)]}' { "log": [ { "commit": "09f665049d7ecde55c5fbe4bb419b992288c4608", "tree": "a2dcc09fe7f79b93406573082baa79fa8d797744", "parents": [ "b22831e6611bec1fdf84e71d80f7917199212ee8" ], "author": { "name": "Wang Haitao", "email": "wang.haitao1@zte.com.cn", "time": "Thu Aug 22 19:32:38 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:29 2013 -0800" }, "message": "mtd: map: fixed bug in 64-bit systems\n\ncommit a4d62babf988fe5dfde24437fa135ef147bc7aa0 upstream.\n\nHardware:\n\tCPU: XLP832,the 64-bit OS\n\tNOR Flash:S29GL128S 128M\nSoftware:\n\tKernel:2.6.32.41\n\tFilesystem:JFFS2\nWhen writing files, errors appear:\n\tWrite len 182 but return retlen 180\n\tWrite of 182 bytes at 0x072c815c failed. returned -5, retlen 180\n\tWrite len 186 but return retlen 184\n\tWrite of 186 bytes at 0x072caff4 failed. returned -5, retlen 184\nThese errors exist only in 64-bit systems,not in 32-bit systems. After analysis, we\nfound that the left shift operation is wrong in map_word_load_partial. For instance:\n\tunsigned char buf[3] \u003d{0x9e,0x3a,0xea};\n\tmap_bankwidth(map) is 4;\n\tfor (i\u003d0; i \u003c 3; i++) {\n\t\tint bitpos;\n\t\tbitpos \u003d (map_bankwidth(map)-1-i)*8;\n\t\torig.x[0] \u0026\u003d ~(0xff \u003c\u003c bitpos);\n\t\torig.x[0] |\u003d buf[i] \u003c\u003c bitpos;\n\t}\n\nThe value of orig.x[0] is expected to be 0x9e3aeaff, but in this situation(64-bit\nSystem) we\u0027ll get the wrong value of 0xffffffff9e3aeaff due to the 64-bit sign\nextension:\nbuf[i] is defined as \"unsigned char\" and the left-shift operation will convert it\nto the type of \"signed int\", so when left-shift buf[i] by 24 bits, the final result\nwill get the wrong value: 0xffffffff9e3aeaff.\n\nIf the left-shift bits are less than 24, then sign extension will not occur. Whereas\nthe bankwidth of the nor flash we used is 4, therefore this BUG emerges.\n\nSigned-off-by: Pang Xunlei \u003cpang.xunlei@zte.com.cn\u003e\nSigned-off-by: Zhang Yi \u003czhang.yi20@zte.com.cn\u003e\nSigned-off-by: Lu Zhongjun \u003clu.zhongjun@zte.com.cn\u003e\nSigned-off-by: Brian Norris \u003ccomputersforpeace@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b22831e6611bec1fdf84e71d80f7917199212ee8", "tree": "27fcd58be5c25b704b053f50f25346309fc999ec", "parents": [ "0aa9fced961d071a0e19c384b2f2c2e50a676602" ], "author": { "name": "Brian Norris", "email": "computersforpeace@gmail.com", "time": "Tue Aug 27 18:45:10 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:28 2013 -0800" }, "message": "mtd: nand: hack ONFI for non-power-of-2 dimensions\n\ncommit 4355b70cf48363c50a9de450b01178c83aba8f6a upstream.\n\nSome bright specification writers decided to write this in the ONFI spec\n(from ONFI 3.0, Section 3.1):\n\n \"The number of blocks and number of pages per block is not required to\n be a power of two. In the case where one of these values is not a\n power of two, the corresponding address shall be rounded to an\n integral number of bits such that it addresses a range up to the\n subsequent power of two value. The host shall not access upper\n addresses in a range that is shown as not supported.\"\n\nThis breaks every assumption MTD makes about NAND block/chip-size\ndimensions -- they *must* be a power of two!\n\nAnd of course, an enterprising manufacturer has made use of this lovely\nfreedom. Exhibit A: Micron MT29F32G08CBADAWP\n\n \"- Plane size: 2 planes x 1064 blocks per plane\n - Device size: 32Gb: 2128 blockss [sic]\"\n\nThis quickly hits a BUG() in nand_base.c, since the extra dimensions\noverflow so we think it\u0027s a second chip (on my single-chip setup):\n\n ONFI param page 0 valid\n ONFI flash detected\n NAND device: Manufacturer ID: 0x2c, Chip ID: 0x44 (Micron MT29F32G08CBADAWP), 4256MiB, page size: 8192, OOB size: 744\n ------------[ cut here ]------------\n kernel BUG at drivers/mtd/nand/nand_base.c:203!\n Internal error: Oops - BUG: 0 [#1] SMP ARM\n [... trim ...]\n [\u003cc02cf3e4\u003e] (nand_select_chip+0x18/0x2c) from [\u003cc02d25c0\u003e] (nand_do_read_ops+0x90/0x424)\n [\u003cc02d25c0\u003e] (nand_do_read_ops+0x90/0x424) from [\u003cc02d2dd8\u003e] (nand_read+0x54/0x78)\n [\u003cc02d2dd8\u003e] (nand_read+0x54/0x78) from [\u003cc02ad2c8\u003e] (mtd_read+0x84/0xbc)\n [\u003cc02ad2c8\u003e] (mtd_read+0x84/0xbc) from [\u003cc02d4b28\u003e] (scan_read.clone.4+0x4c/0x64)\n [\u003cc02d4b28\u003e] (scan_read.clone.4+0x4c/0x64) from [\u003cc02d4c88\u003e] (search_bbt+0x148/0x290)\n [\u003cc02d4c88\u003e] (search_bbt+0x148/0x290) from [\u003cc02d4ea4\u003e] (nand_scan_bbt+0xd4/0x5c0)\n [... trim ...]\n ---[ end trace 0c9363860d865ff2 ]---\n\nSo to fix this, just truncate these dimensions down to the greatest\npower-of-2 dimension that is less than or equal to the specified\ndimension.\n\nSigned-off-by: Brian Norris \u003ccomputersforpeace@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0aa9fced961d071a0e19c384b2f2c2e50a676602", "tree": "3f7e5111509aae06aba29e741514208dfdd22901", "parents": [ "ac6638ed78e168e6c6c77e5ac6d9a6c4f49d0040" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Mon Oct 14 12:12:24 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:28 2013 -0800" }, "message": "loop: fix crash if blk_alloc_queue fails\n\ncommit 3ec981e30fae1f3c8728a05c730acaa1f627bcfb upstream.\n\nloop: fix crash if blk_alloc_queue fails\n\nIf blk_alloc_queue fails, loop_add cleans up, but it doesn\u0027t clean up the\nidentifier allocated with idr_alloc. That causes crash on module unload in\nidr_for_each(\u0026loop_index_idr, \u0026loop_exit_cb, NULL); where we attempt to\nremove non-existed device with that id.\n\nBUG: unable to handle kernel NULL pointer dereference at 0000000000000380\nIP: [\u003cffffffff812057c9\u003e] del_gendisk+0x19/0x2d0\nPGD 43d399067 PUD 43d0ad067 PMD 0\nOops: 0000 [#1] PREEMPT SMP\nModules linked in: loop(-) dm_snapshot dm_zero dm_mirror dm_region_hash dm_log dm_loop dm_mod ip6table_filter ip6_tables uvesafb cfbcopyarea cfbimgblt cfbfillrect fbcon font bitblit fbcon_rotate fbcon_cw fbcon_ud fbcon_ccw softcursor fb fbdev msr ipt_MASQUERADE iptable_nat nf_nat_ipv4 nf_conntrack_ipv4 nf_defrag_ipv4 xt_state ipt_REJECT xt_tcpudp iptable_filter ip_tables x_tables bridge stp llc tun ipv6 cpufreq_userspace cpufreq_stats cpufreq_ondemand cpufreq_conservative cpufreq_powersave spadfs fuse hid_generic usbhid hid raid0 md_mod dmi_sysfs nf_nat_ftp nf_nat nf_conntrack_ftp nf_conntrack snd_usb_audio snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_page_alloc lm85 hwmon_vid snd_hwdep snd_usbmidi_lib snd_rawmidi snd soundcore acpi_cpufreq ohci_hcd freq_table tg3 ehci_pci mperf ehci_hcd kvm_amd kvm sata_svw serverworks libphy libata ide_core k10temp usbcore hwmon microcode ptp pcspkr pps_core e100 skge mii usb_common i2c_piix4 floppy evdev rtc_cmos i2c_core processor but!\n ton unix\nCPU: 7 PID: 2735 Comm: rmmod Tainted: G W 3.10.15-devel #15\nHardware name: empty empty/S3992-E, BIOS \u0027V1.06 \u0027 06/09/2009\ntask: ffff88043d38e780 ti: ffff88043d21e000 task.ti: ffff88043d21e000\nRIP: 0010:[\u003cffffffff812057c9\u003e] [\u003cffffffff812057c9\u003e] del_gendisk+0x19/0x2d0\nRSP: 0018:ffff88043d21fe10 EFLAGS: 00010282\nRAX: ffffffffa05102e0 RBX: 0000000000000000 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffff88043ea82800 RDI: 0000000000000000\nRBP: ffff88043d21fe48 R08: 0000000000000000 R09: 0000000000000001\nR10: 0000000000000001 R11: 0000000000000000 R12: 00000000000000ff\nR13: 0000000000000080 R14: 0000000000000000 R15: ffff88043ea82800\nFS: 00007ff646534700(0000) GS:ffff880447000000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b\nCR2: 0000000000000380 CR3: 000000043e9bf000 CR4: 00000000000007e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\nStack:\n ffffffff8100aba4 0000000000000092 ffff88043d21fe48 ffff88043ea82800\n 00000000000000ff ffff88043d21fe98 0000000000000000 ffff88043d21fe60\n ffffffffa05102b4 0000000000000000 ffff88043d21fe70 ffffffffa05102ec\nCall Trace:\n [\u003cffffffff8100aba4\u003e] ? native_sched_clock+0x24/0x80\n [\u003cffffffffa05102b4\u003e] loop_remove+0x14/0x40 [loop]\n [\u003cffffffffa05102ec\u003e] loop_exit_cb+0xc/0x10 [loop]\n [\u003cffffffff81217b74\u003e] idr_for_each+0x104/0x190\n [\u003cffffffffa05102e0\u003e] ? loop_remove+0x40/0x40 [loop]\n [\u003cffffffff8109adc5\u003e] ? trace_hardirqs_on_caller+0x105/0x1d0\n [\u003cffffffffa05135dc\u003e] loop_exit+0x34/0xa58 [loop]\n [\u003cffffffff810a98ea\u003e] SyS_delete_module+0x13a/0x260\n [\u003cffffffff81221d5e\u003e] ? trace_hardirqs_on_thunk+0x3a/0x3f\n [\u003cffffffff813cff16\u003e] system_call_fastpath+0x1a/0x1f\nCode: f0 4c 8b 6d f8 c9 c3 66 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 56 41 55 4c 8d af 80 00 00 00 41 54 53 48 89 fb 48 83 ec 18 \u003c48\u003e 83 bf 80 03 00\n00 00 74 4d e8 98 fe ff ff 31 f6 48 c7 c7 20\nRIP [\u003cffffffff812057c9\u003e] del_gendisk+0x19/0x2d0\n RSP \u003cffff88043d21fe10\u003e\nCR2: 0000000000000380\n---[ end trace 64ec069ec70f1309 ]---\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nAcked-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ac6638ed78e168e6c6c77e5ac6d9a6c4f49d0040", "tree": "0da2bdbbd4354188f4d47919767490747851569d", "parents": [ "27c0008c75ddfa759d5645ecbc3f86e0de37472a" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Fri Oct 04 09:29:06 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:28 2013 -0800" }, "message": "IB/ipath: Convert ipath_user_sdma_pin_pages() to use get_user_pages_fast()\n\ncommit 4adcf7fb6783e354aab38824d803fa8c4f8e8a27 upstream.\n\nipath_user_sdma_queue_pkts() gets called with mmap_sem held for\nwriting. Except for get_user_pages() deep down in\nipath_user_sdma_pin_pages() we don\u0027t seem to need mmap_sem at all.\n\nEven more interestingly the function ipath_user_sdma_queue_pkts() (and\nalso ipath_user_sdma_coalesce() called somewhat later) call\ncopy_from_user() which can hit a page fault and we deadlock on trying\nto get mmap_sem when handling that fault. So just make\nipath_user_sdma_pin_pages() use get_user_pages_fast() and leave\nmmap_sem locking for mm.\n\nThis deadlock has actually been observed in the wild when the node\nis under memory pressure.\n\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Mike Marciniszyn \u003cmike.marciniszyn@intel.com\u003e\n[ Merged in fix for call to get_user_pages_fast from Tetsuo Handa\n \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e. - Roland ]\nSigned-off-by: Roland Dreier \u003croland@purestorage.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "27c0008c75ddfa759d5645ecbc3f86e0de37472a", "tree": "e9fde1aec4d5fb1de9ca537767279e698a8526b9", "parents": [ "7dac7f101e7b6e5b1dd5164cba7cf7268311e13e" ], "author": { "name": "Eric Seppanen", "email": "eric@purestorage.com", "time": "Wed Nov 20 14:19:52 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:28 2013 -0800" }, "message": "iscsi-target: chap auth shouldn\u0027t match username with trailing garbage\n\ncommit 86784c6bdeeef78eed94d298be7a8879f6a97ee2 upstream.\n\nIn iSCSI negotiations with initiator CHAP enabled, usernames with\ntrailing garbage are permitted, because the string comparison only\nchecks the strlen of the configured username.\n\ne.g. \"usernameXXXXX\" will be permitted to match \"username\".\n\nJust check one more byte so the trailing null char is also matched.\n\nSigned-off-by: Eric Seppanen \u003ceric@purestorage.com\u003e\nSigned-off-by: Nicholas Bellinger \u003cnab@linux-iscsi.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7dac7f101e7b6e5b1dd5164cba7cf7268311e13e", "tree": "ee905090ef9fed06f3b67ac1c732b90e9a5b2bf3", "parents": [ "34bf7634b6d5dd7ce87588b51420cc0a23f3d9d6" ], "author": { "name": "Eric Seppanen", "email": "eric@purestorage.com", "time": "Wed Nov 20 14:19:51 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:27 2013 -0800" }, "message": "iscsi-target: fix extract_param to handle buffer length corner case\n\ncommit 369653e4fb511928511b0ce81f41c812ff1f28b6 upstream.\n\nextract_param() is called with max_length set to the total size of the\noutput buffer. It\u0027s not safe to allow a parameter length equal to the\nbuffer size as the terminating null would be written one byte past the\nend of the output buffer.\n\nSigned-off-by: Eric Seppanen \u003ceric@purestorage.com\u003e\nSigned-off-by: Nicholas Bellinger \u003cnab@linux-iscsi.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "34bf7634b6d5dd7ce87588b51420cc0a23f3d9d6", "tree": "50b66a08064fd93ef9647cdaa167cfe6f55d4d03", "parents": [ "6ca439d8f323780eec60f52c90a6cc61a39347ac" ], "author": { "name": "Samir Benmendil", "email": "samir.benmendil@gmail.com", "time": "Sun Nov 17 23:56:17 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:22 2013 -0800" }, "message": "ahci: add Marvell 9230 to the AHCI PCI device list\n\ncommit 6d5278a68a75891db1df5ae1ecf83d288fc58c65 upstream.\n\nTested with a DAWICONTROL DC-624e on 3.10.10\n\nSigned-off-by: Samir Benmendil \u003csamir.benmendil@gmail.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReviewed-by: Levente Kurusa \u003clevex@linux.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6ca439d8f323780eec60f52c90a6cc61a39347ac", "tree": "ff26a4ecb22c82acdc626e24597890fa13e4b2ef", "parents": [ "4b2162b7f846b9b4326734e305138137ae3491d3" ], "author": { "name": "xiangliang yu", "email": "yxlraid@gmail.com", "time": "Sun Oct 27 08:03:04 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:15 2013 -0800" }, "message": "ahci: disabled FBS prior to issuing software reset\n\ncommit 89dafa20f3daab5b3e0c13d0068a28e8e64e2102 upstream.\n\nTested with Marvell 88se9125, attached with one port mulitplier(5 ports)\nand one disk, we will get following boot log messages if using current\ncode:\n\n ata8: SATA link up 6.0 Gbps (SStatus 133 SControl 330)\n ata8.15: Port Multiplier 1.2, 0x1b4b:0x9715 r160, 5 ports, feat 0x1/0x1f\n ahci 0000:03:00.0: FBS is enabled\n ata8.00: hard resetting link\n ata8.00: SATA link down (SStatus 0 SControl 330)\n ata8.01: hard resetting link\n ata8.01: SATA link down (SStatus 0 SControl 330)\n ata8.02: hard resetting link\n ata8.02: SATA link down (SStatus 0 SControl 330)\n ata8.03: hard resetting link\n ata8.03: SATA link up 6.0 Gbps (SStatus 133 SControl 133)\n ata8.04: hard resetting link\n ata8.04: failed to resume link (SControl 133)\n ata8.04: failed to read SCR 0 (Emask\u003d0x40)\n ata8.04: failed to read SCR 0 (Emask\u003d0x40)\n ata8.04: failed to read SCR 1 (Emask\u003d0x40)\n ata8.04: failed to read SCR 0 (Emask\u003d0x40)\n ata8.03: native sectors (2) is smaller than sectors (976773168)\n ata8.03: ATA-8: ST3500413AS, JC4B, max UDMA/133\n ata8.03: 976773168 sectors, multi 0: LBA48 NCQ (depth 31/32)\n ata8.03: configured for UDMA/133\n ata8.04: failed to IDENTIFY (I/O error, err_mask\u003d0x100)\n ata8.15: hard resetting link\n ata8.15: SATA link up 6.0 Gbps (SStatus 133 SControl 330)\n ata8.15: Port Multiplier vendor mismatch \u00270x1b4b\u0027 !\u003d \u00270x133\u0027\n ata8.15: PMP revalidation failed (errno\u003d-19)\n ata8.15: hard resetting link\n ata8.15: SATA link up 6.0 Gbps (SStatus 133 SControl 330)\n ata8.15: Port Multiplier vendor mismatch \u00270x1b4b\u0027 !\u003d \u00270x133\u0027\n ata8.15: PMP revalidation failed (errno\u003d-19)\n ata8.15: limiting SATA link speed to 3.0 Gbps\n ata8.15: hard resetting link\n ata8.15: SATA link up 3.0 Gbps (SStatus 123 SControl 320)\n ata8.15: Port Multiplier vendor mismatch \u00270x1b4b\u0027 !\u003d \u00270x133\u0027\n ata8.15: PMP revalidation failed (errno\u003d-19)\n ata8.15: failed to recover PMP after 5 tries, giving up\n ata8.15: Port Multiplier detaching\n ata8.03: disabled\n ata8.00: disabled\n ata8: EH complete\n\nThe reason is that current detection code doesn\u0027t follow AHCI spec:\n\nFirst,the port multiplier detection process look like this:\n\n\tahci_hardreset(link, class, deadline)\n\tif (class \u003d\u003d ATA_DEV_PMP) {\n\t\tsata_pmp_attach(dev)\t/* will enable FBS */\n\t\tsata_pmp_init_links(ap, nr_ports);\n\t\tata_for_each_link(link, ap, EDGE) {\n\t\t\tsata_std_hardreset(link, class, deadline);\n\t\t\tif (link_is_online)\t/* do soft reset */\n\t\t\t\tahci_softreset(link, class, deadline);\n\t\t}\n\t}\nBut, according to chapter 9.3.9 in AHCI spec: Prior to issuing software\nreset, software shall clear PxCMD.ST to \u00270\u0027 and then clear PxFBS.EN to\n\u00270\u0027.\n\nThe patch test ok with kernel 3.11.1.\n\ntj: Patch white space contaminated, applied manually with trivial\n updates.\n\nSigned-off-by: Xiangliang Yu \u003cyuxiangl@marvell.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "4b2162b7f846b9b4326734e305138137ae3491d3", "tree": "74a429aad225bfc10a2077e1832346203119d5db", "parents": [ "bb513cf8a564f6b05836354591435362334e3c66" ], "author": { "name": "Larry Finger", "email": "Larry.Finger@lwfinger.net", "time": "Sun Nov 10 22:11:16 2013 -0600" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:15 2013 -0800" }, "message": "rtlwifi: rtl8192cu: Fix more pointer arithmetic errors\n\ncommit eafbdde9c5629bea58df07275c5917eb42afbbe7 upstream.\n\nThis driver uses a number of macros to get and set various fields in the\nRX and TX descriptors. To work correctly, a u8 pointer to the descriptor\nmust be used; however, in some cases a descriptor structure pointer is used\ninstead. In addition, a duplicated statement is removed.\n\nSigned-off-by: Larry Finger \u003cLarry.Finger@lwfinger.net\u003e\nReported-by: Mark Cave-Ayland \u003cmark.cave-ayland@ilande.co.uk\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "bb513cf8a564f6b05836354591435362334e3c66", "tree": "40a236f0f60eda210dff4f2249ceef994fb03a7d", "parents": [ "22363fb4b996766c83d25f47f2de605a6720ccf0" ], "author": { "name": "Felipe Pena", "email": "felipensp@gmail.com", "time": "Fri Oct 18 21:52:40 2013 -0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:15 2013 -0800" }, "message": "rtlwifi: rtl8192se: Fix wrong assignment\n\ncommit 3aef7dde8dcf09e0124f0a2665845a507331972b upstream.\n\nThere is a typo in the struct member name on assignment when checking\nrtlphy-\u003ecurrent_chan_bw \u003d\u003d HT_CHANNEL_WIDTH_20_40, the check uses pwrgroup_ht40\nfor bound limit and uses pwrgroup_ht20 when assigning instead.\n\nSigned-off-by: Felipe Pena \u003cfelipensp@gmail.com\u003e\nAcked-by: Larry Finger \u003cLarry.Finger@lwfinger.net\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "22363fb4b996766c83d25f47f2de605a6720ccf0", "tree": "193bfb63664b150c614b055926dcd71461e74bad", "parents": [ "80b41caaa1455afd259de89e3d430334f8b57156" ], "author": { "name": "Ryan Mallon", "email": "rmallon@gmail.com", "time": "Tue Nov 12 15:08:51 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:14 2013 -0800" }, "message": "vsprintf: check real user/group id for %pK\n\ncommit 312b4e226951f707e120b95b118cbc14f3d162b2 upstream.