req_cons)\nis doing:\n\n\treq_cons - rsp_prod_pvt \u003e\u003d 32\n\nWhich is,\n\tX - X \u003e\u003d 32 or 0 \u003e\u003d 32\n\nAnd that is false, so we continue on looping (this bug).\n\nIf we re-use said macro RING_REQUEST_CONS_OVERFLOW and pass in the rp\ninstead (sring-\u003ereq_prod) of rc, the this macro can do the check:\n\n req_prod - rsp_prov_pvt \u003e\u003d 32\n\nWhich is,\n X + 31415 - X \u003e\u003d 32 , or 31415 \u003e\u003d 32\n\nwhich is true, so we can error out and break out of the function.\n\nUnfortunatly the difference between rsp_prov_pvt and req_prod can be\nat 32 (which would error out in the macro). This condition exists when\nthe backend is lagging behind with the responses and still has not finished\nresponding to all of them (so make_response has not been called), and\nthe rsp_prov_pvt + 32 \u003d\u003d req_cons. This ends up with us not being able\nto use said macro.\n\nHence introducing a new macro called RING_REQUEST_PROD_OVERFLOW which does\na simple check of:\n\n req_prod - rsp_prod_pvt \u003e RING_SIZE\n\nAnd with the X values from above:\n\n X + 31415 - X \u003e 32\n\nReturns true. Also not that if the ring is full (which is where\nthe RING_REQUEST_CONS_OVERFLOW triggered), we would not hit the\nsame condition:\n\n X + 32 - X \u003e 32\n\nWhich is false.\n\nLets use that macro.\nNote that in v5 of this patchset the macro was different - we used an\nearlier version.\n\n[v1: Move the check outside the loop]\n[v2: Add a pr_warn as suggested by David]\n[v3: Use RING_REQUEST_CONS_OVERFLOW as suggested by Jan]\n[v4: Move wake_up after kthread_stop as suggested by Jan]\n[v5: Use RING_REQUEST_PROD_OVERFLOW instead]\n[v6: Use RING_REQUEST_PROD_OVERFLOW - Jan\u0027s version]\nSigned-off-by: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\nReviewed-by: Jan Beulich \u003cjbeulich@suse.com\u003e\n[bwh: Backported to 3.2: adjust context]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Yijing Wang \u003cwangyijing@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "23ced59b3765bc593712fda19af40658829db197", "tree": "09bb93903f0e9905bfc0177c5145aaec30fe084a", "parents": [ "f1369580791ff1eb18a210a58405131e2c3611d2" ], "author": { "name": "Jan Beulich", "email": "jbeulich@suse.com", "time": "Mon Jun 17 15:16:33 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:07 2014 -0700" }, "message": "xen/io/ring.h: new macro to detect whether there are too many requests on the ring\n\ncommit 8d9256906a97c24e97e016482b9be06ea2532b05 upstream.\n\nBackends may need to protect themselves against an insane number of\nproduced requests stored by a frontend, in case they iterate over\nrequests until reaching the req_prod value. There can\u0027t be more\nrequests on the ring than the difference between produced requests\nand produced (but possibly not yet published) responses.\n\nThis is a more strict alternative to a patch previously posted by\nKonrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e.\n\nSigned-off-by: Jan Beulich \u003cjbeulich@suse.com\u003e\nSigned-off-by: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Yijing Wang \u003cwangyijing@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f1369580791ff1eb18a210a58405131e2c3611d2", "tree": "368990d11b61f422234c56c4cd5dd3fe5062698e", "parents": [ "9832f4a0fd7b5f412b2f41ede5b431bd2102b8dd" ], "author": { "name": "Wei Liu", "email": "wei.liu2@citrix.com", "time": "Mon Apr 22 02:20:43 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:07 2014 -0700" }, "message": "xen-netback: don\u0027t disconnect frontend when seeing oversize packet\n\ncommit 03393fd5cc2b6cdeec32b704ecba64dbb0feae3c upstream.