)]}' { "log": [ { "commit": "b71ec07584b31aacb937d8b775a6e373b109028a", "tree": "2bb5d578e9f8308a842033fb3dd968a061b0d21a", "parents": [ "ace595fd79ba3c6f1d067e8be9d311951f591d9c" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Tue Jan 21 15:49:56 2014 -0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:55 2015 +0800" }, "message": "introduce for_each_thread() to replace the buggy while_each_thread()\n\ncommit 0c740d0afc3bff0a097ad03a1c8df92757516f5c upstream.\n\nwhile_each_thread() and next_thread() should die, almost every lockless\nusage is wrong.\n\n1. Unless g \u003d\u003d current, the lockless while_each_thread() is not safe.\n\n while_each_thread(g, t) can loop forever if g exits, next_thread()\n can\u0027t reach the unhashed thread in this case. Note that this can\n happen even if g is the group leader, it can exec.\n\n2. Even if while_each_thread() itself was correct, people often use\n it wrongly.\n\n It was never safe to just take rcu_read_lock() and loop unless\n you verify that pid_alive(g) \u003d\u003d T, even the first next_thread()\n can point to the already freed/reused memory.\n\nThis patch adds signal_struct-\u003ethread_head and task-\u003ethread_node to\ncreate the normal rcu-safe list with the stable head. The new\nfor_each_thread(g, t) helper is always safe under rcu_read_lock() as\nlong as this task_struct can\u0027t go away.\n\nNote: of course it is ugly to have both task_struct-\u003ethread_node and the\nold task_struct-\u003ethread_group, we will kill it later, after we change\nthe users of while_each_thread() to use for_each_thread().\n\nPerhaps we can kill it even before we convert all users, we can\nreimplement next_thread(t) using the new thread_head/thread_node. But\nwe can\u0027t do this right now because this will lead to subtle behavioural\nchanges. For example, do/while_each_thread() always sees at least one\ntask, while for_each_thread() can do nothing if the whole thread group\nhas died. Or thread_group_empty(), currently its semantics is not clear\nunless thread_group_leader(p) and we need to audit the callers before we\ncan change it.\n\nSo this patch adds the new interface which has to coexist with the old\none for some time, hopefully the next changes will be more or less\nstraightforward and the old one will go away soon.\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nReviewed-by: Sergey Dyasly \u003cdserrg@gmail.com\u003e\nTested-by: Sergey Dyasly \u003cdserrg@gmail.com\u003e\nReviewed-by: Sameer Nanda \u003csnanda@chromium.org\u003e\nAcked-by: David Rientjes \u003crientjes@google.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCc: Mandeep Singh Baines \u003cmsb@chromium.org\u003e\nCc: \"Ma, Xindong\" \u003cxindong.ma@intel.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.cz\u003e\nCc: \"Tu, Xiaobing\" \u003cxiaobing.tu@intel.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "ace595fd79ba3c6f1d067e8be9d311951f591d9c", "tree": "1fcc736f9db817e4b1ae6016f6a7d6f02382d19b", "parents": [ "a2ca02f15bababecd0b0626a13a6291fd2d04dbc" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Wed Jul 03 15:08:30 2013 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:55 2015 +0800" }, "message": "kernel/fork.c:copy_process(): unify CLONE_THREAD-or-thread_group_leader code\n\ncommit 80628ca06c5d42929de6bc22c0a41589a834d151 upstream.\n\nCleanup and preparation for the next changes.\n\nMove the \"if (clone_flags \u0026 CLONE_THREAD)\" code down under \"if\n(likely(p-\u003epid))\" and turn it into into the \"else\" branch. This makes the\nprocess/thread initialization more symmetrical and removes one check.\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.cz\u003e\nCc: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nCc: Sergey Dyasly \u003cdserrg@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "a2ca02f15bababecd0b0626a13a6291fd2d04dbc", "tree": "fb8fc09d9185b641bf3fc08c2281e935a8cc50e6", "parents": [ "7e55164764dc6dad42ae86ae5ebec4f352a87fdb" ], "author": { "name": "Cong Wang", "email": "xiyou.wangcong@gmail.com", "time": "Tue Oct 21 09:27:12 2014 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:54 2015 +0800" }, "message": "freezer: Do not freeze tasks killed by OOM killer\n\ncommit 51fae6da640edf9d266c94f36bc806c63c301991 upstream.\n\nSince f660daac474c6f (oom: thaw threads if oom killed thread is frozen\nbefore deferring) OOM killer relies on being able to thaw a frozen task\nto handle OOM situation but a3201227f803 (freezer: make freezing() test\nfreeze conditions in effect instead of TIF_FREEZE) has reorganized the\ncode and stopped clearing freeze flag in __thaw_task. This means that\nthe target task only wakes up and goes into the fridge again because the\nfreezing condition hasn\u0027t changed for it. This reintroduces the bug\nfixed by f660daac474c6f.\n\nFix the issue by checking for TIF_MEMDIE thread flag in\nfreezing_slow_path and exclude the task from freezing completely. If a\ntask was already frozen it would get woken by __thaw_task from OOM killer\nand get out of freezer after rechecking freezing().\n\nChanges since v1\n- put TIF_MEMDIE check into freezing_slowpath rather than in __refrigerator\n as per Oleg\n- return __thaw_task into oom_scan_process_thread because\n oom_kill_process will not wake task in the fridge because it is\n sleeping uninterruptible\n\n[mhocko@suse.cz: rewrote the changelog]\nFixes: a3201227f803 (freezer: make freezing() test freeze conditions in effect instead of TIF_FREEZE)\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nSigned-off-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nAcked-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "7e55164764dc6dad42ae86ae5ebec4f352a87fdb", "tree": "dec7f3ef641146559314e49f6f1ab600e69e8f0d", "parents": [ "7a13f726f0a6a051f2a3e5b18c806e733071c5db" ], "author": { "name": "Vlad Catoi", "email": "vladcatoi@gmail.com", "time": "Sat Oct 18 17:45:41 2014 -0500" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:54 2015 +0800" }, "message": "ALSA: usb-audio: Add support for Steinberg UR22 USB interface\n\ncommit f0b127fbfdc8756eba7437ab668f3169280bd358 upstream.\n\nAdding support for Steinberg UR22 USB interface via quirks table patch\n\nSee Ubuntu bug report:\nhttps://bugs.launchpad.net/ubuntu/+source/linux/+bug/1317244\nAlso see threads:\nhttp://linux-audio.4202.n7.nabble.com/Support-for-Steinberg-UR22-Yamaha-USB-chipset-0499-1509-tc82888.html#a82917\nhttp://www.steinberg.net/forums/viewtopic.php?t\u003d62290\n\nTested by at least 4 people judging by the threads.\nDid not test MIDI interface, but audio output and capture both are\nfunctional. Built 3.17 kernel with this driver on Ubuntu 14.04 \u0026 tested with mpg123\nPatch applied to 3.13 Ubuntu kernel works well enough for daily use.