\n\nSome setuid binaries will allow reading of files which have read\npermission by the real user id. This is problematic with files which\nuse %pK because the file access permission is checked at open() time,\nbut the kptr_restrict setting is checked at read() time. If a setuid\nbinary opens a %pK file as an unprivileged user, and then elevates\npermissions before reading the file, then kernel pointer values may be\nleaked.\n\nThis happens for example with the setuid pppd application on Ubuntu 12.04:\n\n $ head -1 /proc/kallsyms\n 00000000 T startup_32\n\n $ pppd file /proc/kallsyms\n pppd: In file /proc/kallsyms: unrecognized option \u0027c1000000\u0027\n\nThis will only leak the pointer value from the first line, but other\nsetuid binaries may leak more information.\n\nFix this by adding a check that in addition to the current process having\nCAP_SYSLOG, that effective user and group ids are equal to the real ids.\nIf a setuid binary reads the contents of a file which uses %pK then the\npointer values will be printed as NULL if the real user is unprivileged.\n\nUpdate the sysctl documentation to reflect the changes, and also correct\nthe documentation to state the kptr_restrict\u003d0 is the default.\n\nThis is a only temporary solution to the issue. The correct solution is\nto do the permission check at open() time on files, and to replace %pK\nwith a function which checks the open() time permission. %pK uses in\nprintk should be removed since no sane permission check can be done, and\ninstead protected by using dmesg_restrict.\n\nSigned-off-by: Ryan Mallon \u003crmallon@gmail.com\u003e\nCc: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Alexander Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Joe Perches \u003cjoe@perches.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "80b41caaa1455afd259de89e3d430334f8b57156", "tree": "d053bdf6a65d53045fcb69acaa125bb245dbba98", "parents": [ "e90d50f73953118725bff5b1449e2cbbb9ee3554" ], "author": { "name": "Shan Hai", "email": "shan.hai@windriver.com", "time": "Mon Oct 28 16:08:01 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:14 2013 -0800" }, "message": "drivers/libata: Set max sector to 65535 for Slimtype DVD A DS8A9SH drive\n\ncommit 0523f037f65dba10191b0fa9c51266f90ba64630 upstream.\n\nThe \"Slimtype DVD A DS8A9SH\" drive locks up with following backtrace when\nthe max sector is smaller than 65535 bytes, fix it by adding a quirk to set\nthe max sector to 65535 bytes.\n\nINFO: task flush-11:0:663 blocked for more than 120 seconds.\n\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\nflush-11:0 D 00000000ffff5ceb 0 663 2 0x00000000\n ffff88026d3b1710 0000000000000046 0000000000000001 0000000000000000\n ffff88026f2530c0 ffff88026d365860 ffff88026d3b16e0 ffffffff812ffd52\n ffff88026d4fd3d0 0000000100000001 ffff88026d3b16f0 ffff88026d3b1fd8\nCall Trace:\n [\u003cffffffff812ffd52\u003e] ? cfq_may_queue+0x52/0xf0\n [\u003cffffffff81604338\u003e] schedule+0x18/0x30\n [\u003cffffffff81604392\u003e] io_schedule+0x42/0x60\n [\u003cffffffff812f22bb\u003e] get_request_wait+0xeb/0x1f0\n [\u003cffffffff81065660\u003e] ? autoremove_wake_function+0x0/0x40\n [\u003cffffffff812eb382\u003e] ? elv_merge+0x42/0x210\n [\u003cffffffff812f26ae\u003e] __make_request+0x8e/0x4e0\n [\u003cffffffff812f068e\u003e] generic_make_request+0x21e/0x5e0\n [\u003cffffffff812f0aad\u003e] submit_bio+0x5d/0xd0\n [\u003cffffffff81141422\u003e] submit_bh+0xf2/0x130\n [\u003cffffffff8114474c\u003e] __block_write_full_page+0x1dc/0x3a0\n [\u003cffffffff81143f60\u003e] ? end_buffer_async_write+0x0/0x120\n [\u003cffffffff811474e0\u003e] ? blkdev_get_block+0x0/0x70\n [\u003cffffffff811474e0\u003e] ? blkdev_get_block+0x0/0x70\n [\u003cffffffff81143f60\u003e] ? end_buffer_async_write+0x0/0x120\n [\u003cffffffff811449ee\u003e] block_write_full_page_endio+0xde/0x100\n [\u003cffffffff81144a20\u003e] block_write_full_page+0x10/0x20\n [\u003cffffffff81148703\u003e] blkdev_writepage+0x13/0x20\n [\u003cffffffff810d7525\u003e] __writepage+0x15/0x40\n [\u003cffffffff810d7c0f\u003e] write_cache_pages+0x1cf/0x3e0\n [\u003cffffffff810d7510\u003e] ? __writepage+0x0/0x40\n [\u003cffffffff810d7e42\u003e] generic_writepages+0x22/0x30\n [\u003cffffffff810d7e6f\u003e] do_writepages+0x1f/0x40\n [\u003cffffffff8113ae67\u003e] writeback_single_inode+0xe7/0x3b0\n [\u003cffffffff8113b574\u003e] writeback_sb_inodes+0x184/0x280\n [\u003cffffffff8113bedb\u003e] writeback_inodes_wb+0x6b/0x1a0\n [\u003cffffffff8113c24b\u003e] wb_writeback+0x23b/0x2a0\n [\u003cffffffff8113c42d\u003e] wb_do_writeback+0x17d/0x190\n [\u003cffffffff8113c48b\u003e] bdi_writeback_task+0x4b/0xe0\n [\u003cffffffff810e82a0\u003e] ? bdi_start_fn+0x0/0x100\n [\u003cffffffff810e8321\u003e] bdi_start_fn+0x81/0x100\n [\u003cffffffff810e82a0\u003e] ? bdi_start_fn+0x0/0x100\n [\u003cffffffff8106522e\u003e] kthread+0x8e/0xa0\n [\u003cffffffff81039274\u003e] ? finish_task_switch+0x54/0xc0\n [\u003cffffffff81003334\u003e] kernel_thread_helper+0x4/0x10\n [\u003cffffffff810651a0\u003e] ? kthread+0x0/0xa0\n [\u003cffffffff81003330\u003e] ? kernel_thread_helper+0x0/0x10\n\n The above trace was triggered by\n \"dd if\u003d/dev/zero of\u003d/dev/sr0 bs\u003d2048 count\u003d32768\"\n\nSigned-off-by: Shan Hai \u003cshan.hai@windriver.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e90d50f73953118725bff5b1449e2cbbb9ee3554", "tree": "07d5fe5db1e440fb87b6c9f15d6acdaf78a5f695", "parents": [ "799ed0d9c5ee00600823c5762a9e5b20776a1391" ], "author": { "name": "Gwendal Grignou", "email": "gwendal@google.com", "time": "Fri Oct 25 16:28:57 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:14 2013 -0800" }, "message": "libata: Fix display of sata speed\n\ncommit 3e85c3ecbc520751324a191d23bb94873ed01b10 upstream.\n\n6.0 Gbps link speed was not decoded properly:\nspeed was reported at 3.0 Gbps only.\n\nTested: On a machine where libata reports 6.0 Gbps in\n /var/log/messages:\n ata1: SATA link up 6.0 Gbps (SStatus 133 SControl 300)\n\n Before:\n \tcat /sys/class/ata_link/link1/sata_spd\n \t3.0 Gbps\n After:\n \tcat /sys/class/ata_link/link1/sata_spd\n \t6.0 Gbps\n\nSigned-off-by: Gwendal Grignou \u003cgwendal@google.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "799ed0d9c5ee00600823c5762a9e5b20776a1391", "tree": "69caf763885acfb797a36ea190ccabb2e6a4eb06", "parents": [ "510e627f364a15db3b0848de1429d15f1473b95e" ], "author": { "name": "Marc Kleine-Budde", "email": "mkl@pengutronix.de", "time": "Fri Sep 27 12:15:05 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:14 2013 -0800" }, "message": "can: flexcan: fix flexcan_chip_start() on imx6\n\ncommit 0d1862ea1a5bb876cf05555a7307080cb75bf379 upstream.\n\nIn the flexcan_chip_start() function first the flexcan core is going through\nthe soft reset sequence, then the RX FIFO is enabled.\n\nWith the hardware is put into FIFO mode, message buffers 1...7 are reserved by\nthe FIFO engine. The remaining message buffers are in reset default values.\nThis patch removes the bogus initialization of the message buffers, as it\ncauses an imprecise external abort on imx6.\n\nReported-by: Lothar Waßmann \u003cLW@KARO-electronics.de\u003e\nTested-by: Lothar Waßmann \u003cLW@KARO-electronics.de\u003e\n[mkl: adjusted context for stable]\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "510e627f364a15db3b0848de1429d15f1473b95e", "tree": "0f3c532e32932e857fc15855e034421fe4107bb4", "parents": [ "3e05092412210f3a298ef2a4e5f58857513e9954" ], "author": { "name": "Ilija Hadzic", "email": "ihadzic@research.bell-labs.com", "time": "Tue Nov 12 15:11:45 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:14 2013 -0800" }, "message": "devpts: plug the memory leak in kill_sb\n\ncommit 66da0e1f9034140ae2f571ef96e254a25083906c upstream.\n\nWhen devpts is unmounted, there may be a no-longer-used IDR tree hanging\noff the superblock we are about to kill. This needs to be cleaned up\nbefore destroying the SB.\n\nThe leak is usually not a big deal because unmounting devpts is typically\ndone when shutting down the whole machine. However, shutting down an LXC\ncontainer instead of a physical machine exposes the problem (the garbage\nis detectable with kmemleak).\n\nSigned-off-by: Ilija Hadzic \u003cihadzic@research.bell-labs.com\u003e\nCc: Sukadev Bhattiprolu \u003csukadev@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "3e05092412210f3a298ef2a4e5f58857513e9954", "tree": "d9bb8d5c47986907e7ac939ef90cad5a32708c2b", "parents": [ "664eaaa26bca6272673eff01ba5468f95905039d" ], "author": { "name": "KOSAKI Motohiro", "email": "kosaki.motohiro@jp.fujitsu.com", "time": "Mon Oct 14 17:33:16 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:14 2013 -0800" }, "message": "alarmtimer: return EINVAL instead of ENOTSUPP if rtcdev doesn\u0027t exist\n\ncommit 98d6f4dd84a134d942827584a3c5f67ffd8ec35f upstream.\n\nFedora Ruby maintainer reported latest Ruby doesn\u0027t work on Fedora Rawhide\non ARM. (http://bugs.ruby-lang.org/issues/9008)\n\nBecause of, commit 1c6b39ad3f (alarmtimers: Return -ENOTSUPP if no\nRTC device is present) intruduced to return ENOTSUPP when\nclock_get{time,res} can\u0027t find a RTC device. However this is incorrect.\n\nFirst, ENOTSUPP isn\u0027t exported to userland (ENOTSUP or EOPNOTSUP are the\nclosest userland equivlents).\n\nSecond, Posix and Linux man pages agree that clock_gettime and\nclock_getres should return EINVAL if clk_id argument is invalid.\nWhile the arugment that the clockid is valid, but just not supported\non this hardware could be made, this is just a technicality that\ndoesn\u0027t help userspace applicaitons, and only complicates error\nhandling.\n\nThus, this patch changes the code to use EINVAL.\n\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nReported-by: Vit Ondruch \u003cv.ondruch@tiscali.cz\u003e\nSigned-off-by: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\n[jstultz: Tweaks to commit message to include full rational]\nSigned-off-by: John Stultz \u003cjohn.stultz@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "664eaaa26bca6272673eff01ba5468f95905039d", "tree": "daaf5c831bae4d8151b6a5e3f9dccd168795b037", "parents": [ "f5f4825a345b637c81a017ed19a6ea47783cf811" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Nov 13 17:15:00 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:14 2013 -0800" }, "message": "ASoC: blackfin: Fix missing break\n\ncommit afed4dbe3a043dbd833a53b6b4951e155708afd2 upstream.\n\nFixes: 4b2ffc205cb9 (\u0027ASoC: Blackfin I2S: add 8-bit sample support\u0027)\nReported-by: David Binderman\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Mark Brown \u003cbroonie@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f5f4825a345b637c81a017ed19a6ea47783cf811", "tree": "98cc36912eb582c60d45f21a2761331bead1b5ee", "parents": [ "6a4e636d9f9bab7410c90ac091154d85a81e21ee" ], "author": { "name": "Nicolin Chen", "email": "b42378@freescale.com", "time": "Thu Nov 14 11:59:21 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:13 2013 -0800" }, "message": "ASoC: wm8962: Turn on regcache_cache_only before disabling regulator\n\ncommit 50bfcf2df2fadf77e143d6099150e6fa7ef4d78c upstream.\n\nIt\u0027s safer to turn on regcache_cache_only before disabling regulator since\nthe driver will turn off the regcache_cache_only after enabling regulator.\n\nIf we remain cache_only false, some command like \u0027amixer cset\u0027 would get\nfailure if being run before wm8962_resume().\n\nSigned-off-by: Nicolin Chen \u003cb42378@freescale.com\u003e\nSigned-off-by: Mark Brown \u003cbroonie@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6a4e636d9f9bab7410c90ac091154d85a81e21ee", "tree": "394395318ba74fcbf5b5394dfbe8fd161b30c03a", "parents": [ "c504aa16ae29f5c60754eff219a1462aa6548b21" ], "author": { "name": "Phil Edworthy", "email": "phil.edworthy@renesas.com", "time": "Thu Oct 31 23:06:17 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:13 2013 -0800" }, "message": "ASoC: ak4642: prevent un-necessary changes to SG_SL1\n\ncommit 7b5bfb82882b9b1c8423ce0ed6852ca3762d967a upstream.\n\nIf you record the sound during playback,\nthe playback sound becomes silent.\nModify so that the codec driver does not clear\nSG_SL1::DACL bit which is controlled under widget\n\nSigned-off-by: Phil Edworthy \u003cphil.edworthy@renesas.com\u003e\nSigned-off-by: Kuninori Morimoto \u003ckuninori.morimoto.gx@renesas.com\u003e\nSigned-off-by: Mark Brown \u003cbroonie@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c504aa16ae29f5c60754eff219a1462aa6548b21", "tree": "d250d41f50be15a8ccf15526bbdc783996e6c57d", "parents": [ "e3f8bcd36db9a86b78738224ff37e875cc793782" ], "author": { "name": "Johan Hovold", "email": "jhovold@gmail.com", "time": "Tue Nov 12 15:09:38 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:13 2013 -0800" }, "message": "backlight: atmel-pwm-bl: fix reported brightness\n\ncommit 185d91442550110db67a7dc794a32efcea455a36 upstream.\n\nThe driver supports 16-bit brightness values, but the value returned\nfrom get_brightness was truncated to eight bits.\n\nSigned-off-by: Johan Hovold \u003cjhovold@gmail.com\u003e\nCc: Jingoo Han \u003cjg1.han@samsung.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e3f8bcd36db9a86b78738224ff37e875cc793782", "tree": "6728990b6380fc446615b7dc92513d1880842e7c", "parents": [ "b823b82878ad6c8d938bb99fb3ed3f6c75b0f323" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 27 09:32:49 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:13 2013 -0800" }, "message": "Staging: tidspbridge: disable driver\n\ncommit 930ba4a374b96560ef9fde2145cdc454a164ddcc upstream.\n\nThere seems to be no active maintainer for the driver, and there is an\nunfixed security bug, so disable the driver for now.\n\nHopefully someone steps up to be the maintainer, and works to get this\nout of staging, otherwise it will be deleted soon.\n\nReported-by: Nico Golde \u003cnico@ngolde.de\u003e\nReported-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nCc: Omar Ramirez Luna \u003comar.ramirez@copitl.com\u003e\nCc: Omar Ramirez Luna \u003comar.ramirez@ti.com\u003e\nCc: Kanigeri, Hari \u003ch-kanigeri2@ti.com\u003e\nCc: Ameya Palande \u003cameya.palande@nokia.com\u003e\nCc: Guzman Lugo, Fernando \u003cfernando.lugo@ti.com\u003e\nCc: Hebbar, Shivananda \u003cx0hebbar@ti.com\u003e\nCc: Ramos Falcon, Ernesto \u003cernesto@ti.com\u003e\nCc: Felipe Contreras \u003cfelipe.contreras@gmail.com\u003e\nCc: Anna, Suman \u003cs-anna@ti.com\u003e\nCc: Gupta, Ramesh \u003cgrgupta@ti.com\u003e\nCc: Gomez Castellanos, Ivan \u003civan.gomez@ti.com\u003e\nCc: Andy Shevchenko \u003cext-andriy.shevchenko@nokia.com\u003e\nCc: Armando Uribe De Leon \u003cx0095078@ti.com\u003e\nCc: Deepak Chitriki \u003cdeepak.chitriki@ti.com\u003e\nCc: Menon, Nishanth \u003cnm@ti.com\u003e\nCc: Phil Carmody \u003cext-phil.2.carmody@nokia.com\u003e\nCc: Ohad Ben-Cohen \u003cohad@wizery.com\u003e\nCc: stable \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b823b82878ad6c8d938bb99fb3ed3f6c75b0f323", "tree": "67c3ebd766e2e3f80459a1b86784296c45f2f119", "parents": [ "d88da9d09672eddc30d50dec14cd8ddc3fbc284c" ], "author": { "name": "Jonathan Austin", "email": "jonathan.austin@arm.com", "time": "Thu Aug 29 18:41:11 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:13 2013 -0800" }, "message": "ARM: integrator_cp: Set LCD{0,1} enable lines when turning on CLCD\n\ncommit 30aeadd44deea3f3b0df45b9a70ee0fd5f8d6dc2 upstream.\n\nThis turns on the internal integrator LCD display(s). It seems that the code\nto do this got lost in refactoring of the CLCD driver.\n\nSigned-off-by: Jonathan Austin \u003cjonathan.austin@arm.com\u003e\nAcked-by: Linus Walleij \u003clinus.walleij@linaro.org\u003e\nSigned-off-by: Olof Johansson \u003colof@lixom.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d88da9d09672eddc30d50dec14cd8ddc3fbc284c", "tree": "7154b09b2756d659ecd6d83d12785d315a7f8dd8", "parents": [ "71ea1738746efcffab98ff04a8a634a2e2a94400" ], "author": { "name": "Russell King", "email": "rmk+kernel@arm.linux.org.uk", "time": "Wed Oct 16 00:09:02 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:13 2013 -0800" }, "message": "ARM: sa11x0/assabet: ensure CS2 is configured appropriately\n\ncommit f3964fe1c9d9a887d65faf594669852e4dec46e0 upstream.\n\nThe CS2 region contains the Assabet board configuration and status\nregisters, which are 32-bit. Unfortunately, some boot loaders do not\nconfigure this region correctly, leaving it setup as a 16-bit region.\nFix this.\n\nSigned-off-by: Russell King \u003crmk+kernel@arm.linux.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "71ea1738746efcffab98ff04a8a634a2e2a94400", "tree": "f13d9330458381ebde444e6d056589e4ef43a7e3", "parents": [ "778409c66ec599e51e5c1901b9f3631356df5a13" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:58 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:58 2013 -0800" }, "message": "Linux 3.4.71\n" }, { "commit": "778409c66ec599e51e5c1901b9f3631356df5a13", "tree": "d56615bc29df0e8399b205fa03a5bba73b3d2733", "parents": [ "b4db55f32a9b0172a24fb52143f10609708c17ff" ], "author": { "name": "Mauro Carvalho Chehab", "email": "m.chehab@samsung.com", "time": "Tue Nov 12 15:06:49 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:37 2013 -0800" }, "message": "cris: media platform drivers: fix build\n\ncommit 72a0c5571351f5184195754d23db3e14495b2080 upstream.\n\nOn cris arch, the functions below aren\u0027t defined:\n\n drivers/media/platform/sh_veu.c: In function \u0027sh_veu_reg_read\u0027:\n\n drivers/media/platform/sh_veu.c:228:2: error: implicit declaration of function \u0027ioread32\u0027 [-Werror\u003dimplicit-function-declaration]\n drivers/media/platform/sh_veu.c: In function \u0027sh_veu_reg_write\u0027:\n\n drivers/media/platform/sh_veu.c:234:2: error: implicit declaration of function \u0027iowrite32\u0027 [-Werror\u003dimplicit-function-declaration]\n drivers/media/platform/vsp1/vsp1.h: In function \u0027vsp1_read\u0027:\n drivers/media/platform/vsp1/vsp1.h:66:2: error: implicit declaration of function \u0027ioread32\u0027 [-Werror\u003dimplicit-function-declaration]\n drivers/media/platform/vsp1/vsp1.h: In function \u0027vsp1_write\u0027:\n drivers/media/platform/vsp1/vsp1.h:71:2: error: implicit declaration of function \u0027iowrite32\u0027 [-Werror\u003dimplicit-function-declaration]\n drivers/media/platform/vsp1/vsp1.h: In function \u0027vsp1_read\u0027:\n drivers/media/platform/vsp1/vsp1.h:66:2: error: implicit declaration of function \u0027ioread32\u0027 [-Werror\u003dimplicit-function-declaration]\n drivers/media/platform/vsp1/vsp1.h: In function \u0027vsp1_write\u0027:\n drivers/media/platform/vsp1/vsp1.h:71:2: error: implicit declaration of function \u0027iowrite32\u0027 [-Werror\u003dimplicit-function-declaration]\n drivers/media/platform/soc_camera/rcar_vin.c: In function \u0027rcar_vin_setup\u0027:\n drivers/media/platform/soc_camera/rcar_vin.c:284:3: error: implicit declaration of function \u0027iowrite32\u0027 [-Werror\u003dimplicit-function-declaration]\n\n drivers/media/platform/soc_camera/rcar_vin.c: In function \u0027rcar_vin_request_capture_stop\u0027:\n drivers/media/platform/soc_camera/rcar_vin.c:353:2: error: implicit declaration of function \u0027ioread32\u0027 [-Werror\u003dimplicit-function-declaration]\n\nYet, they\u0027re available, as CONFIG_GENERIC_IOMAP is defined. What happens\nis that asm/io.h was not including asm-generic/iomap.h.