)]}' { "log": [ { "commit": "7bf0aee237176a3edcd054b80dba2dad3e2be7ff", "tree": "13ea381ebc701d1c0004ace18980530d48e3c116", "parents": [ "d16beab575e17e46a4b187fb9f8211fab3adfbae" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Mon May 12 20:45:34 2014 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:02:00 2014 -0700" }, "message": "futex: Add another early deadlock detection check\n\ncommit 866293ee54227584ffcb4a42f69c1f365974ba7f upstream.\n\nDave Jones trinity syscall fuzzer exposed an issue in the deadlock\ndetection code of rtmutex:\n http://lkml.kernel.org/r/20140429151655.GA14277@redhat.com\n\nThat underlying issue has been fixed with a patch to the rtmutex code,\nbut the futex code must not call into rtmutex in that case because\n - it can detect that issue early\n - it avoids a different and more complex fixup for backing out\n\nIf the user space variable got manipulated to 0x80000000 which means\nno lock holder, but the waiters bit set and an active pi_state in the\nkernel is found we can figure out the recursive locking issue by\nlooking at the pi_state owner. If that is the current task, then we\ncan safely return -EDEADLK.\n\nThe check should have been added in commit 59fa62451 (futex: Handle\nfutex_pi OWNER_DIED take over correctly) already, but I did not see\nthe above issue caused by user space manipulation back then.\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Dave Jones \u003cdavej@redhat.com\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Darren Hart \u003cdarren@dvhart.com\u003e\nCc: Davidlohr Bueso \u003cdavidlohr@hp.com\u003e\nCc: Steven Rostedt \u003crostedt@goodmis.org\u003e\nCc: Clark Williams \u003cwilliams@redhat.com\u003e\nCc: Paul McKenney \u003cpaulmck@linux.vnet.ibm.com\u003e\nCc: Lai Jiangshan \u003claijs@cn.fujitsu.com\u003e\nCc: Roland McGrath \u003croland@hack.frob.com\u003e\nCc: Carlos ODonell \u003ccarlos@redhat.com\u003e\nCc: Jakub Jelinek \u003cjakub@redhat.com\u003e\nCc: Michael Kerrisk \u003cmtk.manpages@gmail.com\u003e\nCc: Sebastian Andrzej Siewior \u003cbigeasy@linutronix.de\u003e\nLink: http://lkml.kernel.org/r/20140512201701.097349971@linutronix.de\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d16beab575e17e46a4b187fb9f8211fab3adfbae", "tree": "03d690603fd7481aa2c01373cd95562bf69e371d", "parents": [ "1102122b2bdf4307cae269c725fab4c9c6141f5b" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Apr 03 09:28:10 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:02:00 2014 -0700" }, "message": "net-gro: reset skb-\u003etruesize in napi_reuse_skb()\n\n[ Upstream commit e33d0ba8047b049c9262fdb1fcafb93cb52ceceb ]\n\nRecycling skb always had been very tough...\n\nThis time it appears GRO layer can accumulate skb-\u003etruesize\nadjustments made by drivers when they attach a fragment to skb.\n\nskb_gro_receive() can only subtract from skb-\u003etruesize the used part\nof a fragment.\n\nI spotted this problem seeing TcpExtPruneCalled and\nTcpExtTCPRcvCollapsed that were unexpected with a recent kernel, where\nTCP receive window should be sized properly to accept traffic coming\nfrom a driver not overshooting skb-\u003etruesize.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "1102122b2bdf4307cae269c725fab4c9c6141f5b", "tree": "7e0f789b3587400fd8369a0266c5e7013696ab10", "parents": [ "62e1a647e74f708eeabf1c79f3d40833d8ce45eb" ], "author": { "name": "Alexander Duyck", "email": "alexander.h.duyck@intel.com", "time": "Fri May 04 14:26:56 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:02:00 2014 -0700" }, "message": "skb: Add inline helper for getting the skb end offset from head\n\n[ Upstream commit ec47ea82477404631d49b8e568c71826c9b663ac ]\n\nWith the recent changes for how we compute the skb truesize it occurs to me\nwe are probably going to have a lot of calls to skb_end_pointer -\nskb-\u003ehead. Instead of running all over the place doing that it would make\nmore sense to just make it a separate inline skb_end_offset(skb) that way\nwe can return the correct value without having gcc having to do all the\noptimization to cancel out skb-\u003ehead - skb-\u003ehead.\n\nSigned-off-by: Alexander Duyck \u003calexander.h.duyck@intel.com\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "62e1a647e74f708eeabf1c79f3d40833d8ce45eb", "tree": "5c8caecb27d349fca15a5b31140ec1c34455f9ec", "parents": [ "7c8a60a9e3cdfcc04bc4de488876c07225fa0347" ], "author": { "name": "Li RongQing", "email": "roy.qing.li@gmail.com", "time": "Thu May 22 16:36:55 2014 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:02:00 2014 -0700" }, "message": "ipv4: initialise the itag variable in __mkroute_input\n\n[ Upstream commit fbdc0ad095c0a299e9abf5d8ac8f58374951149a ]\n\nthe value of itag is a random value from stack, and may not be initiated by\nfib_validate_source, which called fib_combine_itag if CONFIG_IP_ROUTE_CLASSID\nis not set\n\nThis will make the cached dst uncertainty\n\nSigned-off-by: Li RongQing \u003croy.qing.li@gmail.com\u003e\nAcked-by: Alexei Starovoitov \u003cast@plumgrid.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7c8a60a9e3cdfcc04bc4de488876c07225fa0347", "tree": "2e41952fd15c13213e721a2c139e80432f35639d", "parents": [ "dfe37ad5ddd74bfb299bb50b62db2f5c6b0bc78a" ], "author": { "name": "Jason Wang", "email": "jasowang@redhat.com", "time": "Wed Aug 15 20:44:27 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:02:00 2014 -0700" }, "message": "act_mirred: do not drop packets when fails to mirror it\n\n[ Upstream commit 16c0b164bd24d44db137693a36b428ba28970c62 ]\n\nWe drop packet unconditionally when we fail to mirror it. This is not intended\nin some cases. Consdier for kvm guest, we may mirror the traffic of the bridge\nto a tap device used by a VM. When kernel fails to mirror the packet in\nconditions such as when qemu crashes or stop polling the tap, it\u0027s hard for the\nmanagement software to detect such condition and clean the the mirroring\nbefore. This would lead all packets to the bridge to be dropped and break the\nnetowrk of other virtual machines.\n\nTo solve the issue, the patch does not drop packets when kernel fails to mirror\nit, and only drop the redirected packets.\n\nSigned-off-by: Jason Wang \u003cjasowang@redhat.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "dfe37ad5ddd74bfb299bb50b62db2f5c6b0bc78a", "tree": "c490a9e26fd282e4b626f52d5bb24fd6260bca34", "parents": [ "bd91cb56f951a7b0da8c3098ea9cd56854ece66c" ], "author": { "name": "Sergey Popovich", "email": "popovich_sergei@mail.ru", "time": "Tue May 06 18:23:08 2014 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:59 2014 -0700" }, "message": "ipv4: fib_semantics: increment fib_info_cnt after fib_info allocation\n\n[ Upstream commit aeefa1ecfc799b0ea2c4979617f14cecd5cccbfd ]\n\nIncrement fib_info_cnt in fib_create_info() right after successfuly\nalllocating fib_info structure, overwise fib_metrics allocation failure\nleads to fib_info_cnt incorrectly decremented in free_fib_info(), called\non error path from fib_create_info().\n\nSigned-off-by: Sergey Popovich \u003cpopovich_sergei@mail.ru\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "bd91cb56f951a7b0da8c3098ea9cd56854ece66c", "tree": "7ff7e94d7ec21621fdfe93fd1309d55b0ccca7c0", "parents": [ "b8b4577dff4f2d0964546a6ee9dcb542b13c3337" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Sun May 04 23:24:31 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:59 2014 -0700" }, "message": "net: ipv4: ip_forward: fix inverted local_df test\n\n[ Upstream commit ca6c5d4ad216d5942ae544bbf02503041bd802aa ]\n\nlocal_df means \u0027ignore DF bit if set\u0027, so if its set we\u0027re\nallowed to perform ip fragmentation.\n\nThis wasn\u0027t noticed earlier because the output path also drops such skbs\n(and emits needed icmp error) and because netfilter ip defrag did not\nset local_df until couple of days ago.\n\nOnly difference is that DF-packets-larger-than MTU now discarded\nearlier (f.e. we avoid pointless netfilter postrouting trip).\n\nWhile at it, drop the repeated test ip_exceeds_mtu, checking it once\nis enough...\n\nFixes: fe6cc55f3a9 (\"net: ip, ipv6: handle gso skbs in forwarding path\")\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b8b4577dff4f2d0964546a6ee9dcb542b13c3337", "tree": "c30e6a133a1477c76e00977426ca4117b7c559e7", "parents": [ "2c11ea07f5818be0043b59aa85e7a3ceb927af5e" ], "author": { "name": "Liu Yu", "email": "allanyuliu@tencent.com", "time": "Wed Apr 30 17:34:09 2014 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:59 2014 -0700" }, "message": "tcp_cubic: fix the range of delayed_ack\n\n[ Upstream commit 0cda345d1b2201dd15591b163e3c92bad5191745 ]\n\ncommit b9f47a3aaeab (tcp_cubic: limit delayed_ack ratio to prevent\ndivide error) try to prevent divide error, but there is still a little\nchance that delayed_ack can reach zero. In case the param cnt get\nnegative value, then ratio+cnt would overflow and may happen to be zero.\nAs a result, min(ratio, ACK_RATIO_LIMIT) will calculate to be zero.\n\nIn some old kernels, such as 2.6.32, there is a bug that would\npass negative param, which then ultimately leads to this divide error.\n\ncommit 5b35e1e6e9c (tcp: fix tcp_trim_head() to adjust segment count\nwith skb MSS) fixed the negative param issue. However,\nit\u0027s safe that we fix the range of delayed_ack as well,\nto make sure we do not hit a divide by zero.\n\nCC: Stephen Hemminger \u003cshemminger@vyatta.com\u003e\nSigned-off-by: Liu Yu \u003callanyuliu@tencent.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: Neal Cardwell \u003cncardwell@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "2c11ea07f5818be0043b59aa85e7a3ceb927af5e", "tree": "b23a4949e3121b06801b3df65f845935f64f561e", "parents": [ "3a17d3e6da875f6cccb3233af73272d7ac38389f" ], "author": { "name": "Vlad Yasevich", "email": "vyasevic@redhat.com", "time": "Tue Apr 29 10:09:51 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:59 2014 -0700" }, "message": "Revert \"macvlan : fix checksums error when we are in bridge mode\"\n\n[ Upstream commit f114890cdf84d753f6b41cd0cc44ba51d16313da ]\n\nThis reverts commit 12a2856b604476c27d85a5f9a57ae1661fc46019.\nThe commit above doesn\u0027t appear to be necessary any more as the\nchecksums appear to be correctly computed/validated.\n\nAdditionally the above commit breaks kvm configurations where\none VM is using a device that support checksum offload (virtio) and\nthe other VM does not.\nIn this case, packets leaving virtio device will have CHECKSUM_PARTIAL\nset. The packets is forwarded to a macvtap that has offload features\nturned off. Since we use CHECKSUM_UNNECESSARY, the host does does not\nupdate the checksum and thus a bad checksum is passed up to\nthe guest.\n\nCC: Daniel Lezcano \u003cdaniel.lezcano@free.fr\u003e\nCC: Patrick McHardy \u003ckaber@trash.net\u003e\nCC: Andrian Nord \u003cnightnord@gmail.com\u003e\nCC: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCC: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nCC: Jason Wang \u003cjasowang@redhat.com\u003e\nSigned-off-by: Vlad Yasevich \u003cvyasevic@redhat.com\u003e\nAcked-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nAcked-by: Jason Wang \u003cjasowang@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "3a17d3e6da875f6cccb3233af73272d7ac38389f", "tree": "fe3a8d0bcc28f39e3a864a395de555e0929a3fe4", "parents": [ "4fab0f56cea44d39a2ab41e2869a7ec30c309204" ], "author": { "name": "David Gibson", "email": "david@gibson.dropbear.id.au", "time": "Thu Apr 24 10:22:36 2014 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:59 2014 -0700" }, "message": "rtnetlink: Only supply IFLA_VF_PORTS information when RTEXT_FILTER_VF is set\n\n[ Upstream commit c53864fd60227de025cb79e05493b13f69843971 ]\n\nSince 115c9b81928360d769a76c632bae62d15206a94a (rtnetlink: Fix problem with\nbuffer allocation), RTM_NEWLINK messages only contain the IFLA_VFINFO_LIST\nattribute if they were solicited by a GETLINK message containing an\nIFLA_EXT_MASK attribute with the RTEXT_FILTER_VF flag.\n\nThat was done because some user programs broke when they received more data\nthan expected - because IFLA_VFINFO_LIST contains information for each VF\nit can become large if there are many VFs.\n\nHowever, the IFLA_VF_PORTS attribute, supplied for devices which implement\nndo_get_vf_port (currently the \u0027enic\u0027 driver only), has the same problem.\nIt supplies per-VF information and can therefore become large, but it is\nnot currently conditional on the IFLA_EXT_MASK value.\n\nWorse, it interacts badly with the existing EXT_MASK handling. When\nIFLA_EXT_MASK is not supplied, the buffer for netlink replies is fixed at\nNLMSG_GOODSIZE. If the information for IFLA_VF_PORTS exceeds this, then\nrtnl_fill_ifinfo() returns -EMSGSIZE on the first message in a packet.\nnetlink_dump() will misinterpret this as having finished the listing and\nomit data for this interface and all subsequent ones. That can cause\ngetifaddrs(3) to enter an infinite loop.\n\nThis patch addresses the problem by only supplying IFLA_VF_PORTS when\nIFLA_EXT_MASK is supplied with the RTEXT_FILTER_VF flag set.\n\nSigned-off-by: David Gibson \u003cdavid@gibson.dropbear.id.au\u003e\nReviewed-by: Jiri Pirko \u003cjiri@resnulli.us\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4fab0f56cea44d39a2ab41e2869a7ec30c309204", "tree": "07c5d5cc788f5cb6d00fe0e46037cd07de5dd893", "parents": [ "c7dedf9d07e1471acec49947f3aacd77ea379bdf" ], "author": { "name": "David Gibson", "email": "david@gibson.dropbear.id.au", "time": "Thu Apr 24 10:22:35 2014 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:59 2014 -0700" }, "message": "rtnetlink: Warn when interface\u0027s information won\u0027t fit in our packet\n\n[ Upstream commit 973462bbde79bb827824c73b59027a0aed5c9ca6 ]\n\nWithout IFLA_EXT_MASK specified, the information reported for a single\ninterface in response to RTM_GETLINK is expected to fit within a netlink\npacket of NLMSG_GOODSIZE.\n\nIf it doesn\u0027t, however, things will go badly wrong, When listing all\ninterfaces, netlink_dump() will incorrectly treat -EMSGSIZE on the first\nmessage in a packet as the end of the listing and omit information for\nthat interface and all subsequent ones. This can cause getifaddrs(3) to\nenter an infinite loop.\n\nThis patch won\u0027t fix the problem, but it will WARN_ON() making it easier to\ntrack down what\u0027s going wrong.\n\nSigned-off-by: David Gibson \u003cdavid@gibson.dropbear.id.au\u003e\nReviewed-by: Jiri Pirko \u003cjpirko@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "c7dedf9d07e1471acec49947f3aacd77ea379bdf", "tree": "d7ebae4e8c2c93070d1d27d25d9bb08cdc21ca68", "parents": [ "7dca1b9e80e5742b8edfd747dbee9fee5995c3cf" ], "author": { "name": "Ivan Vecera", "email": "ivecera@redhat.com", "time": "Thu Apr 17 14:51:08 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:59 2014 -0700" }, "message": "tg3: update rx_jumbo_pending ring param only when jumbo frames are enabled\n\nThe patch fixes a problem with dropped jumbo frames after usage of\n\u0027ethtool -G ... rx\u0027.