\n\nSigned-off-by: Vlad Catoi \u003cvladcatoi@gmail.com\u003e\nAcked-by: Clemens Ladisch \u003cclemens@ladisch.de\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "7a13f726f0a6a051f2a3e5b18c806e733071c5db", "tree": "ed75a6f46f6ed0df7239183e8b661a50fc627b89", "parents": [ "6a16b0d080cd68ffac3f063891612dd9725a6d93" ], "author": { "name": "Anatol Pomozov", "email": "anatol.pomozov@gmail.com", "time": "Fri Oct 17 12:43:34 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:54 2015 +0800" }, "message": "ALSA: pcm: use the same dma mmap codepath both for arm and arm64\n\ncommit a011e213f3700233ed2a676f1ef0a74a052d7162 upstream.\n\nThis avoids following kernel crash when try to playback on arm64\n\n[ 107.497203] [\u003cffffffc00046b310\u003e] snd_pcm_mmap_data_fault+0x90/0xd4\n[ 107.503405] [\u003cffffffc0001541ac\u003e] __do_fault+0xb0/0x498\n[ 107.508565] [\u003cffffffc0001576a0\u003e] handle_mm_fault+0x224/0x7b0\n[ 107.514246] [\u003cffffffc000092640\u003e] do_page_fault+0x11c/0x310\n[ 107.519738] [\u003cffffffc000081100\u003e] do_mem_abort+0x38/0x98\n\nTested: backported to 3.14 and tried to playback on arm64 machine\n\nSigned-off-by: Anatol Pomozov \u003canatol.pomozov@gmail.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "6a16b0d080cd68ffac3f063891612dd9725a6d93", "tree": "e2d9c64fbe93bc2c253e0a3e40708f4a3f2bcdef", "parents": [ "e4425815a8d45e730f3a0bd52b149ab65bbad73b" ], "author": { "name": "Daniel Borkmann", "email": "dborkman@redhat.com", "time": "Tue Aug 26 23:16:35 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:54 2015 +0800" }, "message": "random: add and use memzero_explicit() for clearing data\n\ncommit d4c5efdb97773f59a2b711754ca0953f24516739 upstream.\n\nzatimend has reported that in his environment (3.16/gcc4.8.3/corei7)\nmemset() calls which clear out sensitive data in extract_{buf,entropy,\nentropy_user}() in random driver are being optimized away by gcc.\n\nAdd a helper memzero_explicit() (similarly as explicit_bzero() variants)\nthat can be used in such cases where a variable with sensitive data is\nbeing cleared out in the end. Other use cases might also be in crypto\ncode. [ I have put this into lib/string.c though, as it\u0027s always built-in\nand doesn\u0027t need any dependencies then. ]\n\nFixes kernel bugzilla: 82041\n\nReported-by: zatimend@hotmail.co.uk\nSigned-off-by: Daniel Borkmann \u003cdborkman@redhat.com\u003e\nAcked-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nCc: Alexey Dobriyan \u003cadobriyan@gmail.com\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\n[lizf: Backported to 3.4:\n - adjust context\n - another memset() in extract_buf() needs to be converted]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "e4425815a8d45e730f3a0bd52b149ab65bbad73b", "tree": "dfde7c17421015d922718609b539f7b4d5e3e03f", "parents": [ "e7ce7b473f9131b3073baa6dae63cd22de1c4d23" ], "author": { "name": "Cesar Eduardo Barros", "email": "cesarb@cesarb.eti.br", "time": "Mon Nov 25 22:00:41 2013 -0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:53 2015 +0800" }, "message": "crypto: more robust crypto_memneq\n\ncommit fe8c8a126806fea4465c43d62a1f9d273a572bf5 upstream.\n\n[Only use the compiler.h portion of this patch, to get the\nOPTIMIZER_HIDE_VAR() macro, which we need for other -stable patches\n- gregkh]\n\nDisabling compiler optimizations can be fragile, since a new\noptimization could be added to -O0 or -Os that breaks the assumptions\nthe code is making.\n\nInstead of disabling compiler optimizations, use a dummy inline assembly\n(based on RELOC_HIDE) to block the problematic kinds of optimization,\nwhile still allowing other optimizations to be applied to the code.\n\nThe dummy inline assembly is added after every OR, and has the\naccumulator variable as its input and output. The compiler is forced to\nassume that the dummy inline assembly could both depend on the\naccumulator variable and change the accumulator variable, so it is\nforced to compute the value correctly before the inline assembly, and\ncannot assume anything about its value after the inline assembly.\n\nThis change should be enough to make crypto_memneq work correctly (with\ndata-independent timing) even if it is inlined at its call sites. That\ncan be done later in a followup patch.\n\nCompile-tested on x86_64.\n\nSigned-off-by: Cesar Eduardo Barros \u003ccesarb@cesarb.eti.br\u003e\nAcked-by: Daniel Borkmann \u003cdborkman@redhat.com\u003e\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "e7ce7b473f9131b3073baa6dae63cd22de1c4d23", "tree": "56a8ebecfa56024a717fe29b6605fcfc12e717aa", "parents": [ "07cf4db32b426b6b9d649cac784a4b199001fbd1" ], "author": { "name": "Eric Sandeen", "email": "sandeen@redhat.com", "time": "Sat Oct 11 19:51:17 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:53 2015 +0800" }, "message": "ext4: fix reservation overflow in ext4_da_write_begin\n\ncommit 0ff8947fc5f700172b37cbca811a38eb9cb81e08 upstream.\n\nDelalloc write journal reservations only reserve 1 credit,\nto update the inode if necessary. However, it may happen\nonce in a filesystem\u0027s lifetime that a file will cross\nthe 2G threshold, and require the LARGE_FILE feature to\nbe set in the superblock as well, if it was not set already.\n\nThis overruns the transaction reservation, and can be\ndemonstrated simply on any ext4 filesystem without the LARGE_FILE\nfeature already set:\n\ndd if\u003d/dev/zero of\u003dtestfile bs\u003d1 seek\u003d2147483646 count\u003d1 \\\n\tconv\u003dnotrunc of\u003dtestfile\nsync\ndd if\u003d/dev/zero of\u003dtestfile bs\u003d1 seek\u003d2147483647 count\u003d1 \\\n\tconv\u003dnotrunc of\u003dtestfile\n\nleads to:\n\nEXT4-fs: ext4_do_update_inode:4296: aborting transaction: error 28 in __ext4_handle_dirty_super\nEXT4-fs error (device loop0) in ext4_do_update_inode:4301: error 28\nEXT4-fs error (device loop0) in ext4_reserve_inode_write:4757: Readonly filesystem\nEXT4-fs error (device loop0) in ext4_dirty_inode:4876: error 28\nEXT4-fs error (device loop0) in ext4_da_write_end:2685: error 28\n\nAdjust the number of credits based on whether the flag is\nalready set, and whether the current write may extend past the\nLARGE_FILE limit.\n\nSigned-off-by: Eric Sandeen \u003csandeen@redhat.com\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nReviewed-by: Andreas Dilger \u003cadilger@dilger.ca\u003e\n[lizf: Backported to 3.4:\n - adjust context\n - ext4_journal_start() has no parameter type]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "07cf4db32b426b6b9d649cac784a4b199001fbd1", "tree": "3cb4711ecbc0c33f82bc32dcc424cfc61e162cdc", "parents": [ "07048f9e15e456be7d216e6f4515c33cafc6fc2b" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Sun Oct 05 22:56:00 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:53 2015 +0800" }, "message": "ext4: add ext4_iget_normal() which is to be used for dir tree lookups\n\ncommit f4bb2981024fc91b23b4d09a8817c415396dbabb upstream.