\n\nSuggested-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cm.chehab@samsung.com\u003e\nCc: Mikael Starvik \u003cstarvik@axis.com\u003e\nCc: Jesper Nilsson \u003cjesper.nilsson@axis.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b4db55f32a9b0172a24fb52143f10609708c17ff", "tree": "fbe57185503c568c2a5e094a9f0a4742ae59f3dd", "parents": [ "f087a3e5c6d46a7ce7eeb5481612118104abebb8" ], "author": { "name": "Junxiao Bi", "email": "junxiao.bi@oracle.com", "time": "Thu Nov 21 14:31:56 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:37 2013 -0800" }, "message": "configfs: fix race between dentry put and lookup\n\ncommit 76ae281f6307331aa063288edb6422ae99f435f0 upstream.\n\nA race window in configfs, it starts from one dentry is UNHASHED and end\nbefore configfs_d_iput is called. In this window, if a lookup happen,\nsince the original dentry was UNHASHED, so a new dentry will be\nallocated, and then in configfs_attach_attr(), sd-\u003es_dentry will be\nupdated to the new dentry. Then in configfs_d_iput(),\nBUG_ON(sd-\u003es_dentry !\u003d dentry) will be triggered and system panic.\n\nsys_open: sys_close:\n ... fput\n dput\n dentry_kill\n __d_drop \u003c--- dentry unhashed here,\n but sd-\u003edentry still point\n to this dentry.\n\n lookup_real\n configfs_lookup\n configfs_attach_attr---\u003e update sd-\u003es_dentry\n to new allocated dentry here.\n\n d_kill\n configfs_d_iput \u003c--- BUG_ON(sd-\u003es_dentry !\u003d dentry)\n triggered here.\n\nTo fix it, change configfs_d_iput to not update sd-\u003es_dentry if\nsd-\u003es_count \u003e 2, that means there are another dentry is using the sd\nbeside the one that is going to be put. Use configfs_dirent_lock in\nconfigfs_attach_attr to sync with configfs_d_iput.\n\nWith the following steps, you can reproduce the bug.\n\n1. enable ocfs2, this will mount configfs at /sys/kernel/config and\n fill configure in it.\n\n2. run the following script.\n\twhile [ 1 ]; do cat /sys/kernel/config/cluster/$your_cluster_name/idle_timeout_ms \u003e /dev/null; done \u0026\n\twhile [ 1 ]; do cat /sys/kernel/config/cluster/$your_cluster_name/idle_timeout_ms \u003e /dev/null; done \u0026\n\nSigned-off-by: Junxiao Bi \u003cjunxiao.bi@oracle.com\u003e\nCc: Joel Becker \u003cjlbec@evilplan.org\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f087a3e5c6d46a7ce7eeb5481612118104abebb8", "tree": "7f8440ca234b1066dc78e22c0f26b0100bfcd7fe", "parents": [ "53c620ea44ffb999ab52975e42ff3dce19937a86" ], "author": { "name": "Stanislaw Gruszka", "email": "sgruszka@redhat.com", "time": "Fri Oct 18 11:36:54 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:37 2013 -0800" }, "message": "rt2800usb: slow down TX status polling\n\ncommit 36165fd5b00bf8163f89c21bb16a3e9834555b10 upstream.\n\nPolling TX statuses too frequently has two negative effects. First is\nrandomly peek CPU usage, causing overall system functioning delays.\nSecond bad effect is that device is not able to fill TX statuses in\nH/W register on some workloads and we get lot of timeouts like below:\n\nieee80211 phy4: rt2800usb_entry_txstatus_timeout: Warning - TX status timeout for entry 7 in queue 2\nieee80211 phy4: rt2800usb_entry_txstatus_timeout: Warning - TX status timeout for entry 7 in queue 2\nieee80211 phy4: rt2800usb_txdone: Warning - Got TX status for an empty queue 2, dropping\n\nThis not only cause flood of messages in dmesg, but also bad throughput,\nsince rate scaling algorithm can not work optimally.\n\nIn the future, we should probably make polling interval be adjusted\nautomatically, but for now just increase values, this make mentioned\nproblems gone.\n\nResolve:\nhttps://bugzilla.kernel.org/show_bug.cgi?id\u003d62781\n\nSigned-off-by: Stanislaw Gruszka \u003csgruszka@redhat.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "53c620ea44ffb999ab52975e42ff3dce19937a86", "tree": "b906d4cfafc3e0241e0155ef635c42240a18f967", "parents": [ "6beceb767ed86175601237fb3f2d2ff9678fca86" ], "author": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Fri Nov 08 16:03:50 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:36 2013 -0800" }, "message": "SUNRPC: Fix a data corruption issue when retransmitting RPC calls\n\ncommit a6b31d18b02ff9d7915c5898c9b5ca41a798cd73 upstream.\n\nThe following scenario can cause silent data corruption when doing\nNFS writes. It has mainly been observed when doing database writes\nusing O_DIRECT.\n\n1) The RPC client uses sendpage() to do zero-copy of the page data.\n2) Due to networking issues, the reply from the server is delayed,\n and so the RPC client times out.\n\n3) The client issues a second sendpage of the page data as part of\n an RPC call retransmission.\n\n4) The reply to the first transmission arrives from the server\n _before_ the client hardware has emptied the TCP socket send\n buffer.\n5) After processing the reply, the RPC state machine rules that\n the call to be done, and triggers the completion callbacks.\n6) The application notices the RPC call is done, and reuses the\n pages to store something else (e.g. a new write).\n\n7) The client NIC drains the TCP socket send buffer. Since the\n page data has now changed, it reads a corrupted version of the\n initial RPC call, and puts it on the wire.\n\nThis patch fixes the problem in the following manner:\n\nThe ordering guarantees of TCP ensure that when the server sends a\nreply, then we know that the _first_ transmission has completed. Using\nzero-copy in that situation is therefore safe.\nIf a time out occurs, we then send the retransmission using sendmsg()\n(i.e. no zero-copy), We then know that the socket contains a full copy of\nthe data, and so it will retransmit a faithful reproduction even if the\nRPC call completes, and the application reuses the O_DIRECT buffer in\nthe meantime.\n\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6beceb767ed86175601237fb3f2d2ff9678fca86", "tree": "eefe3b1c389ac114125edf94a54ec703d4887be8", "parents": [ "b745b007adf0d7786a9b63a8e2ec91b8bbcdbb61" ], "author": { "name": "Michael Neuling", "email": "mikey@neuling.org", "time": "Wed Nov 20 16:18:54 2013 +1100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:36 2013 -0800" }, "message": "powerpc/signals: Mark VSX not saved with small contexts\n\ncommit c13f20ac48328b05cd3b8c19e31ed6c132b44b42 upstream.\n\nThe VSX MSR bit in the user context indicates if the context contains VSX\nstate. Currently we set this when the process has touched VSX at any stage.\n\nUnfortunately, if the user has not provided enough space to save the VSX state,\nwe can\u0027t save it but we currently still set the MSR VSX bit.\n\nThis patch changes this to clear the MSR VSX bit when the user doesn\u0027t provide\nenough space. This indicates that there is no valid VSX state in the user\ncontext.\n\nThis is needed to support get/set/make/swapcontext for applications that use\nVSX but only provide a small context. For example, getcontext in glibc\nprovides a smaller context since the VSX registers don\u0027t need to be saved over\nthe glibc function call. But since the program calling getcontext may have\nused VSX, the kernel currently says the VSX state is valid when it\u0027s not. If\nthe returned context is then used in setcontext (ie. a small context without\nVSX but with MSR VSX set), the kernel will refuse the context. This situation\nhas been reported by the glibc community.\n\nBased on patch from Carlos O\u0027Donell.\n\nTested-by: Haren Myneni \u003charen@linux.vnet.ibm.com\u003e\nSigned-off-by: Michael Neuling \u003cmikey@neuling.org\u003e\nSigned-off-by: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b745b007adf0d7786a9b63a8e2ec91b8bbcdbb61", "tree": "4fc6a5169d5156af8d83c77823a23d46260ae417", "parents": [ "49aa69febe1dc8643e2d75ffcdf9504337fe4f7e" ], "author": { "name": "Gavin Shan", "email": "shangw@linux.vnet.ibm.com", "time": "Mon Nov 04 16:32:46 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:36 2013 -0800" }, "message": "powerpc/powernv: Add PE to its own PELTV\n\ncommit 631ad691b5818291d89af9be607d2fe40be0886e upstream.\n\nWe need add PE to its own PELTV. Otherwise, the errors originated\nfrom the PE might contribute to other PEs. In the result, we can\u0027t\nclear up the error successfully even we\u0027re checking and clearing\nerrors during access to PCI config space.\n\nReported-by: kalshett@in.ibm.com\nSigned-off-by: Gavin Shan \u003cshangw@linux.vnet.ibm.com\u003e\nSigned-off-by: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "49aa69febe1dc8643e2d75ffcdf9504337fe4f7e", "tree": "6413c65343ceda85d09b739689d25c96571505f9", "parents": [ "801327994060b0ae3749257d264a7bfea119b46c" ], "author": { "name": "Prarit Bhargava", "email": "prarit@redhat.com", "time": "Thu Oct 17 08:00:11 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:36 2013 -0800" }, "message": "powerpc/vio: use strcpy in modalias_show\n\ncommit 411cabf79e684171669ad29a0628c400b4431e95 upstream.\n\nCommit e82b89a6f19bae73fb064d1b3dd91fcefbb478f4 used strcat instead of\nstrcpy which can result in an overflow of newlines on the buffer.\n\nSigned-off-by: Prarit Bhargava\nCc: benh@kernel.crashing.org\nCc: ben@decadent.org.uk\nSigned-off-by: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "801327994060b0ae3749257d264a7bfea119b46c", "tree": "f06d24743c51b4aa314d44c452ccc6642298ce74", "parents": [ "82b80fae0eb0c2d18414f7e678e04a4e7f88ecbe" ], "author": { "name": "Mike Snitzer", "email": "snitzer@redhat.com", "time": "Fri Oct 18 09:44:49 2013 -0600" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:36 2013 -0800" }, "message": "block: properly stack underlying max_segment_size to DM device\n\ncommit d82ae52e68892338068e7559a0c0657193341ce4 upstream.\n\nWithout this patch all DM devices will default to BLK_MAX_SEGMENT_SIZE\n(65536) even if the underlying device(s) have a larger value -- this is\ndue to blk_stack_limits() using min_not_zero() when stacking the\nmax_segment_size limit.\n\n1073741824\n\nbefore patch:\n65536\n\nafter patch:\n1073741824\n\nReported-by: Lukasz Flis \u003cl.flis@cyfronet.pl\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "82b80fae0eb0c2d18414f7e678e04a4e7f88ecbe", "tree": "99866aa3ecfb37f6ec3afaa3eecdf6b796d6de87", "parents": [ "5413d6c032afde960c16c735eef40f9b85fa9132" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Mon Oct 14 12:13:24 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:36 2013 -0800" }, "message": "block: fix a probe argument to blk_register_region\n\ncommit a207f5937630dd35bd2550620bef416937a1365e upstream.\n\nThe probe function is supposed to return NULL on failure (as we can see in\nkobj_lookup: kobj \u003d probe(dev, index, data); ... if (kobj) return kobj;\n\nHowever, in loop and brd, it returns negative error from ERR_PTR.\n\nThis causes a crash if we simulate disk allocation failure and run\nless -f /dev/loop0 because the negative number is interpreted as a pointer:\n\nBUG: unable to handle kernel NULL pointer dereference at 00000000000002b4\nIP: [\u003cffffffff8118b188\u003e] __blkdev_get+0x28/0x450\nPGD 23c677067 PUD 23d6d1067 PMD 0\nOops: 0000 [#1] PREEMPT SMP\nModules linked in: loop hpfs nvidia(PO) ip6table_filter ip6_tables uvesafb cfbcopyarea cfbimgblt cfbfillrect fbcon font bitblit fbcon_rotate fbcon_cw fbcon_ud fbcon_ccw softcursor fb fbdev msr ipt_MASQUERADE iptable_nat nf_nat_ipv4 nf_conntrack_ipv4 nf_defrag_ipv4 xt_state ipt_REJECT xt_tcpudp iptable_filter ip_tables x_tables bridge stp llc tun ipv6 cpufreq_stats cpufreq_ondemand cpufreq_userspace cpufreq_powersave cpufreq_conservative hid_generic spadfs usbhid hid fuse raid0 snd_usb_audio snd_pcm_oss snd_mixer_oss md_mod snd_pcm snd_timer snd_page_alloc snd_hwdep snd_usbmidi_lib dmi_sysfs snd_rawmidi nf_nat_ftp nf_nat nf_conntrack_ftp nf_conntrack snd soundcore lm85 hwmon_vid ohci_hcd ehci_pci ehci_hcd serverworks sata_svw libata acpi_cpufreq freq_table mperf ide_core usbcore kvm_amd kvm tg3 i2c_piix4 libphy microcode e100 usb_common ptp skge i2c_core pcspkr k10temp evdev floppy hwmon pps_core mii rtc_cmos button processor unix [last unloaded: nvidia]\nCPU: 1 PID: 6831 Comm: less Tainted: P W O 3.10.15-devel #18\nHardware name: empty empty/S3992-E, BIOS \u0027V1.06 \u0027 06/09/2009\ntask: ffff880203cc6bc0 ti: ffff88023e47c000 task.ti: ffff88023e47c000\nRIP: 0010:[\u003cffffffff8118b188\u003e] [\u003cffffffff8118b188\u003e] __blkdev_get+0x28/0x450\nRSP: 0018:ffff88023e47dbd8 EFLAGS: 00010286\nRAX: ffffffffffffff74 RBX: ffffffffffffff74 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001\nRBP: ffff88023e47dc18 R08: 0000000000000002 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffff88023f519658\nR13: ffffffff8118c300 R14: 0000000000000000 R15: ffff88023f519640\nFS: 00007f2070bf7700(0000) GS:ffff880247400000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000000002b4 CR3: 000000023da1d000 CR4: 00000000000007e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\nStack:\n 0000000000000002 0000001d00000000 000000003e47dc50 ffff88023f519640\n ffff88043d5bb668 ffffffff8118c300 ffff88023d683550 ffff88023e47de60\n ffff88023e47dc98 ffffffff8118c10d 0000001d81605698 0000000000000292\nCall Trace:\n [\u003cffffffff8118c300\u003e] ? blkdev_get_by_dev+0x60/0x60\n [\u003cffffffff8118c10d\u003e] blkdev_get+0x1dd/0x370\n [\u003cffffffff8118c300\u003e] ? blkdev_get_by_dev+0x60/0x60\n [\u003cffffffff813cea6c\u003e] ? _raw_spin_unlock+0x2c/0x50\n [\u003cffffffff8118c300\u003e] ? blkdev_get_by_dev+0x60/0x60\n [\u003cffffffff8118c365\u003e] blkdev_open+0x65/0x80\n [\u003cffffffff8114d12e\u003e] do_dentry_open.isra.18+0x23e/0x2f0\n [\u003cffffffff8114d214\u003e] finish_open+0x34/0x50\n [\u003cffffffff8115e122\u003e] do_last.isra.62+0x2d2/0xc50\n [\u003cffffffff8115eb58\u003e] path_openat.isra.63+0xb8/0x4d0\n [\u003cffffffff81115a8e\u003e] ? might_fault+0x4e/0xa0\n [\u003cffffffff8115f4f0\u003e] do_filp_open+0x40/0x90\n [\u003cffffffff813cea6c\u003e] ? _raw_spin_unlock+0x2c/0x50\n [\u003cffffffff8116db85\u003e] ? __alloc_fd+0xa5/0x1f0\n [\u003cffffffff8114e45f\u003e] do_sys_open+0xef/0x1d0\n [\u003cffffffff8114e559\u003e] SyS_open+0x19/0x20\n [\u003cffffffff813cff16\u003e] system_call_fastpath+0x1a/0x1f\nCode: 44 00 00 55 48 89 e5 41 57 49 89 ff 41 56 41 89 d6 41 55 41 54 4c 8d 67 18 53 48 83 ec 18 89 75 cc e9 f2 00 00 00 0f 1f 44 00 00 \u003c48\u003e 8b 80 40 03 00 00 48 89 df 4c 8b 68 58 e8 d5\na4 07 00 44 89\nRIP [\u003cffffffff8118b188\u003e] __blkdev_get+0x28/0x450\n RSP \u003cffff88023e47dbd8\u003e\nCR2: 00000000000002b4\n---[ end trace bb7f32dbf02398dc ]---\n\nThe brd change should be backported to stable kernels starting with 2.6.25.\nThe loop change should be backported to stable kernels starting with 2.6.22.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nAcked-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5413d6c032afde960c16c735eef40f9b85fa9132", "tree": "91bf53b9f824ea6d87495c7cd5a113a9a66fffe4", "parents": [ "cf359232f6c3eaf6ddff242a2b8247e20b29c436" ], "author": { "name": "Jeff Moyer", "email": "jmoyer@redhat.com", "time": "Tue Oct 08 14:36:41 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:35 2013 -0800" }, "message": "block: fix race between request completion and timeout handling\n\ncommit 4912aa6c11e6a5d910264deedbec2075c6f1bb73 upstream.\n\ncrocode i2c_i801 i2c_core iTCO_wdt iTCO_vendor_support shpchp ioatdma dca be2net sg ses enclosure ext4 mbcache jbd2 sd_mod crc_t10dif ahci megaraid_sas(U) dm_mirror dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan]\n\nPid: 491, comm: scsi_eh_0 Tainted: G W ---------------- 2.6.32-220.13.1.el6.x86_64 #1 IBM -[8722PAX]-/00D1461\nRIP: 0010:[\u003cffffffff8124e424\u003e] [\u003cffffffff8124e424\u003e] blk_requeue_request+0x94/0xa0\nRSP: 0018:ffff881057eefd60 EFLAGS: 00010012\nRAX: ffff881d99e3e8a8 RBX: ffff881d99e3e780 RCX: ffff881d99e3e8a8\nRDX: ffff881d99e3e8a8 RSI: ffff881d99e3e780 RDI: ffff881d99e3e780\nRBP: ffff881057eefd80 R08: ffff881057eefe90 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffff881057f92338\nR13: 0000000000000000 R14: ffff881057f92338 R15: ffff883058188000\nFS: 0000000000000000(0000) GS:ffff880040200000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b\nCR2: 00000000006d3ec0 CR3: 000000302cd7d000 CR4: 00000000000406b0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\nProcess scsi_eh_0 (pid: 491, threadinfo ffff881057eee000, task ffff881057e29540)\nStack:\n 0000000000001057 0000000000000286 ffff8810275efdc0 ffff881057f16000\n\u003c0\u003e ffff881057eefdd0 ffffffff81362323 ffff881057eefe20 ffffffff8135f393\n\u003c0\u003e ffff881057e29af8 ffff8810275efdc0 ffff881057eefe78 ffff881057eefe90\nCall Trace:\n [\u003cffffffff81362323\u003e] __scsi_queue_insert+0xa3/0x150\n [\u003cffffffff8135f393\u003e] ? scsi_eh_ready_devs+0x5e3/0x850\n [\u003cffffffff81362a23\u003e] scsi_queue_insert+0x13/0x20\n [\u003cffffffff8135e4d4\u003e] scsi_eh_flush_done_q+0x104/0x160\n [\u003cffffffff8135fb6b\u003e] scsi_error_handler+0x35b/0x660\n [\u003cffffffff8135f810\u003e] ? scsi_error_handler+0x0/0x660\n [\u003cffffffff810908c6\u003e] kthread+0x96/0xa0\n [\u003cffffffff8100c14a\u003e] child_rip+0xa/0x20\n [\u003cffffffff81090830\u003e] ? kthread+0x0/0xa0\n [\u003cffffffff8100c140\u003e] ? child_rip+0x0/0x20\nCode: 00 00 eb d1 4c 8b 2d 3c 8f 97 00 4d 85 ed 74 bf 49 8b 45 00 49 83 c5 08 48 89 de 4c 89 e7 ff d0 49 8b 45 00 48 85 c0 75 eb eb a4 \u003c0f\u003e 0b eb fe 0f 1f 84 00 00 00 00 00 55 48 89 e5 0f 1f 44 00 00\nRIP [\u003cffffffff8124e424\u003e] blk_requeue_request+0x94/0xa0\n RSP \u003cffff881057eefd60\u003e\n\nThe RIP is this line:\n BUG_ON(blk_queued_rq(rq));\n\nAfter digging through the code, I think there may be a race between the\nrequest completion and the timer handler running.