\n\nScenario:\n1. ip link set eth0 up\n2. ethtool -G eth0 rx N # \u003c- This zeroes rx-jumbo\n3. ip link set mtu 9000 dev eth0\n\nThe ethtool command set rx_jumbo_pending to zero so any received jumbo\npackets are dropped and you need to use \u0027ethtool -G eth0 rx-jumbo N\u0027\nto workaround the issue.\nThe patch changes the logic so rx_jumbo_pending value is changed only if\njumbo frames are enabled (MTU \u003e 1500).\n\nSigned-off-by: Ivan Vecera \u003civecera@redhat.com\u003e\nAcked-by: Michael Chan \u003cmchan@broadcom.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7dca1b9e80e5742b8edfd747dbee9fee5995c3cf", "tree": "2a2d661f48fff705565d5dffa7417edf4e276811", "parents": [ "67c6fc9e79121c69134efdd03a6d35aa6adf6c92" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Sun Apr 13 18:23:33 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:59 2014 -0700" }, "message": "filter: prevent nla extensions to peek beyond the end of the message\n\n[ Upstream commit 05ab8f2647e4221cbdb3856dd7d32bd5407316b3 ]\n\nThe BPF_S_ANC_NLATTR and BPF_S_ANC_NLATTR_NEST extensions fail to check\nfor a minimal message length before testing the supplied offset to be\nwithin the bounds of the message. This allows the subtraction of the nla\nheader to underflow and therefore -- as the data type is unsigned --\nallowing far to big offset and length values for the search of the\nnetlink attribute.\n\nThe remainder calculation for the BPF_S_ANC_NLATTR_NEST extension is\nalso wrong. It has the minuend and subtrahend mixed up, therefore\ncalculates a huge length value, allowing to overrun the end of the\nmessage while looking for the netlink attribute.\n\nThe following three BPF snippets will trigger the bugs when attached to\na UNIX datagram socket and parsing a message with length 1, 2 or 3.\n\n ,-[ PoC for missing size check in BPF_S_ANC_NLATTR ]--\n | ld\t#0x87654321\n | ldx\t#42\n | ld\t#nla\n | ret\ta\n `---\n\n ,-[ PoC for the same bug in BPF_S_ANC_NLATTR_NEST ]--\n | ld\t#0x87654321\n | ldx\t#42\n | ld\t#nlan\n | ret\ta\n `---\n\n ,-[ PoC for wrong remainder calculation in BPF_S_ANC_NLATTR_NEST ]--\n | ; (needs a fake netlink header at offset 0)\n | ld\t#0\n | ldx\t#42\n | ld\t#nlan\n | ret\ta\n `---\n\nFix the first issue by ensuring the message length fulfills the minimal\nsize constrains of a nla header. Fix the second bug by getting the math\nfor the remainder calculation right.\n\nFixes: 4738c1db15 (\"[SKFILTER]: Add SKF_ADF_NLATTR instruction\")\nFixes: d214c7537b (\"filter: add SKF_AD_NLATTR_NEST to look for nested..\")\nCc: Patrick McHardy \u003ckaber@trash.net\u003e\nCc: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nAcked-by: Daniel Borkmann \u003cdborkman@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "67c6fc9e79121c69134efdd03a6d35aa6adf6c92", "tree": "943e80cb81fda3a60ff37ced6f7a15227882bffc", "parents": [ "6392b2685b864f0ace1eaae43c998dccb856bd30" ], "author": { "name": "Wang, Xiaoming", "email": "xiaoming.wang@intel.com", "time": "Mon Apr 14 12:30:45 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:59 2014 -0700" }, "message": "net: ipv4: current group_info should be put after using.\n\n[ Upstream commit b04c46190219a4f845e46a459e3102137b7f6cac ]\n\nPlug a group_info refcount leak in ping_init.\ngroup_info is only needed during initialization and\nthe code failed to release the reference on exit.\nWhile here move grabbing the reference to a place\nwhere it is actually needed.\n\nSigned-off-by: Chuansheng Liu \u003cchuansheng.liu@intel.com\u003e\nSigned-off-by: Zhang Dongxing \u003cdongxing.zhang@intel.com\u003e\nSigned-off-by: xiaoming wang \u003cxiaoming.wang@intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "6392b2685b864f0ace1eaae43c998dccb856bd30", "tree": "bb292ae3b0ac6311e88201c20d74f81241ec4d1c", "parents": [ "cedc89a20df8cb06e3fee2f3f7b9d90430142e22" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Apr 10 21:23:36 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:59 2014 -0700" }, "message": "ipv6: Limit mtu to 65575 bytes\n\n[ Upstream commit 30f78d8ebf7f514801e71b88a10c948275168518 ]\n\nFrancois reported that setting big mtu on loopback device could prevent\ntcp sessions making progress.\n\nWe do not support (yet ?) IPv6 Jumbograms and cook corrupted packets.\n\nWe must limit the IPv6 MTU to (65535 + 40) bytes in theory.\n\nTested:\n\nifconfig lo mtu 70000\nnetperf -H ::1\n\nBefore patch : Throughput : 0.05 Mbits\n\nAfter patch : Throughput : 35484 Mbits\n\nReported-by: Francois WELLENREITER \u003cf.wellenreiter@gmail.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nAcked-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "cedc89a20df8cb06e3fee2f3f7b9d90430142e22", "tree": "3ecdf19b6ee6d5249054064a31cc9ce0a8775f4e", "parents": [ "20874f008f43d98548af632bbbfb54336183a98a" ], "author": { "name": "Thomas Richter", "email": "tmricht@linux.vnet.ibm.com", "time": "Wed Apr 09 12:52:59 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:59 2014 -0700" }, "message": "bonding: Remove debug_fs files when module init fails\n\n[ Upstream commit db29868653394937037d71dc3545768302dda643 ]\n\nRemove the bonding debug_fs entries when the\nmodule initialization fails. The debug_fs\nentries should be removed together with all other\nalready allocated resources.\n\nSigned-off-by: Thomas Richter \u003ctmricht@linux.vnet.ibm.com\u003e\nSigned-off-by: Jay Vosburgh \u003cj.vosburgh@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "20874f008f43d98548af632bbbfb54336183a98a", "tree": "830e681a324d73706ac2595ee4aa7c19ca2b2293", "parents": [ "f32abfaa76f1859eae458ea4b6fee2f9385a0d59" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Apr 09 10:28:50 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:58 2014 -0700" }, "message": "net: core: don\u0027t account for udp header size when computing seglen\n\n[ Upstream commit 6d39d589bb76ee8a1c6cde6822006ae0053decff ]\n\nIn case of tcp, gso_size contains the tcpmss.\n\nFor UFO (udp fragmentation offloading) skbs, gso_size is the fragment\npayload size, i.e. we must not account for udp header size.\n\nOtherwise, when using virtio drivers, a to-be-forwarded UFO GSO packet\nwill be needlessly fragmented in the forward path, because we think its\nindividual segments are too large for the outgoing link.\n\nFixes: fe6cc55f3a9a053 (\"net: ip, ipv6: handle gso skbs in forwarding path\")\nCc: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nReported-by: Tobias Brunner \u003ctobias@strongswan.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f32abfaa76f1859eae458ea4b6fee2f9385a0d59", "tree": "76eda8712e369a2850790cbf150ea681996b0696", "parents": [ "7658e7de68b967b01be536c998b0b90d0b6ec013" ], "author": { "name": "Dmitry Petukhov", "email": "dmgenp@gmail.com", "time": "Wed Apr 09 02:23:20 2014 +0600" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:58 2014 -0700" }, "message": "l2tp: take PMTU from tunnel UDP socket\n\n[ Upstream commit f34c4a35d87949fbb0e0f31eba3c054e9f8199ba ]\n\nWhen l2tp driver tries to get PMTU for the tunnel destination, it uses\nthe pointer to struct sock that represents PPPoX socket, while it\nshould use the pointer that represents UDP socket of the tunnel.\n\nSigned-off-by: Dmitry Petukhov \u003cdmgenp@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7658e7de68b967b01be536c998b0b90d0b6ec013", "tree": "5e90a13cec957586cc763f5cef98a4c57dce921a", "parents": [ "0fc175dff42444b3fe24dff93d25aa5c7c427724" ], "author": { "name": "Daniel Borkmann", "email": "dborkman@redhat.com", "time": "Wed Apr 09 16:10:20 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:58 2014 -0700" }, "message": "net: sctp: test if association is dead in sctp_wake_up_waiters\n\n[ Upstream commit 1e1cdf8ac78793e0875465e98a648df64694a8d0 ]\n\nIn function sctp_wake_up_waiters(), we need to involve a test\nif the association is declared dead. If so, we don\u0027t have any\nreference to a possible sibling association anymore and need\nto invoke sctp_write_space() instead, and normally walk the\nsocket\u0027s associations and notify them of new wmem space. The\nreason for special casing is that otherwise, we could run\ninto the following issue when a sctp_primitive_SEND() call\nfrom sctp_sendmsg() fails, and tries to flush an association\u0027s\noutq, i.e. in the following way:\n\nsctp_association_free()\n`-\u003e list_del(\u0026asoc-\u003easocs) \u003c-- poisons list pointer\n asoc-\u003ebase.dead \u003d true\n sctp_outq_free(\u0026asoc-\u003eoutqueue)\n `-\u003e __sctp_outq_teardown()\n `-\u003e sctp_chunk_free()\n `-\u003e consume_skb()\n `-\u003e sctp_wfree()\n `-\u003e sctp_wake_up_waiters() \u003c-- dereferences poisoned pointers\n if asoc-\u003eep-\u003esndbuf_policy\u003d0\n\nTherefore, only walk the list in an \u0027optimized\u0027 way if we find\nthat the current association is still active. We could also use\nlist_del_init() in addition when we call sctp_association_free(),\nbut as Vlad suggests, we want to trap such bugs and thus leave\nit poisoned as is.\n\nWhy is it safe to resolve the issue by testing for asoc-\u003ebase.dead?\nParallel calls to sctp_sendmsg() are protected under socket lock,\nthat is lock_sock()/release_sock(). Only within that path under\nlock held, we\u0027re setting skb/chunk owner via sctp_set_owner_w().\nEventually, chunks are freed directly by an association still\nunder that lock. So when traversing association list on destruction\ntime from sctp_wake_up_waiters() via sctp_wfree(), a different\nCPU can\u0027t be running sctp_wfree() while another one calls\nsctp_association_free() as both happens under the same lock.\nTherefore, this can also not race with setting/testing against\nasoc-\u003ebase.dead as we are guaranteed for this to happen in order,\nunder lock. Further, Vlad says: the times we check asoc-\u003ebase.dead\nis when we\u0027ve cached an association pointer for later processing.\nIn between cache and processing, the association may have been\nfreed and is simply still around due to reference counts. We check\nasoc-\u003ebase.dead under a lock, so it should always be safe to check\nand not race against sctp_association_free(). Stress-testing seems\nfine now, too.\n\nFixes: cd253f9f357d (\"net: sctp: wake up all assocs if sndbuf policy is per socket\")\nSigned-off-by: Daniel Borkmann \u003cdborkman@redhat.com\u003e\nCc: Vlad Yasevich \u003cvyasevic@redhat.com\u003e\nAcked-by: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nAcked-by: Vlad Yasevich \u003cvyasevic@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "0fc175dff42444b3fe24dff93d25aa5c7c427724", "tree": "8b079c03e577b7866ba44b2ae8b1a610db3f2345", "parents": [ "fce85b081c08c1326d9bcab0ff9ea1c85b7e9858" ], "author": { "name": "Daniel Borkmann", "email": "dborkman@redhat.com", "time": "Tue Apr 08 17:26:13 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:58 2014 -0700" }, "message": "net: sctp: wake up all assocs if sndbuf policy is per socket\n\n[ Upstream commit 52c35befb69b005c3fc5afdaae3a5717ad013411 ]\n\nSCTP charges chunks for wmem accounting via skb-\u003etruesize in\nsctp_set_owner_w(), and sctp_wfree() respectively as the\nreverse operation. If a sender runs out of wmem, it needs to\nwait via sctp_wait_for_sndbuf(), and gets woken up by a call\nto __sctp_write_space() mostly via sctp_wfree().\n\n__sctp_write_space() is being called per association. Although\nwe assign sk-\u003esk_write_space() to sctp_write_space(), which\nis then being done per socket, it is only used if send space\nis increased per socket option (SO_SNDBUF), as SOCK_USE_WRITE_QUEUE\nis set and therefore not invoked in sock_wfree().\n\nCommit 4c3a5bdae293 (\"sctp: Don\u0027t charge for data in sndbuf\nagain when transmitting packet\") fixed an issue where in case\nsctp_packet_transmit() manages to queue up more than sndbuf\nbytes, sctp_wait_for_sndbuf() will never be woken up again\nunless it is interrupted by a signal. However, a still\nremaining issue is that if net.sctp.sndbuf_policy\u003d0, that is\naccounting per socket, and one-to-many sockets are in use,\nthe reclaimed write space from sctp_wfree() is \u0027unfairly\u0027\nhanded back on the server to the association that is the lucky\none to be woken up again via __sctp_write_space(), while\nthe remaining associations are never be woken up again\n(unless by a signal).\n\nThe effect disappears with net.sctp.sndbuf_policy\u003d1, that\nis wmem accounting per association, as it guarantees a fair\nshare of wmem among associations.\n\nTherefore, if we have reclaimed memory in case of per socket\naccounting, wake all related associations to a socket in a\nfair manner, that is, traverse the socket association list\nstarting from the current neighbour of the association and\nissue a __sctp_write_space() to everyone until we end up\nwaking ourselves. This guarantees that no association is\npreferred over another and even if more associations are\ntaken into the one-to-many session, all receivers will get\nmessages from the server and are not stalled forever on\nhigh load. This setting still leaves the advantage of per\nsocket accounting in touch as an association can still use\nup global limits if unused by others.\n\nFixes: 4eb701dfc618 (\"[SCTP] Fix SCTP sendbuffer accouting.\")\nSigned-off-by: Daniel Borkmann \u003cdborkman@redhat.com\u003e\nCc: Thomas Graf \u003ctgraf@suug.ch\u003e\nCc: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nCc: Vlad Yasevich \u003cvyasevic@redhat.com\u003e\nAcked-by: Vlad Yasevich \u003cvyasevic@redhat.com\u003e\nAcked-by: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "fce85b081c08c1326d9bcab0ff9ea1c85b7e9858", "tree": "b8dca480b76cecd52287d243766c84d52ade153e", "parents": [ "ced68efe273377c2f525418da0b75f8d2d6d2402" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Tue Nov 12 15:10:01 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:58 2014 -0700" }, "message": "list: introduce list_next_entry() and list_prev_entry()\n\n[ Upstream commit 008208c6b26f21c2648c250a09c55e737c02c5f8 ]\n\nAdd two trivial helpers list_next_entry() and list_prev_entry(), they\ncan have a lot of users including list.h itself. In fact the 1st one is\nalready defined in events/core.c and bnx2x_sp.c, so the patch simply\nmoves the definition to list.h.\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: Eilon Greenstein \u003ceilong@broadcom.com\u003e\nCc: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nCc: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ced68efe273377c2f525418da0b75f8d2d6d2402", "tree": "f1699a80164a4757c79cc061b30903f49793cae5", "parents": [ "b8a0ddefa0086479a20270c43fb00f71cb5ce573" ], "author": { "name": "Alex Deucher", "email": "alexdeucher@gmail.com", "time": "Mon Mar 31 11:19:46 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:58 2014 -0700" }, "message": "drm/radeon: call drm_edid_to_eld when we update the edid\n\ncommit 16086279353cbfecbb3ead474072dced17b97ddc upstream.\n\nThis needs to be done to update some of the fields in\nthe connector structure used by the audio code.\n\nNoticed by several users on irc.