\n\nIf there is a corrupted file system which has directory entries that\npoint at reserved, metadata inodes, prohibit them from being used by\ntreating them the same way we treat Boot Loader inodes --- that is,\nmark them to be bad inodes. This prohibits them from being opened,\ndeleted, or modified via chmod, chown, utimes, etc.\n\nIn particular, this prevents a corrupted file system which has a\ndirectory entry which points at the journal inode from being deleted\nand its blocks released, after which point Much Hilarity Ensues.\n\nReported-by: Sami Liedes \u003csami.liedes@iki.fi\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "07048f9e15e456be7d216e6f4515c33cafc6fc2b", "tree": "4e6ad2fad0e9c6c43cdd4cdab6bc0d2571986c55", "parents": [ "60e7100a311b7b0d4ad87f20d6a13f1f4a4d786d" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Sun Oct 05 22:47:07 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:52 2015 +0800" }, "message": "ext4: don\u0027t orphan or truncate the boot loader inode\n\ncommit e2bfb088fac03c0f621886a04cffc7faa2b49b1d upstream.\n\nThe boot loader inode (inode #5) should never be visible in the\ndirectory hierarchy, but it\u0027s possible if the file system is corrupted\nthat there will be a directory entry that points at inode #5. In\norder to avoid accidentally trashing it, when such a directory inode\nis opened, the inode will be marked as a bad inode, so that it\u0027s not\npossible to modify (or read) the inode from userspace.\n\nUnfortunately, when we unlink this (invalid/illegal) directory entry,\nwe will put the bad inode on the ophan list, and then when try to\nunlink the directory, we don\u0027t actually remove the bad inode from the\norphan list before freeing in-memory inode structure. This means the\nin-memory orphan list is corrupted, leading to a kernel oops.\n\nIn addition, avoid truncating a bad inode in ext4_destroy_inode(),\nsince truncating the boot loader inode is not a smart thing to do.\n\nReported-by: Sami Liedes \u003csami.liedes@iki.fi\u003e\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "60e7100a311b7b0d4ad87f20d6a13f1f4a4d786d", "tree": "1134746c46072c2d7a061fb1a5fff0cedb22ac14", "parents": [ "e306b0daae1fe8ad4b581dcc2f12917732a5fb1b" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Wed Oct 01 21:49:18 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:52 2015 +0800" }, "message": "vfs: fix data corruption when blocksize \u003c pagesize for mmaped data\n\ncommit 90a8020278c1598fafd071736a0846b38510309c upstream.\n\n-\u003epage_mkwrite() is used by filesystems to allocate blocks under a page\nwhich is becoming writeably mmapped in some process\u0027 address space. This\nallows a filesystem to return a page fault if there is not enough space\navailable, user exceeds quota or similar problem happens, rather than\nsilently discarding data later when writepage is called.\n\nHowever VFS fails to call -\u003epage_mkwrite() in all the cases where\nfilesystems need it when blocksize \u003c pagesize. For example when\nblocksize \u003d 1024, pagesize \u003d 4096 the following is problematic:\n ftruncate(fd, 0);\n pwrite(fd, buf, 1024, 0);\n map \u003d mmap(NULL, 1024, PROT_WRITE, MAP_SHARED, fd, 0);\n map[0] \u003d \u0027a\u0027; ----\u003e page_mkwrite() for index 0 is called\n ftruncate(fd, 10000); /* or even pwrite(fd, buf, 1, 10000) */\n mremap(map, 1024, 10000, 0);\n map[4095] \u003d \u0027a\u0027; ----\u003e no page_mkwrite() called\n\nAt the moment -\u003epage_mkwrite() is called, filesystem can allocate only\none block for the page because i_size \u003d\u003d 1024. Otherwise it would create\nblocks beyond i_size which is generally undesirable. But later at\n-\u003ewritepage() time, we also need to store data at offset 4095 but we\ndon\u0027t have block allocated for it.\n\nThis patch introduces a helper function filesystems can use to have\n-\u003epage_mkwrite() called at all the necessary moments.\n\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\n[lizf: Backported to 3.4:\n - adjust context\n - truncate_setsize() already has an oldsize variable]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "e306b0daae1fe8ad4b581dcc2f12917732a5fb1b", "tree": "e6bfdb21ff155a0f89b5e22dc605c4fe59b13781", "parents": [ "a38c4d8a974e03044f208dfdf09a5a5d55d1dd4d" ], "author": { "name": "Quinn Tran", "email": "quinn.tran@qlogic.com", "time": "Thu Sep 25 06:22:28 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:52 2015 +0800" }, "message": "target: Fix queue full status NULL pointer for SCF_TRANSPORT_TASK_SENSE\n\ncommit 082f58ac4a48d3f5cb4597232cb2ac6823a96f43 upstream.\n\nDuring temporary resource starvation at lower transport layer, command\nis placed on queue full retry path, which expose this problem. The TCM\nqueue full handling of SCF_TRANSPORT_TASK_SENSE currently sends the same\ncmd twice to lower layer. The 1st time led to cmd normal free path.\nThe 2nd time cause Null pointer access.\n\nThis regression bug was originally introduced v3.1-rc code in the\nfollowing commit:\n\ncommit e057f53308a5f071556ee80586b99ee755bf07f5\nAuthor: Christoph Hellwig \u003chch@infradead.org\u003e\nDate: Mon Oct 17 13:56:41 2011 -0400\n\n target: remove the transport_qf_callback se_cmd callback\n\nSigned-off-by: Quinn Tran \u003cquinn.tran@qlogic.com\u003e\nSigned-off-by: Saurav Kashyap \u003csaurav.kashyap@qlogic.com\u003e\nSigned-off-by: Nicholas Bellinger \u003cnab@linux-iscsi.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "a38c4d8a974e03044f208dfdf09a5a5d55d1dd4d", "tree": "00cc656464e1dd15af4388f85a74ab996a1a60e2", "parents": [ "b0fea9c1a057c4e4d30046b26a9309366aaf1ad6" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu Sep 18 01:12:15 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:51 2015 +0800" }, "message": "ext4: don\u0027t check quota format when there are no quota files\n\ncommit 279bf6d390933d5353ab298fcc306c391a961469 upstream.\n\nThe check whether quota format is set even though there are no\nquota files with journalled quota is pointless and it actually\nmakes it impossible to turn off journalled quotas (as there\u0027s\nno way to unset journalled quota format). Just remove the check.\n\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "b0fea9c1a057c4e4d30046b26a9309366aaf1ad6", "tree": "e9edb54a0d3d4c8a76914637288934532eb4b97d", "parents": [ "4e2c6422ab866ca9ea23714b32be9fbfad77743e" ], "author": { "name": "Darrick J. Wong", "email": "darrick.wong@oracle.com", "time": "Tue Sep 16 14:34:59 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:51 2015 +0800" }, "message": "ext4: check EA value offset when loading\n\ncommit a0626e75954078cfacddb00a4545dde821170bc5 upstream.