\n\nA timer is started for each request put on the device\u0027s queue (see\nblk_start_request-\u003eblk_add_timer). If the request does not complete\nbefore the timer expires, the timer handler (blk_rq_timed_out_timer)\nwill mark the request complete atomically:\n\nstatic inline int blk_mark_rq_complete(struct request *rq)\n{\n return test_and_set_bit(REQ_ATOM_COMPLETE, \u0026rq-\u003eatomic_flags);\n}\n\nand then call blk_rq_timed_out. The latter function will call\nscsi_times_out, which will return one of BLK_EH_HANDLED,\nBLK_EH_RESET_TIMER or BLK_EH_NOT_HANDLED. If BLK_EH_RESET_TIMER is\nreturned, blk_clear_rq_complete is called, and blk_add_timer is again\ncalled to simply wait longer for the request to complete.\n\nNow, if the request happens to complete while this is going on, what\nhappens? Given that we know the completion handler will bail if it\nfinds the REQ_ATOM_COMPLETE bit set, we need to focus on the completion\nhandler running after that bit is cleared. So, from the above\nparagraph, after the call to blk_clear_rq_complete. If the completion\nsets REQ_ATOM_COMPLETE before the BUG_ON in blk_add_timer, we go boom\nthere (I haven\u0027t seen this in the cores). Next, if we get the\ncompletion before the call to list_add_tail, then the timer will\neventually fire for an old req, which may either be freed or reallocated\n(there is evidence that this might be the case). Finally, if the\ncompletion comes in *after* the addition to the timeout list, I think\nit\u0027s harmless. The request will be removed from the timeout list,\nreq_atom_complete will be set, and all will be well.\n\nThis will only actually explain the coredumps *IF* the request\nstructure was freed, reallocated *and* queued before the error handler\nthread had a chance to process it. That is possible, but it may make\nsense to keep digging for another race. I think that if this is what\nwas happening, we would see other instances of this problem showing up\nas null pointer or garbage pointer dereferences, for example when the\nrequest structure was not re-used. It looks like we actually do run\ninto that situation in other reports.\n\nThis patch moves the BUG_ON(test_bit(REQ_ATOM_COMPLETE,\n\u0026req-\u003eatomic_flags)); from blk_add_timer to the only caller that could\ntrip over it (blk_start_request). It then inverts the calls to\nblk_clear_rq_complete and blk_add_timer in blk_rq_timed_out to address\nthe race. I\u0027ve boot tested this patch, but nothing more.\n\nSigned-off-by: Jeff Moyer \u003cjmoyer@redhat.com\u003e\nAcked-by: Hannes Reinecke \u003chare@suse.de\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "cf359232f6c3eaf6ddff242a2b8247e20b29c436", "tree": "ed78117b8b2ace3ff821d4ee8053e0076013b703", "parents": [ "b227aa81f4a892ad31e202aba1de8449d131e670" ], "author": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Fri Nov 15 10:40:38 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:35 2013 -0800" }, "message": "hwmon: (lm90) Fix max6696 alarm handling\n\ncommit e41fae2b1ed8c78283d73651cd65be0228c0dd1c upstream.\n\nBit 2 of status register 2 on MAX6696 (external diode 2 open)\nsets ALERT; the bit thus has to be listed in alert_alarms.\nAlso display a message in the alert handler if the condition\nis encountered.\n\nEven though not all overtemperature conditions cause ALERT\nto be set, we should not ignore them in the alert handler.\nDisplay messages for all out-of-range conditions.\n\nReported-by: Jean Delvare \u003ckhali@linux-fr.org\u003e\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\nSigned-off-by: Jean Delvare \u003ckhali@linux-fr.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b227aa81f4a892ad31e202aba1de8449d131e670", "tree": "6dd8b1eff44d1c8c9ea5de7a975d8f123c3ec5ce", "parents": [ "107bb3cc6b12d800f9949f5ecae808caae38a9f5" ], "author": { "name": "Thomas Renninger", "email": "trenn@suse.de", "time": "Tue Nov 12 17:39:43 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:35 2013 -0800" }, "message": "x86/microcode/amd: Tone down printk(), don\u0027t treat a missing firmware file as an error\n\ncommit 11f918d3e2d3861b6931e97b3aa778e4984935aa upstream.\n\nDo it the same way as done in microcode_intel.c: use pr_debug()\nfor missing firmware files.\n\nThere seem to be CPUs out there for which no microcode update\nhas been submitted to kernel-firmware repo yet resulting in\nscary sounding error messages in dmesg:\n\n microcode: failed to load file amd-ucode/microcode_amd_fam16h.bin\n\nSigned-off-by: Thomas Renninger \u003ctrenn@suse.de\u003e\nAcked-by: Borislav Petkov \u003cbp@suse.de\u003e\nLink: http://lkml.kernel.org/r/1384274383-43510-1-git-send-email-trenn@suse.de\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "107bb3cc6b12d800f9949f5ecae808caae38a9f5", "tree": "66ebf2132601b2892acf0e6a9b81c6f3bec43341", "parents": [ "6ee4fd261478ff5eed6b83cb5a18421c01707ad3" ], "author": { "name": "Christoph Hellwig", "email": "hch@infradead.org", "time": "Mon Nov 18 05:07:47 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:35 2013 -0800" }, "message": "nfsd: make sure to balance get/put_write_access\n\ncommit 987da4791052fa298b7cfcde4dea9f6f2bbc786b upstream.\n\nUse a straight goto error label style in nfsd_setattr to make sure\nwe always do the put_write_access call after we got it earlier.\n\nNote that the we have been failing to do that in the case\nnfsd_break_lease() returns an error, a bug introduced into 2.6.38 with\n6a76bebefe15d9a08864f824d7f8d5beaf37c997 \"nfsd4: break lease on nfsd\nsetattr\".\n\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6ee4fd261478ff5eed6b83cb5a18421c01707ad3", "tree": "47f157c25e6430faf0df862420f09b6ac1df33b4", "parents": [ "1ac50b943ce53d5f8ce077240191fc50d0e84662" ], "author": { "name": "Christoph Hellwig", "email": "hch@infradead.org", "time": "Mon Nov 18 05:07:30 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:35 2013 -0800" }, "message": "nfsd: split up nfsd_setattr\n\ncommit 818e5a22e907fbae75e9c1fd78233baec9fa64b6 upstream.\n\nSplit out two helpers to make the code more readable and easier to verify\nfor correctness.\n\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1ac50b943ce53d5f8ce077240191fc50d0e84662", "tree": "1b1743dbf76ee781c9bc0b0a57e6bdf3346aa0e5", "parents": [ "eaea722ea81a2e9dab5a81ff00b3cf9b88cca9b5" ], "author": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Tue Oct 01 14:24:58 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:34 2013 -0800" }, "message": "NFSv4: Fix a use-after-free situation in _nfs4_proc_getlk()\n\ncommit a6f951ddbdfb7bd87d31a44f61abe202ed6ce57f upstream.\n\nIn nfs4_proc_getlk(), when some error causes a retry of the call to\n_nfs4_proc_getlk(), we can end up with Oopses of the form\n\n BUG: unable to handle kernel NULL pointer dereference at 0000000000000134\n IP: [\u003cffffffff8165270e\u003e] _raw_spin_lock+0xe/0x30\n\u003csnip\u003e\n Call Trace:\n [\u003cffffffff812f287d\u003e] _atomic_dec_and_lock+0x4d/0x70\n [\u003cffffffffa053c4f2\u003e] nfs4_put_lock_state+0x32/0xb0 [nfsv4]\n [\u003cffffffffa053c585\u003e] nfs4_fl_release_lock+0x15/0x20 [nfsv4]\n [\u003cffffffffa0522c06\u003e] _nfs4_proc_getlk.isra.40+0x146/0x170 [nfsv4]\n [\u003cffffffffa052ad99\u003e] nfs4_proc_lock+0x399/0x5a0 [nfsv4]\n\nThe problem is that we don\u0027t clear the request-\u003efl_ops after the first\ntry and so when we retry, nfs4_set_lock_state() exits early without\nsetting the lock stateid.\nRegression introduced by commit 70cc6487a4e08b8698c0e2ec935fb48d10490162\n(locks: make -\u003elock release private data before returning in GETLK case)\n\nReported-by: Weston Andros Adamson \u003cdros@netapp.com\u003e\nReported-by: Jorge Mora \u003cmora@netapp.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "eaea722ea81a2e9dab5a81ff00b3cf9b88cca9b5", "tree": "df6c0c658be0163b1b32347cef9b4522bb3c8189", "parents": [ "1b443352fed11fd666c719d7b1399674c62437bf" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Tue Nov 12 08:06:20 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:34 2013 -0800" }, "message": "ALSA: msnd: Avoid duplicated driver name\n\ncommit 092f9cd16aac7d054af1755c945f37c1b33399e6 upstream.\n\nmsnd_pinnacle.c is used for both snd-msnd-pinnacle and\nsnd-msnd-classic drivers, and both should have different driver\nnames. Using the same driver name results in the sysfs warning for\nduplicated entries like\n kobject: \u0027msnd-pinnacle.7\u0027 (cec33408): kobject_release, parent (null) (delayed)\n kobject: \u0027msnd-pinnacle\u0027 (cecd4980): kobject_release, parent cf3ad9b0 (delayed)\n ------------[ cut here ]------------\n WARNING: CPU: 0 PID: 1 at fs/sysfs/dir.c:486 sysfs_warn_dup+0x7d/0xa0()\n sysfs: cannot create duplicate filename \u0027/bus/isa/drivers/msnd-pinnacle\u0027\n ......\n\nReported-by: Fengguang Wu \u003cfengguang.wu@intel.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1b443352fed11fd666c719d7b1399674c62437bf", "tree": "c8b43b7ed0ec451d4622654f3d0015b376edcd75", "parents": [ "c0d30628ff1b424f041d83fee37daea5f84eb0a2" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Mon Oct 28 11:24:23 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:34 2013 -0800" }, "message": "ALSA: 6fire: Fix probe of multiple cards\n\ncommit 9b389a8a022110b4bc055a19b888283544d9eba6 upstream.\n\nThe probe code of snd-usb-6fire driver overrides the devices[] pointer\nwrongly without checking whether it\u0027s already occupied or not. This\nwould screw up the device disconnection later.\n\nSpotted by coverity CID 141423.\n\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c0d30628ff1b424f041d83fee37daea5f84eb0a2", "tree": "d7bc2b3b5824eeddeb687c3547c21984e1d6c422", "parents": [ "7288f91dd5b55d82e1dee9f0d24e9f4730d57392" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Tue Nov 12 15:11:17 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:34 2013 -0800" }, "message": "exec/ptrace: fix get_dumpable() incorrect tests\n\ncommit d049f74f2dbe71354d43d393ac3a188947811348 upstream.\n\nThe get_dumpable() return value is not boolean. Most users of the\nfunction actually want to be testing for non-SUID_DUMP_USER(1) rather than\nSUID_DUMP_DISABLE(0). The SUID_DUMP_ROOT(2) is also considered a\nprotected state. Almost all places did this correctly, excepting the two\nplaces fixed in this patch.\n\nWrong logic:\n if (dumpable \u003d\u003d SUID_DUMP_DISABLE) { /* be protective */ }\n or\n if (dumpable \u003d\u003d 0) { /* be protective */ }\n or\n if (!dumpable) { /* be protective */ }\n\nCorrect logic:\n if (dumpable !\u003d SUID_DUMP_USER) { /* be protective */ }\n or\n if (dumpable !\u003d 1) { /* be protective */ }\n\nWithout this patch, if the system had set the sysctl fs/suid_dumpable\u003d2, a\nuser was able to ptrace attach to processes that had dropped privileges to\nthat user. (This may have been partially mitigated if Yama was enabled.)\n\nThe macros have been moved into the file that declares get/set_dumpable(),\nwhich means things like the ia64 code can see them too.\n\nCVE-2013-2929\n\nReported-by: Vasily Kulikov \u003csegoon@openwall.com\u003e\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: \"Luck, Tony\" \u003ctony.luck@intel.com\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7288f91dd5b55d82e1dee9f0d24e9f4730d57392", "tree": "ddacb42865accbcdfa64f3562b68e4df3ff5f11a", "parents": [ "7eebf56b11ac00f164583a217b65fa264f62cb07" ], "author": { "name": "Mimi Zohar", "email": "zohar@linux.vnet.ibm.com", "time": "Thu Oct 17 07:34:02 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:34 2013 -0800" }, "message": "Revert \"ima: policy for RAMFS\"\n\ncommit 08de59eb144d7c41351a467442f898d720f0f15f upstream.\n\nThis reverts commit 4c2c392763a682354fac65b6a569adec4e4b5387.\n\nEverything in the initramfs should be measured and appraised,\nbut until the initramfs has extended attribute support, at\nleast measured.\n\nSigned-off-by: Mimi Zohar \u003czohar@us.ibm.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7eebf56b11ac00f164583a217b65fa264f62cb07", "tree": "0fb4bd321b2baf65670e4f473fe43e41f272c90f", "parents": [ "d134082b7a9bb0e09158a2cc2e551841a84ddfa7" ], "author": { "name": "Stanislaw Gruszka", "email": "stf_xl@wp.pl", "time": "Tue Oct 15 14:31:12 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:33 2013 -0800" }, "message": "rt2x00: check if device is still available on rt2x00mac_flush()\n\ncommit 5671ab05cf2a579218985ef56595387932d78ee4 upstream.\n\nFix random kernel panic with below messages when remove dongle.\n\n[ 2212.355447] BUG: unable to handle kernel NULL pointer dereference at 0000000000000250\n[ 2212.355527] IP: [\u003cffffffffa02667f2\u003e] rt2x00usb_kick_tx_entry+0x12/0x160 [rt2x00usb]\n[ 2212.355599] PGD 0\n[ 2212.355626] Oops: 0000 [#1] SMP\n[ 2212.355664] Modules linked in: rt2800usb rt2x00usb rt2800lib crc_ccitt rt2x00lib mac80211 cfg80211 tun arc4 fuse rfcomm bnep snd_hda_codec_realtek snd_hda_intel snd_hda_codec btusb uvcvideo bluetooth snd_hwdep x86_pkg_temp_thermal snd_seq coretemp aesni_intel aes_x86_64 snd_seq_device glue_helper snd_pcm ablk_helper videobuf2_vmalloc sdhci_pci videobuf2_memops videobuf2_core sdhci videodev mmc_core serio_raw snd_page_alloc microcode i2c_i801 snd_timer hid_multitouch thinkpad_acpi lpc_ich mfd_core snd tpm_tis wmi tpm tpm_bios soundcore acpi_cpufreq i915 i2c_algo_bit drm_kms_helper drm i2c_core video [last unloaded: cfg80211]\n[ 2212.356224] CPU: 0 PID: 34 Comm: khubd Not tainted 3.12.0-rc3-wl+ #3\n[ 2212.356268] Hardware name: LENOVO 3444CUU/3444CUU, BIOS G6ET93WW (2.53 ) 02/04/2013\n[ 2212.356319] task: ffff880212f687c0 ti: ffff880212f66000 task.ti: ffff880212f66000\n[ 2212.356392] RIP: 0010:[\u003cffffffffa02667f2\u003e] [\u003cffffffffa02667f2\u003e] rt2x00usb_kick_tx_entry+0x12/0x160 [rt2x00usb]\n[ 2212.356481] RSP: 0018:ffff880212f67750 EFLAGS: 00010202\n[ 2212.356519] RAX: 000000000000000c RBX: 000000000000000c RCX: 0000000000000293\n[ 2212.356568] RDX: ffff8801f4dc219a RSI: 0000000000000000 RDI: 0000000000000240\n[ 2212.356617] RBP: ffff880212f67778 R08: ffffffffa02667e0 R09: 0000000000000002\n[ 2212.356665] R10: 0001f95254ab4b40 R11: ffff880212f675be R12: ffff8801f4dc2150\n[ 2212.356712] R13: 0000000000000000 R14: ffffffffa02667e0 R15: 000000000000000d\n[ 2212.356761] FS: 0000000000000000(0000) GS:ffff88021e200000(0000) knlGS:0000000000000000\n[ 2212.356813] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 2212.356852] CR2: 0000000000000250 CR3: 0000000001a0c000 CR4: 00000000001407f0\n[ 2212.356899] Stack:\n[ 2212.356917] 000000000000000c ffff8801f4dc2150 0000000000000000 ffffffffa02667e0\n[ 2212.356980] 000000000000000d ffff880212f677b8 ffffffffa03a31ad ffff8801f4dc219a\n[ 2212.357038] ffff8801f4dc2150 0000000000000000 ffff8800b93217a0 ffff8801f49bc800\n[ 2212.357099] Call Trace:\n[ 2212.357122] [\u003cffffffffa02667e0\u003e] ? rt2x00usb_interrupt_txdone+0x90/0x90 [rt2x00usb]\n[ 2212.357174] [\u003cffffffffa03a31ad\u003e] rt2x00queue_for_each_entry+0xed/0x170 [rt2x00lib]\n[ 2212.357244] [\u003cffffffffa026701c\u003e] rt2x00usb_kick_queue+0x5c/0x60 [rt2x00usb]\n[ 2212.357314] [\u003cffffffffa03a3682\u003e] rt2x00queue_flush_queue+0x62/0xa0 [rt2x00lib]\n[ 2212.357386] [\u003cffffffffa03a2930\u003e] rt2x00mac_flush+0x30/0x70 [rt2x00lib]\n[ 2212.357470] [\u003cffffffffa04edded\u003e] ieee80211_flush_queues+0xbd/0x140 [mac80211]\n[ 2212.357555] [\u003cffffffffa0502e52\u003e] ieee80211_set_disassoc+0x2d2/0x3d0 [mac80211]\n[ 2212.357645] [\u003cffffffffa0506da3\u003e] ieee80211_mgd_deauth+0x1d3/0x240 [mac80211]\n[ 2212.357718] [\u003cffffffff8108b17c\u003e] ? try_to_wake_up+0xec/0x290\n[ 2212.357788] [\u003cffffffffa04dbd18\u003e] ieee80211_deauth+0x18/0x20 [mac80211]\n[ 2212.357872] [\u003cffffffffa0418ddc\u003e] cfg80211_mlme_deauth+0x9c/0x140 [cfg80211]\n[ 2212.357913] [\u003cffffffffa041907c\u003e] cfg80211_mlme_down+0x5c/0x60 [cfg80211]\n[ 2212.357962] [\u003cffffffffa041cd18\u003e] cfg80211_disconnect+0x188/0x1a0 [cfg80211]\n[ 2212.358014] [\u003cffffffffa04013bc\u003e] ? __cfg80211_stop_sched_scan+0x1c/0x130 [cfg80211]\n[ 2212.358067] [\u003cffffffffa03f8954\u003e] cfg80211_leave+0xc4/0xe0 [cfg80211]\n[ 2212.358124] [\u003cffffffffa03f8d1b\u003e] cfg80211_netdev_notifier_call+0x3ab/0x5e0 [cfg80211]\n[ 2212.358177] [\u003cffffffff815140f8\u003e] ? inetdev_event+0x38/0x510\n[ 2212.358217] [\u003cffffffff81085a94\u003e] ? __wake_up+0x44/0x50\n[ 2212.358254] [\u003cffffffff8155995c\u003e] notifier_call_chain+0x4c/0x70\n[ 2212.358293] [\u003cffffffff81081156\u003e] raw_notifier_call_chain+0x16/0x20\n[ 2212.358361] [\u003cffffffff814b6dd5\u003e] call_netdevice_notifiers_info+0x35/0x60\n[ 2212.358429] [\u003cffffffff814b6ec9\u003e] __dev_close_many+0x49/0xd0\n[ 2212.358487] [\u003cffffffff814b7028\u003e] dev_close_many+0x88/0x100\n[ 2212.358546] [\u003cffffffff814b8150\u003e] rollback_registered_many+0xb0/0x220\n[ 2212.358612] [\u003cffffffff814b8319\u003e] unregister_netdevice_many+0x19/0x60\n[ 2212.358694] [\u003cffffffffa04d8eb2\u003e] ieee80211_remove_interfaces+0x112/0x190 [mac80211]\n[ 2212.358791] [\u003cffffffffa04c585f\u003e] ieee80211_unregister_hw+0x4f/0x100 [mac80211]\n[ 2212.361994] [\u003cffffffffa03a1221\u003e] rt2x00lib_remove_dev+0x161/0x1a0 [rt2x00lib]\n[ 2212.365240] [\u003cffffffffa0266e2e\u003e] rt2x00usb_disconnect+0x2e/0x70 [rt2x00usb]\n[ 2212.368470] [\u003cffffffff81419ce4\u003e] usb_unbind_interface+0x64/0x1c0\n[ 2212.371734] [\u003cffffffff813b446f\u003e] __device_release_driver+0x7f/0xf0\n[ 2212.374999] [\u003cffffffff813b4503\u003e] device_release_driver+0x23/0x30\n[ 2212.378131] [\u003cffffffff813b3c98\u003e] bus_remove_device+0x108/0x180\n[ 2212.381358] [\u003cffffffff813b0565\u003e] device_del+0x135/0x1d0\n[ 2212.384454] [\u003cffffffff81417760\u003e] usb_disable_device+0xb0/0x270\n[ 2212.387451] [\u003cffffffff8140d9cd\u003e] usb_disconnect+0xad/0x1d0\n[ 2212.390294] [\u003cffffffff8140f6cd\u003e] hub_thread+0x63d/0x1660\n[ 2212.393034] [\u003cffffffff8107c860\u003e] ? wake_up_atomic_t+0x30/0x30\n[ 2212.395728] [\u003cffffffff8140f090\u003e] ? hub_port_debounce+0x130/0x130\n[ 2212.398412] [\u003cffffffff8107baa0\u003e] kthread+0xc0/0xd0\n[ 2212.401058] [\u003cffffffff8107b9e0\u003e] ? insert_kthread_work+0x40/0x40\n[ 2212.403639] [\u003cffffffff8155de3c\u003e] ret_from_fork+0x7c/0xb0\n[ 2212.406193] [\u003cffffffff8107b9e0\u003e] ? insert_kthread_work+0x40/0x40\n[ 2212.408732] Code: 24 58 08 00 00 bf 80 00 00 00 e8 3a c3 e0 e0 5b 41 5c 5d c3 0f 1f 44 00 00 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 53 \u003c48\u003e 8b 47 10 48 89 fb 4c 8b 6f 28 4c 8b 20 49 8b 04 24 4c 8b 30\n[ 2212.414671] RIP [\u003cffffffffa02667f2\u003e] rt2x00usb_kick_tx_entry+0x12/0x160 [rt2x00usb]\n[ 2212.417646] RSP \u003cffff880212f67750\u003e\n[ 2212.420547] CR2: 0000000000000250\n[ 2212.441024] ---[ end trace 5442918f33832bce ]---\n\nSigned-off-by: Stanislaw Gruszka \u003cstf_xl@wp.pl\u003e\nAcked-by: Helmut Schaa \u003chelmut.schaa@googlemail.