\n\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Christian König \u003cchristian.koenig@amd.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b8a0ddefa0086479a20270c43fb00f71cb5ce573", "tree": "f3268d6a74d51c01cb5f3159f0c293c6cb6e25de", "parents": [ "2b8b56486c1cb6bb0ea3a5eafc5f54748fd05c7a" ], "author": { "name": "Christopher Friedt", "email": "chrisfriedt@gmail.com", "time": "Sat Feb 01 10:01:15 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:58 2014 -0700" }, "message": "drm/vmwgfx: correct fb_fix_screeninfo.line_length\n\ncommit aa6de142c901cd2d90ef08db30ae87da214bedcc upstream.\n\nPreviously, the vmwgfx_fb driver would allow users to call FBIOSET_VINFO, but it would not adjust\nthe FINFO properly, resulting in distorted screen rendering. The patch corrects that behaviour.\n\nSee https://bugs.gentoo.org/show_bug.cgi?id\u003d494794 for examples.\n\nSigned-off-by: Christopher Friedt \u003cchrisfriedt@gmail.com\u003e\nReviewed-by: Thomas Hellstrom \u003cthellstrom@vmware.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2b8b56486c1cb6bb0ea3a5eafc5f54748fd05c7a", "tree": "8c88d73435203dbf2852a8d4af45256166dff810", "parents": [ "3794e546cf34fa6da751518a9e3aeac62cc82202" ], "author": { "name": "Bjørn Mork", "email": "bjorn@mork.no", "time": "Fri Apr 25 18:49:20 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:58 2014 -0700" }, "message": "usb: option: add and update a number of CMOTech devices\n\ncommit 34f972d6156fe9eea2ab7bb418c71f9d1d5c8e7b upstream.\n\nA number of older CMOTech modems are based on Qualcomm\nchips. The blacklisted interfaces are QMI/wwan.\n\nReported-by: Lars Melin \u003clarsm17@gmail.com\u003e\nSigned-off-by: Bjørn Mork \u003cbjorn@mork.no\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "3794e546cf34fa6da751518a9e3aeac62cc82202", "tree": "23691e24b267eb1feed4dde6904247c7372ba381", "parents": [ "08e1505871a4bde2e454591a8c3d2fb522fecd69" ], "author": { "name": "Bjørn Mork", "email": "bjorn@mork.no", "time": "Fri Apr 25 18:49:19 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:58 2014 -0700" }, "message": "usb: option: add Alcatel L800MA\n\ncommit dd6b48ecec2ea7d15f28d5e5474388681899a5e1 upstream.\n\nDevice interface layout:\n0: ff/ff/ff - serial\n1: ff/00/00 - serial AT+PPP\n2: ff/ff/ff - QMI/wwan\n3: 08/06/50 - storage\n\nSigned-off-by: Bjørn Mork \u003cbjorn@mork.no\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "08e1505871a4bde2e454591a8c3d2fb522fecd69", "tree": "ef2442cb4888485cda61b87c187682c97d7ee42f", "parents": [ "818346b5be68137e39adf5895fe0172a9c84b949" ], "author": { "name": "Bjørn Mork", "email": "bjorn@mork.no", "time": "Fri Apr 25 18:49:18 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:58 2014 -0700" }, "message": "usb: option: add Olivetti Olicard 500\n\ncommit 533b3994610f316e5cd61b56d0c4daa15c830f89 upstream.\n\nDevice interface layout:\n0: ff/ff/ff - serial\n1: ff/ff/ff - serial AT+PPP\n2: 08/06/50 - storage\n3: ff/ff/ff - serial\n4: ff/ff/ff - QMI/wwan\n\nReported-by: Julio Araujo \u003cjulio.araujo@wllctel.com.br\u003e\nSigned-off-by: Bjørn Mork \u003cbjorn@mork.no\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "818346b5be68137e39adf5895fe0172a9c84b949", "tree": "47d8ff90ddc1b3e2aa97be8d5246da3df6d8d26e", "parents": [ "d3972467efba36977afd3810c23617ecf5853656" ], "author": { "name": "Johan Hovold", "email": "jhovold@gmail.com", "time": "Fri Apr 25 15:23:03 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:58 2014 -0700" }, "message": "USB: io_ti: fix firmware download on big-endian machines\n\ncommit 5509076d1b4485ce9fb07705fcbcd2695907ab5b upstream.\n\nDuring firmware download the device expects memory addresses in\nbig-endian byte order. As the wIndex parameter which hold the address is\nsent in little-endian byte order regardless of host byte order, we need\nto use swab16 rather than cpu_to_be16.\n\nAlso make sure to handle the struct ti_i2c_desc size parameter which is\nreturned in little-endian byte order.\n\nReported-by: Ludovic Drolez \u003cldrolez@debian.org\u003e\nTested-by: Ludovic Drolez \u003cldrolez@debian.org\u003e\nSigned-off-by: Johan Hovold \u003cjhovold@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d3972467efba36977afd3810c23617ecf5853656", "tree": "8b9ba90d61b6d23ee308b6945a95ab2403fd6973", "parents": [ "a1611e6cc002b38a449e61dc69e8f24b2a627854" ], "author": { "name": "Johan Hovold", "email": "jhovold@gmail.com", "time": "Fri Mar 28 18:05:10 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:58 2014 -0700" }, "message": "Revert \"USB: serial: add usbid for dell wwan card to sierra.c\"\n\ncommit 2e01280d2801c72878cf3a7119eac30077b463d5 upstream.\n\nThis reverts commit 1ebca9dad5abe8b2ed4dbd186cd657fb47c1f321.\n\nThis device was erroneously added to the sierra driver even though it\u0027s\nnot a Sierra device and was already handled by the option driver.\n\nCc: Richard Farina \u003csidhayn@gmail.com\u003e\nSigned-off-by: Johan Hovold \u003cjhovold@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a1611e6cc002b38a449e61dc69e8f24b2a627854", "tree": "14804c36fef98e4ff3e677a44e21bddc5978a1a3", "parents": [ "7f72c55d0b8869aa40181b1e8b5456a800c4c154" ], "author": { "name": "Daniele Palmas", "email": "dnlplm@gmail.com", "time": "Wed Apr 02 11:19:48 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:57 2014 -0700" }, "message": "usb: option driver, add support for Telit UE910v2\n\ncommit d6de486bc22255779bd54b0fceb4c240962bf146 upstream.\n\noption driver, added VID/PID for Telit UE910v2 modem\n\nSigned-off-by: Daniele Palmas \u003cdnlplm@gmail.com\u003e\nSigned-off-by: Johan Hovold \u003cjhovold@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7f72c55d0b8869aa40181b1e8b5456a800c4c154", "tree": "afad6c47b21fdaf83a164650030cc37c247de085", "parents": [ "971779e857794be65387204ceee8fd4e9afddb72" ], "author": { "name": "Michele Baldessari", "email": "michele@acksyn.org", "time": "Mon Mar 31 10:51:00 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:57 2014 -0700" }, "message": "USB: serial: ftdi_sio: add id for Brainboxes serial cards\n\ncommit efe26e16b1d93ac0085e69178cc18811629e8fc5 upstream.\n\nCustom VID/PIDs for Brainboxes cards as reported in\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d1071914\n\nSigned-off-by: Michele Baldessari \u003cmichele@acksyn.org\u003e\nSigned-off-by: Johan Hovold \u003cjhovold@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "971779e857794be65387204ceee8fd4e9afddb72", "tree": "5e8a0b7d914248ec7f4773985abc2f4d4785e88d", "parents": [ "b08f08b56fdbff8617e4d85182500684f754890e" ], "author": { "name": "Tristan Bruns", "email": "tristan@tristanbruns.de", "time": "Sun Apr 13 23:57:16 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:57 2014 -0700" }, "message": "USB: cp210x: Add 8281 (Nanotec Plug \u0026 Drive)\n\ncommit 72b3007951010ce1bbf950e23b19d9839fa905a5 upstream.\n\nSigned-off-by: Tristan Bruns \u003ctristan@tristanbruns.de\u003e\nSigned-off-by: Johan Hovold \u003cjhovold@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b08f08b56fdbff8617e4d85182500684f754890e", "tree": "0f42e5c887da00df44a6088bddeceb0b3472475d", "parents": [ "e4e351a30ae3928b889cf23e5153075591938926" ], "author": { "name": "Michael Ulbricht", "email": "michael.ulbricht@systec-electronic.com", "time": "Tue Mar 25 10:34:18 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:57 2014 -0700" }, "message": "USB: cdc-acm: Remove Motorola/Telit H24 serial interfaces from ACM driver\n\ncommit 895d240d1db0b2736d779200788e4c4aea28a0c6 upstream.\n\nBy specifying NO_UNION_NORMAL the ACM driver does only use the first two\nUSB interfaces (modem data \u0026 control). The AT Port, Diagnostic and NMEA\ninterfaces are left to the USB serial driver.\n\nSigned-off-by: Michael Ulbricht \u003cmichael.ulbricht@systec-electronic.com\u003e\nSigned-off-by: Alexander Stein \u003calexander.stein@systec-electronic.com\u003e\nSigned-off-by: Oliver Neukum \u003coliver@neukum.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e4e351a30ae3928b889cf23e5153075591938926", "tree": "0ce8162391e68e7b60a427307a4dcd22b202fcb0", "parents": [ "69ec67c1c1360345aa949fa571039bd8c69d7721" ], "author": { "name": "Mizuma, Masayoshi", "email": "m.mizuma@jp.fujitsu.com", "time": "Fri Apr 18 15:07:18 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:57 2014 -0700" }, "message": "mm/hugetlb.c: add cond_resched_lock() in return_unused_surplus_pages()\n\ncommit 7848a4bf51b34f41fcc9bd77e837126d99ae84e3 upstream.\n\nsoft lockup in freeing gigantic hugepage fixed in commit 55f67141a892 \"mm:\nhugetlb: fix softlockup when a large number of hugepages are freed.\" can\nhappen in return_unused_surplus_pages(), so let\u0027s fix it.\n\nSigned-off-by: Masayoshi Mizuma \u003cm.mizuma@jp.fujitsu.com\u003e\nSigned-off-by: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nCc: Joonsoo Kim \u003ciamjoonsoo.kim@lge.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.cz\u003e\nCc: Aneesh Kumar \u003caneesh.kumar@linux.vnet.ibm.com\u003e\nCc: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "69ec67c1c1360345aa949fa571039bd8c69d7721", "tree": "ec432f3fcaef8afe9369590b6a5729bcf0876273", "parents": [ "25c7b871a00b8cbe3522ec22300f564c81b73134" ], "author": { "name": "Helge Deller", "email": "deller@gmx.de", "time": "Sun Apr 13 00:03:55 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:01:57 2014 -0700" }, "message": "parisc: fix epoll_pwait syscall on compat kernel\n\ncommit ab3e55b119c9653b19ea4edffb86f04db867ac98 upstream.\n\nThis bug was detected with the libio-epoll-perl debian package where the\ntest case IO-Ppoll-compat.t failed.\n\nSigned-off-by: Helge Deller \u003cdeller@gmx.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "25c7b871a00b8cbe3522ec22300f564c81b73134", "tree": "f8a7d07f060b2aafb3b3ec937a64ef93d4a4b22e", "parents": [ "3ddd37aaf5db2fbcd0f8a485a9a3390d22574371" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 18 05:26:09 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 18 05:26:09 2014 -0700" }, "message": "Linux 3.4.91\n" }, { "commit": "3ddd37aaf5db2fbcd0f8a485a9a3390d22574371", "tree": "2845e7186dfe49d35ecacccef4ab4dcb0b7abcaa", "parents": [ "7dff32efd24849aca3ab1eabe8b867025f34a3f8" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Thu Jan 23 14:42:43 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 18 05:25:57 2014 -0700" }, "message": "tgafb: fix mode setting with fbset\n\ncommit 624966589041deb32a2626ee2e176e8274581101 upstream.\n\nMode setting in the TGA driver is broken for these reasons:\n\n- info-\u003efix.line_length is set just once in tgafb_init_fix function. If\n we change videomode, info-\u003efix.line_length is not recalculated - so\n the video mode is changed but the screen is corrupted because of wrong\n info-\u003efix.line_length.\n\n- info-\u003efix.smem_len is set in tgafb_init_fix to the size of the default\n video mode (640x480). If we set a higher resolution,\n info-\u003efix.smem_len is smaller than the current screen size, preventing\n the userspace program from mapping the framebuffer.\n\nThis patch fixes it:\n\n- info-\u003efix.line_length initialization is moved to tgafb_set_par so that\n it is recalculated with each mode change.\n\n- info-\u003efix.smem_len is set to a fixed value representing the real\n amount of video ram (the values are taken from xfree86 driver).\n\n- add a check to tgafb_check_var to prevent us from setting a videomode\n that doesn\u0027t fit into videoram.\n\n- in tgafb_register, tgafb_init_fix is moved upwards, to be called\n before fb_find_mode (because fb_find_mode already needs the videoram\n size set in tgafb_init_fix).\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Tomi Valkeinen \u003ctomi.valkeinen@ti.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n\n" }, { "commit": "7dff32efd24849aca3ab1eabe8b867025f34a3f8", "tree": "84d7e9342bd13019308c937cdcecae4e94d4bbdf", "parents": [ "7bd3c53d12e0e454091ad35090410267af0e4a84" ], "author": { "name": "Andreas Schwab", "email": "schwab@linux-m68k.org", "time": "Mon Dec 30 15:31:17 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 18 05:25:56 2014 -0700" }, "message": "powerpc: Add vr save/restore functions\n\ncommit 8fe9c93e7453e67b8bd09f263ec1bb0783c733fc upstream.\n\nGCC 4.8 now generates out-of-line vr save/restore functions when\noptimizing for size. They are needed for the raid6 altivec support.\n\nSigned-off-by: Andreas Schwab \u003cschwab@linux-m68k.org\u003e\nSigned-off-by: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nCc: Guenter Roeck \u003clinux@roeck-us.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7bd3c53d12e0e454091ad35090410267af0e4a84", "tree": "98acc75a24ce0b6d632d2eb1daa8d510f3daea94", "parents": [ "8ed40c122919cd79bc3c059e5864e5e7d9d455f0" ], "author": { "name": "Steven Rostedt (Red Hat)", "email": "rostedt@goodmis.org", "time": "Wed Feb 26 10:54:36 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 18 05:25:56 2014 -0700" }, "message": "tracepoint: Do not waste memory on mods with no tracepoints\n\ncommit 7dec935a3aa04412cba2cebe1524ae0d34a30c24 upstream.\n\nNo reason to allocate tp_module structures for modules that have no\ntracepoints. This just wastes memory.\n\nFixes: b75ef8b44b1c \"Tracepoint: Dissociate from module mutex\"\nAcked-by: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8ed40c122919cd79bc3c059e5864e5e7d9d455f0", "tree": "ff7767d691d7eeda890a3a3abba81eb8a675027e", "parents": [ "4ede126ea94672827d60e5237ed2c6624b06a255" ], "author": { "name": "Thomas Graf", "email": "tgraf@suug.ch", "time": "Fri Apr 04 17:57:45 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 18 05:25:56 2014 -0700" }, "message": "netfilter: Can\u0027t fail and free after table replacement\n\ncommit c58dd2dd443c26d856a168db108a0cd11c285bf3 upstream.\n\nAll xtables variants suffer from the defect that the copy_to_user()\nto copy the counters to user memory may fail after the table has\nalready been exchanged and thus exposed. Return an error at this\npoint will result in freeing the already exposed table. Any\nsubsequent packet processing will result in a kernel panic.\n\nWe can\u0027t copy the counters before exposing the new tables as we\nwant provide the counter state after the old table has been\nunhooked. Therefore convert this into a silent error.\n\nCc: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Thomas Graf \u003ctgraf@suug.ch\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "4ede126ea94672827d60e5237ed2c6624b06a255", "tree": "bd4d64acd350acbdf98d271c4dc417e5b5f7787b", "parents": [ "4b87f408045848f42ae574326faf64073f92f2af" ], "author": { "name": "Joe Perches", "email": "joe@perches.com", "time": "Sun May 13 21:56:25 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 18 05:25:56 2014 -0700" }, "message": "net: Add net_ratelimited_function and net_\u003clevel\u003e_ratelimited macros\n\ncommit 3a3bfb61e64476ff1e4ac3122cb6dec9c79b795c upstream.\n\n__ratelimit() can be considered an inverted bool test because\nit returns true when not ratelimited. Several tests in the\nkernel tree use this __ratelimit() function incorrectly.