\n\nWhen loading extended attributes, check each entry\u0027s value offset to\nmake sure it doesn\u0027t collide with the entries.\n\nWithout this check it is easy to crash the kernel by mounting a\nmalicious FS containing a file with an EA wherein e_value_offs \u003d 0 and\ne_value_size \u003e 0 and then deleting the EA, which corrupts the name\nlist.\n\n(See the f_ea_value_crash test\u0027s FS image in e2fsprogs for an example.)\n\nSigned-off-by: Darrick J. Wong \u003cdarrick.wong@oracle.com\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "4e2c6422ab866ca9ea23714b32be9fbfad77743e", "tree": "177a1b4275239a3651fe07dc6f4fd0c2f797d850", "parents": [ "9e9aab5dbf6f13478cd996692ed9679af2404fc7" ], "author": { "name": "Andy Lutomirski", "email": "luto@amacapital.net", "time": "Wed Oct 08 09:02:13 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:51 2015 +0800" }, "message": "x86,kvm,vmx: Preserve CR4 across VM entry\n\ncommit d974baa398f34393db76be45f7d4d04fbdbb4a0a upstream.\n\nCR4 isn\u0027t constant; at least the TSD and PCE bits can vary.\n\nTBH, treating CR0 and CR3 as constant scares me a bit, too, but it looks\nlike it\u0027s correct.\n\nThis adds a branch and a read from cr4 to each vm entry. Because it is\nextremely likely that consecutive entries into the same vcpu will have\nthe same host cr4 value, this fixes up the vmcs instead of restoring cr4\nafter the fact. A subsequent patch will add a kernel-wide cr4 shadow,\nreducing the overhead in the common case to just two memory reads and a\nbranch.\n\nSigned-off-by: Andy Lutomirski \u003cluto@amacapital.net\u003e\nAcked-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\nCc: Petr Matousek \u003cpmatouse@redhat.com\u003e\nCc: Gleb Natapov \u003cgleb@kernel.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n[lizf: Backported to 3.4:\n - adjust context\n - add parameter struct vcpu_vmx *vmx to vmx_set_constant_host_state()]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "9e9aab5dbf6f13478cd996692ed9679af2404fc7", "tree": "3e8f726d264a7f0affc09df4609a9630493bc14f", "parents": [ "e8ab53a5d68c75722c8a2ad3b08a6798ed47d4dc" ], "author": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Fri Oct 17 17:38:49 2014 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:51 2015 +0800" }, "message": "futex: Ensure get_futex_key_refs() always implies a barrier\n\ncommit 76835b0ebf8a7fe85beb03c75121419a7dec52f0 upstream.\n\nCommit b0c29f79ecea (futexes: Avoid taking the hb-\u003elock if there\u0027s\nnothing to wake up) changes the futex code to avoid taking a lock when\nthere are no waiters. This code has been subsequently fixed in commit\n11d4616bd07f (futex: revert back to the explicit waiter counting code).\nBoth the original commit and the fix-up rely on get_futex_key_refs() to\nalways imply a barrier.\n\nHowever, for private futexes, none of the cases in the switch statement\nof get_futex_key_refs() would be hit and the function completes without\na memory barrier as required before checking the \"waiters\" in\nfutex_wake() -\u003e hb_waiters_pending(). The consequence is a race with a\nthread waiting on a futex on another CPU, allowing the waker thread to\nread \"waiters \u003d\u003d 0\" while the waiter thread to have read \"futex_val \u003d\u003d\nlocked\" (in kernel).\n\nWithout this fix, the problem (user space deadlocks) can be seen with\nAndroid bionic\u0027s mutex implementation on an arm64 multi-cluster system.\n\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nReported-by: Matteo Franchin \u003cMatteo.Franchin@arm.com\u003e\nFixes: b0c29f79ecea (futexes: Avoid taking the hb-\u003elock if there\u0027s nothing to wake up)\nAcked-by: Davidlohr Bueso \u003cdave@stgolabs.net\u003e\nTested-by: Mike Galbraith \u003cumgwanakikbuti@gmail.com\u003e\nCc: Darren Hart \u003cdvhart@linux.intel.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Paul E. McKenney \u003cpaulmck@linux.vnet.ibm.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "e8ab53a5d68c75722c8a2ad3b08a6798ed47d4dc", "tree": "a9aedcea0154591a9dbc782bddb4a6ad592143f4", "parents": [ "fb7eb2f7483ea1017d3fed87944a1153bc0879ec" ], "author": { "name": "Stephen Smalley", "email": "sds@tycho.nsa.gov", "time": "Mon Oct 06 16:32:52 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:50 2015 +0800" }, "message": "selinux: fix inode security list corruption\n\ncommit 923190d32de4428afbea5e5773be86bea60a9925 upstream.\n\nsb_finish_set_opts() can race with inode_free_security()\nwhen initializing inode security structures for inodes\ncreated prior to initial policy load or by the filesystem\nduring -\u003emount(). This appears to have always been\na possible race, but commit 3dc91d4 (\"SELinux: Fix possible\nNULL pointer dereference in selinux_inode_permission()\")\nmade it more evident by immediately reusing the unioned\nlist/rcu element of the inode security structure for call_rcu()\nupon an inode_free_security(). But the underlying issue\nwas already present before that commit as a possible use-after-free\nof isec.\n\nShivnandan Kumar reported the list corruption and proposed\na patch to split the list and rcu elements out of the union\nas separate fields of the inode_security_struct so that setting\nthe rcu element would not affect the list element. However,\nthis would merely hide the issue and not truly fix the code.\n\nThis patch instead moves up the deletion of the list entry\nprior to dropping the sbsec-\u003eisec_lock initially. Then,\nif the inode is dropped subsequently, there will be no further\nreferences to the isec.\n\nReported-by: Shivnandan Kumar \u003cshivnandan.k@samsung.com\u003e\nSigned-off-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nSigned-off-by: Paul Moore \u003cpmoore@redhat.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "fb7eb2f7483ea1017d3fed87944a1153bc0879ec", "tree": "1f1d3f354e82f6b0ef88d39ceb0b28325b22ef1c", "parents": [ "9f7d53c09a1f87ebe228b55a83c1b8f952d76260" ], "author": { "name": "Michael S. Tsirkin", "email": "mst@redhat.com", "time": "Tue Oct 14 10:40:29 2014 +1030" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:50 2015 +0800" }, "message": "virtio_pci: fix virtio spec compliance on restore\n\ncommit 6fbc198cf623944ab60a1db6d306a4d55cdd820d upstream.\n\nOn restore, virtio pci does the following:\n+ set features\n+ init vqs etc - device can be used at this point!\n+ set ACKNOWLEDGE,DRIVER and DRIVER_OK status bits\n\nThis is in violation of the virtio spec, which\nrequires the following order:\n- ACKNOWLEDGE\n- DRIVER\n- init vqs\n- DRIVER_OK\n\nThis behaviour will break with hypervisors that assume spec compliant\nbehaviour. It seems like a good idea to have this patch applied to\nstable branches to reduce the support butden for the hypervisors.