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d134082b7a9bb0e09158a2cc2e551841a84ddfa7", "tree": "867255fbc644ae386cb93323401437f9167cce7e", "parents": [ "f22ff9d05def87a049c5c8c7b86539bd4f8e3172" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Tue Nov 05 12:51:11 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:33 2013 -0800" }, "message": "perf/ftrace: Fix paranoid level for enabling function tracer\n\ncommit 12ae030d54ef250706da5642fc7697cc60ad0df7 upstream.\n\nThe current default perf paranoid level is \"1\" which has\n\"perf_paranoid_kernel()\" return false, and giving any operations that\nuse it, access to normal users. Unfortunately, this includes function\ntracing and normal users should not be allowed to enable function\ntracing by default.\n\nThe proper level is defined at \"-1\" (full perf access), which\n\"perf_paranoid_tracepoint_raw()\" will only give access to. Use that\ncheck instead for enabling function tracing.\n\nReported-by: Dave Jones \u003cdavej@redhat.com\u003e\nReported-by: Vince Weaver \u003cvincent.weaver@maine.edu\u003e\nTested-by: Vince Weaver \u003cvincent.weaver@maine.edu\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Jiri Olsa \u003cjolsa@redhat.com\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCVE: CVE-2013-2930\nFixes: ced39002f5ea (\"ftrace, perf: Add support to use function tracepoint in perf\")\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f22ff9d05def87a049c5c8c7b86539bd4f8e3172", "tree": "ed805b8838b5cf2d7686345c8859eeb1f8d48901", "parents": [ "df4011e050b4e80165a317424e6b3367dfa7697c" ], "author": { "name": "Fan Du", "email": "fan.du@windriver.com", "time": "Tue Apr 30 15:27:27 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:33 2013 -0800" }, "message": "include/linux/fs.h: disable preempt when acquire i_size_seqcount write lock\n\ncommit 74e3d1e17b2e11d175970b85acd44f5927000ba2 upstream.\n\nTwo rt tasks bind to one CPU core.\n\nThe higher priority rt task A preempts a lower priority rt task B which\nhas already taken the write seq lock, and then the higher priority rt\ntask A try to acquire read seq lock, it\u0027s doomed to lockup.\n\nrt task A with lower priority: call write\ni_size_write rt task B with higher priority: call sync, and preempt task A\n write_seqcount_begin(\u0026inode-\u003ei_size_seqcount); i_size_read\n inode-\u003ei_size \u003d i_size; read_seqcount_begin \u003c-- lockup here...\n\nSo disable preempt when acquiring every i_size_seqcount *write* lock will\ncure the problem.\n\nSigned-off-by: Fan Du \u003cfan.du@windriver.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Zhao Hongjiang \u003czhaohongjiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "df4011e050b4e80165a317424e6b3367dfa7697c", "tree": "2aef78ae8ee675b60ec7798beda0b49e73545f51", "parents": [ "1a9a8c2c61437bc8ab745c96af936196f4684495" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Tue Apr 30 15:28:20 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:33 2013 -0800" }, "message": "exec: do not abuse -\u003ecred_guard_mutex in threadgroup_lock()\n\ncommit e56fb2874015370e3b7f8d85051f6dce26051df9 upstream.\n\nthreadgroup_lock() takes signal-\u003ecred_guard_mutex to ensure that\nthread_group_leader() is stable. This doesn\u0027t look nice, the scope of\nthis lock in do_execve() is huge.\n\nAnd as Dave pointed out this can lead to deadlock, we have the\nfollowing dependencies:\n\n\tdo_execve:\t\tcred_guard_mutex -\u003e i_mutex\n\tcgroup_mount:\t\ti_mutex -\u003e cgroup_mutex\n\tattach_task_by_pid:\tcgroup_mutex -\u003e cred_guard_mutex\n\nChange de_thread() to take threadgroup_change_begin() around the\nswitch-the-leader code and change threadgroup_lock() to avoid\n-\u003ecred_guard_mutex.\n\nNote that de_thread() can\u0027t sleep with -\u003egroup_rwsem held, this can\nobviously deadlock with the exiting leader if the writer is active, so it\ndoes threadgroup_change_end() before schedule().\n\nReported-by: Dave Jones \u003cdavej@redhat.com\u003e\nAcked-by: Tejun Heo \u003ctj@kernel.org\u003e\nAcked-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n[ zhj: adjust context ]\nSigned-off-by: Zhao Hongjiang \u003czhaohongjiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "1a9a8c2c61437bc8ab745c96af936196f4684495", "tree": "7146378ada66a0de24598f8eae031b911942a0dd", "parents": [ "acf9ebdebcb3f39a41cf5fead7c11c32372dbf6c" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Mar 26 18:25:57 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:33 2013 -0800" }, "message": "Nest rename_lock inside vfsmount_lock\n\ncommit 7ea600b5314529f9d1b9d6d3c41cb26fce6a7a4a upstream.\n\n... lest we get livelocks between path_is_under() and d_path() and friends.\n\nThe thing is, wrt fairness lglocks are more similar to rwsems than to rwlocks;\nit is possible to have thread B spin on attempt to take lock shared while thread\nA is already holding it shared, if B is on lower-numbered CPU than A and there\u0027s\na thread C spinning on attempt to take the same lock exclusive.\n\nAs the result, we need consistent ordering between vfsmount_lock (lglock) and\nrename_lock (seq_lock), even though everything that takes both is going to take\nvfsmount_lock only shared.\n\nSpotted-by: Brad Spengler \u003cspender@grsecurity.net\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n[ zhj: backport to 3.4:\n - Adjust context\n - s/\u0026vfsmount_lock/vfsmount_lock/]\nSigned-off-by: Zhao Hongjiang \u003czhaohongjiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "acf9ebdebcb3f39a41cf5fead7c11c32372dbf6c", "tree": "808c768d781d78c9f25592aa7f5ecc406530e4ea", "parents": [ "14384c7346f4d6480503b825a474006a654d50e2" ], "author": { "name": "Andy Adamson", "email": "andros@netapp.com", "time": "Wed Aug 14 11:59:13 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:33 2013 -0800" }, "message": "SUNRPC: don\u0027t map EKEYEXPIRED to EACCES in call_refreshresult\n\ncommit f1ff0c27fd9987c59d707cd1a6b6c1fc3ae0a250 upstream.\n\nThe NFS layer needs to know when a key has expired.\nThis change also returns -EKEYEXPIRED to the application, and the informative\n\"Key has expired\" error message is displayed. The user then knows that\ncredential renewal is required.\n\nSigned-off-by: Andy Adamson \u003candros@netapp.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "14384c7346f4d6480503b825a474006a654d50e2", "tree": "102f7a97b454cfe3a2a555f4d25a6a6593921b5a", "parents": [ "fa7b5d69efb4db4ee60adcefa86bac1efd8e8b45" ], "author": { "name": "Andy Adamson", "email": "andros@netapp.com", "time": "Tue Nov 27 10:34:19 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:32 2013 -0800" }, "message": "SUNRPC handle EKEYEXPIRED in call_refreshresult\n\ncommit eb96d5c97b0825d542e9c4ba5e0a22b519355166 upstream.\n\nCurrently, when an RPCSEC_GSS context has expired or is non-existent\nand the users (Kerberos) credentials have also expired or are non-existent,\nthe client receives the -EKEYEXPIRED error and tries to refresh the context\nforever. If an application is performing I/O, or other work against the share,\nthe application hangs, and the user is not prompted to refresh/establish their\ncredentials. This can result in a denial of service for other users.\n\nUsers are expected to manage their Kerberos credential lifetimes to mitigate\nthis issue.\n\nMove the -EKEYEXPIRED handling into the RPC layer. Try tk_cred_retry number\nof times to refresh the gss_context, and then return -EACCES to the application.\n\nSigned-off-by: Andy Adamson \u003candros@netapp.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\n[bwh: Backported to 3.2:\n - Adjust context\n - Drop change to nfs4_handle_reclaim_lease_error()]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "fa7b5d69efb4db4ee60adcefa86bac1efd8e8b45", "tree": "95bf54a9a7a18bb510ea2715d9150da53b510472", "parents": [ "d05ee9e14f71acbc101358ac0659b67794ca644f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 29 10:21:34 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:32 2013 -0800" }, "message": "Fix a few incorrectly checked [io_]remap_pfn_range() calls\n\ncommit 7314e613d5ff9f0934f7a0f74ed7973b903315d1 upstream.\n\nNico Golde reports a few straggling uses of [io_]remap_pfn_range() that\nreally should use the vm_iomap_memory() helper. This trivially converts\ntwo of them to the helper, and comments about why the third one really\nneeds to continue to use remap_pfn_range(), and adds the missing size\ncheck.\n\nReported-by: Nico Golde \u003cnico@ngolde.de\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org.\n[lizf: backported to 3.4:\n - adjust context\n - no uio_physical_vm_ops]\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d05ee9e14f71acbc101358ac0659b67794ca644f", "tree": "9f27cdff0820e77cdad92836d1eefc8c800e48ba", "parents": [ "06d5a745ee1257f4dbf49385bf63e2b7554cc9b7" ], "author": { "name": "David Woodhouse", "email": "dwmw2@infradead.org", "time": "Sat Nov 24 12:11:21 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:32 2013 -0800" }, "message": "8139cp: re-enable interrupts after tx timeout\n\ncommit 01ffc0a7f1c1801a2354719dedbc32aff45b987d upstream.\n\nRecovery doesn\u0027t work too well if we leave interrupts disabled...\n\nSigned-off-by: David Woodhouse \u003cDavid.Woodhouse@intel.com\u003e\nAcked-by: Francois Romieu \u003cromieu@fr.zoreil.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nCc: Luis Henriques \u003cluis.henriques@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "06d5a745ee1257f4dbf49385bf63e2b7554cc9b7", "tree": "ba43167f8bf06716383807ddff40db5ae131e76f", "parents": [ "4a4c6cd28ac9322f1a69e15eeb314566dfefe23d" ], "author": { "name": "Markus Pargmann", "email": "mpa@pengutronix.de", "time": "Mon Oct 28 09:54:40 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:32 2013 -0800" }, "message": "can: c_can: Fix RX message handling, handle lost message before EOB\n\ncommit 5d0f801a2ccec3b1fdabc3392c8d99ed0413d216 upstream.\n\nIf we handle end of block messages with higher priority than a lost message,\nwe can run into an endless interrupt loop.\n\nThis is reproducable with a am335x processor and \"cansequence -r\" at 1Mbit.\nAs soon as we loose a packet we can\u0027t escape from an interrupt loop.\n\nThis patch fixes the problem by handling lost packets before EOB packets.\n\nSigned-off-by: Markus Pargmann \u003cmpa@pengutronix.de\u003e\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "4a4c6cd28ac9322f1a69e15eeb314566dfefe23d", "tree": "e561c89a89f46a0ebbc22a9ac941df32f5159d2a", "parents": [ "a4f4086ae811ac85d536dadc5ef8387cb404d042" ], "author": { "name": "Neil Horman", "email": "nhorman@tuxdriver.com", "time": "Tue Sep 17 08:33:11 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:32 2013 -0800" }, "message": "crypto: ansi_cprng - Fix off by one error in non-block size request\n\ncommit 714b33d15130cbb5ab426456d4e3de842d6c5b8a upstream.\n\nStephan Mueller reported to me recently a error in random number generation in\nthe ansi cprng. If several small requests are made that are less than the\ninstances block size, the remainder for loop code doesn\u0027t increment\nrand_data_valid in the last iteration, meaning that the last bytes in the\nrand_data buffer gets reused on the subsequent smaller-than-a-block request for\nrandom data.\n\nThe fix is pretty easy, just re-code the for loop to make sure that\nrand_data_valid gets incremented appropriately\n\nSigned-off-by: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nReported-by: Stephan Mueller \u003cstephan.mueller@atsec.com\u003e\nCC: Stephan Mueller \u003cstephan.mueller@atsec.com\u003e\nCC: Petr Matousek \u003cpmatouse@redhat.com\u003e\nCC: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nCC: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nCc: Luis Henriques \u003cluis.henriques@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a4f4086ae811ac85d536dadc5ef8387cb404d042", "tree": "18f0c22fdc8eef38a3b37d33bd6f016bffad02ac", "parents": [ "8e5931c319674b15847999e79f90e763f32af663" ], "author": { "name": "Johan Hovold", "email": "jhovold@gmail.com", "time": "Wed Oct 09 17:01:09 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:32 2013 -0800" }, "message": "USB: mos7840: fix tiocmget error handling\n\ncommit a91ccd26e75235d86248d018fe3779732bcafd8d upstream.\n\nMake sure to return errors from tiocmget rather than rely on\nuninitialised stack data.\n\nSigned-off-by: Johan Hovold \u003cjhovold@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8e5931c319674b15847999e79f90e763f32af663", "tree": "6c84d6dfec6dbc3226daec696f66f16584bd8ce6", "parents": [ "f9a3a293af3ca3cec5240f0c479f0bed84f195cc" ], "author": { "name": "Bob Moore", "email": "robert.moore@intel.com", "time": "Fri Sep 06 14:27:15 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:31 2013 -0800" }, "message": "ACPICA: Fix for a Store-\u003eArgX when ArgX contains a reference to a field.\n\ncommit 4be4be8fee2ee99a52f94f90d03d2f287ee1db86 upstream.\n\nThis change fixes a problem where a Store operation to an ArgX object\nthat contained a reference to a field object did not complete the\nautomatic dereference and then write to the actual field object.\nInstead, the object type of the field object was inadvertently changed\nto match the type of the source operand. The new behavior will actually\nwrite to the field object (buffer field or field unit), thus matching\nthe correct ACPI-defined behavior.\n\nSigned-off-by: Bob Moore \u003crobert.moore@intel.com\u003e\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nSigned-off-by: Lv Zheng \u003clv.zheng@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f9a3a293af3ca3cec5240f0c479f0bed84f195cc", "tree": "8d5b7e676f5386c9b7206a3d6591b264e868c938", "parents": [ "71a28e49b6566e92f157c871ce50a9613c682caa" ], "author": { "name": "Bob Moore", "email": "robert.moore@intel.com", "time": "Thu Aug 08 15:29:58 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:31 2013 -0800" }, "message": "ACPICA: Return error if DerefOf resolves to a null package element.\n\ncommit a50abf4842dd7d603a2ad6dcc7f1467fd2a66f03 upstream.\n\nDisallow the dereference of a reference (via index) to an uninitialized\npackage element. Provides compatibility with other ACPI\nimplementations. ACPICA BZ 1003.\n\nReferences: https://bugs.acpica.org/show_bug.cgi?id\u003d431\nSigned-off-by: Bob Moore \u003crobert.moore@intel.com\u003e\nSigned-off-by: Lv Zheng \u003clv.zheng@intel.com\u003e\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "71a28e49b6566e92f157c871ce50a9613c682caa", "tree": "0eb4056515f1eb008212efacfb3709e361f8414b", "parents": [ "b6af75b221f4a998dbbf9297fa3ac591974e70ab" ], "author": { "name": "Bob Moore", "email": "robert.moore@intel.com", "time": "Thu Aug 08 15:29:32 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:31 2013 -0800" }, "message": "ACPICA: DeRefOf operator: Update to fully resolve FieldUnit and BufferField refs.\n\ncommit 63660e05ec719613b518547b40a1c501c10f0bc4 upstream.\n\nPreviously, references to these objects were resolved only to the actual\nFieldUnit or BufferField object. The correct behavior is to resolve these\nreferences to an actual value.\nThe problem is that DerefOf did not resolve these objects to actual\nvalues. An \"Integer\" object is simple, return the value. But a field in\nan operation region will require a read operation. For a BufferField, the\nappropriate data must be extracted from the parent buffer.\n\nNOTE: It appears that this issues is present in Windows7 but not\nWindows8.\n\nSigned-off-by: Bob Moore \u003crobert.moore@intel.com\u003e\nSigned-off-by: Lv Zheng \u003clv.zheng@intel.com\u003e\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b6af75b221f4a998dbbf9297fa3ac591974e70ab", "tree": "88ede841b193de19b80fbcd190de9a9c313c1a6f", "parents": [ "3a7ed06c1e3a1ec493d97dc5a708bae17dd9e7b0" ], "author": { "name": "Bob Moore", "email": "robert.moore@intel.com", "time": "Mon Dec 31 00:11:45 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:31 2013 -0800" }, "message": "ACPICA: Interpreter: Fix Store() when implicit conversion is not possible.\n\ncommit 3f654bad3257427bea7ba1c4d43a23d99a03622b upstream.\n\nFor the cases such as a store of a string to an existing package\nobject, implement the store as a CopyObject().\nThis is a small departure from the ACPI specification which states\nthat the control method should be aborted in this case. However,\nASLTS suite depends on this behavior.\n\nSigned-off-by: Bob Moore \u003crobert.moore@intel.com\u003e\nSigned-off-by: Lv Zheng \u003clv.zheng@intel.com\u003e\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "3a7ed06c1e3a1ec493d97dc5a708bae17dd9e7b0", "tree": "359d107b79558d26a39bb674a1c2f79815cfc5c6", "parents": [ "e181e37563a1ef5dcc25565c12b03f6a816b0f36" ], "author": { "name": "Mahesh Rajashekhara", "email": "Mahesh.Rajashekhara@pmcs.com", "time": "Thu Oct 31 14:01:02 2013 +0530" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:30 2013 -0800" }, "message": "aacraid: prevent invalid pointer dereference\n\ncommit b4789b8e6be3151a955ade74872822f30e8cd914 upstream.\n\nIt appears that driver runs into a problem here if fibsize is too small\nbecause we allocate user_srbcmd with fibsize size only but later we\naccess it until user_srbcmd-\u003esg.count to copy it over to srbcmd.\n\nIt is not correct to test (fibsize \u003c sizeof(*user_srbcmd)) because this\nstructure already includes one sg element and this is not needed for\ncommands without data. So, we would recommend to add the following\n(instead of test for fibsize \u003d\u003d 0).\n\nSigned-off-by: Mahesh Rajashekhara \u003cMahesh.Rajashekhara@pmcs.com\u003e\nReported-by: Nico Golde \u003cnico@ngolde.de\u003e\nReported-by: Fabian Yamaguchi \u003cfabs@goesec.de\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e181e37563a1ef5dcc25565c12b03f6a816b0f36", "tree": "56a2a81c71936937f7ca46261c6cdd5e7ceebf38", "parents": [ "d92fa5be781c08695c9cb47124a5ac4746964e6d" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Wed Oct 30 20:12:51 2013 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:30 2013 -0800" }, "message": "libertas: potential oops in debugfs\n\ncommit a497e47d4aec37aaf8f13509f3ef3d1f6a717d88 upstream.\n\nIf we do a zero size allocation then it will oops. Also we can\u0027t be\nsure the user passes us a NUL terminated string so I\u0027ve added a\nterminator.\n\nThis code can only be triggered by root.