\n\nSome frontend drivers are sending packets \u003e 64 KiB in length. This length\noverflows the length field in the first slot making the following slots have\nan invalid length.\n\nTurn this error back into a non-fatal error by dropping the packet. To avoid\nhaving the following slots having fatal errors, consume all slots in the\npacket.\n\nThis does not reopen the security hole in XSA-39 as if the packet as an\ninvalid number of slots it will still hit fatal error case.\n\nSigned-off-by: David Vrabel \u003cdavid.vrabel@citrix.com\u003e\nSigned-off-by: Wei Liu \u003cwei.liu2@citrix.com\u003e\nAcked-by: Ian Campbell \u003cian.campbell@citrix.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Yijing Wang \u003cwangyijing@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9832f4a0fd7b5f412b2f41ede5b431bd2102b8dd", "tree": "1add7418c1d1d288b4cc65b728d2cd11d39239c4", "parents": [ "047140a3c2a68b7f1ce24dad37ba2463031aef6a" ], "author": { "name": "Wei Liu", "email": "wei.liu2@citrix.com", "time": "Mon Apr 22 02:20:42 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:07 2014 -0700" }, "message": "xen-netback: coalesce slots in TX path and fix regressions\n\ncommit 2810e5b9a7731ca5fce22bfbe12c96e16ac44b6f upstream.\n\nThis patch tries to coalesce tx requests when constructing grant copy\nstructures. It enables netback to deal with situation when frontend\u0027s\nMAX_SKB_FRAGS is larger than backend\u0027s MAX_SKB_FRAGS.\n\nWith the help of coalescing, this patch tries to address two regressions\navoid reopening the security hole in XSA-39.\n\nRegression 1. The reduction of the number of supported ring entries (slots)\nper packet (from 18 to 17). This regression has been around for some time but\nremains unnoticed until XSA-39 security fix. This is fixed by coalescing\nslots.\n\nRegression 2. The XSA-39 security fix turning \"too many frags\" errors from\njust dropping the packet to a fatal error and disabling the VIF. This is fixed\nby coalescing slots (handling 18 slots when backend\u0027s MAX_SKB_FRAGS is 17)\nwhich rules out false positive (using 18 slots is legit) and dropping packets\nusing 19 to `max_skb_slots` slots.\n\nTo avoid reopening security hole in XSA-39, frontend sending packet using more\nthan max_skb_slots is considered malicious.\n\nThe behavior of netback for packet is thus:\n\n 1-18 slots: valid\n 19-max_skb_slots slots: drop and respond with an error\n max_skb_slots+ slots: fatal error\n\nmax_skb_slots is configurable by admin, default value is 20.\n\nAlso change variable name from \"frags\" to \"slots\" in netbk_count_requests.\n\nPlease note that RX path still has dependency on MAX_SKB_FRAGS. This will be\nfixed with separate patch.\n\nSigned-off-by: Wei Liu \u003cwei.liu2@citrix.com\u003e\nAcked-by: Ian Campbell \u003cian.campbell@citrix.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Yijing Wang \u003cwangyijing@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "047140a3c2a68b7f1ce24dad37ba2463031aef6a", "tree": "414ad4dfc91c97ccd7a15e46cba3ed2ca943517c", "parents": [ "63f12e8d2bea38715b30a6051325230f6ec25a3b" ], "author": { "name": "stephen hemminger", "email": "stephen@networkplumber.org", "time": "Wed Apr 10 10:54:46 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:07 2014 -0700" }, "message": "xen-netback: fix sparse warning\n\ncommit 9eaee8beeeb3bca0d9b14324fd9d467d48db784c upstream.\n\nFix warning about 0 used as NULL.\n\nSigned-off-by: Stephen Hemminger \u003cstephen@networkplumber.