\n\nCc: Amit Shah \u003camit.shah@redhat.com\u003e\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nSigned-off-by: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "9f7d53c09a1f87ebe228b55a83c1b8f952d76260", "tree": "7b3e09db1364b8ac9acc0513780b6ba9fd5cfe0c", "parents": [ "e65c1a23f47148d534970cbdd6646cf8fba924c3" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Wed Oct 08 10:42:27 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:50 2015 +0800" }, "message": "mnt: Prevent pivot_root from creating a loop in the mount tree\n\ncommit 0d0826019e529f21c84687521d03f60cd241ca7d upstream.\n\nAndy Lutomirski recently demonstrated that when chroot is used to set\nthe root path below the path for the new ``root\u0027\u0027 passed to pivot_root\nthe pivot_root system call succeeds and leaks mounts.\n\nIn examining the code I see that starting with a new root that is\nbelow the current root in the mount tree will result in a loop in the\nmount tree after the mounts are detached and then reattached to one\nanother. Resulting in all kinds of ugliness including a leak of that\nmounts involved in the leak of the mount loop.\n\nPrevent this problem by ensuring that the new mount is reachable from\nthe current root of the mount tree.\n\n[Added stable cc. Fixes CVE-2014-7970. --Andy]\n\nReported-by: Andy Lutomirski \u003cluto@amacapital.net\u003e\nReviewed-by: Andy Lutomirski \u003cluto@amacapital.net\u003e\nLink: http://lkml.kernel.org/r/87bnpmihks.fsf@x220.int.ebiederm.org\nSigned-off-by: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nSigned-off-by: Andy Lutomirski \u003cluto@amacapital.net\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "e65c1a23f47148d534970cbdd6646cf8fba924c3", "tree": "4f11496e4dd92d2092c041be79f4ac3a6ccc176b", "parents": [ "bf70aaaa88db72720aee2460157bf7afd20601e4" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Mon Oct 13 23:18:02 2014 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:50 2015 +0800" }, "message": "ALSA: emu10k1: Fix deadlock in synth voice lookup\n\ncommit 95926035b187cc9fee6fb61385b7da9c28123f74 upstream.\n\nThe emu10k1 voice allocator takes voice_lock spinlock. When there is\nno empty stream available, it tries to release a voice used by synth,\nand calls get_synth_voice. The callback function,\nsnd_emu10k1_synth_get_voice(), however, also takes the voice_lock,\nthus it deadlocks.\n\nThe fix is simply removing the voice_lock holds in\nsnd_emu10k1_synth_get_voice(), as this is always called in the\nspinlock context.\n\nReported-and-tested-by: Arthur Marsh \u003carthur.marsh@internode.on.net\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "bf70aaaa88db72720aee2460157bf7afd20601e4", "tree": "bd49134f8f3079238a1d7831438bc38a97acb306", "parents": [ "fbc94908bca2603a046fd7745ccffceb0076137a" ], "author": { "name": "Sasha Levin", "email": "sasha.levin@oracle.com", "time": "Mon Oct 13 15:51:05 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:49 2015 +0800" }, "message": "kernel: add support for gcc 5\n\ncommit 71458cfc782eafe4b27656e078d379a34e472adf upstream.\n\nWe\u0027re missing include/linux/compiler-gcc5.h which is required now\nbecause gcc branched off to v5 in trunk.\n\nJust copy the relevant bits out of include/linux/compiler-gcc4.h,\nno new code is added as of now.\n\nThis fixes a build error when using gcc 5.\n\nSigned-off-by: Sasha Levin \u003csasha.levin@oracle.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "fbc94908bca2603a046fd7745ccffceb0076137a", "tree": "1573648797563f4c0c2646ff82c3423973bdc5cb", "parents": [ "8000fbfa741dcfbdfead87f419c5725becc5b62a" ], "author": { "name": "Hans de Goede", "email": "hdegoede@redhat.com", "time": "Sat Oct 11 11:27:37 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:49 2015 +0800" }, "message": "Input: i8042 - add noloop quirk for Asus X750LN\n\ncommit 9ff84a17302aeb8913ff244ecc0d8f9d219fecb5 upstream.\n\nWithout this the aux port does not get detected, and consequently the\ntouchpad will not work.\n\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d1110011\n\nSigned-off-by: Hans de Goede \u003chdegoede@redhat.com\u003e\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "8000fbfa741dcfbdfead87f419c5725becc5b62a", "tree": "717228ced0c6c855b5d6f9fb91ddb07d34b4e55f", "parents": [ "7baa56f6e80d72ab594b55465b2f42a5e13698c0" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Tue Sep 02 09:49:18 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:49 2015 +0800" }, "message": "Input: synaptics - gate forcepad support by DMI check\n\ncommit aa972409951e0675e07918620427517cad5090e0 upstream.\n\nUnfortunately, ForcePad capability is not actually exported over PS/2, so\nwe have to resort to DMI checks.\n\nReported-by: Nicole Faerber \u003cnicole.faerber@kernelconcepts.de\u003e\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "7baa56f6e80d72ab594b55465b2f42a5e13698c0", "tree": "9ff4dd73979f5db20dc2c8ff1fb44ec4ea270155", "parents": [ "c76a73b3d03e08074d08a7cbf1acb386a022a367" ], "author": { "name": "Yann Droneaud", "email": "ydroneaud@opteya.com", "time": "Thu Oct 09 15:24:40 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:49 2015 +0800" }, "message": "fanotify: enable close-on-exec on events\u0027 fd when requested in fanotify_init()\n\ncommit 0b37e097a648aa71d4db1ad108001e95b69a2da4 upstream.\n\nAccording to commit 80af258867648 (\"fanotify: groups can specify their\nf_flags for new fd\"), file descriptors created as part of file access\nnotification events inherit flags from the event_f_flags argument passed\nto syscall fanotify_init(2)[1].\n\nUnfortunately O_CLOEXEC is currently silently ignored.\n\nIndeed, event_f_flags are only given to dentry_open(), which only seems to\ncare about O_ACCMODE and O_PATH in do_dentry_open(), O_DIRECT in\nopen_check_o_direct() and O_LARGEFILE in generic_file_open().\n\nIt\u0027s a pity, since, according to some lookup on various search engines and\nhttp://codesearch.debian.net/, there\u0027s already some userspace code which\nuse O_CLOEXEC:\n\n- in systemd\u0027s readahead[2]:\n\n fanotify_fd \u003d fanotify_init(FAN_CLOEXEC|FAN_NONBLOCK, O_RDONLY|O_LARGEFILE|O_CLOEXEC|O_NOATIME);\n\n- in clsync[3]:\n\n #define FANOTIFY_EVFLAGS (O_LARGEFILE|O_RDONLY|O_CLOEXEC)\n\n int fanotify_d \u003d fanotify_init(FANOTIFY_FLAGS, FANOTIFY_EVFLAGS);\n\n- in examples [4] from \"Filesystem monitoring in the Linux\n kernel\" article[5] by Aleksander Morgado:\n\n if ((fanotify_fd \u003d fanotify_init (FAN_CLOEXEC,\n O_RDONLY | O_CLOEXEC | O_LARGEFILE)) \u003c 0)\n\nAdditionally, since commit 48149e9d3a7e (\"fanotify: check file flags\npassed in fanotify_init\"). having O_CLOEXEC as part of fanotify_init()\nsecond argument is expressly allowed.