\n\nReported-by: Nico Golde \u003cnico@ngolde.de\u003e\nReported-by: Fabian Yamaguchi \u003cfabs@goesec.de\u003e\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nAcked-by: Dan Williams \u003cdcbw@redhat.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nCc: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d92fa5be781c08695c9cb47124a5ac4746964e6d", "tree": "f1acd8aa2ef24471c0f2631d06a81b136dce7c9f", "parents": [ "a3b4c0bacef529359f30d85107b6b8af8684ccd0" ], "author": { "name": "Jeff Layton", "email": "jlayton@redhat.com", "time": "Wed Feb 27 20:10:34 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:30 2013 -0800" }, "message": "nfs: don\u0027t allow nfs_find_actor to match inodes of the wrong type\n\ncommit f6488c9ba51d65410e2dbc4345413c0d9120971e upstream.\n\nBenny Halevy reported the following oops when testing RHEL6:\n\n\u003c7\u003enfs_update_inode: inode 892950 mode changed, 0040755 to 0100644\n\u003c1\u003eBUG: unable to handle kernel NULL pointer dereference at (null)\n\u003c1\u003eIP: [\u003cffffffffa02a52c5\u003e] nfs_closedir+0x15/0x30 [nfs]\n\u003c4\u003ePGD 81448a067 PUD 831632067 PMD 0\n\u003c4\u003eOops: 0000 [#1] SMP\n\u003c4\u003elast sysfs file: /sys/kernel/mm/redhat_transparent_hugepage/enabled\n\u003c4\u003eCPU 6\n\u003c4\u003eModules linked in: fuse bonding 8021q garp ebtable_nat ebtables be2iscsi iscsi_boot_sysfs bnx2i cnic uio cxgb4i cxgb4 cxgb3i libcxgbi cxgb3 mdio ib_iser rdma_cm ib_cm iw_cm ib_sa ib_mad ib_core ib_addr iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi softdog bridge stp llc xt_physdev ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4 xt_multiport iptable_filter ip_tables ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables ipv6 dm_round_robin dm_multipath objlayoutdriver2(U) nfs(U) lockd fscache auth_rpcgss nfs_acl sunrpc vhost_net macvtap macvlan tun kvm_intel kvm be2net igb dca ptp pps_core microcode serio_raw sg iTCO_wdt iTCO_vendor_support i7core_edac edac_core shpchp ext4 mbcache jbd2 sd_mod crc_t10dif ahci dm_mirror dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan]\n\u003c4\u003e\n\u003c4\u003ePid: 6332, comm: dd Not tainted 2.6.32-358.el6.x86_64 #1 HP ProLiant DL170e G6 /ProLiant DL170e G6\n\u003c4\u003eRIP: 0010:[\u003cffffffffa02a52c5\u003e] [\u003cffffffffa02a52c5\u003e] nfs_closedir+0x15/0x30 [nfs]\n\u003c4\u003eRSP: 0018:ffff88081458bb98 EFLAGS: 00010292\n\u003c4\u003eRAX: ffffffffa02a52b0 RBX: 0000000000000000 RCX: 0000000000000003\n\u003c4\u003eRDX: ffffffffa02e45a0 RSI: ffff88081440b300 RDI: ffff88082d5f5760\n\u003c4\u003eRBP: ffff88081458bba8 R08: 0000000000000000 R09: 0000000000000000\n\u003c4\u003eR10: 0000000000000772 R11: 0000000000400004 R12: 0000000040000008\n\u003c4\u003eR13: ffff88082d5f5760 R14: ffff88082d6e8800 R15: ffff88082f12d780\n\u003c4\u003eFS: 00007f728f37e700(0000) GS:ffff8800456c0000(0000) knlGS:0000000000000000\n\u003c4\u003eCS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n\u003c4\u003eCR2: 0000000000000000 CR3: 0000000831279000 CR4: 00000000000007e0\n\u003c4\u003eDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n\u003c4\u003eDR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n\u003c4\u003eProcess dd (pid: 6332, threadinfo ffff88081458a000, task ffff88082fa0e040)\n\u003c4\u003eStack:\n\u003c4\u003e 0000000040000008 ffff88081440b300 ffff88081458bbf8 ffffffff81182745\n\u003c4\u003e\u003cd\u003e ffff88082d5f5760 ffff88082d6e8800 ffff88081458bbf8 ffffffffffffffea\n\u003c4\u003e\u003cd\u003e ffff88082f12d780 ffff88082d6e8800 ffffffffa02a50a0 ffff88082d5f5760\n\u003c4\u003eCall Trace:\n\u003c4\u003e [\u003cffffffff81182745\u003e] __fput+0xf5/0x210\n\u003c4\u003e [\u003cffffffffa02a50a0\u003e] ? do_open+0x0/0x20 [nfs]\n\u003c4\u003e [\u003cffffffff81182885\u003e] fput+0x25/0x30\n\u003c4\u003e [\u003cffffffff8117e23e\u003e] __dentry_open+0x27e/0x360\n\u003c4\u003e [\u003cffffffff811c397a\u003e] ? inotify_d_instantiate+0x2a/0x60\n\u003c4\u003e [\u003cffffffff8117e4b9\u003e] lookup_instantiate_filp+0x69/0x90\n\u003c4\u003e [\u003cffffffffa02a6679\u003e] nfs_intent_set_file+0x59/0x90 [nfs]\n\u003c4\u003e [\u003cffffffffa02a686b\u003e] nfs_atomic_lookup+0x1bb/0x310 [nfs]\n\u003c4\u003e [\u003cffffffff8118e0c2\u003e] __lookup_hash+0x102/0x160\n\u003c4\u003e [\u003cffffffff81225052\u003e] ? selinux_inode_permission+0x72/0xb0\n\u003c4\u003e [\u003cffffffff8118e76a\u003e] lookup_hash+0x3a/0x50\n\u003c4\u003e [\u003cffffffff81192a4b\u003e] do_filp_open+0x2eb/0xdd0\n\u003c4\u003e [\u003cffffffff8104757c\u003e] ? __do_page_fault+0x1ec/0x480\n\u003c4\u003e [\u003cffffffff8119f562\u003e] ? alloc_fd+0x92/0x160\n\u003c4\u003e [\u003cffffffff8117de79\u003e] do_sys_open+0x69/0x140\n\u003c4\u003e [\u003cffffffff811811f6\u003e] ? sys_lseek+0x66/0x80\n\u003c4\u003e [\u003cffffffff8117df90\u003e] sys_open+0x20/0x30\n\u003c4\u003e [\u003cffffffff8100b072\u003e] system_call_fastpath+0x16/0x1b\n\u003c4\u003eCode: 65 48 8b 04 25 c8 cb 00 00 83 a8 44 e0 ff ff 01 5b 41 5c c9 c3 90 55 48 89 e5 53 48 83 ec 08 0f 1f 44 00 00 48 8b 9e a0 00 00 00 \u003c48\u003e 8b 3b e8 13 0c f7 ff 48 89 df e8 ab 3d ec e0 48 83 c4 08 31\n\u003c1\u003eRIP [\u003cffffffffa02a52c5\u003e] nfs_closedir+0x15/0x30 [nfs]\n\u003c4\u003e RSP \u003cffff88081458bb98\u003e\n\u003c4\u003eCR2: 0000000000000000\n\nI think this is ultimately due to a bug on the server. The client had\npreviously found a directory dentry. It then later tried to do an atomic\nopen on a new (regular file) dentry. The attributes it got back had the\nsame filehandle as the previously found directory inode. It then tried\nto put the filp because it failed the aops tests for O_DIRECT opens, and\noopsed here because the ctx was still NULL.\n\nObviously the root cause here is a server issue, but we can take steps\nto mitigate this on the client. When nfs_fhget is called, we always know\nwhat type of inode it is. In the event that there\u0027s a broken or\nmalicious server on the other end of the wire, the client can end up\ncrashing because the wrong ops are set on it.\n\nHave nfs_find_actor check that the inode type is correct after checking\nthe fileid. The fileid check should rarely ever match, so it should only\nrarely ever get to this check. In the case where we have a broken\nserver, we may see two different inodes with the same i_ino, but the\nclient should be able to cope with them without crashing.\n\nThis should fix the oops reported here:\n\n https://bugzilla.redhat.com/show_bug.cgi?id\u003d913660\n\nReported-by: Benny Halevy \u003cbhalevy@tonian.com\u003e\nSigned-off-by: Jeff Layton \u003cjlayton@redhat.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nCc: Rui Xiang \u003crui.xiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a3b4c0bacef529359f30d85107b6b8af8684ccd0", "tree": "8304c38a674b9d5a474787b4e8daa90064007626", "parents": [ "234d96ee0f3b8e49501d068a2a3165aa4db60903" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 22 11:44:04 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:30 2013 -0800" }, "message": "vfs,proc: guarantee unique inodes in /proc\n\ncommit 51f0885e5415b4cc6535e9cdcc5145bfbc134353 upstream.\n\nDave Jones found another /proc issue with his Trinity tool: thanks to\nthe namespace model, we can have multiple /proc dentries that point to\nthe same inode, aliasing directories in /proc/\u003cpid\u003e/net/ for example.\n\nThis ends up being a total disaster, because it acts like hardlinked\ndirectories, and causes locking problems. We rely on the topological\nsort of the inodes pointed to by dentries, and if we have aliased\ndirectories, that odering becomes unreliable.\n\nIn short: don\u0027t do this. Multiple dentries with the same (directory)\ninode is just a bad idea, and the namespace code should never have\nexposed things this way. But we\u0027re kind of stuck with it.\n\nThis solves things by just always allocating a new inode during /proc\ndentry lookup, instead of using \"iget_locked()\" to look up existing\ninodes by superblock and number. That actually simplies the code a bit,\nat the cost of potentially doing more inode [de]allocations.\n\nThat said, the inode lookup wasn\u0027t free either (and did a lot of locking\nof inodes), so it is probably not that noticeable. We could easily keep\nthe old lookup model for non-directory entries, but rather than try to\nbe excessively clever this just implements the minimal and simplest\nworkaround for the problem.\n\nReported-and-tested-by: Dave Jones \u003cdavej@redhat.com\u003e\nAnalyzed-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n[bwh: Backported to 3.2:\n - Adjust context\n - Never drop the pde reference in proc_get_inode(), as callers only\n expect this when we return an existing inode, and we never do that now]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Rui Xiang \u003crui.xiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "234d96ee0f3b8e49501d068a2a3165aa4db60903", "tree": "6cb7d819de6509756f78942c2d5d97c14640ee0c", "parents": [ "a73ff6145f62f0e744aeb095bf7119edfcb8a2e7" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 20 10:43:41 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 20 10:43:41 2013 -0800" }, "message": "Linux 3.4.70\n" }, { "commit": "a73ff6145f62f0e744aeb095bf7119edfcb8a2e7", "tree": "1778402544bb1cd769bef14291b4955df465ecfc", "parents": [ "17447567e81dd2e9614ec4837128daebc0c4abb1" ], "author": { "name": "Krzysztof Mazur", "email": "krzysiek@podlesie.net", "time": "Thu Aug 22 14:49:38 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 20 10:43:19 2013 -0800" }, "message": "usb: fix cleanup after failure in hub_configure()\n\ncommit d0308d4b6b02597f39fc31a9bddf7bb3faad5622 upstream.\n\nIf the hub_configure() fails after setting the hdev-\u003emaxchild\nthe hub-\u003eports might be NULL or point to uninitialized kzallocated\nmemory causing NULL pointer dereference in hub_quiesce() during cleanup.\n\nNow after such error the hdev-\u003emaxchild is set to 0 to avoid cleanup\nof uninitialized ports.\n\nSigned-off-by: Krzysztof Mazur \u003ckrzysiek@podlesie.net\u003e\nAcked-by: Alan Stern \u003cstern@rowland.harvard.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "17447567e81dd2e9614ec4837128daebc0c4abb1", "tree": "9ae54a78fc78b3b698ee03d5aab8cbd6abc62c56", "parents": [ "d1814ea12da067fda7bac933e06ef205163617f6" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Mon Feb 04 15:56:05 2013 +0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 20 10:43:19 2013 -0800" }, "message": "PCI/PM: Clear state_saved during suspend\n\ncommit 82fee4d67ab86d6fe5eb0f9a9e988ca9d654d765 upstream.\n\nThis patch clears pci_dev-\u003estate_saved at the beginning of suspending.\nPCI config state may be saved long before that. Some drivers call\npci_save_state() from the -\u003eprobe() callback to get snapshot of sane\nconfiguration space to use in the -\u003eslot_reset() callback.\n\n[wangyj: adjust context]\nSigned-off-by: Konstantin Khlebnikov \u003ckhlebnikov@openvz.org\u003e # add comment\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nSigned-off-by: Yijing Wang \u003cwangyijing@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d1814ea12da067fda7bac933e06ef205163617f6", "tree": "0ac58de8ac0d91dda338fdbcdbf24ec47f99d645", "parents": [ "e6fffec6636ffa3062891bae69a3895bbb73b148" ], "author": { "name": "Nicolas Pitre", "email": "nicolas.pitre@linaro.org", "time": "Tue Mar 12 13:00:42 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 20 10:43:19 2013 -0800" }, "message": "ARM: 7670/1: fix the memset fix\n\ncommit 418df63adac56841ef6b0f1fcf435bc64d4ed177 upstream.\n\nCommit 455bd4c430b0 (\"ARM: 7668/1: fix memset-related crashes caused by\nrecent GCC (4.7.2) optimizations\") attempted to fix a compliance issue\nwith the memset return value. However the memset itself became broken\nby that patch for misaligned pointers.\n\nThis fixes the above by branching over the entry code from the\nmisaligned fixup code to avoid reloading the original pointer.\n\nAlso, because the function entry alignment is wrong in the Thumb mode\ncompilation, that fixup code is moved to the end.\n\nWhile at it, the entry instructions are slightly reworked to help dual\nissue pipelines.\n\nSigned-off-by: Nicolas Pitre \u003cnico@linaro.org\u003e\nTested-by: Alexander Holler \u003choller@ahsoftware.de\u003e\nSigned-off-by: Russell King \u003crmk+kernel@arm.linux.org.uk\u003e\nCc: Eric Bénard \u003ceric@eukrea.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e6fffec6636ffa3062891bae69a3895bbb73b148", "tree": "7190a3af67fd6ceb7f353b19c0bffd7d957d353b", "parents": [ "af15b7691766d99f0f84bae9b3444ab06e9beb29" ], "author": { "name": "Ivan Djelic", "email": "ivan.djelic@parrot.com", "time": "Wed Mar 06 20:09:27 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 20 10:43:19 2013 -0800" }, "message": "ARM: 7668/1: fix memset-related crashes caused by recent GCC (4.7.2) optimizations\n\ncommit 455bd4c430b0c0a361f38e8658a0d6cb469942b5 upstream.\n\nRecent GCC versions (e.g. GCC-4.7.2) perform optimizations based on\nassumptions about the implementation of memset and similar functions.\nThe current ARM optimized memset code does not return the value of\nits first argument, as is usually expected from standard implementations.\n\nFor instance in the following function:\n\nvoid debug_mutex_lock_common(struct mutex *lock, struct mutex_waiter *waiter)\n{\n\tmemset(waiter, MUTEX_DEBUG_INIT, sizeof(*waiter));\n\twaiter-\u003emagic \u003d waiter;\n\tINIT_LIST_HEAD(\u0026waiter-\u003elist);\n}\n\ncompiled as:\n\n800554d0 \u003cdebug_mutex_lock_common\u003e:\n800554d0: e92d4008 push {r3, lr}\n800554d4: e1a00001 mov r0, r1\n800554d8: e3a02010 mov r2, #16 ; 0x10\n800554dc: e3a01011 mov r1, #17 ; 0x11\n800554e0: eb04426e bl 80165ea0 \u003cmemset\u003e\n800554e4: e1a03000 mov r3, r0\n800554e8: e583000c str r0, [r3, #12]\n800554ec: e5830000 str r0, [r3]\n800554f0: e5830004 str r0, [r3, #4]\n800554f4: e8bd8008 pop {r3, pc}\n\nGCC assumes memset returns the value of pointer \u0027waiter\u0027 in register r0; causing\nregister/memory corruptions.\n\nThis patch fixes the return value of the assembly version of memset.\nIt adds a \u0027mov\u0027 instruction and merges an additional load+store into\nexisting load/store instructions.\nFor ease of review, here is a breakdown of the patch into 4 simple steps:\n\nStep 1\n\u003d\u003d\u003d\u003d\u003d\u003d\nPerform the following substitutions:\nip -\u003e r8, then\nr0 -\u003e ip,\nand insert \u0027mov ip, r0\u0027 as the first statement of the function.\nAt this point, we have a memset() implementation returning the proper result,\nbut corrupting r8 on some paths (the ones that were using ip).\n\nStep 2\n\u003d\u003d\u003d\u003d\u003d\u003d\nMake sure r8 is saved and restored when (! CALGN(1)+0) \u003d\u003d 1:\n\nsave r8:\n- str lr, [sp, #-4]!\n+ stmfd sp!, {r8, lr}\n\nand restore r8 on both exit paths:\n- ldmeqfd sp!, {pc} @ Now \u003c64 bytes to go.\n+ ldmeqfd sp!, {r8, pc} @ Now \u003c64 bytes to go.\n(...)\n tst r2, #16\n stmneia ip!, {r1, r3, r8, lr}\n- ldr lr, [sp], #4\n+ ldmfd sp!, {r8, lr}\n\nStep 3\n\u003d\u003d\u003d\u003d\u003d\u003d\nMake sure r8 is saved and restored when (! CALGN(1)+0) \u003d\u003d 0:\n\nsave r8:\n- stmfd sp!, {r4-r7, lr}\n+ stmfd sp!, {r4-r8, lr}\n\nand restore r8 on both exit paths:\n bgt 3b\n- ldmeqfd sp!, {r4-r7, pc}\n+ ldmeqfd sp!, {r4-r8, pc}\n(...)\n tst r2, #16\n stmneia ip!, {r4-r7}\n- ldmfd sp!, {r4-r7, lr}\n+ ldmfd sp!, {r4-r8, lr}\n\nStep 4\n\u003d\u003d\u003d\u003d\u003d\u003d\nRewrite register list \"r4-r7, r8\" as \"r4-r8\".\n\nSigned-off-by: Ivan Djelic \u003civan.djelic@parrot.com\u003e\nReviewed-by: Nicolas Pitre \u003cnico@linaro.org\u003e\nSigned-off-by: Dirk Behme \u003cdirk.behme@gmail.com\u003e\nSigned-off-by: Russell King \u003crmk+kernel@arm.linux.org.uk\u003e\nCc: Eric Bénard \u003ceric@eukrea.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "af15b7691766d99f0f84bae9b3444ab06e9beb29", "tree": "5d22a78374519c3feeabeaddad7e4f0fb58360a6", "parents": [ "9736cb3f9aa9c620965d937f4ff0261f6ac32ee1" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Wed Oct 09 22:23:23 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 20 10:43:19 2013 -0800" }, "message": "tracing: Fix potential out-of-bounds in trace_get_user()\n\ncommit 057db8488b53d5e4faa0cedb2f39d4ae75dfbdbb upstream.\n\nAndrey reported the following report:\n\nERROR: AddressSanitizer: heap-buffer-overflow on address ffff8800359c99f3\nffff8800359c99f3 is located 0 bytes to the right of 243-byte region [ffff8800359c9900, ffff8800359c99f3)\nAccessed by thread T13003:\n #0 ffffffff810dd2da (asan_report_error+0x32a/0x440)\n #1 ffffffff810dc6b0 (asan_check_region+0x30/0x40)\n #2 ffffffff810dd4d3 (__tsan_write1+0x13/0x20)\n #3 ffffffff811cd19e (ftrace_regex_release+0x1be/0x260)\n #4 ffffffff812a1065 (__fput+0x155/0x360)\n #5 ffffffff812a12de (____fput+0x1e/0x30)\n #6 ffffffff8111708d (task_work_run+0x10d/0x140)\n #7 ffffffff810ea043 (do_exit+0x433/0x11f0)\n #8 ffffffff810eaee4 (do_group_exit+0x84/0x130)\n #9 ffffffff810eafb1 (SyS_exit_group+0x21/0x30)\n #10 ffffffff81928782 (system_call_fastpath+0x16/0x1b)\n\nAllocated by thread T5167:\n #0 ffffffff810dc778 (asan_slab_alloc+0x48/0xc0)\n #1 ffffffff8128337c (__kmalloc+0xbc/0x500)\n #2 ffffffff811d9d54 (trace_parser_get_init+0x34/0x90)\n #3 ffffffff811cd7b3 (ftrace_regex_open+0x83/0x2e0)\n #4 ffffffff811cda7d (ftrace_filter_open+0x2d/0x40)\n #5 ffffffff8129b4ff (do_dentry_open+0x32f/0x430)\n #6 ffffffff8129b668 (finish_open+0x68/0xa0)\n #7 ffffffff812b66ac (do_last+0xb8c/0x1710)\n #8 ffffffff812b7350 (path_openat+0x120/0xb50)\n #9 ffffffff812b8884 (do_filp_open+0x54/0xb0)\n #10 ffffffff8129d36c (do_sys_open+0x1ac/0x2c0)\n #11 ffffffff8129d4b7 (SyS_open+0x37/0x50)\n #12 ffffffff81928782 (system_call_fastpath+0x16/0x1b)\n\nShadow bytes around the buggy address:\n ffff8800359c9700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n ffff8800359c9780: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa\n ffff8800359c9800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n ffff8800359c9880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n ffff8800359c9900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n\u003d\u003effff8800359c9980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[03]fb\n ffff8800359c9a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n ffff8800359c9a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n ffff8800359c9b00: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00\n ffff8800359c9b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff8800359c9c00: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07\n Heap redzone: fa\n Heap kmalloc redzone: fb\n Freed heap region: fd\n Shadow gap: fe\n\nThe out-of-bounds access happens on \u0027parser-\u003ebuffer[parser-\u003eidx] \u003d 0;\u0027\n\nAlthough the crash happened in ftrace_regex_open() the real bug\noccurred in trace_get_user() where there\u0027s an incrementation to\nparser-\u003eidx without a check against the size. The way it is triggered\nis if userspace sends in 128 characters (EVENT_BUF_SIZE + 1), the loop\nthat reads the last character stores it and then breaks out because\nthere is no more characters. Then the last character is read to determine\nwhat to do next, and the index is incremented without checking size.