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Yijing Wang \u003cwangyijing@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "63f12e8d2bea38715b30a6051325230f6ec25a3b", "tree": "b303bc6a31125f613610f1015abf23b59f22e5d5", "parents": [ "32ed904ec15d37d35afae9ce784951ec955d20a5" ], "author": { "name": "Konrad Rzeszutek Wilk", "email": "konrad.wilk@oracle.com", "time": "Tue Apr 16 14:08:50 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:06 2014 -0700" }, "message": "xen/smp/spinlock: Fix leakage of the spinlock interrupt line for every CPU online/offline\n\ncommit 66ff0fe9e7bda8aec99985b24daad03652f7304e upstream.\n\nWhile we don\u0027t use the spinlock interrupt line (see for details\ncommit f10cd522c5fbfec9ae3cc01967868c9c2401ed23 -\nxen: disable PV spinlocks on HVM) - we should still do the proper\ninit / deinit sequence. We did not do that correctly and for the\nCPU init for PVHVM guest we would allocate an interrupt line - but\nfailed to deallocate the old interrupt line.\n\nThis resulted in leakage of an irq_desc but more importantly this splat\nas we online an offlined CPU:\n\ngenirq: Flags mismatch irq 71. 0002cc20 (spinlock1) vs. 0002cc20 (spinlock1)\nPid: 2542, comm: init.late Not tainted 3.9.0-rc6upstream #1\nCall Trace:\n [\u003cffffffff811156de\u003e] __setup_irq+0x23e/0x4a0\n [\u003cffffffff81194191\u003e] ? kmem_cache_alloc_trace+0x221/0x250\n [\u003cffffffff811161bb\u003e] request_threaded_irq+0xfb/0x160\n [\u003cffffffff8104c6f0\u003e] ? xen_spin_trylock+0x20/0x20\n [\u003cffffffff813a8423\u003e] bind_ipi_to_irqhandler+0xa3/0x160\n [\u003cffffffff81303758\u003e] ? kasprintf+0x38/0x40\n [\u003cffffffff8104c6f0\u003e] ? xen_spin_trylock+0x20/0x20\n [\u003cffffffff810cad35\u003e] ? update_max_interval+0x15/0x40\n [\u003cffffffff816605db\u003e] xen_init_lock_cpu+0x3c/0x78\n [\u003cffffffff81660029\u003e] xen_hvm_cpu_notify+0x29/0x33\n [\u003cffffffff81676bdd\u003e] notifier_call_chain+0x4d/0x70\n [\u003cffffffff810bb2a9\u003e] __raw_notifier_call_chain+0x9/0x10\n [\u003cffffffff8109402b\u003e] __cpu_notify+0x1b/0x30\n [\u003cffffffff8166834a\u003e] _cpu_up+0xa0/0x14b\n [\u003cffffffff816684ce\u003e] cpu_up+0xd9/0xec\n [\u003cffffffff8165f754\u003e] store_online+0x94/0xd0\n [\u003cffffffff8141d15b\u003e] dev_attr_store+0x1b/0x20\n [\u003cffffffff81218f44\u003e] sysfs_write_file+0xf4/0x170\n [\u003cffffffff811a2864\u003e] vfs_write+0xb4/0x130\n [\u003cffffffff811a302a\u003e] sys_write+0x5a/0xa0\n [\u003cffffffff8167ada9\u003e] system_call_fastpath+0x16/0x1b\ncpu 1 spinlock event irq -16\nsmpboot: Booting Node 0 Processor 1 APIC 0x2\n\nAnd if one looks at the /proc/interrupts right after\nofflining (CPU1):\n\n 70: 0 0 xen-percpu-ipi spinlock0\n 71: 0 0 xen-percpu-ipi spinlock1\n 77: 0 0 xen-percpu-ipi spinlock2\n\nThere is the oddity of the \u0027spinlock1\u0027 still being present.\n\nSigned-off-by: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\n[bwh: Backported to 3.2: adjust context]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Yijing Wang \u003cwangyijing@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "32ed904ec15d37d35afae9ce784951ec955d20a5", "tree": "2c3648e3e6c3d6d57ae85be52af11f324ecaf0f3", "parents": [ "79b6a2d6bd21bf90b38dbad0cf9210235944e8f9" ], "author": { "name": "Konrad Rzeszutek Wilk", "email": "konrad.wilk@oracle.com", "time": "Tue Apr 16 13:49:26 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:06 2014 -0700" }, "message": "xen/smp: Fix leakage of timer interrupt line for every CPU online/offline.\n\ncommit 888b65b4bc5e7fcbbb967023300cd5d44dba1950 upstream.