\n\nSo it seems expected to set close-on-exec flag on the file descriptors if\nuserspace is allowed to request it with O_CLOEXEC.\n\nBut Andrew Morton raised[6] the concern that enabling now close-on-exec\nmight break existing applications which ask for O_CLOEXEC but expect the\nfile descriptor to be inherited across exec().\n\nIn the other hand, as reported by Mihai Dontu[7] close-on-exec on the file\ndescriptor returned as part of file access notify can break applications\ndue to deadlock. So close-on-exec is needed for most applications.\n\nMore, applications asking for close-on-exec are likely expecting it to be\nenabled, relying on O_CLOEXEC being effective. If not, it might weaken\ntheir security, as noted by Jan Kara[8].\n\nSo this patch replaces call to macro get_unused_fd() by a call to function\nget_unused_fd_flags() with event_f_flags value as argument. This way\nO_CLOEXEC flag in the second argument of fanotify_init(2) syscall is\ninterpreted and close-on-exec get enabled when requested.\n\n[1] http://man7.org/linux/man-pages/man2/fanotify_init.2.html\n[2] http://cgit.freedesktop.org/systemd/systemd/tree/src/readahead/readahead-collect.c?id\u003dv208#n294\n[3] https://github.com/xaionaro/clsync/blob/v0.2.1/sync.c#L1631\n https://github.com/xaionaro/clsync/blob/v0.2.1/configuration.h#L38\n[4] http://www.lanedo.com/~aleksander/fanotify/fanotify-example.c\n[5] http://www.lanedo.com/2013/filesystem-monitoring-linux-kernel/\n[6] http://lkml.kernel.org/r/20141001153621.65e9258e65a6167bf2e4cb50@linux-foundation.org\n[7] http://lkml.kernel.org/r/20141002095046.3715eb69@mdontu-l\n[8] http://lkml.kernel.org/r/20141002104410.GB19748@quack.suse.cz\n\nLink: http://lkml.kernel.org/r/cover.1411562410.git.ydroneaud@opteya.com\nSigned-off-by: Yann Droneaud \u003cydroneaud@opteya.com\u003e\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nReviewed by: Heinrich Schuchardt \u003cxypron.glpk@gmx.de\u003e\nTested-by: Heinrich Schuchardt \u003cxypron.glpk@gmx.de\u003e\nCc: Mihai Don\\u021bu \u003cmihai.dontu@gmail.com\u003e\nCc: Pádraig Brady \u003cP@draigBrady.com\u003e\nCc: Heinrich Schuchardt \u003cxypron.glpk@gmx.de\u003e\nCc: Jan Kara \u003cjack@suse.cz\u003e\nCc: Valdis Kletnieks \u003cValdis.Kletnieks@vt.edu\u003e\nCc: Michael Kerrisk-manpages \u003cmtk.manpages@gmail.com\u003e\nCc: Lino Sanfilippo \u003cLinoSanfilippo@gmx.de\u003e\nCc: Richard Guy Briggs \u003crgb@redhat.com\u003e\nCc: Eric Paris \u003ceparis@redhat.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Michael Kerrisk \u003cmtk.manpages@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "c76a73b3d03e08074d08a7cbf1acb386a022a367", "tree": "ff9a2b25d6649c6920dc274ed352e3ffa6ce3087", "parents": [ "15c0af9cd63cf84fc7f527da7d12b80e096b60d2" ], "author": { "name": "Mike Snitzer", "email": "snitzer@redhat.com", "time": "Wed Oct 08 18:26:13 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:48 2015 +0800" }, "message": "block: fix alignment_offset math that assumes io_min is a power-of-2\n\ncommit b8839b8c55f3fdd60dc36abcda7e0266aff7985c upstream.\n\nThe math in both blk_stack_limits() and queue_limit_alignment_offset()\nassume that a block device\u0027s io_min (aka minimum_io_size) is always a\npower-of-2. Fix the math such that it works for non-power-of-2 io_min.\n\nThis issue (of alignment_offset !\u003d 0) became apparent when testing\ndm-thinp with a thinp blocksize that matches a RAID6 stripesize of\n1280K. Commit fdfb4c8c1 (\"dm thin: set minimum_io_size to pool\u0027s data\nblock size\") unlocked the potential for alignment_offset !\u003d 0 due to\nthe dm-thin-pool\u0027s io_min possibly being a non-power-of-2.\n\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nAcked-by: Martin K. Petersen \u003cmartin.petersen@oracle.com\u003e\nSigned-off-by: Jens Axboe \u003caxboe@fb.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "15c0af9cd63cf84fc7f527da7d12b80e096b60d2", "tree": "5910630b355a9d0de361c828fd46fb1215715d5a", "parents": [ "2551b5ed84a7cfe5e414544bb9ad95ebf43b3ff3" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed Oct 08 23:44:00 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:48 2015 +0800" }, "message": "fix misuses of f_count() in ppp and netlink\n\ncommit 24dff96a37a2ca319e75a74d3929b2de22447ca6 upstream.\n\nwe used to check for \"nobody else could start doing anything with\nthat opened file\" by checking that refcount was 2 or less - one\nfor descriptor table and one we\u0027d acquired in fget() on the way to\nwherever we are. That was race-prone (somebody else might have\nhad a reference to descriptor table and do fget() just as we\u0027d\nbeen checking) and it had become flat-out incorrect back when\nwe switched to fget_light() on those codepaths - unlike fget(),\nit doesn\u0027t grab an extra reference unless the descriptor table\nis shared. The same change allowed a race-free check, though -\nwe are safe exactly when refcount is less than 2.\n\nIt was a long time ago; pre-2.6.12 for ioctl() (the codepath leading\nto ppp one) and 2.6.17 for sendmsg() (netlink one). OTOH,\nnetlink hadn\u0027t grown that check until 3.9 and ppp used to live\nin drivers/net, not drivers/net/ppp until 3.1. The bug existed\nwell before that, though, and the same fix used to apply in old\nlocation of file.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n[lizf: Backported to 3.4: drop the change to netlink_mmap_sendmsg()]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "2551b5ed84a7cfe5e414544bb9ad95ebf43b3ff3", "tree": "73da55734a049f564f3e038d880291c3a6eab161", "parents": [ "2ea17e6740ac0e15f86854973dbd22100579bbf8" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Sun Jul 27 13:00:41 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:48 2015 +0800" }, "message": "fs: make cont_expand_zero interruptible\n\ncommit c2ca0fcd202863b14bd041a7fece2e789926c225 upstream.\n\nThis patch makes it possible to kill a process looping in\ncont_expand_zero. A process may spend a lot of time in this function, so\nit is desirable to be able to kill it.\n\nIt happened to me that I wanted to copy a piece data from the disk to a\nfile. By mistake, I used the \"seek\" parameter to dd instead of \"skip\". Due\nto the \"seek\" parameter, dd attempted to extend the file and became stuck\ndoing so - the only possibility was to reset the machine or wait many\nhours until the filesystem runs out of space and cont_expand_zero fails.\nWe need this patch to be able to terminate the process.