\n\nThen the caller of trace_get_user() usually nulls out the last character\nwith a zero, but since the index is equal to the size, it writes a nul\ncharacter after the allocated space, which can corrupt memory.\n\nLuckily, only root user has write access to this file.\n\nLink: http://lkml.kernel.org/r/20131009222323.04fd1a0d@gandalf.local.home\n\nReported-by: Andrey Konovalov \u003candreyknvl@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9736cb3f9aa9c620965d937f4ff0261f6ac32ee1", "tree": "e92ab89b0f3a3849238dab6f985355dd273e9b6c", "parents": [ "1ddb811a5471028b2c85c4d8515ce4ff65d867a1" ], "author": { "name": "Patrick McHardy", "email": "kaber@trash.net", "time": "Fri Apr 05 08:13:30 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 20 10:43:18 2013 -0800" }, "message": "netfilter: nf_ct_sip: don\u0027t drop packets with offsets pointing outside the packet\n\ncommit 3a7b21eaf4fb3c971bdb47a98f570550ddfe4471 upstream.\n\nSome Cisco phones create huge messages that are spread over multiple packets.\nAfter calculating the offset of the SIP body, it is validated to be within\nthe packet and the packet is dropped otherwise. This breaks operation of\nthese phones. Since connection tracking is supposed to be passive, just let\nthose packets pass unmodified and untracked.\n\nSigned-off-by: Patrick McHardy \u003ckaber@trash.net\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nCc: William Roberts \u003cbill.c.roberts@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1ddb811a5471028b2c85c4d8515ce4ff65d867a1", "tree": "f4f88dfadc22ee9a15ba17d73a82eaf9a69da817", "parents": [ "a275776838715e6d7400b03414a23e99d6d85b8a" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Jun 20 16:32:22 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 20 10:43:18 2013 -0800" }, "message": "ALSA: hda - Move one-time init codes from generic_hdmi_init()\n\ncommit 8b8d654b55648561287bd8baca0f75f964a17038 upstream.\n\nThe codes to initialize work struct or create a proc interface should\nbe called only once and never although it\u0027s called many times through\nthe init callback. Move that stuff into patch_generic_hdmi() so that\nit\u0027s called only once.\n\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nBugLink: https://bugs.launchpad.net/bugs/1212160\nSigned-off-by: David Henningsson \u003cdavid.henningsson@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a275776838715e6d7400b03414a23e99d6d85b8a", "tree": "36e43d8dae2a93a10ee4d804542f7410d5767b66", "parents": [ "c10141099c1ea42afa3ded64530cf285d8ffc96a" ], "author": { "name": "Rui li", "email": "li.rui27@zte.com.cn", "time": "Fri Oct 25 10:57:21 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 20 10:43:18 2013 -0800" }, "message": "USB: add new zte 3g-dongle\u0027s pid to option.c\n\ncommit 0636fc507a976cdc40f21bdbcce6f0b98ff1dfe9 upstream.\n\nSigned-off-by: Rui li \u003cli.rui27@zte.com.cn\u003e\nCc: stable \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c10141099c1ea42afa3ded64530cf285d8ffc96a", "tree": "3ecf78bc947f72c19ea04e13e696aa424a37ddcf", "parents": [ "161f4a458cd88dc6ab33078d64aa28315129fade" ], "author": { "name": "Nikhil P Rao", "email": "nikhil.rao@intel.com", "time": "Wed Jun 20 12:56:00 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 20 10:43:18 2013 -0800" }, "message": "PCI: fix truncation of resource size to 32 bits\n\ncommit d6776e6d5c2f8db0252f447b09736075e1bbe387 upstream.\n\n_pci_assign_resource() took an int \"size\" argument, which meant that\nsizes larger than 4GB were truncated. Change type to resource_size_t.\n\n[bhelgaas: changelog]\nSigned-off-by: Nikhil P Rao \u003cnikhil.rao@intel.com\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nCc: Jiri Slaby \u003cjslaby@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "161f4a458cd88dc6ab33078d64aa28315129fade", "tree": "f8058dd4997ff9dd603d07a57945810b09f0db5f", "parents": [ "2b58df72acb8525ea75947e75d2e79f76b240cca" ], "author": { "name": "Jason Wang", "email": "jasowang@redhat.com", "time": "Fri Nov 01 15:01:10 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 20 10:43:18 2013 -0800" }, "message": "net: flow_dissector: fail on evil iph-\u003eihl\n\n[ Upstream commit 6f092343855a71e03b8d209815d8c45bf3a27fcd ]\n\nWe don\u0027t validate iph-\u003eihl which may lead a dead loop if we meet a IPIP\nskb whose iph-\u003eihl is zero. Fix this by failing immediately when iph-\u003eihl\nis evil (less than 5).\n\nThis issue were introduced by commit ec5efe7946280d1e84603389a1030ccec0a767ae\n(rps: support IPIP encapsulation).\n\nSigned-off-by: Jason Wang \u003cjasowang@redhat.com\u003e\nCc: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Petr Matousek \u003cpmatouse@redhat.com\u003e\nCc: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nCc: Daniel Borkmann \u003cdborkman@redhat.com\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "2b58df72acb8525ea75947e75d2e79f76b240cca", "tree": "09190c9e3caa3ee205cc9fdcf07328a37f3311f6", "parents": [ "14aa272fcd1cdbe7173073250c767bc7a37278ce" ], "author": { "name": "Wei Liu", "email": "wei.liu2@citrix.com", "time": "Mon Oct 28 12:07:57 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 20 10:43:18 2013 -0800" }, "message": "xen-netback: use jiffies_64 value to calculate credit timeout\n\n[ Upstream commit 059dfa6a93b779516321e5112db9d7621b1367ba ]\n\ntime_after_eq() only works if the delta is \u003c MAX_ULONG/2.\n\nFor a 32bit Dom0, if netfront sends packets at a very low rate, the time\nbetween subsequent calls to tx_credit_exceeded() may exceed MAX_ULONG/2\nand the test for timer_after_eq() will be incorrect. Credit will not be\nreplenished and the guest may become unable to send packets (e.g., if\nprior to the long gap, all credit was exhausted).\n\nUse jiffies_64 variant to mitigate this problem for 32bit Dom0.\n\nSuggested-by: Jan Beulich \u003cjbeulich@suse.com\u003e\nSigned-off-by: Wei Liu \u003cwei.liu2@citrix.com\u003e\nReviewed-by: David Vrabel \u003cdavid.vrabel@citrix.com\u003e\nCc: Ian Campbell \u003cian.campbell@citrix.com\u003e\nCc: Jason Luan \u003cjianhai.luan@oracle.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "14aa272fcd1cdbe7173073250c767bc7a37278ce", "tree": "2b4984ca4b7d014aac0cb81a40d6fa267c773c3b", "parents": [ "69ef8f446862dd467bd9da111c3a8c17446d74b6" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:02:08 2013 +0900" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:02:08 2013 +0900" }, "message": "Linux 3.4.69\n" }, { "commit": "69ef8f446862dd467bd9da111c3a8c17446d74b6", "tree": "3fc20359596a0f2f6454643780152deedb99b1c0", "parents": [ "b6a155c67112746f43d8f9c86dfc426dd455060f" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 10 16:45:27 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:49 2013 +0900" }, "message": "drm/radeon/atom: workaround vbios bug in transmitter table on rs780\n\ncommit c23632d4e57c0dd20bf50eca08fa0eb8ad3ff680 upstream.\n\nSome rs780 asics seem to be affected as well.\n\nSee:\nhttp://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id\u003d91f3a6aaf280294b07c05dfe606e6c27b7ba3c72\n\nFixes:\nhttps://bugzilla.kernel.org/show_bug.cgi?id\u003d60791\n\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b6a155c67112746f43d8f9c86dfc426dd455060f", "tree": "f5918a374645b531ed0147a75731a5731d4bc6dc", "parents": [ "b07ef016454ff46f98e633b5a6247ca7e343fb67" ], "author": { "name": "Chris Wilson", "email": "chris@chris-wilson.co.uk", "time": "Wed Oct 16 11:22:44 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:49 2013 +0900" }, "message": "drm: Prevent overwriting from userspace underallocating core ioctl structs\n\ncommit b062672e305ce071f21eb9e18b102c2a430e0999 upstream.\n\nApply the protections from\n\ncommit 1b2f1489633888d4a06028315dc19d65768a1c05\nAuthor: Dave Airlie \u003cairlied@redhat.com\u003e\nDate: Sat Aug 14 20:20:34 2010 +1000\n\n drm: block userspace under allocating buffer and having drivers overwrite it (v2)\n\nto the core ioctl structs as well, for we found one instance where there\nis a 32-/64-bit size mismatch and were guilty of writing beyond the end\nof the user\u0027s buffer.\n\nSigned-off-by: Chris Wilson \u003cchris@chris-wilson.co.uk\u003e\nCc: Dave Airlie \u003cairlied@redhat.com\u003e\nReviewed-by: Ville Syrjälä \u003cville.syrjala@linux.intel.com\u003e\nCc: dri-devel@lists.freedesktop.org\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b07ef016454ff46f98e633b5a6247ca7e343fb67", "tree": "0bf6063dd93e4186cc9c2d0b2c72a43c74c787f1", "parents": [ "8c16bfc9ef0f2353e55b6d44fe6f2fddc76260d7" ], "author": { "name": "Khalid Aziz", "email": "khalid.aziz@oracle.com", "time": "Wed Sep 11 14:22:20 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:49 2013 +0900" }, "message": "mm: fix aio performance regression for database caused by THP\n\ncommit 7cb2ef56e6a8b7b368b2e883a0a47d02fed66911 upstream.\n\nI am working with a tool that simulates oracle database I/O workload.\nThis tool (orion to be specific -\n\u003chttp://docs.oracle.com/cd/E11882_01/server.112/e16638/iodesign.htm#autoId24\u003e)\nallocates hugetlbfs pages using shmget() with SHM_HUGETLB flag. It then\ndoes aio into these pages from flash disks using various common block\nsizes used by database. I am looking at performance with two of the most\ncommon block sizes - 1M and 64K. aio performance with these two block\nsizes plunged after Transparent HugePages was introduced in the kernel.\nHere are performance numbers:\n\n\t\tpre-THP\t\t2.6.39\t\t3.11-rc5\n1M read\t\t8384 MB/s\t5629 MB/s\t6501 MB/s\n64K read\t7867 MB/s\t4576 MB/s\t4251 MB/s\n\nI have narrowed the performance impact down to the overheads introduced by\nTHP in __get_page_tail() and put_compound_page() routines. perf top shows\n\u003e40% of cycles being spent in these two routines. Every time direct I/O\nto hugetlbfs pages starts, kernel calls get_page() to grab a reference to\nthe pages and calls put_page() when I/O completes to put the reference\naway. THP introduced significant amount of locking overhead to get_page()\nand put_page() when dealing with compound pages because hugepages can be\nsplit underneath get_page() and put_page(). It added this overhead\nirrespective of whether it is dealing with hugetlbfs pages or transparent\nhugepages. This resulted in 20%-45% drop in aio performance when using\nhugetlbfs pages.\n\nSince hugetlbfs pages can not be split, there is no reason to go through\nall the locking overhead for these pages from what I can see. I added\ncode to __get_page_tail() and put_compound_page() to bypass all the\nlocking code when working with hugetlbfs pages. This improved performance\nsignificantly. Performance numbers with this patch:\n\n\t\tpre-THP\t\t3.11-rc5\t3.11-rc5 + Patch\n1M read\t\t8384 MB/s\t6501 MB/s\t8371 MB/s\n64K read\t7867 MB/s\t4251 MB/s\t6510 MB/s\n\nPerformance with 64K read is still lower than what it was before THP, but\nstill a 53% improvement. It does mean there is more work to be done but I\nwill take a 53% improvement for now.\n\nPlease take a look at the following patch and let me know if it looks\nreasonable.\n\n[akpm@linux-foundation.org: tweak comments]\nSigned-off-by: Khalid Aziz \u003ckhalid.aziz@oracle.com\u003e\nCc: Pravin B Shelar \u003cpshelar@nicira.com\u003e\nCc: Christoph Lameter \u003ccl@linux.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Johannes Weiner \u003channes@cmpxchg.org\u003e\nCc: Mel Gorman \u003cmel@csn.ul.ie\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Minchan Kim \u003cminchan@kernel.org\u003e\nCc: Andi Kleen \u003candi@firstfloor.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8c16bfc9ef0f2353e55b6d44fe6f2fddc76260d7", "tree": "15922842983cd126cea92a8878700cebcff498ab", "parents": [ "366f8a3ab0757921c4a925f7248e8c3f120305f9" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Tue Oct 29 22:11:06 2013 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:49 2013 +0900" }, "message": "aacraid: missing capable() check in compat ioctl\n\ncommit f856567b930dfcdbc3323261bf77240ccdde01f5 upstream.\n\nIn commit d496f94d22d1 (\u0027[SCSI] aacraid: fix security weakness\u0027) we\nadded a check on CAP_SYS_RAWIO to the ioctl. The compat ioctls need the\ncheck as well.\n\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "366f8a3ab0757921c4a925f7248e8c3f120305f9", "tree": "93fe862e9cd6a7fbf07894442452f15c8f541855", "parents": [ "10ff8e6bf05b639df6d68abe5351be5d0cc18e4d" ], "author": { "name": "Ming Lei", "email": "ming.lei@canonical.com", "time": "Thu Oct 31 16:34:17 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:49 2013 +0900" }, "message": "lib/scatterlist.c: don\u0027t flush_kernel_dcache_page on slab page\n\ncommit 3d77b50c5874b7e923be946ba793644f82336b75 upstream.\n\nCommit b1adaf65ba03 (\"[SCSI] block: add sg buffer copy helper\nfunctions\") introduces two sg buffer copy helpers, and calls\nflush_kernel_dcache_page() on pages in SG list after these pages are\nwritten to.\n\nUnfortunately, the commit may introduce a potential bug:\n\n - Before sending some SCSI commands, kmalloc() buffer may be passed to\n block layper, so flush_kernel_dcache_page() can see a slab page\n finally\n\n - According to cachetlb.txt, flush_kernel_dcache_page() is only called\n on \"a user page\", which surely can\u0027t be a slab page.\n\n - ARCH\u0027s implementation of flush_kernel_dcache_page() may use page\n mapping information to do optimization so page_mapping() will see the\n slab page, then VM_BUG_ON() is triggered.\n\nAaro Koskinen reported the bug on ARM/kirkwood when DEBUG_VM is enabled,\nand this patch fixes the bug by adding test of \u0027!PageSlab(miter-\u003epage)\u0027\nbefore calling flush_kernel_dcache_page().\n\nSigned-off-by: Ming Lei \u003cming.lei@canonical.com\u003e\nReported-by: Aaro Koskinen \u003caaro.koskinen@iki.fi\u003e\nTested-by: Simon Baatz \u003cgmbnomis@gmail.com\u003e\nCc: Russell King - ARM Linux \u003clinux@arm.linux.org.uk\u003e\nCc: Will Deacon \u003cwill.deacon@arm.com\u003e\nCc: Aaro Koskinen \u003caaro.koskinen@iki.fi\u003e\nAcked-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nCc: FUJITA Tomonori \u003cfujita.tomonori@lab.ntt.co.jp\u003e\nCc: Tejun Heo \u003ctj@kernel.org\u003e\nCc: \"James E.J. Bottomley\" \u003cJBottomley@parallels.com\u003e\nCc: Jens Axboe \u003caxboe@kernel.dk\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "10ff8e6bf05b639df6d68abe5351be5d0cc18e4d", "tree": "2075a04c84f16892aab8ecf504d74b80d7ba05e8", "parents": [ "cc51af932905754ad594f8d1fc02d61073b7236f" ], "author": { "name": "Baruch Siach", "email": "baruch@tkos.co.il", "time": "Tue Oct 15 02:22:43 2013 +0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:49 2013 +0900" }, "message": "xtensa: don\u0027t use alternate signal stack on threads\n\ncommit cba9a90053e3b7973eff4f1946f33032e98eeed5 upstream.\n\nAccording to create_thread(3): \"The new thread does not inherit the creating\nthread\u0027s alternate signal stack\". Since commit f9a3879a (Fix sigaltstack\ncorruption among cloned threads), current-\u003esas_ss_size is set to 0 for cloned\nprocesses sharing VM with their parent. Don\u0027t use the (nonexistent) alternate\nsignal stack in this case. This has been broken since commit 29c4dfd9 ([XTENSA]\nRemove non-rt signal handling).\n\nFixes the SA_ONSTACK part of the nptl/tst-cancel20 test from uClibc.\n\nSigned-off-by: Baruch Siach \u003cbaruch@tkos.co.il\u003e\nSigned-off-by: Max Filippov \u003cjcmvbkbc@gmail.com\u003e\nSigned-off-by: Chris Zankel \u003cchris@zankel.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "cc51af932905754ad594f8d1fc02d61073b7236f", "tree": "023afccd4a608a0d7e0564082bfc9a79eb626908", "parents": [ "8c373c185f096a93a70f7ebba792cb16f2a8530e" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Tue Oct 29 22:06:04 2013 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:49 2013 +0900" }, "message": "uml: check length in exitcode_proc_write()\n\ncommit 201f99f170df14ba52ea4c52847779042b7a623b upstream.\n\nWe don\u0027t cap the size of buffer from the user so we could write past the\nend of the array here. Only root can write to this file.\n\nReported-by: Nico Golde \u003cnico@ngolde.de\u003e\nReported-by: Fabian Yamaguchi \u003cfabs@goesec.de\u003e\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8c373c185f096a93a70f7ebba792cb16f2a8530e", "tree": "7fac31fb58a59ddecd88df0890136badcfc3e2c8", "parents": [ "8c4ff75c8345b3463a4a76af942ee2d401ccf2e2" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Tue Oct 29 23:01:11 2013 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:49 2013 +0900" }, "message": "Staging: bcm: info leak in ioctl\n\ncommit 8d1e72250c847fa96498ec029891de4dc638a5ba upstream.\n\nThe DevInfo.u32Reserved[] array isn\u0027t initialized so it leaks kernel\ninformation to user space.\n\nReported-by: Nico Golde \u003cnico@ngolde.de\u003e\nReported-by: Fabian Yamaguchi \u003cfabs@goesec.de\u003e\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8c4ff75c8345b3463a4a76af942ee2d401ccf2e2", "tree": "a57fccdf48dd5dfc8e15618b6c396fed9c9342b8", "parents": [ "827a291cb0f3979c05f985fd553e1795d8fe3818" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Tue Oct 29 22:07:47 2013 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:49 2013 +0900" }, "message": "staging: ozwpan: prevent overflow in oz_cdev_write()\n\ncommit c2c65cd2e14ada6de44cb527e7f1990bede24e15 upstream.\n\nWe need to check \"count\" so we don\u0027t overflow the ei-\u003edata buffer.\n\nReported-by: Nico Golde \u003cnico@ngolde.de\u003e\nReported-by: Fabian Yamaguchi \u003cfabs@goesec.de\u003e\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "827a291cb0f3979c05f985fd553e1795d8fe3818", "tree": "582f2da5ea4f22f6dc50e780374549a2915e9fbf", "parents": [ "b187d81c10722b118c9a84fc5518cf062f6d9e7f" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Mon Oct 28 14:21:49 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:49 2013 +0900" }, "message": "ASoC: dapm: Fix source list debugfs outputs\n\ncommit ff18620c2157671a8ee21ebb8e6a3520ea209b1f upstream.\n\n... due to a copy \u0026 paste error.