\n\nIn the PVHVM path when we do CPU online/offline path we would\nleak the timer%d IRQ line everytime we do a offline event. The\nonline path (xen_hvm_setup_cpu_clockevents via\nx86_cpuinit.setup_percpu_clockev) would allocate a new interrupt\nline for the timer%d.\n\nBut we would still use the old interrupt line leading to:\n\nkernel BUG at /home/konrad/ssd/konrad/linux/kernel/hrtimer.c:1261!\ninvalid opcode: 0000 [#1] SMP\nRIP: 0010:[\u003cffffffff810b9e21\u003e] [\u003cffffffff810b9e21\u003e] hrtimer_interrupt+0x261/0x270\n.. snip..\n \u003cIRQ\u003e\n [\u003cffffffff810445ef\u003e] xen_timer_interrupt+0x2f/0x1b0\n [\u003cffffffff81104825\u003e] ? stop_machine_cpu_stop+0xb5/0xf0\n [\u003cffffffff8111434c\u003e] handle_irq_event_percpu+0x7c/0x240\n [\u003cffffffff811175b9\u003e] handle_percpu_irq+0x49/0x70\n [\u003cffffffff813a74a3\u003e] __xen_evtchn_do_upcall+0x1c3/0x2f0\n [\u003cffffffff813a760a\u003e] xen_evtchn_do_upcall+0x2a/0x40\n [\u003cffffffff8167c26d\u003e] xen_hvm_callback_vector+0x6d/0x80\n \u003cEOI\u003e\n [\u003cffffffff81666d01\u003e] ? start_secondary+0x193/0x1a8\n [\u003cffffffff81666cfd\u003e] ? start_secondary+0x18f/0x1a8\n\nThere is also the oddity (timer1) in the /proc/interrupts after\nofflining CPU1:\n\n 64: 1121 0 xen-percpu-virq timer0\n 78: 0 0 xen-percpu-virq timer1\n 84: 0 2483 xen-percpu-virq timer2\n\nThis patch fixes it.\n\nSigned-off-by: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\n[bwh: Backported to 3.2: adjust context]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Yijing Wang \u003cwangyijing@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "79b6a2d6bd21bf90b38dbad0cf9210235944e8f9", "tree": "32e5707ab57c2f664810a4ac705228fc6f8463c2", "parents": [ "d54ecc0f3edbf3d50b508e45b7a6b80d73f7ed64" ], "author": { "name": "Konrad Rzeszutek Wilk", "email": "konrad.wilk@oracle.com", "time": "Wed Sep 19 08:30:55 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:06 2014 -0700" }, "message": "xen/boot: Disable BIOS SMP MP table search.\n\ncommit bd49940a35ec7d488ae63bd625639893b3385b97 upstream.\n\nAs the initial domain we are able to search/map certain regions\nof memory to harvest configuration data. For all low-level we\nuse ACPI tables - for interrupts we use exclusively ACPI _PRT\n(so DSDT) and MADT for INT_SRC_OVR.\n\nThe SMP MP table is not used at all. As a matter of fact we do\nnot even support machines that only have SMP MP but no ACPI tables.\n\nLets follow how Moorestown does it and just disable searching\nfor BIOS SMP tables.\n\nThis also fixes an issue on HP Proliant BL680c G5 and DL380 G6:\n\n9f-\u003e100 for 1:1 PTE\nFreeing 9f-100 pfn range: 97 pages freed\n1-1 mapping on 9f-\u003e100\n.. snip..\ne820: BIOS-provided physical RAM map:\nXen: [mem 0x0000000000000000-0x000000000009efff] usable\nXen: [mem 0x000000000009f400-0x00000000000fffff] reserved\nXen: [mem 0x0000000000100000-0x00000000cfd1dfff] usable\n.. snip..\nScan for SMP in [mem 0x00000000-0x000003ff]\nScan for SMP in [mem 0x0009fc00-0x0009ffff]\nScan for SMP in [mem 0x000f0000-0x000fffff]\nfound SMP MP-table at [mem 0x000f4fa0-0x000f4faf] mapped at [ffff8800000f4fa0]\n(XEN) mm.c:908:d0 Error getting mfn 100 (pfn 5555555555555555) from L1 entry 0000000000100461 for l1e_owner\u003d0, pg_owner\u003d0\n(XEN) mm.c:4995:d0 ptwr_emulate: could not get_page_from_l1e()\nBUG: unable to handle kernel NULL pointer dereference at (null)\nIP: [\u003cffffffff81ac07e2\u003e] xen_set_pte_init+0x66/0x71\n. snip..\nPid: 0, comm: swapper Not tainted 3.6.0-rc6upstream-00188-gb6fb969-dirty #2 HP ProLiant BL680c G5\n.. snip..