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "2ea17e6740ac0e15f86854973dbd22100579bbf8", "tree": "4db201f54ea452f9bfda0fa80fa4907205c2f2a8", "parents": [ "db55550da4a9ca71d76f47286a5a9790f12a2868" ], "author": { "name": "Tetsuo Handa", "email": "penguin-kernel@I-love.SAKURA.ne.jp", "time": "Sat May 17 20:56:38 2014 +0900" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:48 2015 +0800" }, "message": "fs: Fix theoretical division by 0 in super_cache_scan().\n\ncommit 475d0db742e3755c6b267f48577ff7cbb7dfda0d upstream.\n\ntotal_objects could be 0 and is used as a denom.\n\nWhile total_objects is a \"long\", total_objects \u003d\u003d 0 unlikely happens for\n3.12 and later kernels because 32-bit architectures would not be able to\nhold (1 \u003c\u003c 32) objects. However, total_objects \u003d\u003d 0 may happen for kernels\nbetween 3.1 and 3.11 because total_objects in prune_super() was an \"int\"\nand (e.g.) x86_64 architecture might be able to hold (1 \u003c\u003c 32) objects.\n\nSigned-off-by: Tetsuo Handa \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "db55550da4a9ca71d76f47286a5a9790f12a2868", "tree": "52f660491b1a2a088e5802d8899301a30a435674", "parents": [ "9be2cb104b9a741878720a41911b7c4739dde12b" ], "author": { "name": "Ben Hutchings", "email": "ben@decadent.org.uk", "time": "Sun Sep 07 21:05:05 2014 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:47 2015 +0800" }, "message": "x86: Reject x32 executables if x32 ABI not supported\n\ncommit 0e6d3112a4e95d55cf6dca88f298d5f4b8f29bd1 upstream.\n\nIt is currently possible to execve() an x32 executable on an x86_64\nkernel that has only ia32 compat enabled. However all its syscalls\nwill fail, even _exit(). This usually causes it to segfault.\n\nChange the ELF compat architecture check so that x32 executables are\nrejected if we don\u0027t support the x32 ABI.\n\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nLink: http://lkml.kernel.org/r/1410120305.6822.9.camel@decadent.org.uk\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "9be2cb104b9a741878720a41911b7c4739dde12b", "tree": "d0a6a21eee5d7c890b4ebac90905da4391342cf7", "parents": [ "771f8a87c7e09184a411702313917e2a6db0359e" ], "author": { "name": "Scott Carter", "email": "ccscott@funsoft.com", "time": "Wed Sep 24 18:13:09 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:47 2015 +0800" }, "message": "pata_serverworks: disable 64-KB DMA transfers on Broadcom OSB4 IDE Controller\n\ncommit 37017ac6849e772e67dd187ba2fbd056c4afa533 upstream.\n\nThe Broadcom OSB4 IDE Controller (vendor and device IDs: 1166:0211)\ndoes not support 64-KB DMA transfers.\nWhenever a 64-KB DMA transfer is attempted,\nthe transfer fails and messages similar to the following\nare written to the console log:\n\n [ 2431.851125] sr 0:0:0:0: [sr0] Unhandled sense code\n [ 2431.851139] sr 0:0:0:0: [sr0] Result: hostbyte\u003dDID_OK driverbyte\u003dDRIVER_SENSE\n [ 2431.851152] sr 0:0:0:0: [sr0] Sense Key : Hardware Error [current]\n [ 2431.851166] sr 0:0:0:0: [sr0] Add. Sense: Logical unit communication time-out\n [ 2431.851182] sr 0:0:0:0: [sr0] CDB: Read(10): 28 00 00 00 76 f4 00 00 40 00\n [ 2431.851210] end_request: I/O error, dev sr0, sector 121808\n\nWhen the libata and pata_serverworks modules\nare recompiled with ATA_DEBUG and ATA_VERBOSE_DEBUG defined in libata.h,\nthe 64-KB transfer size in the scatter-gather list can be seen\nin the console log:\n\n [ 2664.897267] sr 9:0:0:0: [sr0] Send:\n [ 2664.897274] 0xf63d85e0\n [ 2664.897283] sr 9:0:0:0: [sr0] CDB:\n [ 2664.897288] Read(10): 28 00 00 00 7f b4 00 00 40 00\n [ 2664.897319] buffer \u003d 0xf6d6fbc0, bufflen \u003d 131072, queuecommand 0xf81b7700\n [ 2664.897331] ata_scsi_dump_cdb: CDB (1:0,0,0) 28 00 00 00 7f b4 00 00 40\n [ 2664.897338] ata_scsi_translate: ENTER\n [ 2664.897345] ata_sg_setup: ENTER, ata1\n [ 2664.897356] ata_sg_setup: 3 sg elements mapped\n [ 2664.897364] ata_bmdma_fill_sg: PRD[0] \u003d (0x66FD2000, 0xE000)\n [ 2664.897371] ata_bmdma_fill_sg: PRD[1] \u003d (0x65000000, 0x10000)\n ------------------------------------------------------\u003e \u003d\u003d\u003d\u003d\u003d\u003d\u003d\n [ 2664.897378] ata_bmdma_fill_sg: PRD[2] \u003d (0x66A10000, 0x2000)\n [ 2664.897386] ata1: ata_dev_select: ENTER, device 0, wait 1\n [ 2664.897422] ata_sff_tf_load: feat 0x1 nsect 0x0 lba 0x0 0x0 0xFC\n [ 2664.897428] ata_sff_tf_load: device 0xA0\n [ 2664.897448] ata_sff_exec_command: ata1: cmd 0xA0\n [ 2664.897457] ata_scsi_translate: EXIT\n [ 2664.897462] leaving scsi_dispatch_cmnd()\n [ 2664.897497] Doing sr request, dev \u003d sr0, block \u003d 0\n [ 2664.897507] sr0 : reading 64/256 512 byte blocks.\n [ 2664.897553] ata_sff_hsm_move: ata1: protocol 7 task_state 1 (dev_stat 0x58)\n [ 2664.897560] atapi_send_cdb: send cdb\n [ 2666.910058] ata_bmdma_port_intr: ata1: host_stat 0x64\n [ 2666.910079] __ata_sff_port_intr: ata1: protocol 7 task_state 3\n [ 2666.910093] ata_sff_hsm_move: ata1: protocol 7 task_state 3 (dev_stat 0x51)\n [ 2666.910101] ata_sff_hsm_move: ata1: protocol 7 task_state 4 (dev_stat 0x51)\n [ 2666.910129] sr 9:0:0:0: [sr0] Done:\n [ 2666.910136] 0xf63d85e0 TIMEOUT\n\nlspci shows that the driver used for the Broadcom OSB4 IDE Controller is\npata_serverworks:\n\n 00:0f.1 IDE interface: Broadcom OSB4 IDE Controller (prog-if 8e [Master SecP SecO PriP])\n Flags: bus master, medium devsel, latency 64\n [virtual] Memory at 000001f0 (32-bit, non-prefetchable) [size\u003d8]\n [virtual] Memory at 000003f0 (type 3, non-prefetchable) [size\u003d1]\n I/O ports at 0170 [size\u003d8]\n I/O ports at 0374 [size\u003d4]\n I/O ports at 1440 [size\u003d16]\n Kernel driver in use: pata_serverworks\n\nThe pata_serverworks driver supports five distinct device IDs,\none being the OSB4 and the other four belonging to the CSB series.\nThe CSB series appears to support 64-KB DMA transfers,\nas tests on a machine with an SAI2 motherboard\ncontaining a Broadcom CSB5 IDE Controller (vendor and device IDs: 1166:0212)\nshowed no problems with 64-KB DMA transfers.\n\nThis problem was first discovered when attempting to install openSUSE\nfrom a DVD on a machine with an STL2 motherboard.\nUsing the pata_serverworks module,\nolder releases of openSUSE will not install at all due to the timeouts.\nReleases of openSUSE prior to 11.3 can be installed by disabling\nthe pata_serverworks module using the brokenmodules boot parameter,\nwhich causes the serverworks module to be used instead.\nRecent releases of openSUSE (12.2 and later) include better error recovery and\nwill install, though very slowly.\nOn all openSUSE releases, the problem can be recreated\non a machine containing a Broadcom OSB4 IDE Controller\nby mounting an install DVD and running a command similar to the following:\n\n find /mnt -type f -print | xargs cat \u003e /dev/null\n\nThe patch below corrects the problem.