\n\nNo net_ratelimit uses are incorrect currently though.\n\nMost uses of net_ratelimit are to log something via printk or\npr_\u003clevel\u003e.\n\nIn order to minimize the uses of net_ratelimit, and to start\nstandardizing the code style used for __ratelimit() and net_ratelimit(),\nadd a net_ratelimited_function() macro and net_\u003clevel\u003e_ratelimited()\nlogging macros similar to pr_\u003clevel\u003e_ratelimited that use the global\nnet_ratelimit instead of a static per call site \"struct ratelimit_state\".\n\nSigned-off-by: Joe Perches \u003cjoe@perches.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "4b87f408045848f42ae574326faf64073f92f2af", "tree": "118545ed115af537d5bbb2da8cbc46ff9dd943cb", "parents": [ "14eee5bd065d6aac0acbdc6092a25ba68c55b9c8" ], "author": { "name": "Andrey Vagin", "email": "avagin@openvz.org", "time": "Fri Mar 28 13:54:32 2014 +0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 18 05:25:55 2014 -0700" }, "message": "netfilter: nf_conntrack: reserve two bytes for nf_ct_ext-\u003elen\n\ncommit 223b02d923ecd7c84cf9780bb3686f455d279279 upstream.\n\n\"len\" contains sizeof(nf_ct_ext) and size of extensions. In a worst\ncase it can contain all extensions. Bellow you can find sizes for all\ntypes of extensions. Their sum is definitely bigger than 256.\n\nnf_ct_ext_types[0]-\u003elen \u003d 24\nnf_ct_ext_types[1]-\u003elen \u003d 32\nnf_ct_ext_types[2]-\u003elen \u003d 24\nnf_ct_ext_types[3]-\u003elen \u003d 32\nnf_ct_ext_types[4]-\u003elen \u003d 152\nnf_ct_ext_types[5]-\u003elen \u003d 2\nnf_ct_ext_types[6]-\u003elen \u003d 16\nnf_ct_ext_types[7]-\u003elen \u003d 8\n\nI have seen \"len\" up to 280 and my host has crashes w/o this patch.\n\nThe right way to fix this problem is reducing the size of the ecache\nextension (4) and Florian is going to do this, but these changes will\nbe quite large to be appropriate for a stable tree.\n\nFixes: 5b423f6a40a0 (netfilter: nf_conntrack: fix racy timer handling with reliable)\nCc: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nCc: Patrick McHardy \u003ckaber@trash.net\u003e\nCc: Jozsef Kadlecsik \u003ckadlec@blackhole.kfki.hu\u003e\nCc: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\nSigned-off-by: Andrey Vagin \u003cavagin@openvz.org\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "14eee5bd065d6aac0acbdc6092a25ba68c55b9c8", "tree": "6a5be23dd8205130a59ea2d9b9ce13e54c7c518f", "parents": [ "664c0fc651b6ca2ab43ddbb73bbda2acdb2c9915" ], "author": { "name": "Roman Pen", "email": "r.peniaev@gmail.com", "time": "Tue Mar 04 23:13:10 2014 +0900" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 18 05:25:55 2014 -0700" }, "message": "blktrace: fix accounting of partially completed requests\n\ncommit af5040da01ef980670b3741b3e10733ee3e33566 upstream.\n\ntrace_block_rq_complete does not take into account that request can\nbe partially completed, so we can get the following incorrect output\nof blkparser:\n\n C R 232 + 240 [0]\n C R 240 + 232 [0]\n C R 248 + 224 [0]\n C R 256 + 216 [0]\n\nbut should be:\n\n C R 232 + 8 [0]\n C R 240 + 8 [0]\n C R 248 + 8 [0]\n C R 256 + 8 [0]\n\nAlso, the whole output summary statistics of completed requests and\nfinal throughput will be incorrect.\n\nThis patch takes into account real completion size of the request and\nfixes wrong completion accounting.\n\nSigned-off-by: Roman Pen \u003cr.peniaev@gmail.com\u003e\nCC: Steven Rostedt \u003crostedt@goodmis.org\u003e\nCC: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCC: Ingo Molnar \u003cmingo@redhat.com\u003e\nCC: linux-kernel@vger.kernel.org\nSigned-off-by: Jens Axboe \u003caxboe@fb.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "664c0fc651b6ca2ab43ddbb73bbda2acdb2c9915", "tree": "7e2ce98cb950909f3857130410a6ce60d4612b76", "parents": [ "3307c63bcea0f3a2d912bec9f460335fe051aaa8" ], "author": { "name": "Peter Hurley", "email": "peter@hurleysoftware.com", "time": "Sat May 03 14:04:59 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 18 05:25:55 2014 -0700" }, "message": "n_tty: Fix n_tty_write crash when echoing in raw mode\n\ncommit 4291086b1f081b869c6d79e5b7441633dc3ace00 upstream.\n\nThe tty atomic_write_lock does not provide an exclusion guarantee for\nthe tty driver if the termios settings are LECHO \u0026 !OPOST. And since\nit is unexpected and not allowed to call TTY buffer helpers like\ntty_insert_flip_string concurrently, this may lead to crashes when\nconcurrect writers call pty_write. In that case the following two\nwriters:\n* the ECHOing from a workqueue and\n* pty_write from the process\nrace and can overflow the corresponding TTY buffer like follows.\n\nIf we look into tty_insert_flip_string_fixed_flag, there is:\n int space \u003d __tty_buffer_request_room(port, goal, flags);\n struct tty_buffer *tb \u003d port-\u003ebuf.tail;\n ...\n memcpy(char_buf_ptr(tb, tb-\u003eused), chars, space);\n ...\n tb-\u003eused +\u003d space;\n\nso the race of the two can result in something like this:\n A B\n__tty_buffer_request_room\n __tty_buffer_request_room\nmemcpy(buf(tb-\u003eused), ...)\ntb-\u003eused +\u003d space;\n memcpy(buf(tb-\u003eused), ...) -\u003eBOOM\n\nB\u0027s memcpy is past the tty_buffer due to the previous A\u0027s tb-\u003eused\nincrement.\n\nSince the N_TTY line discipline input processing can output\nconcurrently with a tty write, obtain the N_TTY ldisc output_lock to\nserialize echo output with normal tty writes. This ensures the tty\nbuffer helper tty_insert_flip_string is not called concurrently and\neverything is fine.\n\nNote that this is nicely reproducible by an ordinary user using\nforkpty and some setup around that (raw termios + ECHO). And it is\npresent in kernels at least after commit\nd945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to\nuse the normal buffering logic) in 2.6.31-rc3.\n\njs: add more info to the commit log\njs: switch to bool\njs: lock unconditionally\njs: lock only the tty-\u003eops-\u003ewrite call\n\nReferences: CVE-2014-0196\nReported-and-tested-by: Jiri Slaby \u003cjslaby@suse.cz\u003e\nSigned-off-by: Peter Hurley \u003cpeter@hurleysoftware.com\u003e\nSigned-off-by: Jiri Slaby \u003cjslaby@suse.cz\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Alan Cox \u003calan@lxorguk.ukuu.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n[bwh: Backported to 3.2: output_lock is a member of struct tty_struct]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\n" }, { "commit": "3307c63bcea0f3a2d912bec9f460335fe051aaa8", "tree": "712fa1adcc3db146d536d0f890681bb81a427e61", "parents": [ "f39c8bf9da4f90904787f63abfa138ceae0f5db9" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Wed Oct 30 20:13:51 2013 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 18 05:25:54 2014 -0700" }, "message": "SCSI: megaraid: missing bounds check in mimd_to_kioc()\n\ncommit 3de2260140417759c669d391613d583baf03b0cf upstream.\n\npthru32-\u003edataxferlen comes from the user so we need to check that it\u0027s\nnot too large so we don\u0027t overflow the buffer.\n\nReported-by: Nico Golde \u003cnico@ngolde.de\u003e\nReported-by: Fabian Yamaguchi \u003cfabs@goesec.de\u003e\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nAcked-by: Sumit Saxena \u003csumit.saxena@lsi.com\u003e\nSigned-off-by: James Bottomley \u003cJBottomley@Parallels.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f39c8bf9da4f90904787f63abfa138ceae0f5db9", "tree": "e07dfb73b567d70fcbd28a33bca4af2b2c781891", "parents": [ "53b67ae8d3d01efbdfd7ae431d8d46cba70084b9" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:45 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:45 2014 +0200" }, "message": "Linux 3.4.90\n" }, { "commit": "53b67ae8d3d01efbdfd7ae431d8d46cba70084b9", "tree": "ba99052e5ad2a0d44b2b2dda74d715be3ce5793e", "parents": [ "b4e472edda0a5993ede690aca9a3fa3d8750c5f2" ], "author": { "name": "Mike Snitzer", "email": "snitzer@redhat.com", "time": "Fri Mar 28 02:15:02 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:32 2014 +0200" }, "message": "dm thin: fix dangling bio in process_deferred_bios error path\n\ncommit fe76cd88e654124d1431bb662a0fc6e99ca811a5 upstream.\n\nIf unable to ensure_next_mapping() we must add the current bio, which\nwas removed from the @bios list via bio_list_pop, back to the\ndeferred_bios list before all the remaining @bios.\n\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nAcked-by: Joe Thornber \u003cejt@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b4e472edda0a5993ede690aca9a3fa3d8750c5f2", "tree": "f2b6d1a4ce95334e6aa0a918439295480c64d4c4", "parents": [ "9a9269138723e71e87f4adb00c0c2bbdc7bdcd0b" ], "author": { "name": "Giacomo Comes", "email": "comes@naic.edu", "time": "Thu Apr 03 14:13:55 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:32 2014 +0200" }, "message": "Skip intel_crt_init for Dell XPS 8700\n\ncommit 10b6ee4a87811a110cb01eaca01eb04da6801baf upstream.\n\nThe Dell XPS 8700 has a onboard Display port and HDMI port and no VGA port.\nThe call intel_crt_init freeze the machine, so skip such call.\n\nBugzilla: https://bugs.freedesktop.org/show_bug.cgi?id\u003d73559\nSigned-off-by: Giacomo Comes \u003ccomes at naic.edu\u003e\nSigned-off-by: Daniel Vetter \u003cdaniel.vetter@ffwll.ch\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9a9269138723e71e87f4adb00c0c2bbdc7bdcd0b", "tree": "0319b0e0bd2bfa6f0fa4750f627195acadb54f86", "parents": [ "c3a47361053bdd9059eec78510de21684f4112c5" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Thu Dec 05 17:53:50 2013 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:32 2014 +0200" }, "message": "mtd: sm_ftl: heap corruption in sm_create_sysfs_attributes()\n\ncommit b4c233057771581698a13694ab6f33b48ce837dc upstream.\n\nWe always put a NUL terminator one space past the end of the \"vendor\"\nbuffer. Walter Harms also pointed out that this should just use\nkstrndup().\n\nFixes: 7d17c02a01a1 (\u0027mtd: Add new SmartMedia/xD FTL\u0027)\n\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: Brian Norris \u003ccomputersforpeace@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c3a47361053bdd9059eec78510de21684f4112c5", "tree": "8506be3a2c4021a75507e0460b8cef4d85fb8a9c", "parents": [ "fd9a5e6cd4d5f923eff026dd288764cf65c001a7" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Mon Feb 17 23:03:08 2014 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:31 2014 +0200" }, "message": "mtd: nuc900_nand: NULL dereference in nuc900_nand_enable()\n\ncommit c69dbbf3335a21aae74376d7e5db50a486d52439 upstream.\n\nInstead of writing to \"nand-\u003ereg + REG_FMICSR\" we write to \"REG_FMICSR\"\nwhich is NULL and not a valid register.\n\nFixes: 8bff82cbc308 (\u0027mtd: add nand support for w90p910 (v2)\u0027)\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: Brian Norris \u003ccomputersforpeace@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "fd9a5e6cd4d5f923eff026dd288764cf65c001a7", "tree": "582fbb165db4a107cde9cb0b6dd249259781891d", "parents": [ "0e0dc73524d0e17a6dce2d3cd7ec3d6a785eb6df" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Thu Jan 23 14:43:10 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:31 2014 +0200" }, "message": "tgafb: fix data copying\n\ncommit 6b0df6827bb6fcacb158dff29ad0a62d6418b534 upstream.\n\nThe functions for data copying copyarea_foreward_8bpp and\ncopyarea_backward_8bpp are buggy, they produce screen corruption.\n\nThis patch fixes the functions and moves the logic to one function\n\"copyarea_8bpp\". For simplicity, the function only handles copying that\nis aligned on 8 pixes. If we copy an unaligned area, generic function\ncfb_copyarea is used.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Tomi Valkeinen \u003ctomi.valkeinen@ti.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0e0dc73524d0e17a6dce2d3cd7ec3d6a785eb6df", "tree": "5be5264e47b9ba75e8ff530d3777ba4af8499d6b", "parents": [ "f8f3dc1af7bfe87bafce271fd3f7b65078cd8778" ], "author": { "name": "Marek Vasut", "email": "marex@denx.de", "time": "Mon Mar 24 03:38:10 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:31 2014 +0200" }, "message": "gpio: mxs: Allow for recursive enable_irq_wake() call\n\ncommit a585f87c863e4e1d496459d382b802bf5ebe3717 upstream.\n\nThe scenario here is that someone calls enable_irq_wake() from somewhere\nin the code. This will result in the lockdep producing a backtrace as can\nbe seen below. In my case, this problem is triggered when using the wl1271\n(TI WlCore) driver found in drivers/net/wireless/ti/ .\n\nThe problem cause is rather obvious from the backtrace, but let\u0027s outline\nthe dependency. enable_irq_wake() grabs the IRQ buslock in irq_set_irq_wake(),\nwhich in turns calls mxs_gpio_set_wake_irq() . But mxs_gpio_set_wake_irq()\ncalls enable_irq_wake() again on the one-level-higher IRQ , thus it tries to\ngrab the IRQ buslock again in irq_set_irq_wake() . Because the spinlock in\nirq_set_irq_wake()-\u003eirq_get_desc_buslock()-\u003e__irq_get_desc_lock() is not\nmarked as recursive, lockdep will spew the stuff below.\n\nWe know we can safely re-enter the lock, so use IRQ_GC_INIT_NESTED_LOCK to\nfix the spew.\n\n \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n [ INFO: possible recursive locking detected ]\n 3.10.33-00012-gf06b763-dirty #61 Not tainted\n ---------------------------------------------\n kworker/0:1/18 is trying to acquire lock:\n (\u0026irq_desc_lock_class){-.-...}, at: [\u003cc00685f0\u003e] __irq_get_desc_lock+0x48/0x88\n\n but task is already holding lock:\n (\u0026irq_desc_lock_class){-.-...}, at: [\u003cc00685f0\u003e] __irq_get_desc_lock+0x48/0x88\n\n other info that might help us debug this:\n Possible unsafe locking scenario:\n\n CPU0\n ----\n lock(\u0026irq_desc_lock_class);\n lock(\u0026irq_desc_lock_class);\n\n *** DEADLOCK ***\n\n May be due to missing lock nesting notation\n\n 3 locks held by kworker/0:1/18:\n #0: (events){.+.+.+}, at: [\u003cc0036308\u003e] process_one_work+0x134/0x4a4\n #1: ((\u0026fw_work-\u003ework)){+.+.+.}, at: [\u003cc0036308\u003e] process_one_work+0x134/0x4a4\n #2: (\u0026irq_desc_lock_class){-.-...