\n\nSpotted by coverity CID 710923.\n\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Mark Brown \u003cbroonie@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b187d81c10722b118c9a84fc5518cf062f6d9e7f", "tree": "6dfcc5300fbfcbfaa24542418c44a9e7d80e79db", "parents": [ "5812381adfde20cb352d3047190ab45ea5bb59f2" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Oct 30 08:35:02 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:49 2013 +0900" }, "message": "ASoC: wm_hubs: Add missing break in hp_supply_event()\n\ncommit 268ff14525edba31da29a12a9dd693cdd6a7872e upstream.\n\nSpotted by coverity CID 115170.\n\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Mark Brown \u003cbroonie@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5812381adfde20cb352d3047190ab45ea5bb59f2", "tree": "62032d72f83f7cbf1722ade909de4d3e45848d7b", "parents": [ "014c0d018c43e8ee99a46fbbbe387677ac3b9907" ], "author": { "name": "Russell King", "email": "rmk+kernel@arm.linux.org.uk", "time": "Thu Oct 31 15:01:37 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:49 2013 +0900" }, "message": "ALSA: fix oops in snd_pcm_info() caused by ASoC DPCM\n\ncommit a4461f41b94cb52e0141af717dcf4ef6558c8e2e upstream.\n\nUnable to handle kernel NULL pointer dereference at virtual address 00000008\npgd \u003d d5300000\n[00000008] *pgd\u003d0d265831, *pte\u003d00000000, *ppte\u003d00000000\nInternal error: Oops: 17 [#1] PREEMPT ARM\nCPU: 0 PID: 2295 Comm: vlc Not tainted 3.11.0+ #755\ntask: dee74800 ti: e213c000 task.ti: e213c000\nPC is at snd_pcm_info+0xc8/0xd8\nLR is at 0x30232065\npc : [\u003cc031b52c\u003e] lr : [\u003c30232065\u003e] psr: a0070013\nsp : e213dea8 ip : d81cb0d0 fp : c05f7678\nr10: c05f7770 r9 : fffffdfd r8 : 00000000\nr7 : d8a968a8 r6 : d8a96800 r5 : d8a96200 r4 : d81cb000\nr3 : 00000000 r2 : d81cb000 r1 : 00000001 r0 : d8a96200\nFlags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user\nControl: 10c5387d Table: 15300019 DAC: 00000015\nProcess vlc (pid: 2295, stack limit \u003d 0xe213c248)\n[\u003cc031b52c\u003e] (snd_pcm_info) from [\u003cc031b570\u003e] (snd_pcm_info_user+0x34/0x9c)\n[\u003cc031b570\u003e] (snd_pcm_info_user) from [\u003cc03164a4\u003e] (snd_pcm_control_ioctl+0x274/0x280)\n[\u003cc03164a4\u003e] (snd_pcm_control_ioctl) from [\u003cc0311458\u003e] (snd_ctl_ioctl+0xc0/0x55c)\n[\u003cc0311458\u003e] (snd_ctl_ioctl) from [\u003cc00eca84\u003e] (do_vfs_ioctl+0x80/0x31c)\n[\u003cc00eca84\u003e] (do_vfs_ioctl) from [\u003cc00ecd5c\u003e] (SyS_ioctl+0x3c/0x60)\n[\u003cc00ecd5c\u003e] (SyS_ioctl) from [\u003cc000e500\u003e] (ret_fast_syscall+0x0/0x48)\nCode: e1a00005 e59530dc e3a01001 e1a02004 (e5933008)\n---[ end trace cb3d9bdb8dfefb3c ]---\n\nThis is provoked when the ASoC front end is open along with its backend,\n(which causes the backend to have a runtime assigned to it) and then the\nSNDRV_CTL_IOCTL_PCM_INFO is requested for the (visible) backend device.\n\nResolve this by ensuring that ASoC internal backend devices are not\nvisible to userspace, just as the commentry for snd_pcm_new_internal()\nsays it should be.\n\nSigned-off-by: Russell King \u003crmk+kernel@arm.linux.org.uk\u003e\nAcked-by: Mark Brown \u003cbroonie@linaro.org\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "014c0d018c43e8ee99a46fbbbe387677ac3b9907", "tree": "90f91ccc819999c975e572452f4345d4b658de9d", "parents": [ "1099a507a89854b10c867f953761940b80b01433" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Oct 30 12:29:40 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:49 2013 +0900" }, "message": "ALSA: hda - Add a fixup for ASUS N76VZ\n\ncommit 6fc16e58adf50c0f1e4478538983fb5ff6f453d4 upstream.\n\nASUS N76VZ needs the same fixup as N56VZ for supporting the boost\nspeaker.\n\nBugzilla: https://bugzilla.novell.com/show_bug.cgi?id\u003d846529\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1099a507a89854b10c867f953761940b80b01433", "tree": "6227a1d55ac204df6229080a0739f652a9596b3c", "parents": [ "f81d0a99446a0c4548d5783807529d075b06c64e" ], "author": { "name": "Helge Deller", "email": "deller@gmx.de", "time": "Sat Oct 26 23:19:25 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:49 2013 +0900" }, "message": "parisc: Do not crash 64bit SMP kernels on machines with \u003e\u003d 4GB RAM\n\ncommit 54e181e073fc1415e41917d725ebdbd7de956455 upstream.\n\nSince the beginning of the parisc-linux port, sometimes 64bit SMP kernels were\nnot able to bring up other CPUs than the monarch CPU and instead crashed the\nkernel. The reason was unclear, esp. since it involved various machines (e.g.\nJ5600, J6750 and SuperDome). Testing showed, that those crashes didn\u0027t happened\nwhen less than 4GB were installed, or if a 32bit Linux kernel was booted.\n\nIn the end, the fix for those SMP problems is trivial:\nDuring the early phase of the initialization of the CPUs, including the monarch\nCPU, the PDC_PSW firmware function to enable WIDE (\u003d64bit) mode is called.\nIt\u0027s documented that this firmware function may clobber various registers, and\none one of those possibly clobbered registers is %cr30 which holds the task\nthread info pointer.\n\nNow, if %cr30 would always have been clobbered, then this bug would have been\ndetected much earlier. But lots of testing finally showed, that - at least for\n%cr30 - on some machines only the upper 32bits of the 64bit register suddenly\nturned zero after the firmware call.\n\nSo, after finding the root cause, the explanation for the various crashes\nbecame clear:\n- On 32bit SMP Linux kernels all upper 32bit were zero, so we didn\u0027t faced this\n problem.\n- Monarch CPUs in 64bit mode always booted sucessfully, because the inital task\n thread info pointer was below 4GB.\n- Secondary CPUs booted sucessfully on machines with less than 4GB RAM because\n the upper 32bit were zero anyay.\n- Secondary CPus failed to boot if we had more than 4GB RAM and the task thread\n info pointer was located above the 4GB boundary.\n\nFinally, the patch to fix this problem is trivial by saving the %cr30 register\nbefore the firmware call and restoring it afterwards.\n\nSigned-off-by: Helge Deller \u003cdeller@gmx.de\u003e\nSigned-off-by: John David Anglin \u003cdave.anglin@bell.net\u003e\nSigned-off-by: Helge Deller \u003cdeller@gmx.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f81d0a99446a0c4548d5783807529d075b06c64e", "tree": "b0697e8167ee4daf0d8b66f38270670498998f20", "parents": [ "268417aeea96a1941c2cd14f0f8b5b39c374ad25" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Tue Sep 24 21:50:23 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:48 2013 +0900" }, "message": "clockevents: Sanitize ticks to nsec conversion\n\ncommit 97b9410643475d6557d2517c2aff9fd2221141a9 upstream.\n\nMarc Kleine-Budde pointed out, that commit 77cc982 \"clocksource: use\nclockevents_config_and_register() where possible\" caused a regression\nfor some of the converted subarchs.\n\nThe reason is, that the clockevents core code converts the minimal\nhardware tick delta to a nanosecond value for core internal\nusage. This conversion is affected by integer math rounding loss, so\nthe backwards conversion to hardware ticks will likely result in a\nvalue which is less than the configured hardware limitation. The\naffected subarchs used their own workaround (SIGH!) which got lost in\nthe conversion.\n\nThe solution for the issue at hand is simple: adding evt-\u003emult - 1 to\nthe shifted value before the integer divison in the core conversion\nfunction takes care of it. But this only works for the case where for\nthe scaled math mult/shift pair \"mult \u003c\u003d 1 \u003c\u003c shift\" is true. For the\ncase where \"mult \u003e 1 \u003c\u003c shift\" we can apply the rounding add only for\nthe minimum delta value to make sure that the backward conversion is\nnot less than the given hardware limit. For the upper bound we need to\nomit the rounding add, because the backwards conversion is always\nlarger than the original latch value. That would violate the upper\nbound of the hardware device.\n\nThough looking closer at the details of that function reveals another\nbogosity: The upper bounds check is broken as well. Checking for a\nresulting \"clc\" value greater than KTIME_MAX after the conversion is\npointless. The conversion does:\n\n u64 clc \u003d (latch \u003c\u003c evt-\u003eshift) / evt-\u003emult;\n\nSo there is no sanity check for (latch \u003c\u003c evt-\u003eshift) exceeding the\n64bit boundary. The latch argument is \"unsigned long\", so on a 64bit\narch the handed in argument could easily lead to an unnoticed shift\noverflow. With the above rounding fix applied the calculation before\nthe divison is:\n\n u64 clc \u003d (latch \u003c\u003c evt-\u003eshift) + evt-\u003emult - 1;\n\nSo we need to make sure, that neither the shift nor the rounding add\nis overflowing the u64 boundary.\n\n[ukl: move assignment to rnd after eventually changing mult, fix build\n issue and correct comment with the right math]\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Russell King - ARM Linux \u003clinux@arm.linux.org.uk\u003e\nCc: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\nCc: nicolas.ferre@atmel.com\nCc: Marc Pignat \u003cmarc.pignat@hevs.ch\u003e\nCc: john.stultz@linaro.org\nCc: kernel@pengutronix.de\nCc: Ronald Wahl \u003cronald.wahl@raritan.com\u003e\nCc: LAK \u003clinux-arm-kernel@lists.infradead.org\u003e\nCc: Ludovic Desroches \u003cludovic.desroches@atmel.com\u003e\nLink: http://lkml.kernel.org/r/1380052223-24139-1-git-send-email-u.kleine-koenig@pengutronix.de\nSigned-off-by: Uwe Kleine-König \u003cu.kleine-koenig@pengutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "268417aeea96a1941c2cd14f0f8b5b39c374ad25", "tree": "1ecf8a31d004e68f12040642dde8a31ddd9beb50", "parents": [ "49028693152b88ae7ab2d444df7f73d2f0e3bbfd" ], "author": { "name": "Lukasz Dorau", "email": "lukasz.dorau@intel.com", "time": "Thu Oct 24 12:55:17 2013 +1100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:48 2013 +0900" }, "message": "md: Fix skipping recovery for read-only arrays.\n\ncommit 61e4947c99c4494336254ec540c50186d186150b upstream.\n\nSince:\n commit 7ceb17e87bde79d285a8b988cfed9eaeebe60b86\n md: Allow devices to be re-added to a read-only array.\n\nspares are activated on a read-only array. In case of raid1 and raid10\npersonalities it causes that not-in-sync devices are marked in-sync\nwithout checking if recovery has been finished.\n\nIf a read-only array is degraded and one of its devices is not in-sync\n(because the array has been only partially recovered) recovery will be skipped.\n\nThis patch adds checking if recovery has been finished before marking a device\nin-sync for raid1 and raid10 personalities. In case of raid5 personality\nsuch condition is already present (at raid5.c:6029).\n\nBug was introduced in 3.10 and causes data corruption.\n\nSigned-off-by: Pawel Baldysiak \u003cpawel.baldysiak@intel.com\u003e\nSigned-off-by: Lukasz Dorau \u003clukasz.dorau@intel.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "49028693152b88ae7ab2d444df7f73d2f0e3bbfd", "tree": "fe22a3f75517e65011aa18755d7c310a2f9179b5", "parents": [ "f49c173bb693fa2aea6c96c931f9449ce4885d7b" ], "author": { "name": "Gwendal Grignou", "email": "gwendal@google.com", "time": "Fri Aug 07 16:17:49 2009 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:48 2013 +0900" }, "message": "libata: make ata_eh_qc_retry() bump scmd-\u003eallowed on bogus failures\n\ncommit f13e220161e738c2710b9904dcb3cf8bb0bcce61 upstream.\n\nlibata EH decrements scmd-\u003eretries when the command failed for reasons\nunrelated to the command itself so that, for example, commands aborted\ndue to suspend / resume cycle don\u0027t get penalized; however,\ndecrementing scmd-\u003eretries isn\u0027t enough for ATA passthrough commands.\n\nWithout this fix, ATA passthrough commands are not resend to the\ndrive, and no error is signalled to the caller because:\n\n- allowed retry count is 1\n- ata_eh_qc_complete fill the sense data, so result is valid\n- sense data is filled with untouched ATA registers.\n\nSigned-off-by: Gwendal Grignou \u003cgwendal@google.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f49c173bb693fa2aea6c96c931f9449ce4885d7b", "tree": "6614dba7f2bb2621417c10eda48e790e3eb376bb", "parents": [ "20b2a1eb2de54d0fce4dee198546cc448589dad8" ], "author": { "name": "Marc Kleine-Budde", "email": "mkl@pengutronix.de", "time": "Fri Oct 04 10:52:36 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:48 2013 +0900" }, "message": "can: flexcan: flexcan_chip_start: fix regression, mark one MB for TX and abort pending TX\n\ncommit d5a7b406c529e4595ce03dc8f6dcf7fa36f106fa upstream.\n\nIn patch\n\n 0d1862e can: flexcan: fix flexcan_chip_start() on imx6\n\nthe loop in flexcan_chip_start() that iterates over all mailboxes after the\nsoft reset of the CAN core was removed. This loop put all mailboxes (even the\nones marked as reserved 1...7) into EMPTY/INACTIVE mode. On mailboxes 8...63,\nthis aborts any pending TX messages.\n\nAfter a cold boot there is random garbage in the mailboxes, which leads to\nspontaneous transmit of CAN frames during first activation. Further if the\ninterface was disabled with a pending message (usually due to an error\ncondition on the CAN bus), this message is retransmitted after enabling the\ninterface again.\n\nThis patch fixes the regression by:\n1) Limiting the maximum number of used mailboxes to 8, 0...7 are used by the RX\nFIFO, 8 is used by TX.\n2) Marking the TX mailbox as EMPTY/INACTIVE, so that any pending TX of that\nmailbox is aborted.\n\nCc: Lothar Waßmann \u003cLW@KARO-electronics.de\u003e\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "20b2a1eb2de54d0fce4dee198546cc448589dad8", "tree": "46fa8e5282020453e9cefe42f8bef7d5c1db2552", "parents": [ "9fda0bdd950b09c42e26cc7e19590ce62e842fee" ], "author": { "name": "Dave Kleikamp", "email": "dave.kleikamp@oracle.com", "time": "Fri Sep 06 21:49:56 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:48 2013 +0900" }, "message": "jfs: fix error path in ialloc\n\ncommit 8660998608cfa1077e560034db81885af8e1e885 upstream.\n\nIf insert_inode_locked() fails, we shouldn\u0027t be calling\nunlock_new_inode().\n\nSigned-off-by: Dave Kleikamp \u003cdave.kleikamp@oracle.com\u003e\nTested-by: Michael L. Semon \u003cmlsemon35@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9fda0bdd950b09c42e26cc7e19590ce62e842fee", "tree": "327489988e7fecde6cd192fa97df9ec4d23e3a2c", "parents": [ "48cca8f206801410760e7dc5abaa361c3fdba10a" ], "author": { "name": "Mark Cave-Ayland", "email": "mark.cave-ayland@ilande.co.uk", "time": "Tue Oct 08 10:18:20 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:48 2013 +0900" }, "message": "rtlwifi: rtl8192cu: Fix error in pointer arithmetic\n\ncommit 9473ca6e920a3b9ca902753ce52833657f9221cc upstream.\n\nAn error in calculating the offset in an skb causes the driver to read\nessential device info from the wrong locations. The main effect is that\nautomatic gain calculations are nonsense.\n\nSigned-off-by: Mark Cave-Ayland \u003cmark.cave-ayland@ilande.co.uk\u003e\nSigned-off-by: Larry Finger \u003cLarry.Finger@lwfinger.net\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "48cca8f206801410760e7dc5abaa361c3fdba10a", "tree": "08f875f5b28686ac27ea4142a8e927da36edac7b", "parents": [ "b9ef1eea8bc243c4435c85ea5a30c647ea19995a" ], "author": { "name": "Felix Fietkau", "email": "nbd@openwrt.org", "time": "Sun Sep 29 21:39:34 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:48 2013 +0900" }, "message": "mac80211: update sta-\u003elast_rx on acked tx frames\n\ncommit 0c5b93290b2f3c7a376567c03ae8d385b0e99851 upstream.\n\nWhen clients are idle for too long, hostapd sends nullfunc frames for\nprobing. When those are acked by the client, the idle time needs to be\nupdated.\n\nTo make this work (and to avoid unnecessary probing), update sta-\u003elast_rx\nwhenever an ACK was received for a tx packet. Only do this if the flag\nIEEE80211_HW_REPORTS_TX_ACK_STATUS is set.\n\nSigned-off-by: Felix Fietkau \u003cnbd@openwrt.org\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b9ef1eea8bc243c4435c85ea5a30c647ea19995a", "tree": "a6fac05862d731b40e7f43640803e27421c60de8", "parents": [ "609a45c1bbd45beb7a042b09488f1f971f4a2999" ], "author": { "name": "Emmanuel Grumbach", "email": "emmanuel.grumbach@intel.com", "time": "Mon Sep 16 11:12:07 2013 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:48 2013 +0900" }, "message": "mac80211: correctly close cancelled scans\n\ncommit a754055a1296fcbe6f32de3a5eaca6efb2fd1865 upstream.\n\n__ieee80211_scan_completed is called from a worker. This\nmeans that the following flow is possible.\n\n * driver calls ieee80211_scan_completed\n * mac80211 cancels the scan (that is already complete)\n * __ieee80211_scan_completed runs\n\nWhen scan_work will finally run, it will see that the scan\nhasn\u0027t been aborted and might even trigger another scan on\nanother band. This leads to a situation where cfg80211\u0027s\nscan is not done and no further scan can be issued.\n\nFix this by setting a new flag when a HW scan is being\ncancelled so that no other scan will be triggered.\n\nSigned-off-by: Emmanuel Grumbach \u003cemmanuel.grumbach@intel.com\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "609a45c1bbd45beb7a042b09488f1f971f4a2999", "tree": "a76d3749c7c953263cbf712bc7946150f6b507ae", "parents": [ "1a86db5aa1235625049b9c7676e759206654fd16" ], "author": { "name": "Алексей Крамаренко", "email": "alexeyk13@yandex.ru", "time": "Fri Nov 01 17:26:38 2013 +0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:48 2013 +0900" }, "message": "USB: serial: ftdi_sio: add id for Z3X Box device\n\ncommit e1466ad5b1aeda303f9282463d55798d2eda218c upstream.\n\nCustom VID/PID for Z3X Box device, popular tool for cellphone flashing.\n\nSigned-off-by: Alexey E. Kramarenko \u003calexeyk13@yandex.ru\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1a86db5aa1235625049b9c7676e759206654fd16", "tree": "1c9a58aa631208c4bf96df2f0208a009e7d8f998", "parents": [ "76d83ad79046e19a5fdc7f0946d845fe3f099ac2" ], "author": { "name": "Oliver Neukum", "email": "oneukum@suse.de", "time": "Wed Oct 16 12:26:07 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:47 2013 +0900" }, "message": "USB: quirks: add touchscreen that is dazzeled by remote wakeup\n\ncommit 614ced91fc6fbb5a1cdd12f0f1b6c9197d9f1350 upstream.\n\nThe device descriptors are messed up after remote wakeup\n\nSigned-off-by: Oliver Neukum \u003coneukum@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" } ], "next": "76d83ad79046e19a5fdc7f0946d845fe3f099ac2" }