\nCall Trace:\n [\u003cffffffff81ad31c6\u003e] __early_ioremap+0x18a/0x248\n [\u003cffffffff81624731\u003e] ? printk+0x48/0x4a\n [\u003cffffffff81ad32ac\u003e] early_ioremap+0x13/0x15\n [\u003cffffffff81acc140\u003e] get_mpc_size+0x2f/0x67\n [\u003cffffffff81acc284\u003e] smp_scan_config+0x10c/0x136\n [\u003cffffffff81acc2e4\u003e] default_find_smp_config+0x36/0x5a\n [\u003cffffffff81ac3085\u003e] setup_arch+0x5b3/0xb5b\n [\u003cffffffff81624731\u003e] ? printk+0x48/0x4a\n [\u003cffffffff81abca7f\u003e] start_kernel+0x90/0x390\n [\u003cffffffff81abc356\u003e] x86_64_start_reservations+0x131/0x136\n [\u003cffffffff81abfa83\u003e] xen_start_kernel+0x65f/0x661\n(XEN) Domain 0 crashed: \u0027noreboot\u0027 set - not rebooting.\n\nwhich is that ioremap would end up mapping 0xff using _PAGE_IOMAP\n(which is what early_ioremap sticks as a flag) - which meant\nwe would get MFN 0xFF (pte ff461, which is OK), and then it would\nalso map 0x100 (b/c ioremap tries to get page aligned request, and\nit was trying to map 0xf4fa0 + PAGE_SIZE - so it mapped the next page)\nas _PAGE_IOMAP. Since 0x100 is actually a RAM page, and the _PAGE_IOMAP\nbypasses the P2M lookup we would happily set the PTE to 1000461.\nXen would deny the request since we do not have access to the\nMachine Frame Number (MFN) of 0x100. The P2M[0x100] is for example\n0x80140.\n\nFixes-Oracle-Bugzilla: https://bugzilla.oracle.com/bugzilla/show_bug.cgi?id\u003d13665\nAcked-by: Jan Beulich \u003cjbeulich@suse.com\u003e\nSigned-off-by: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\n[bwh: Backported to 3.2: adjust context]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Yijing Wang \u003cwangyijing@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d54ecc0f3edbf3d50b508e45b7a6b80d73f7ed64", "tree": "62b2cb29c6fe912acfbe24514df0e3d7b4bbecd3", "parents": [ "c28414d3497a0db41a9fb08650131ee15989ee9c" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Jul 11 18:00:59 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:06 2014 -0700" }, "message": "saa7134: Fix unlocked snd_pcm_stop() call\n\ncommit e6355ad7b1c6f70e2f48ae159f5658b441ccff95 upstream.\n\nsnd_pcm_stop() must be called in the PCM substream lock context.\n\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n[wml: Backported to 3.4: Adjust filename]\nSigned-off-by: Weng Meiling \u003cwengmeiling.weng@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "c28414d3497a0db41a9fb08650131ee15989ee9c", "tree": "ee7207a07f766bf45670c466ee2640a17d78e289", "parents": [ "0ef4c881e4ade7a45174d9cf45eca6f9e10f5ccc" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Sat Jan 12 16:19:36 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:06 2014 -0700" }, "message": "ext4: return ENOMEM if sb_getblk() fails\n\ncommit 860d21e2c585f7ee8a4ecc06f474fdc33c9474f4 upstream.\n\nThe only reason for sb_getblk() failing is if it can\u0027t allocate the\nbuffer_head. So ENOMEM is more appropriate than EIO. In addition,\nmake sure that the file system is marked as being inconsistent if\nsb_getblk() fails.\n\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\n[xr: Backported to 3.4:\n - Drop change to inline.c\n - Call to ext4_ext_check() from ext4_ext_find_extent() is conditional]\nSigned-off-by: Rui Xiang \u003crui.xiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0ef4c881e4ade7a45174d9cf45eca6f9e10f5ccc", "tree": "36131ba5152ad6b4fb076541076a2d386393e363", "parents": [ "50e97121b728014dfbc34f07d1ac5a507466a2b7" ], "author": { "name": "Roland Dreier", "email": "roland@purestorage.com", "time": "Thu Nov 22 02:00:11 2012 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:06 2014 -0700" }, "message": "block: Don\u0027t access request after it might be freed\n\ncommit 893d290f1d7496db97c9471bc352ad4a11dc8a25 upstream.