}, at: [\u003cc00685f0\u003e] __irq_get_desc_lock+0x48/0x88\n\n stack backtrace:\n CPU: 0 PID: 18 Comm: kworker/0:1 Not tainted 3.10.33-00012-gf06b763-dirty #61\n Workqueue: events request_firmware_work_func\n [\u003cc0013eb4\u003e] (unwind_backtrace+0x0/0xf0) from [\u003cc0011c74\u003e] (show_stack+0x10/0x14)\n [\u003cc0011c74\u003e] (show_stack+0x10/0x14) from [\u003cc005bb08\u003e] (__lock_acquire+0x140c/0x1a64)\n [\u003cc005bb08\u003e] (__lock_acquire+0x140c/0x1a64) from [\u003cc005c6a8\u003e] (lock_acquire+0x9c/0x104)\n [\u003cc005c6a8\u003e] (lock_acquire+0x9c/0x104) from [\u003cc051d5a4\u003e] (_raw_spin_lock_irqsave+0x44/0x58)\n [\u003cc051d5a4\u003e] (_raw_spin_lock_irqsave+0x44/0x58) from [\u003cc00685f0\u003e] (__irq_get_desc_lock+0x48/0x88)\n [\u003cc00685f0\u003e] (__irq_get_desc_lock+0x48/0x88) from [\u003cc0068e78\u003e] (irq_set_irq_wake+0x20/0xf4)\n [\u003cc0068e78\u003e] (irq_set_irq_wake+0x20/0xf4) from [\u003cc027260c\u003e] (mxs_gpio_set_wake_irq+0x1c/0x24)\n [\u003cc027260c\u003e] (mxs_gpio_set_wake_irq+0x1c/0x24) from [\u003cc0068cf4\u003e] (set_irq_wake_real+0x30/0x44)\n [\u003cc0068cf4\u003e] (set_irq_wake_real+0x30/0x44) from [\u003cc0068ee4\u003e] (irq_set_irq_wake+0x8c/0xf4)\n [\u003cc0068ee4\u003e] (irq_set_irq_wake+0x8c/0xf4) from [\u003cc0310748\u003e] (wlcore_nvs_cb+0x10c/0x97c)\n [\u003cc0310748\u003e] (wlcore_nvs_cb+0x10c/0x97c) from [\u003cc02be5e8\u003e] (request_firmware_work_func+0x38/0x58)\n [\u003cc02be5e8\u003e] (request_firmware_work_func+0x38/0x58) from [\u003cc0036394\u003e] (process_one_work+0x1c0/0x4a4)\n [\u003cc0036394\u003e] (process_one_work+0x1c0/0x4a4) from [\u003cc0036a4c\u003e] (worker_thread+0x138/0x394)\n [\u003cc0036a4c\u003e] (worker_thread+0x138/0x394) from [\u003cc003cb74\u003e] (kthread+0xa4/0xb0)\n [\u003cc003cb74\u003e] (kthread+0xa4/0xb0) from [\u003cc000ee00\u003e] (ret_from_fork+0x14/0x34)\n wlcore: loaded\n\nSigned-off-by: Marek Vasut \u003cmarex@denx.de\u003e\nAcked-by: Shawn Guo \u003cshawn.guo@linaro.org\u003e\nSigned-off-by: Linus Walleij \u003clinus.walleij@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f8f3dc1af7bfe87bafce271fd3f7b65078cd8778", "tree": "c31452acd3f0751af22826e45afc6ea2a2914c4a", "parents": [ "04dbe2b495485ba9172da476beedbba76bca2bc8" ], "author": { "name": "Larry Finger", "email": "Larry.Finger@lwfinger.net", "time": "Tue Mar 04 16:53:51 2014 -0600" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:31 2014 +0200" }, "message": "rtlwifi: rtl8192se: Fix too long disable of IRQs\n\ncommit 2610decdd0b3808ba20471a999835cfee5275f98 upstream.\n\nIn commit f78bccd79ba3cd9d9664981b501d57bdb81ab8a4 entitled \"rtlwifi:\nrtl8192ce: Fix too long disable of IRQs\", Olivier Langlois\n\u003colivier@trillion01.com\u003e fixed a problem caused by an extra long disabling\nof interrupts. This patch makes the same fix for rtl8192se.\n\nSigned-off-by: Larry Finger \u003cLarry.Finger@lwfinger.net\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "04dbe2b495485ba9172da476beedbba76bca2bc8", "tree": "32f1dfc6724aef21b15730e96e5d376e74964746", "parents": [ "08f36d9d2cbe95df935378c220215791fc1dd111" ], "author": { "name": "Larry Finger", "email": "Larry.Finger@lwfinger.net", "time": "Tue Mar 04 16:53:50 2014 -0600" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:31 2014 +0200" }, "message": "rtlwifi: rtl8192cu: Fix too long disable of IRQs\n\ncommit a53268be0cb9763f11da4f6fe3fb924cbe3a7d4a upstream.\n\nIn commit f78bccd79ba3cd9d9664981b501d57bdb81ab8a4 entitled \"rtlwifi:\nrtl8192ce: Fix too long disable of IRQs\", Olivier Langlois\n\u003colivier@trillion01.com\u003e fixed a problem caused by an extra long disabling\nof interrupts. This patch makes the same fix for rtl8192cu.\n\nSigned-off-by: Larry Finger \u003cLarry.Finger@lwfinger.net\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "08f36d9d2cbe95df935378c220215791fc1dd111", "tree": "5789ef0e64f0251484a83a44854cd728cc2f3409", "parents": [ "e45d91ae6e931aec803c5cbbe36b53e64c3e3077" ], "author": { "name": "Jeff Layton", "email": "jlayton@redhat.com", "time": "Tue Apr 15 08:44:12 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:31 2014 +0200" }, "message": "locks: allow __break_lease to sleep even when break_time is 0\n\ncommit 4991a628a789dc5954e98e79476d9808812292ec upstream.\n\nA fl-\u003efl_break_time of 0 has a special meaning to the lease break code\nthat basically means \"never break the lease\". knfsd uses this to ensure\nthat leases don\u0027t disappear out from under it.\n\nUnfortunately, the code in __break_lease can end up passing this value\nto wait_event_interruptible as a timeout, which prevents it from going\nto sleep at all. This causes __break_lease to spin in a tight loop and\ncauses soft lockups.\n\nFix this by ensuring that we pass a minimum value of 1 as a timeout\ninstead.\n\nCc: J. Bruce Fields \u003cbfields@fieldses.org\u003e\nReported-by: Terry Barnaby \u003cterry1@beam.ltd.uk\u003e\nSigned-off-by: Jeff Layton \u003cjlayton@redhat.com\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e45d91ae6e931aec803c5cbbe36b53e64c3e3077", "tree": "307555a3258c9bb4a3164844cdb5f52807e9a4a2", "parents": [ "b9fbc5762da741f3fa89246193acdce428ce6816" ], "author": { "name": "Dan Williams", "email": "dan.j.williams@intel.com", "time": "Thu Apr 17 11:48:21 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:31 2014 +0200" }, "message": "libata/ahci: accommodate tag ordered controllers\n\ncommit 8a4aeec8d2d6a3edeffbdfae451cdf05cbf0fefd upstream.\n\nThe AHCI spec allows implementations to issue commands in tag order\nrather than FIFO order:\n\n\t5.3.2.12 P:SelectCmd\n\tHBA sets pSlotLoc \u003d (pSlotLoc + 1) mod (CAP.NCS + 1)\n\tor HBA selects the command to issue that has had the\n\tPxCI bit set to \u00271\u0027 longer than any other command\n\tpending to be issued.\n\nThe result is that commands posted sequentially (time-wise) may play out\nof sequence when issued by hardware.\n\nThis behavior has likely been hidden by drives that arrange for commands\nto complete in issue order. However, it appears recent drives (two from\ndifferent vendors that we have found so far) inflict out-of-order\ncompletions as a matter of course. So, we need to take care to maintain\nordered submission, otherwise we risk triggering a drive to fall out of\nsequential-io automation and back to random-io processing, which incurs\nlarge latency and degrades throughput.\n\nThis issue was found in simple benchmarks where QD\u003d2 seq-write\nperformance was 30-50% *greater* than QD\u003d32 seq-write performance.\n\nTagging for -stable and making the change globally since it has a low\nrisk-to-reward ratio. Also, word is that recent versions of an unnamed\nOS also does it this way now. So, drives in the field are already\nexperienced with this tag ordering scheme.\n\nCc: Dave Jiang \u003cdave.jiang@intel.com\u003e\nCc: Ed Ciechanowski \u003ced.ciechanowski@intel.com\u003e\nReviewed-by: Matthew Wilcox \u003cmatthew.r.wilcox@intel.com\u003e\nSigned-off-by: Dan Williams \u003cdan.j.williams@intel.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b9fbc5762da741f3fa89246193acdce428ce6816", "tree": "7adc92f2a706da48587ac7a3b85913afd15a28f8", "parents": [ "34dc182bf300e62e830c19ad174dfcb6ea973e6a" ], "author": { "name": "Rafał Miłecki", "email": "zajec5@gmail.com", "time": "Sat Apr 05 18:08:25 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:31 2014 +0200" }, "message": "b43: Fix machine check error due to improper access of B43_MMIO_PSM_PHY_HDR\n\ncommit 12cd43c6ed6da7bf7c5afbd74da6959cda6d056b upstream.\n\nRegister B43_MMIO_PSM_PHY_HDR is 16 bit one, so accessing it with 32b\nfunctions isn\u0027t safe. On my machine it causes delayed (!) CPU exception:\n\nDisabling lock debugging due to kernel taint\nmce: [Hardware Error]: CPU 0: Machine Check Exception: 4 Bank 4: b200000000070f0f\nmce: [Hardware Error]: TSC 164083803dc\nmce: [Hardware Error]: PROCESSOR 2:20fc2 TIME 1396650505 SOCKET 0 APIC 0 microcode 0\nmce: [Hardware Error]: Run the above through \u0027mcelog --ascii\u0027\nmce: [Hardware Error]: Machine check: Processor context corrupt\nKernel panic - not syncing: Fatal machine check on current CPU\nKernel Offset: 0x0 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffff9fffffff)\n\nSigned-off-by: Rafał Miłecki \u003czajec5@gmail.com\u003e\nAcked-by: Larry Finger \u003cLarry.Finger@lwfinger.net\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "34dc182bf300e62e830c19ad174dfcb6ea973e6a", "tree": "a8add999f603eef9148e83c6b76cce7ee24307da", "parents": [ "caf6f52449661bfcc4c5d3f79d65c1cda23f4a89" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Thu Jan 23 14:41:59 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:30 2014 +0200" }, "message": "mach64: fix cursor when character width is not a multiple of 8 pixels\n\ncommit 43751a1b8ee2e70ce392bf31ef3133da324e68b3 upstream.\n\nThis patch fixes the hardware cursor on mach64 when font width is not a\nmultiple of 8 pixels.\n\nIf you load such a font, the cursor is expanded to the next 8-byte\nboundary and a part of the next character after the cursor is not\nvisible.\nFor example, when you load a font with 12-pixel width, the cursor width\nis 16 pixels and when the cursor is displayed, 4 pixels of the next\ncharacter are not visible.\n\nThe reason is this: atyfb_cursor is called with proper parameters to\nload an image that is 12-pixel wide. However, the number is aligned on\nthe next 8-pixel boundary on the line\n\"unsigned int width \u003d (cursor-\u003eimage.width + 7) \u003e\u003e 3;\" and the whole\nfunction acts as it is was loading a 16-pixel image.\n\nThis patch fixes it so that the value written to the framebuffer is\npadded with 0xaaaa (the transparent pattern) when the image size it not\na multiple of 8 pixels. The transparent pattern causes that the cursor\nwill not interfere with the next character.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Tomi Valkeinen \u003ctomi.valkeinen@ti.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "caf6f52449661bfcc4c5d3f79d65c1cda23f4a89", "tree": "44b4e88613dc613a4234421f2f1aa9345c3ca192", "parents": [ "7ea30442913175c11e9e142c45c11bd88570bbad" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Thu Jan 23 14:41:09 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:30 2014 +0200" }, "message": "mach64: use unaligned access\n\ncommit c29dd8696dc5dbd50b3ac441b8a26751277ba520 upstream.\n\nThis patch fixes mach64 to use unaligned access to the font bitmap.\n\nThis fixes unaligned access warning on sparc64 when 14x8 font is loaded.\n\nOn x86(64), unaligned access is handled in hardware, so both functions\nle32_to_cpup and get_unaligned_le32 perform the same operation.\n\nOn RISC machines, unaligned access is not handled in hardware, so we\nbetter use get_unaligned_le32 to avoid the unaligned trap and warning.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Tomi Valkeinen \u003ctomi.valkeinen@ti.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7ea30442913175c11e9e142c45c11bd88570bbad", "tree": "e57f755c6df0da4e122ba98ad00dcf761e205931", "parents": [ "8b26a7a7b4abd06f3eca2772317bc7840f6e834a" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Thu Jan 23 14:39:04 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:30 2014 +0200" }, "message": "matroxfb: restore the registers M_ACCESS and M_PITCH\n\ncommit a772d4736641ec1b421ad965e13457c17379fc86 upstream.\n\nWhen X11 is running and the user switches back to console, the card\nmodifies the content of registers M_MACCESS and M_PITCH in periodic\nintervals.\n\nThis patch fixes it by restoring the content of these registers before\nissuing any accelerator command.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Tomi Valkeinen \u003ctomi.valkeinen@ti.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8b26a7a7b4abd06f3eca2772317bc7840f6e834a", "tree": "d8ab406166b5087f745900cdd15d028dc1cb8051", "parents": [ "89a3abc1fd0dd979929362a2a355d899f4574dab" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Thu Jan 23 14:39:29 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:30 2014 +0200" }, "message": "framebuffer: fix cfb_copyarea\n\ncommit 00a9d699bc85052d2d3ed56251cd928024ce06a3 upstream.\n\nThe function cfb_copyarea is buggy when the copy operation is not aligned on\nlong boundary (4 bytes on 32-bit machines, 8 bytes on 64-bit machines).\n\nHow to reproduce:\n- use x86-64 machine\n- use a framebuffer driver without acceleration (for example uvesafb)\n- set the framebuffer to 8-bit depth\n\t(for example fbset -a 1024x768-60 -depth 8)\n- load a font with character width that is not a multiple of 8 pixels\n\tnote: the console-tools package cannot load a font that has\n\twidth different from 8 pixels. You need to install the packages\n\t\"kbd\" and \"console-terminus\" and use the program \"setfont\" to\n\tset font width (for example: setfont Uni2-Terminus20x10)\n- move some text left and right on the bash command line and you get a\n\tscreen corruption\n\nTo expose more bugs, put this line to the end of uvesafb_init_info:\ninfo-\u003eflags |\u003d FBINFO_HWACCEL_COPYAREA | FBINFO_READS_FAST;\n- Now framebuffer console will use cfb_copyarea for console scrolling.\nYou get a screen corruption when console is scrolled.\n\nThis patch is a rewrite of cfb_copyarea. It fixes the bugs, with this\npatch, console scrolling in 8-bit depth with a font width that is not a\nmultiple of 8 pixels works fine.\n\nThe cfb_copyarea code was very buggy and it looks like it was written\nand never tried with non-8-pixel font.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Tomi Valkeinen \u003ctomi.valkeinen@ti.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "89a3abc1fd0dd979929362a2a355d899f4574dab", "tree": "a78ec88835316fda87b0c696a7e195b559ffd5ce", "parents": [ "a2295c4263fe35f674f0061fe0419c73238d5b5b" ], "author": { "name": "Ard Biesheuvel", "email": "ard.biesheuvel@linaro.org", "time": "Thu Mar 27 18:14:40 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:30 2014 +0200" }, "message": "crypto: ghash-clmulni-intel - use C implementation for setkey()\n\ncommit 8ceee72808d1ae3fb191284afc2257a2be964725 upstream.\n\nThe GHASH setkey() function uses SSE registers but fails to call\nkernel_fpu_begin()/kernel_fpu_end(). Instead of adding these calls, and\nthen having to deal with the restriction that they cannot be called from\ninterrupt context, move the setkey() implementation to the C domain.\n\nNote that setkey() does not use any particular SSE features and is not\nexpected to become a performance bottleneck.\n\nSigned-off-by: Ard Biesheuvel \u003card.biesheuvel@linaro.org\u003e\nAcked-by: H. Peter Anvin \u003chpa@linux.intel.com\u003e\nFixes: 0e1227d356e9b (crypto: ghash - Add PCLMULQDQ accelerated implementation)\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a2295c4263fe35f674f0061fe0419c73238d5b5b", "tree": "15b88f2cad71f1a4d95619176f6b245f48edf0c4", "parents": [ "983327a48a263bd65fa869a0aad76baaf75fff86" ], "author": { "name": "Tyler Stachecki", "email": "tstache1@binghamton.edu", "time": "Fri Apr 25 16:41:04 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:30 2014 +0200" }, "message": "mpt2sas: Don\u0027t disable device twice at suspend.\n\ncommit af61e27c3f77c7623b5335590ae24b6a5c323e22 upstream.\n\nOn suspend, _scsih_suspend calls mpt2sas_base_free_resources, which\nin turn calls pci_disable_device if the device is enabled prior to\nsuspending. However, _scsih_suspend also calls pci_disable_device\nitself.\n\nThus, in the event that the device is enabled prior to suspending,\npci_disable_device will be called twice. This patch removes the\nduplicate call to pci_disable_device in _scsi_suspend as it is both\nunnecessary and results in a kernel oops.\n\nSigned-off-by: Tyler Stachecki \u003ctstache1@binghamton.edu\u003e\nSigned-off-by: James Bottomley \u003cJBottomley@Parallels.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "983327a48a263bd65fa869a0aad76baaf75fff86", "tree": "1d8dfd2284c812187522b45bbbcdbedef614ee15", "parents": [ "ef9146785e023ef84cb777aac6deae53c53a2b84" ], "author": { "name": "Rusty Russell", "email": "rusty@rustcorp.com.au", "time": "Thu Mar 13 11:23:38 2014 +1030" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:30 2014 +0200" }, "message": "virtio_balloon: don\u0027t softlockup on huge balloon changes.\n\ncommit 1f74ef0f2d7d692fcd615621e0e734c3e7771413 upstream.\n\nWhen adding or removing 100G from a balloon:\n\n BUG: soft lockup - CPU#0 stuck for 22s! [vballoon:367]\n\nWe have a wait_event_interruptible(), but the condition is always true\n(more ballooning to do) so we don\u0027t ever sleep. We also have a\nwait_event() for the host to ack, but that is also always true as QEMU\nis synchronous for balloon operations.\n\nReported-by: Gopesh Kumar Chaudhary \u003cgopchaud@in.ibm.com\u003e\nSigned-off-by: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ef9146785e023ef84cb777aac6deae53c53a2b84", "tree": "b723a6e28700011923d4e5b66340f3485b3084e1", "parents": [ "bfa779779247e9421b23155747e1779ce87aa040" ], "author": { "name": "Huacai Chen", "email": "chenhc@lemote.com", "time": "Sat Mar 22 17:21:44 2014 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:29 2014 +0200" }, "message": "MIPS: Hibernate: Flush TLB entries in swsusp_arch_resume()\n\ncommit c14af233fbe279d0e561ecf84f1208b1bae087ef upstream.\n\nThe original MIPS hibernate code flushes cache and TLB entries in\nswsusp_arch_resume(). But they are removed in Commit 44eeab67416711\n(MIPS: Hibernation: Remove SMP TLB and cacheflushing code.). A cross-\nCPU flush is surely unnecessary because all but the local CPU have\nalready been disabled. But a local flush (at least the TLB flush) is\nneeded. When we do hibernation on Loongson-3 with an E1000E NIC, it is\nvery easy to produce a kernel panic (kernel page fault, or unaligned\naccess). The root cause is E1000E driver use vzalloc_node() to allocate\npages, the stale TLB entries of the booting kernel will be misused by\nthe resumed target kernel.\n\nSigned-off-by: Huacai Chen \u003cchenhc@lemote.com\u003e\nCc: John Crispin \u003cjohn@phrozen.org\u003e\nCc: Steven J. Hill \u003cSteven.Hill@imgtec.com\u003e\nCc: Aurelien Jarno \u003caurelien@aurel32.net\u003e\nCc: linux-mips@linux-mips.org\nCc: Fuxin Zhang \u003czhangfx@lemote.com\u003e\nCc: Zhangjin Wu \u003cwuzhangjin@gmail.com\u003e\nPatchwork: https://patchwork.linux-mips.org/patch/6643/\nSigned-off-by: Ralf Baechle \u003cralf@linux-mips.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "bfa779779247e9421b23155747e1779ce87aa040", "tree": "ba0e80345bca015d0381aaeb0cc447b1a5d5e452", "parents": [ "a04d8ef979b661ce9051d0f22b0b2c25fc94b955" ], "author": { "name": "Matthew Daley", "email": "mattd@bugfuzz.com", "time": "Mon Apr 28 19:05:21 2014 +1200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:29 2014 +0200" }, "message": "floppy: don\u0027t write kernel-only members to FDRAWCMD ioctl output\n\ncommit 2145e15e0557a01b9195d1c7199a1b92cb9be81f upstream.\n\nDo not leak kernel-only floppy_raw_cmd structure members to userspace.\nThis includes the linked-list pointer and the pointer to the allocated\nDMA space.\n\nSigned-off-by: Matthew Daley \u003cmattd@bugfuzz.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a04d8ef979b661ce9051d0f22b0b2c25fc94b955", "tree": "4affe04b7b7b698f317df00858f3d065caef521f", "parents": [ "5c5aeb0ca78c6b9cdca6462bf54f50ac28756cbb" ], "author": { "name": "Matthew Daley", "email": "mattd@bugfuzz.com", "time": "Mon Apr 28 19:05:20 2014 +1200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:29 2014 +0200" }, "message": "floppy: ignore kernel-only members in FDRAWCMD ioctl input\n\ncommit ef87dbe7614341c2e7bfe8d32fcb7028cc97442c upstream.\n\nAlways clear out these floppy_raw_cmd struct members after copying the\nentire structure from userspace so that the in-kernel version is always\nvalid and never left in an interdeterminate state.\n\nSigned-off-by: Matthew Daley \u003cmattd@bugfuzz.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5c5aeb0ca78c6b9cdca6462bf54f50ac28756cbb", "tree": "be6157846a37ab8393947daeb1f1eb2ca0231e84", "parents": [ "d89a13cf5f83e4f2b6fe98b52530bdab4b773c5c" ], "author": { "name": "Tomoki Sekiyama", "email": "tomoki.sekiyama@hds.com", "time": "Fri May 02 18:58:24 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:29 2014 +0200" }, "message": "drivers/tty/hvc: don\u0027t free hvc_console_setup after init\n\ncommit 501fed45b7e8836ee9373f4d31e2d85e3db6103a upstream.\n\nWhen \u0027console\u003dhvc0\u0027 is specified to the kernel parameter in x86 KVM guest,\nhvc console is setup within a kthread. However, that will cause SEGV\nand the boot will fail when the driver is builtin to the kernel,\nbecause currently hvc_console_setup() is annotated with \u0027__init\u0027. This\npatch removes \u0027__init\u0027 to boot the guest successfully with \u0027console\u003dhvc0\u0027.\n\nSigned-off-by: Tomoki Sekiyama \u003ctomoki.sekiyama@hds.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d89a13cf5f83e4f2b6fe98b52530bdab4b773c5c", "tree": "630316963499f1022761d4252ae19ba4e4fb9345", "parents": [ "1361b5386da290994fcbf5399d87e4417bec213d" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:52:14 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:52:14 2014 -0700" }, "message": "Linux 3.4.89\n" }, { "commit": "1361b5386da290994fcbf5399d87e4417bec213d", "tree": "ad025d3623914c7cfe8429fd82de31458c58e66f", "parents": [ "6b2b2314fe03f5dc66d4c9370dfa263e19fda392" ], "author": { "name": "Aaron Sanders", "email": "aaron.sanders@hp.com", "time": "Mon Mar 31 15:54:21 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:46 2014 -0700" }, "message": "USB: pl2303: add ids for Hewlett-Packard HP POS pole displays\n\ncommit b16c02fbfb963fa2941b7517ebf1f8a21946775e upstream.\n\nAdd device ids to pl2303 for the Hewlett-Packard HP POS pole displays:\n\nLD960: 03f0:0B39\nLCM220: 03f0:3139\nLCM960: 03f0:3239\n\n[ Johan: fix indentation and sort PIDs numerically ]\n\nSigned-off-by: Aaron Sanders \u003caaron.sanders@hp.com\u003e\nSigned-off-by: Johan Hovold \u003cjhovold@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6b2b2314fe03f5dc66d4c9370dfa263e19fda392", "tree": "fcfbb967c872fc8391d2bc7fa870a0568f22f513", "parents": [ "982daeb44e46bd2c1d84106f90381184bf2c0ed2" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Sat Apr 12 12:45:25 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:46 2014 -0700" }, "message": "ext4: use i_size_read in ext4_unaligned_aio()\n\ncommit 6e6358fc3c3c862bfe9a5bc029d3f8ce43dc9765 upstream.\n\nWe haven\u0027t taken i_mutex yet, so we need to use i_size_read().\n\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "982daeb44e46bd2c1d84106f90381184bf2c0ed2", "tree": "ebdb45f53d165340ac471e9c8fccb656a427cc7f", "parents": [ "8917a40da468d4ffb7accf5eea6e381a123058b1" ], "author": { "name": "alex chen", "email": "alex.chen@huawei.com", "time": "Thu Apr 03 14:47:05 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:46 2014 -0700" }, "message": "ocfs2: do not put bh when buffer_uptodate failed\n\ncommit f7cf4f5bfe073ad792ab49c04f247626b3e38db6 upstream.\n\nDo not put bh when buffer_uptodate failed in ocfs2_write_block and\nocfs2_write_super_or_backup, because it will put bh in b_end_io.\nOtherwise it will hit a warning \"VFS: brelse: Trying to free free\nbuffer\".\n\nSigned-off-by: Alex Chen \u003calex.chen@huawei.com\u003e\nReviewed-by: Joseph Qi \u003cjoseph.qi@huawei.com\u003e\nReviewed-by: Srinivas Eeda \u003csrinivas.eeda@oracle.com\u003e\nCc: Mark Fasheh \u003cmfasheh@suse.com\u003e\nAcked-by: Joel Becker \u003cjlbec@evilplan.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8917a40da468d4ffb7accf5eea6e381a123058b1", "tree": "14a650166f3a03e46c3962fdc4d102a605279569", "parents": [ "09400fe4ff8794b823889c4634afa0c740d29b1c" ], "author": { "name": "Junxiao Bi", "email": "junxiao.bi@oracle.com", "time": "Thu Apr 03 14:46:51 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:46 2014 -0700" }, "message": "ocfs2: dlm: fix recovery hung\n\ncommit ded2cf71419b9353060e633b59e446c42a6a2a09 upstream.\n\nThere is a race window in dlm_do_recovery() between dlm_remaster_locks()\nand dlm_reset_recovery() when the recovery master nearly finish the\nrecovery process for a dead node. After the master sends FINALIZE_RECO\nmessage in dlm_remaster_locks(), another node may become the recovery\nmaster for another dead node, and then send the BEGIN_RECO message to\nall the nodes included the old master, in the handler of this message\ndlm_begin_reco_handler() of old master, dlm-\u003ereco.dead_node and\ndlm-\u003ereco.new_master will be set to the second dead node and the new\nmaster, then in dlm_reset_recovery(), these two variables will be reset\nto default value. This will cause new recovery master can not finish\nthe recovery process and hung, at last the whole cluster will hung for\nrecovery.\n\nold recovery master: new recovery master:\ndlm_remaster_locks()\n become recovery master for\n another dead node.\n dlm_send_begin_reco_message()\ndlm_begin_reco_handler()\n{\n if (dlm-\u003ereco.state \u0026 DLM_RECO_STATE_FINALIZE) {\n return -EAGAIN;\n }\n dlm_set_reco_master(dlm, br-\u003enode_idx);\n dlm_set_reco_dead_node(dlm, br-\u003edead_node);\n}\ndlm_reset_recovery()\n{\n dlm_set_reco_dead_node(dlm, O2NM_INVALID_NODE_NUM);\n dlm_set_reco_master(dlm, O2NM_INVALID_NODE_NUM);\n}\n will hang in dlm_remaster_locks() for\n request dlm locks info\n\nBefore send FINALIZE_RECO message, recovery master should set\nDLM_RECO_STATE_FINALIZE for itself and clear it after the recovery done,\nthis can break the race windows as the BEGIN_RECO messages will not be\nhandled before DLM_RECO_STATE_FINALIZE flag is cleared.\n\nA similar race may happen between new recovery master and normal node\nwhich is in dlm_finalize_reco_handler(), also fix it.\n\nSigned-off-by: Junxiao Bi \u003cjunxiao.bi@oracle.com\u003e\nReviewed-by: Srinivas Eeda \u003csrinivas.eeda@oracle.com\u003e\nReviewed-by: Wengang Wang \u003cwen.gang.wang@oracle.com\u003e\nCc: Joel Becker \u003cjlbec@evilplan.org\u003e\nCc: Mark Fasheh \u003cmfasheh@suse.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "09400fe4ff8794b823889c4634afa0c740d29b1c", "tree": "041f6c8351f4849df2eccc9787ddc628d8a5439e", "parents": [ "96f6aea2715b25edfc9b982f9e372bd87db6c04e" ], "author": { "name": "Junxiao Bi", "email": "junxiao.bi@oracle.com", "time": "Thu Apr 03 14:46:49 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:45 2014 -0700" }, "message": "ocfs2: dlm: fix lock migration crash\n\ncommit 34aa8dac482f1358d59110d5e3a12f4351f6acaa upstream.\n\nThis issue was introduced by commit 800deef3f6f8 (\"ocfs2: use\nlist_for_each_entry where benefical\") in 2007 where it replaced\nlist_for_each with list_for_each_entry. The variable \"lock\" will point\nto invalid data if \"tmpq\" list is empty and a panic will be triggered\ndue to this. Sunil advised reverting it back, but the old version was\nalso not right. At the end of the outer for loop, that\nlist_for_each_entry will also set \"lock\" to an invalid data, then in the\nnext loop, if the \"tmpq\" list is empty, \"lock\" will be an stale invalid\ndata and cause the panic. So reverting the list_for_each back and reset\n\"lock\" to NULL to fix this issue.\n\nAnother concern is that this seemes can not happen because the \"tmpq\"\nlist should not be empty. Let me describe how.\n\nold lock resource owner(node 1): migratation target(node 2):\nimage there\u0027s lockres with a EX lock from node 2 in\ngranted list, a NR lock from node x with convert_type\nEX in converting list.\ndlm_empty_lockres() {\n dlm_pick_migration_target() {\n pick node 2 as target as its lock is the first one\n in granted list.\n }\n dlm_migrate_lockres() {\n dlm_mark_lockres_migrating() {\n res-\u003estate |\u003d DLM_LOCK_RES_BLOCK_DIRTY;\n wait_event(dlm-\u003east_wq, !dlm_lockres_is_dirty(dlm, res));\n\t //after the above code, we can not dirty lockres any more,\n // so dlm_thread shuffle list will not run\n downconvert lock from EX to NR\n upconvert lock from NR to EX\n\u003c\u003c\u003c migration may schedule out here, then\n\u003c\u003c\u003c node 2 send down convert request to convert type from EX to\n\u003c\u003c\u003c NR, then send up convert request to convert type from NR to\n\u003c\u003c\u003c EX, at this time, lockres granted list is empty, and two locks\n\u003c\u003c\u003c in the converting list, node x up convert lock followed by\n\u003c\u003c\u003c node 2 up convert lock.\n\n\t // will set lockres RES_MIGRATING flag, the following\n\t // lock/unlock can not run\n dlm_lockres_release_ast(dlm, res);\n }\n\n dlm_send_one_lockres()\n dlm_process_recovery_data()\n for (i\u003d0; i\u003cmres-\u003enum_locks; i++)\n if (ml-\u003enode \u003d\u003d dlm-\u003enode_num)\n for (j \u003d DLM_GRANTED_LIST; j \u003c\u003d DLM_BLOCKED_LIST; j++) {\n list_for_each_entry(lock, tmpq, list)\n if (lock) break; \u003c\u003c\u003c lock is invalid as grant list is empty.\n }\n if (lock-\u003eml.node !\u003d ml-\u003enode)\n BUG() \u003e\u003e\u003e crash here\n }\n\nI see the above locks status from a vmcore of our internal bug.\n\nSigned-off-by: Junxiao Bi \u003cjunxiao.bi@oracle.com\u003e\nReviewed-by: Wengang Wang \u003cwen.gang.wang@oracle.com\u003e\nCc: Sunil Mushran \u003csunil.mushran@gmail.com\u003e\nReviewed-by: Srinivas Eeda \u003csrinivas.eeda@oracle.com\u003e\nCc: Joel Becker \u003cjlbec@evilplan.org\u003e\nCc: Mark Fasheh \u003cmfasheh@suse.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "96f6aea2715b25edfc9b982f9e372bd87db6c04e", "tree": "36c4f98e3e0c9e2a8ac02ccfbdd320577478abc5", "parents": [ "af4acfaf3ca2f1da6e48d67e50f27f5e22fa3308" ], "author": { "name": "Liu Hua", "email": "sdu.liu@huawei.com", "time": "Mon Apr 07 15:38:57 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:45 2014 -0700" }, "message": "hung_task: check the value of \"sysctl_hung_task_timeout_sec\"\n\ncommit 80df28476505ed4e6701c3448c63c9229a50c655 upstream.\n\nAs sysctl_hung_task_timeout_sec is unsigned long, when this value is\nlarger then LONG_MAX/HZ, the function schedule_timeout_interruptible in\nwatchdog will return immediately without sleep and with print :\n\n schedule_timeout: wrong timeout value ffffffffffffff83\n\nand then the funtion watchdog will call schedule_timeout_interruptible\nagain and again. The screen will be filled with\n\n\t\"schedule_timeout: wrong timeout value ffffffffffffff83\"\n\nThis patch does some check and correction in sysctl, to let the function\nschedule_timeout_interruptible allways get the valid parameter.\n\nSigned-off-by: Liu Hua \u003csdu.liu@huawei.com\u003e\nTested-by: Satoru Takeuchi \u003csatoru.takeuchi@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "af4acfaf3ca2f1da6e48d67e50f27f5e22fa3308", "tree": "e563577a2a106b1c4b45507a6a8d729e4f650061", "parents": [ "5650bff7fdf4f586d05dad9315d4786eba694149" ], "author": { "name": "Mizuma, Masayoshi", "email": "m.mizuma@jp.fujitsu.com", "time": "Mon Apr 07 15:37:54 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:45 2014 -0700" }, "message": "mm: hugetlb: fix softlockup when a large number of hugepages are freed.