\n\nAfter we\u0027ve done __elv_add_request() and __blk_run_queue() in\nblk_execute_rq_nowait(), the request might finish and be freed\nimmediately. Therefore checking if the type is REQ_TYPE_PM_RESUME\nisn\u0027t safe afterwards, because if it isn\u0027t, rq might be gone.\nInstead, check beforehand and stash the result in a temporary.\n\nThis fixes crashes in blk_execute_rq_nowait() I get occasionally when\nrunning with lots of memory debugging options enabled -- I think this\nrace is usually harmless because the window for rq to be reallocated\nis so small.\n\nSigned-off-by: Roland Dreier \u003croland@purestorage.com\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n[xr: Backported to 3.4: adjust context]\nSigned-off-by: Rui Xiang \u003crui.xiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "50e97121b728014dfbc34f07d1ac5a507466a2b7", "tree": "09bd01313569381c361418a1fb7715f2c883f7aa", "parents": [ "b0f9634dcc55be0ad7cfbc96c790bad780bd463d" ], "author": { "name": "Paul Clements", "email": "paul.clements@steeleye.com", "time": "Wed Jul 03 15:09:04 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:06 2014 -0700" }, "message": "nbd: correct disconnect behavior\n\ncommit c378f70adbc1bbecd9e6db145019f14b2f688c7c upstream.\n\nCurrently, when a disconnect is requested by the user (via NBD_DISCONNECT\nioctl) the return from NBD_DO_IT is undefined (it is usually one of\nseveral error codes). This means that nbd-client does not know if a\nmanual disconnect was performed or whether a network error occurred.\nBecause of this, nbd-client\u0027s persist mode (which tries to reconnect after\nerror, but not after manual disconnect) does not always work correctly.\n\nThis change fixes this by causing NBD_DO_IT to always return 0 if a user\nrequests a disconnect. This means that nbd-client can correctly either\npersist the connection (if an error occurred) or disconnect (if the user\nrequested it).\n\nSigned-off-by: Paul Clements \u003cpaul.clements@steeleye.com\u003e\nAcked-by: Rob Landley \u003crob@landley.net\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n[xr: Backported to 3.4: adjust context]\nSigned-off-by: Rui Xiang \u003crui.xiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b0f9634dcc55be0ad7cfbc96c790bad780bd463d", "tree": "8428f2543d72fb2f6f1bea97a4397a873b113b0f", "parents": [ "b54e3acc375bf344c2273662c61ce0265969b5fd" ], "author": { "name": "Jeff Layton", "email": "jlayton@redhat.com", "time": "Thu Dec 27 08:05:03 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:05 2014 -0700" }, "message": "cifs: adjust sequence number downward after signing NT_CANCEL request\n\ncommit 31efee60f489c759c341454d755a9fd13de8c03d upstream.\n\nWhen a call goes out, the signing code adjusts the sequence number\nupward by two to account for the request and the response. An NT_CANCEL\nhowever doesn\u0027t get a response of its own, it just hurries the server\nalong to get it to respond to the original request more quickly.\nTherefore, we must adjust the sequence number back down by one after\nsigning a NT_CANCEL request.\n\nReported-by: Tim Perry \u003ctdparmor-sambabugs@yahoo.com\u003e\nSigned-off-by: Jeff Layton \u003cjlayton@redhat.com\u003e\nSigned-off-by: Steve French \u003csmfrench@gmail.com\u003e\n[bwh: Backported to 3.2: adjust filename]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Rui Xiang \u003crui.xiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" } ], "next": "b54e3acc375bf344c2273662c61ce0265969b5fd" }