\n\ncommit 55f67141a8927b2be3e51840da37b8a2320143ed upstream.\n\nWhen I decrease the value of nr_hugepage in procfs a lot, softlockup\nhappens. It is because there is no chance of context switch during this\nprocess.\n\nOn the other hand, when I allocate a large number of hugepages, there is\nsome chance of context switch. Hence softlockup doesn\u0027t happen during\nthis process. So it\u0027s necessary to add the context switch in the\nfreeing process as same as allocating process to avoid softlockup.\n\nWhen I freed 12 TB hugapages with kernel-2.6.32-358.el6, the freeing\nprocess occupied a CPU over 150 seconds and following softlockup message\nappeared twice or more.\n\n$ echo 6000000 \u003e /proc/sys/vm/nr_hugepages\n$ cat /proc/sys/vm/nr_hugepages\n6000000\n$ grep ^Huge /proc/meminfo\nHugePages_Total: 6000000\nHugePages_Free: 6000000\nHugePages_Rsvd: 0\nHugePages_Surp: 0\nHugepagesize: 2048 kB\n$ echo 0 \u003e /proc/sys/vm/nr_hugepages\n\nBUG: soft lockup - CPU#16 stuck for 67s! [sh:12883] ...\nPid: 12883, comm: sh Not tainted 2.6.32-358.el6.x86_64 #1\nCall Trace:\n free_pool_huge_page+0xb8/0xd0\n set_max_huge_pages+0x128/0x190\n hugetlb_sysctl_handler_common+0x113/0x140\n hugetlb_sysctl_handler+0x1e/0x20\n proc_sys_call_handler+0x97/0xd0\n proc_sys_write+0x14/0x20\n vfs_write+0xb8/0x1a0\n sys_write+0x51/0x90\n __audit_syscall_exit+0x265/0x290\n system_call_fastpath+0x16/0x1b\n\nI have not confirmed this problem with upstream kernels because I am not\nable to prepare the machine equipped with 12TB memory now. However I\nconfirmed that the amount of decreasing hugepages was directly\nproportional to the amount of required time.\n\nI measured required times on a smaller machine. It showed 130-145\nhugepages decreased in a millisecond.\n\n Amount of decreasing Required time Decreasing rate\n hugepages (msec) (pages/msec)\n ------------------------------------------------------------\n 10,000 pages \u003d\u003d 20GB 70 - 74 135-142\n 30,000 pages \u003d\u003d 60GB 208 - 229 131-144\n\nIt means decrement of 6TB hugepages will trigger softlockup with the\ndefault threshold 20sec, in this decreasing rate.\n\nSigned-off-by: Masayoshi Mizuma \u003cm.mizuma@jp.fujitsu.com\u003e\nCc: Joonsoo Kim \u003ciamjoonsoo.kim@lge.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.cz\u003e\nCc: Wanpeng Li \u003cliwanp@linux.vnet.ibm.com\u003e\nCc: Aneesh Kumar \u003caneesh.kumar@linux.vnet.ibm.com\u003e\nCc: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nCc: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5650bff7fdf4f586d05dad9315d4786eba694149", "tree": "3286ec5f670affebf7ec13b081fc44b59903b4d7", "parents": [ "d6f6fc7a2bc99124058b7c4850a9997530589a33" ], "author": { "name": "Matt Fleming", "email": "matt.fleming@intel.com", "time": "Thu Apr 03 14:46:20 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:45 2014 -0700" }, "message": "sh: fix format string bug in stack tracer\n\ncommit a0c32761e73c9999cbf592b702f284221fea8040 upstream.\n\nKees reported the following error:\n\n arch/sh/kernel/dumpstack.c: In function \u0027print_trace_address\u0027:\n arch/sh/kernel/dumpstack.c:118:2: error: format not a string literal and no format arguments [-Werror\u003dformat-security]\n\nUse the \"%s\" format so that it\u0027s impossible to interpret \u0027data\u0027 as a\nformat string.\n\nSigned-off-by: Matt Fleming \u003cmatt.fleming@intel.com\u003e\nReported-by: Kees Cook \u003ckeescook@chromium.org\u003e\nAcked-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Paul Mundt \u003clethal@linux-sh.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d6f6fc7a2bc99124058b7c4850a9997530589a33", "tree": "9bc2384599e2b0be35cf36266c24c8f12dfb735c", "parents": [ "216583b5033215cd64468b865c0ee96d265cf546" ], "author": { "name": "Alan Stern", "email": "stern@rowland.harvard.edu", "time": "Wed Mar 12 11:30:38 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:45 2014 -0700" }, "message": "USB: unbind all interfaces before rebinding any\n\ncommit 6aec044cc2f5670cf3b143c151c8be846499bd15 upstream.\n\nWhen a driver doesn\u0027t have pre_reset, post_reset, or reset_resume\nmethods, the USB core unbinds that driver when its device undergoes a\nreset or a reset-resume, and then rebinds it afterward.\n\nThe existing straightforward implementation can lead to problems,\nbecause each interface gets unbound and rebound before the next\ninterface is handled. If a driver claims additional interfaces, the\nclaim may fail because the old binding instance may still own the\nadditional interface when the new instance tries to claim it.\n\nThis patch fixes the problem by first unbinding all the interfaces\nthat are marked (i.e., their needs_binding flag is set) and then\nrebinding all of them.\n\nThe patch also makes the helper functions in driver.c a little more\nuniform and adjusts some out-of-date comments.\n\nSigned-off-by: Alan Stern \u003cstern@rowland.harvard.edu\u003e\nReported-and-tested-by: \"Poulain, Loic\" \u003cloic.poulain@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "216583b5033215cd64468b865c0ee96d265cf546", "tree": "85bede3a9de8e178aac7b362fea9f672682b0a68", "parents": [ "f53fd451ade7c197376e9337c0ff4bbadf985dde" ], "author": { "name": "Paul Gortmaker", "email": "paul.gortmaker@windriver.com", "time": "Tue Jan 14 16:03:37 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:45 2014 -0700" }, "message": "hvc: ensure hvc_init is only ever called once in hvc_console.c\n\ncommit f76a1cbed18c86e2d192455f0daebb48458965f3 upstream.\n\nCommit 3e6c6f630a5282df8f3393a59f10eb9c56536d23 (\"Delay creation of\nkhcvd thread\") moved the call of hvc_init from being a device_initcall\ninto hvc_alloc, and used a non-null hvc_driver as indication of whether\nhvc_init had already been called.\n\nThe problem with this is that hvc_driver is only assigned a value\nat the bottom of hvc_init, and so there is a window where multiple\nhvc_alloc calls can be in progress at the same time and hence try\nand call hvc_init multiple times. Previously the use of device_init\nguaranteed that hvc_init was only called once.\n\nThis manifests itself as sporadic instances of two hvc_init calls\nracing each other, and with the loser of the race getting -EBUSY\nfrom tty_register_driver() and hence that virtual console fails:\n\n Couldn\u0027t register hvc console driver\n virtio-ports vport0p1: error -16 allocating hvc for port\n\nHere we add an atomic_t to guarantee we\u0027ll never run hvc_init twice.\n\nCc: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nCc: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nFixes: 3e6c6f630a52 (\"Delay creation of khcvd thread\")\nReported-by: Jim Somerville \u003cJim.Somerville@windriver.com\u003e\nTested-by: Jim Somerville \u003cJim.Somerville@windriver.com\u003e\nSigned-off-by: Paul Gortmaker \u003cpaul.gortmaker@windriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f53fd451ade7c197376e9337c0ff4bbadf985dde", "tree": "e5a614a9b242e0b0c5a13d9d13d45534819f240d", "parents": [ "f97f28f902804f7ccc209ff0e560c20dcb32c608" ], "author": { "name": "Huang Rui", "email": "ray.huang@amd.com", "time": "Tue Jan 07 17:45:50 2014 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:44 2014 -0700" }, "message": "usb: dwc3: fix wrong bit mask in dwc3_event_devt\n\ncommit 06f9b6e59661cee510b04513b13ea7927727d758 upstream.\n\nAround DWC USB3 2.30a release another bit has been added to the\nDevice-Specific Event (DEVT) Event Information (EvtInfo) bitfield.\n\nBecause of that, what used to be 8 bits long, has become 9 bits long.\n\nPer dwc3 2.30a+ spec in the Device-Specific Event (DEVT), the field of\nEvent Information Bits(EvtInfo) uses [24:16] bits, and it has 9 bits\nnot 8 bits. And the following reserved field uses [31:25] bits not\n[31:24] bits, and it has 7 bits.\n\nSo in dwc3_event_devt, the bit mask should be:\nevent_info\t[24:16]\t\t9 bits\nreserved31_25\t[31:25]\t\t7 bits\n\nThis patch makes sure that newer core releases will work fine with\nLinux and that we will decode the event information properly on new\ncore releases.\n\n[ balbi@ti.com : improve commit log a bit ]\n\nSigned-off-by: Huang Rui \u003cray.huang@amd.com\u003e\nSigned-off-by: Felipe Balbi \u003cbalbi@ti.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f97f28f902804f7ccc209ff0e560c20dcb32c608", "tree": "a2f149322def325ffad3ec9c8ae28bc817c37b24", "parents": [ "8ccd1a5521d0e870ccc5fee1d4bf7ee7ddab66ff" ], "author": { "name": "David Cohen", "email": "david.a.cohen@linux.intel.com", "time": "Fri Apr 25 19:20:16 2014 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:44 2014 -0700" }, "message": "usb/xhci: fix compilation warning when !CONFIG_PCI \u0026\u0026 !CONFIG_PM\n\ncommit 01bb59ebffdec314da8da66266edf29529372f9b upstream.\n\nWhen CONFIG_PCI and CONFIG_PM are not selected, xhci.c gets this\nwarning:\ndrivers/usb/host/xhci.c:409:13: warning: ‘xhci_msix_sync_irqs’ defined\nbut not used [-Wunused-function]\n\nInstead of creating nested #ifdefs, this patch fixes it by defining the\nxHCI PCI stubs as inline.\n\nThis warning has been in since 3.2 kernel and was\ncaused by commit 421aa841a134f6a743111cf44d0c6d3b45e3cf8c\n\"usb/xhci: hide MSI code behind PCI bars\", but wasn\u0027t noticed\nuntil 3.13 when a configuration with these options was tried\n\nSigned-off-by: David Cohen \u003cdavid.a.cohen@linux.intel.com\u003e\nSigned-off-by: Mathias Nyman \u003cmathias.nyman@linux.intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8ccd1a5521d0e870ccc5fee1d4bf7ee7ddab66ff", "tree": "680e1732fcca6d43d535bb912d027041c185ed07", "parents": [ "41b4a7dfd391b5826492a89c702420b97dc02334" ], "author": { "name": "Igor Gnatenko", "email": "i.gnatenko.brain@gmail.com", "time": "Fri Apr 25 19:20:15 2014 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:44 2014 -0700" }, "message": "xhci: extend quirk for Renesas cards\n\ncommit 6db249ebefc6bf5c39f35dfaacc046d8ad3ffd70 upstream.\n\nAfter suspend another Renesas PCI-X USB 3.0 card doesn\u0027t work.\n[root@fedora-20 ~]# lspci -vmnnd 1912:\nDevice:\t03:00.0\nClass:\tUSB controller [0c03]\nVendor:\tRenesas Technology Corp. [1912]\nDevice:\tuPD720202 USB 3.0 Host Controller [0015]\nSVendor:\tRenesas Technology Corp. [1912]\nSDevice:\tuPD720202 USB 3.0 Host Controller [0015]\nRev:\t02\nProgIf:\t30\n\nThis patch should be applied to stable kernel 3.14 that contain\nthe commit 1aa9578c1a9450fb21501c4f549f5b1edb557e6d\n\"xhci: Fix resume issues on Renesas chips in Samsung laptops\"\n\nReported-and-tested-by: Anatoly Kharchenko \u003crfr-bugs@yandex.ru\u003e\nReference: http://redmine.russianfedora.pro/issues/1315\nSigned-off-by: Igor Gnatenko \u003ci.gnatenko.brain@gmail.com\u003e\nSigned-off-by: Mathias Nyman \u003cmathias.nyman@linux.intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "41b4a7dfd391b5826492a89c702420b97dc02334", "tree": "22b1c0dc0d1213b6a3e4712123b3546e5f82dafd", "parents": [ "15e5f90c0f1d3f597981ffe18112aae9421f57c0" ], "author": { "name": "supriya karanth", "email": "supriya.karanth@stericsson.com", "time": "Thu Dec 06 11:12:48 2012 +0530" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:44 2014 -0700" }, "message": "usb: musb: set TXMAXP and AUTOSET for full speed bulk in device mode\n\ncommit bb3a2ef2eb8cfaea335dcb3426350df7f3d48069 upstream.\n\nThe TXMAXP register is not set correctly for full speed bulk case\nwhen the can_bulk_split() is used. Without this PIO transfers will\nnot take place correctly\n\nThe \"mult\" factor needs to be updated correctly for the\ncan_bulk_split() case\n\nThe AUTOSET bit in the TXCSR is not being set if the \"mult\"\nfactor is greater than 0 for the High Bandwidth ISO case.\nBut the \"mult\" factor is also greater than 0 in case of Full speed\nbulk transfers with the packet splitting in TXMAXP register\n\nWithout the AUTOSET the DMA transfers will not progress in mode1\n\n[ balbi@ti.com : add braces to both branches ]\n\nSigned-off-by: supriya karanth \u003csupriya.karanth@stericsson.com\u003e\nSigned-off-by: Praveena NADAHALLY \u003cpraveen.nadahally@stericsson.com\u003e\nAcked-by: Linus Walleij \u003clinus.walleij@linaro.org\u003e\nSigned-off-by: Felipe Balbi \u003cbalbi@ti.com\u003e\nCc: ian coolidge \u003ciancoolidge@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "15e5f90c0f1d3f597981ffe18112aae9421f57c0", "tree": "7b23c1679b69ac6d3b79da9aec33ecfcfe828c48", "parents": [ "86455b800f7544e239b2fa5a16962ea780a1e9d8" ], "author": { "name": "Jeff Mahoney", "email": "jeffm@suse.com", "time": "Wed Apr 02 14:40:26 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:44 2014 -0700" }, "message": "reiserfs: fix race in readdir\n\ncommit 01d8885785a60ae8f4c37b0ed75bdc96d0fc6a44 upstream.\n\njdm-20004 reiserfs_delete_xattrs: Couldn\u0027t delete all xattrs (-2)\n\nThe -ENOENT is due to readdir calling dir_emit on the same entry twice.\n\nIf the dir_emit callback sleeps and the tree is changed underneath us,\nwe won\u0027t be able to trust deh_offset(deh) anymore. We need to save\nnext_pos before we might sleep so we can find the next entry.\n\nSigned-off-by: Jeff Mahoney \u003cjeffm@suse.com\u003e\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "86455b800f7544e239b2fa5a16962ea780a1e9d8", "tree": "7119f6a2a710aa78fc46eeb2d9d3cf06da12389c", "parents": [ "d72db3c871f7232448abab9e12fbbe9d80a6606c" ], "author": { "name": "Andy Grover", "email": "agrover@redhat.com", "time": "Fri Apr 04 16:44:37 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:44 2014 -0700" }, "message": "target/tcm_fc: Fix use-after-free of ft_tpg\n\ncommit 2c42be2dd4f6586728dba5c4e197afd5cfaded78 upstream.\n\nft_del_tpg checks tpg-\u003etport is set before unlinking the tpg from the\ntport when the tpg is being removed. Set this pointer in ft_tport_create,\nor the unlinking won\u0027t happen in ft_del_tpg and tport-\u003etpg will reference\na deleted object.\n\nThis patch sets tpg-\u003etport in ft_tport_create, because that\u0027s what\nft_del_tpg checks, and is the only way to get back to the tport to\nclear tport-\u003etpg.\n\nThe bug was occuring when:\n\n- lport created, tport (our per-lport, per-provider context) is\n allocated.\n tport-\u003etpg \u003d NULL\n- tpg created\n- a PRLI is received. ft_tport_create is called, tpg is found and\n tport-\u003etpg is set\n- tpg removed. ft_tpg is freed in ft_del_tpg. Since tpg-\u003etport was not\n set, tport-\u003etpg is not cleared and points at freed memory\n- Future calls to ft_tport_create return tport via first conditional,\n instead of searching for new tpg by calling ft_lport_find_tpg.\n tport-\u003etpg is still invalid, and will access freed memory.\n\nsee https://bugzilla.redhat.com/show_bug.cgi?id\u003d1071340\n\nSigned-off-by: Andy Grover \u003cagrover@redhat.com\u003e\nSigned-off-by: Nicholas Bellinger \u003cnab@linux-iscsi.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d72db3c871f7232448abab9e12fbbe9d80a6606c", "tree": "57332345d7f1a1de27f9eaae4eda3b9709fc4d82", "parents": [ "8ba4bc7680f75ac3294cb3222b21bc2912b24963" ], "author": { "name": "Nicholas Bellinger", "email": "nab@linux-iscsi.org", "time": "Wed Feb 19 23:32:14 2014 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:43 2014 -0700" }, "message": "iscsi-target: Fix ERL\u003d2 ASYNC_EVENT connection pointer bug\n\ncommit d444edc679e7713412f243b792b1f964e5cff1e1 upstream.\n\nThis patch fixes a long-standing bug in iscsit_build_conn_drop_async_message()\nwhere during ERL\u003d2 connection recovery, a bogus conn_p pointer could\nend up being used to send the ISCSI_OP_ASYNC_EVENT + DROPPING_CONNECTION\nnotifying the initiator that cmd-\u003elogout_cid has failed.\n\nThe bug was manifesting itself as an OOPs in iscsit_allocate_cmd() with\na bogus conn_p pointer in iscsit_build_conn_drop_async_message().\n\nReported-by: Arshad Hussain \u003carshad.hussain@calsoftinc.com\u003e\nReported-by: santosh kulkarni \u003csantosh.kulkarni@calsoftinc.com\u003e\nSigned-off-by: Nicholas Bellinger \u003cnab@linux-iscsi.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8ba4bc7680f75ac3294cb3222b21bc2912b24963", "tree": "6d2e583cf657638790e10dfbdab1e49a37f4fde6", "parents": [ "41d5d291583dedd9fde7dbdad524a604166266c4" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Tue Feb 11 19:06:33 2014 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:43 2014 -0700" }, "message": "SCSI: arcmsr: upper 32 of dma address lost\n\ncommit e2c70425f05219b142b3a8a9489a622c736db39d upstream.\n\nThe original code always set the upper 32 bits to zero because it was\ndoing a shift of the wrong variable.\n\nFixes: 1a4f550a09f8 (\u0027[SCSI] arcmsr: 1.20.00.15: add SATA RAID plus other fixes\u0027)\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: James Bottomley \u003cJBottomley@Parallels.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "41d5d291583dedd9fde7dbdad524a604166266c4", "tree": "2f0731e52957f8a901510fd84cd7ffe94f1b59ea", "parents": [ "794f9950ebd832b8712e32007e0359e5c6e60f55" ], "author": { "name": "Mike Marciniszyn", "email": "mike.marciniszyn@intel.com", "time": "Mon Apr 07 13:58:35 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:43 2014 -0700" }, "message": "ib_srpt: Use correct ib_sg_dma primitives\n\ncommit b076808051f2c80d38e03fb2f1294f525c7a446d upstream.\n\nThe code was incorrectly using sg_dma_address() and\nsg_dma_len() instead of ib_sg_dma_address() and\nib_sg_dma_len().\n\nThis prevents srpt from functioning with the\nIntel HCA and indeed will corrupt memory\nbadly.\n\nCc: Bart Van Assche \u003cbvanassche@acm.org\u003e\nReviewed-by: Dennis Dalessandro \u003cdennis.dalessandro@intel.com\u003e\nTested-by: Vinod Kumar \u003cvinod.kumar@intel.com\u003e\nSigned-off-by: Mike Marciniszyn \u003cmike.marciniszyn@intel.com\u003e\nSigned-off-by: Nicholas Bellinger \u003cnab@linux-iscsi.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "794f9950ebd832b8712e32007e0359e5c6e60f55", "tree": "0a07c710c6cf08308d96fd4b291981880c09b090", "parents": [ "53b5bc1e97df8c617d6a9e15d0ce33981ee086c9" ], "author": { "name": "Yann Droneaud", "email": "ydroneaud@opteya.com", "time": "Mon Mar 10 23:06:25 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:43 2014 -0700" }, "message": "IB/ehca: Returns an error on ib_copy_to_udata() failure\n\ncommit 5bdb0f02add5994b0bc17494f4726925ca5d6ba1 upstream.\n\nIn case of error when writing to userspace, function ehca_create_cq()\ndoes not set an error code before following its error path.\n\nThis patch sets the error code to -EFAULT when ib_copy_to_udata()\nfails.\n\nThis was caught when using spatch (aka. coccinelle)\nto rewrite call to ib_copy_{from,to}_udata().\n\nLink: https://www.gitorious.org/opteya/coccib/source/75ebf2c1033c64c1d81df13e4ae44ee99c989eba:ib_copy_udata.cocci\nLink: http://marc.info/?i\u003dcover.1394485254.git.ydroneaud@opteya.com\nSigned-off-by: Yann Droneaud \u003cydroneaud@opteya.com\u003e\nSigned-off-by: Roland Dreier \u003croland@purestorage.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "53b5bc1e97df8c617d6a9e15d0ce33981ee086c9", "tree": "9d0be6df99b030d8b9b6af4af3e0fc52d17e4cd4", "parents": [ "64900cd67cf96f8fc40d1db1f4058cbaa2dca7ff" ], "author": { "name": "Yann Droneaud", "email": "ydroneaud@opteya.com", "time": "Mon Mar 10 23:06:26 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:43 2014 -0700" }, "message": "IB/mthca: Return an error on ib_copy_to_udata() failure\n\ncommit 08e74c4b00c30c232d535ff368554959403d0432 upstream.\n\nIn case of error when writing to userspace, the function mthca_create_cq()\ndoes not set an error code before following its error path.\n\nThis patch sets the error code to -EFAULT when ib_copy_to_udata() fails.\n\nThis was caught when using spatch (aka. coccinelle)\nto rewrite call to ib_copy_{from,to}_udata().\n\nLink: https://www.gitorious.org/opteya/coccib/source/75ebf2c1033c64c1d81df13e4ae44ee99c989eba:ib_copy_udata.cocci\nLink: http://marc.info/?i\u003dcover.1394485254.git.ydroneaud@opteya.com\nSigned-off-by: Yann Droneaud \u003cydroneaud@opteya.com\u003e\nSigned-off-by: Roland Dreier \u003croland@purestorage.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "64900cd67cf96f8fc40d1db1f4058cbaa2dca7ff", "tree": "73cc9e6a5c00d76674790c77d579a37136b07a24", "parents": [ "066c269f39f667f486d3cb709429dc73ff2f172d" ], "author": { "name": "Yann Droneaud", "email": "ydroneaud@opteya.com", "time": "Mon Mar 10 23:06:27 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:43 2014 -0700" }, "message": "IB/nes: Return an error on ib_copy_from_udata() failure instead of NULL\n\ncommit 9d194d1025f463392feafa26ff8c2d8247f71be1 upstream.\n\nIn case of error while accessing to userspace memory, function\nnes_create_qp() returns NULL instead of an error code wrapped through\nERR_PTR(). But NULL is not expected by ib_uverbs_create_qp(), as it\ncheck for error with IS_ERR().\n\nAs page 0 is likely not mapped, it is going to trigger an Oops when\nthe kernel will try to dereference NULL pointer to access to struct\nib_qp\u0027s fields.\n\nIn some rare cases, page 0 could be mapped by userspace, which could\nturn this bug to a vulnerability that could be exploited: the function\npointers in struct ib_device will be under userspace total control.\n\nThis was caught when using spatch (aka. coccinelle)\nto rewrite calls to ib_copy_{from,to}_udata().\n\nLink: https://www.gitorious.org/opteya/ib-hw-nes-create-qp-null\nLink: https://www.gitorious.org/opteya/coccib/source/75ebf2c1033c64c1d81df13e4ae44ee99c989eba:ib_copy_udata.cocci\nLink: http://marc.info/?i\u003dcover.1394485254.git.ydroneaud@opteya.com\nSigned-off-by: Yann Droneaud \u003cydroneaud@opteya.com\u003e\nSigned-off-by: Roland Dreier \u003croland@purestorage.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "066c269f39f667f486d3cb709429dc73ff2f172d", "tree": "056b30092367c8618500d3ca9d980defd5920f1e", "parents": [ "d8992efff2b60c8b360ebef7daa03db6496cc131" ], "author": { "name": "Dennis Dalessandro", "email": "dennis.dalessandro@intel.com", "time": "Thu Feb 20 11:02:53 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:43 2014 -0700" }, "message": "IB/ipath: Fix potential buffer overrun in sending diag packet routine\n\ncommit a2cb0eb8a64adb29a99fd864013de957028f36ae upstream.\n\nGuard against a potential buffer overrun. The size to read from the\nuser is passed in, and due to the padding that needs to be taken into\naccount, as well as the place holder for the ICRC it is possible to\noverflow the 32bit value which would cause more data to be copied from\nuser space than is allocated in the buffer.\n\nReported-by: Nico Golde \u003cnico@ngolde.de\u003e\nReported-by: Fabian Yamaguchi \u003cfabs@goesec.de\u003e\nReviewed-by: Mike Marciniszyn \u003cmike.marciniszyn@intel.com\u003e\nSigned-off-by: Dennis Dalessandro \u003cdennis.dalessandro@intel.com\u003e\nSigned-off-by: Roland Dreier \u003croland@purestorage.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d8992efff2b60c8b360ebef7daa03db6496cc131", "tree": "8d9c6eec926034373edfbc387556f2743260a6be", "parents": [ "367bce496469f4a47c717c048116cdb73caefa62" ], "author": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Mon Mar 10 14:17:55 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:42 2014 -0700" }, "message": "nfsd4: fix setclientid encode size\n\ncommit 480efaee085235bb848f1063f959bf144103c342 upstream.\n\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "367bce496469f4a47c717c048116cdb73caefa62", "tree": "0470771399f03018f5ef348c6041bc3817ed758d", "parents": [ "c2189c7fedb781f3dd14b4df162661e36a85cc02" ], "author": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Mon Feb 24 14:59:47 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:42 2014 -0700" }, "message": "nfsd: notify_change needs elevated write count\n\ncommit 9f67f189939eccaa54f3d2c9cf10788abaf2d584 upstream.\n\nLooks like this bug has been here since these write counts were\nintroduced, not sure why it was just noticed now.\n\nThanks also to Jan Kara for pointing out the problem.\n\nReported-by: Matthew Rahtz \u003cmrahtz@rapitasystems.com\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c2189c7fedb781f3dd14b4df162661e36a85cc02", "tree": "f913a63c0c1d04c74cd8af30ff5c4b72439768fa", "parents": [ "9acc531f6038cccb95a7bf4d26469196764e6d53" ], "author": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Mon Feb 03 16:31:42 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:42 2014 -0700" }, "message": "nfsd4: fix test_stateid error reply encoding\n\ncommit a11fcce1544df08c723d950ff0edef3adac40405 upstream.\n\nIf the entire operation fails then there\u0027s nothing to encode.\n\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9acc531f6038cccb95a7bf4d26469196764e6d53", "tree": "7d3b9e2f1b064e527954ca5f321d1148f6054fd8", "parents": [ "fc111bf8f73b9223fd4f8e420b7b76f4e0fed427" ], "author": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Tue Jan 28 16:05:15 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:42 2014 -0700" }, "message": "nfsd4: buffer-length check for SUPPATTR_EXCLCREAT\n\ncommit de3997a7eeb9ea286b15879fdf8a95aae065b4f7 upstream.\n\nThis was an omission from 8c18f2052e756e7d5dea712fc6e7ed70c00e8a39\n\"nfsd41: SUPPATTR_EXCLCREAT attribute\".\n\nCc: Benny Halevy \u003cbhalevy@primarydata.com\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "fc111bf8f73b9223fd4f8e420b7b76f4e0fed427", "tree": "c320303c76a4252d965345ca05baf791b336100f", "parents": [ "5d052fbbd7b0069df1fdeaa7dd5eb16e1345a458" ], "author": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Tue Jan 28 16:01:04 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:42 2014 -0700" }, "message": "nfsd4: session needs room for following op to error out\n\ncommit 4c69d5855a16f7378648c5733632628fa10431db upstream.\n\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5d052fbbd7b0069df1fdeaa7dd5eb16e1345a458", "tree": "85d38d4c39d69a896dbbddc578485305c9e2d81f", "parents": [ "632d996e9911371a3b48cec1e8451c7c2761fd69" ], "author": { "name": "Alan Stern", "email": "stern@rowland.harvard.edu", "time": "Mon Apr 14 13:48:47 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:42 2014 -0700" }, "message": "USB: fix crash during hotplug of PCI USB controller card\n\ncommit a2ff864b53eac9a0e9b05bfe9d1781ccd6c2af71 upstream.\n\nThe code in hcd-pci.c that matches up EHCI controllers with their\ncompanion UHCI or OHCI controllers assumes that the private drvdata\nfields don\u0027t get set too early. However, it turns out that this field\ngets set by usb_create_hcd(), before hcd-pci expects it, and this can\nresult in a crash when two controllers are probed in parallel (as can\nhappen when a new controller card is hotplugged).\n\nThe companions_rwsem lock was supposed to prevent this sort of thing,\nbut usb_create_hcd() is called outside the scope of the rwsem.\n\nA simple solution is to check that the root-hub pointer has been\ninitialized as well as the drvdata field. This doesn\u0027t happen until\nusb_add_hcd() is called; that call and the check are both protected by\nthe rwsem.\n\nThis patch should be applied to stable kernels from 3.10 onward.\n\nSigned-off-by: Alan Stern \u003cstern@rowland.harvard.edu\u003e\nReported-by: Stefani Seibold \u003cstefani@seibold.net\u003e\nTested-by: Stefani Seibold \u003cstefani@seibold.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "632d996e9911371a3b48cec1e8451c7c2761fd69", "tree": "fad9c784dd595583703c53555f28d1ca06c2a32d", "parents": [ "9d1a5959bc3be5b9aa5886e8736534b96098b215" ], "author": { "name": "H. Peter Anvin", "email": "hpa@linux.intel.com", "time": "Sun Mar 16 15:31:54 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:42 2014 -0700" }, "message": "x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels\n\ncommit b3b42ac2cbae1f3cecbb6229964a4d48af31d382 upstream.\n\nThe IRET instruction, when returning to a 16-bit segment, only\nrestores the bottom 16 bits of the user space stack pointer. We have\na software workaround for that (\"espfix\") for the 32-bit kernel, but\nit relies on a nonzero stack segment base which is not available in\n32-bit mode.\n\nSince 16-bit support is somewhat crippled anyway on a 64-bit kernel\n(no V86 mode), and most (if not quite all) 64-bit processors support\nvirtualization for the users who really need it, simply reject\nattempts at creating a 16-bit segment when running on top of a 64-bit\nkernel.\n\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: H. Peter Anvin \u003chpa@linux.intel.com\u003e\nLink: http://lkml.kernel.org/n/tip-kicdm89kzw9lldryb1br9od0@git.kernel.org\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9d1a5959bc3be5b9aa5886e8736534b96098b215", "tree": "08279717977dcbeb73901895ae4992042e219c8c", "parents": [ "725f2ba0cbb94c7e8f3499ef57dbd47d85521ef7" ], "author": { "name": "Larry Finger", "email": "Larry.Finger@lwfinger.net", "time": "Wed Apr 16 14:49:33 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:41 2014 -0700" }, "message": "staging: r8712u: Fix case where ethtype was never obtained and always be checked against 0\n\ncommit f764cd68d9036498f08fe8834deb6a367b5c2542 upstream.\n\nZero-initializing ether_type masked that the ether type would never be\nobtained for 8021x packets and the comparison against eapol_type\nwould always fail.\n\nReported-by: Jes Sorensen \u003cJes.Sorensen@redhat.com\u003e\nSigned-off-by: Larry Finger \u003cLarry.Finger@lwfinger.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "725f2ba0cbb94c7e8f3499ef57dbd47d85521ef7", "tree": "b8b6b089bdf8f2e5cf1e883b038b1eb52efe5b7e", "parents": [ "6733ac581418cfd8d7bef57c22fc2e0d673c4272" ], "author": { "name": "Himangi Saraogi", "email": "himangi774@gmail.com", "time": "Wed Mar 05 04:59:57 2014 +0530" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:41 2014 -0700" }, "message": "staging:serqt_usb2: Fix sparse warning restricted __le16 degrades to integer\n\ncommit abe5d64d1a74195a44cd14624f8178b9f48b7cc7 upstream.\n\nThis patch fixes the following sparse warning :\ndrivers/staging/serqt_usb2/serqt_usb2.c:727:40: warning: restricted __le16 degrades to integer\n\nSigned-off-by: Himangi Saraogi \u003chimangi774@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" } ], "next": "6733ac581418cfd8d7bef57c22fc2e0d673c4272" }