\nSimilar to the other ATA drivers that do not support 64-KB DMA transfers,\nthe patch changes the ata_port_operations qc_prep vector to point to a routine\nthat breaks any 64-KB segment into two 32-KB segments and\nchanges the scsi_host_template sg_tablesize element to reduce by half\nthe number of scatter/gather elements allowed.\nThese two changes affect only the OSB4.\n\nSigned-off-by: Scott Carter \u003cccscott@funsoft.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "771f8a87c7e09184a411702313917e2a6db0359e", "tree": "21f9f8cc029c130780b72680289fb4f7e3eae680", "parents": [ "dbd43539a8faff93490475bccbf9e4d0b7ebc2cb" ], "author": { "name": "Chao Yu", "email": "chao2.yu@samsung.com", "time": "Thu Jul 24 17:25:42 2014 +0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:47 2015 +0800" }, "message": "ecryptfs: avoid to access NULL pointer when write metadata in xattr\n\ncommit 35425ea2492175fd39f6116481fe98b2b3ddd4ca upstream.\n\nChristopher Head 2014-06-28 05:26:20 UTC described:\n\"I tried to reproduce this on 3.12.21. Instead, when I do \"echo hello \u003e foo\"\nin an ecryptfs mount with ecryptfs_xattr specified, I get a kernel crash:\n\nBUG: unable to handle kernel NULL pointer dereference at (null)\nIP: [\u003cffffffff8110eb39\u003e] fsstack_copy_attr_all+0x2/0x61\nPGD d7840067 PUD b2c3c067 PMD 0\nOops: 0002 [#1] SMP\nModules linked in: nvidia(PO)\nCPU: 3 PID: 3566 Comm: bash Tainted: P O 3.12.21-gentoo-r1 #2\nHardware name: ASUSTek Computer Inc. G60JX/G60JX, BIOS 206 03/15/2010\ntask: ffff8801948944c0 ti: ffff8800bad70000 task.ti: ffff8800bad70000\nRIP: 0010:[\u003cffffffff8110eb39\u003e] [\u003cffffffff8110eb39\u003e] fsstack_copy_attr_all+0x2/0x61\nRSP: 0018:ffff8800bad71c10 EFLAGS: 00010246\nRAX: 00000000000181a4 RBX: ffff880198648480 RCX: 0000000000000000\nRDX: 0000000000000004 RSI: ffff880172010450 RDI: 0000000000000000\nRBP: ffff880198490e40 R08: 0000000000000000 R09: 0000000000000000\nR10: ffff880172010450 R11: ffffea0002c51e80 R12: 0000000000002000\nR13: 000000000000001a R14: 0000000000000000 R15: ffff880198490e40\nFS: 00007ff224caa700(0000) GS:ffff88019fcc0000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000000 CR3: 00000000bb07f000 CR4: 00000000000007e0\nStack:\nffffffff811826e8 ffff8800a39d8000 0000000000000000 000000000000001a\nffff8800a01d0000 ffff8800a39d8000 ffffffff81185fd5 ffffffff81082c2c\n00000001a39d8000 53d0abbc98490e40 0000000000000037 ffff8800a39d8220\nCall Trace:\n[\u003cffffffff811826e8\u003e] ? ecryptfs_setxattr+0x40/0x52\n[\u003cffffffff81185fd5\u003e] ? ecryptfs_write_metadata+0x1b3/0x223\n[\u003cffffffff81082c2c\u003e] ? should_resched+0x5/0x23\n[\u003cffffffff8118322b\u003e] ? ecryptfs_initialize_file+0xaf/0xd4\n[\u003cffffffff81183344\u003e] ? ecryptfs_create+0xf4/0x142\n[\u003cffffffff810f8c0d\u003e] ? vfs_create+0x48/0x71\n[\u003cffffffff810f9c86\u003e] ? do_last.isra.68+0x559/0x952\n[\u003cffffffff810f7ce7\u003e] ? link_path_walk+0xbd/0x458\n[\u003cffffffff810fa2a3\u003e] ? path_openat+0x224/0x472\n[\u003cffffffff810fa7bd\u003e] ? do_filp_open+0x2b/0x6f\n[\u003cffffffff81103606\u003e] ? __alloc_fd+0xd6/0xe7\n[\u003cffffffff810ee6ab\u003e] ? do_sys_open+0x65/0xe9\n[\u003cffffffff8157d022\u003e] ? system_call_fastpath+0x16/0x1b\nRIP [\u003cffffffff8110eb39\u003e] fsstack_copy_attr_all+0x2/0x61\nRSP \u003cffff8800bad71c10\u003e\nCR2: 0000000000000000\n---[ end trace df9dba5f1ddb8565 ]---\"\n\nIf we create a file when we mount with ecryptfs_xattr_metadata option, we will\nencounter a crash in this path:\n-\u003eecryptfs_create\n -\u003eecryptfs_initialize_file\n -\u003eecryptfs_write_metadata\n -\u003eecryptfs_write_metadata_to_xattr\n -\u003eecryptfs_setxattr\n -\u003efsstack_copy_attr_all\nIt\u0027s because our dentry-\u003ed_inode used in fsstack_copy_attr_all is NULL, and it\nwill be initialized when ecryptfs_initialize_file finish.\n\nSo we should skip copying attr from lower inode when the value of -\u003ed_inode is\ninvalid.\n\nSigned-off-by: Chao Yu \u003cchao2.yu@samsung.com\u003e\nSigned-off-by: Tyler Hicks \u003ctyhicks@canonical.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "dbd43539a8faff93490475bccbf9e4d0b7ebc2cb", "tree": "ee871c4a43ad02fe1decc1a07469e409387b24bb", "parents": [ "adcbd2e571ae7b295c25065b55af6550659bd483" ], "author": { "name": "Alexey Khoroshilov", "email": "khoroshilov@ispras.ru", "time": "Wed Oct 01 22:58:35 2014 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:47 2015 +0800" }, "message": "dm log userspace: fix memory leak in dm_ulog_tfr_init failure path\n\ncommit 56ec16cb1e1ce46354de8511eef962a417c32c92 upstream.\n\nIf cn_add_callback() fails in dm_ulog_tfr_init(), it does not\ndeallocate prealloced memory but calls cn_del_callback().\n\nFound by Linux Driver Verification project (linuxtesting.org).\n\nSigned-off-by: Alexey Khoroshilov \u003ckhoroshilov@ispras.ru\u003e\nReviewed-by: Jonathan Brassow \u003cjbrassow@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "adcbd2e571ae7b295c25065b55af6550659bd483", "tree": "121b0d03c13e1f700be085cfb218bab843894e08", "parents": [ "82556daff1b0ab58610d94188eed14dacf427bdc" ], "author": { "name": "Joe Thornber", "email": "ejt@redhat.com", "time": "Tue Sep 30 09:32:46 2014 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:46 2015 +0800" }, "message": "dm bufio: update last_accessed when relinking a buffer\n\ncommit eb76faf53b1ff7a77ce3f78cc98ad392ac70c2a0 upstream.\n\nThe \u0027last_accessed\u0027 member of the dm_buffer structure was only set when\nthe the buffer was created. This led to each buffer being discarded\nafter dm_bufio_max_age time even if it was used recently. In practice\nthis resulted in all thinp metadata being evicted soon after being read\n-- this is particularly problematic for metadata intensive workloads\nlike multithreaded small random IO.\n\n\u0027last_accessed\u0027 is now updated each time the buffer is moved to the head\nof the LRU list, so the buffer is now properly discarded if it was not\nused in dm_bufio_max_age time.\n\nSigned-off-by: Joe Thornber \u003cejt@redhat.com\u003e\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "82556daff1b0ab58610d94188eed14dacf427bdc", "tree": "361b6cfaee132bb1c02b1d087e7bc134d35f290e", "parents": [ "2c9d556d14bc8d18cfa6635d1d5e751508dc7ec8" ], "author": { "name": "Geert Uytterhoeven", "email": "geert@linux-m68k.org", "time": "Sun Sep 28 10:50:06 2014 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:46 2015 +0800" }, "message": "m68k: Disable/restore interrupts in hwreg_present()/hwreg_write()\n\ncommit e4dc601bf99ccd1c95b7e6eef1d3cf3c4b0d4961 upstream.\n\nhwreg_present() and hwreg_write() temporarily change the VBR register to\nanother vector table. This table contains a valid bus error handler\nonly, all other entries point to arbitrary addresses.\n\nIf an interrupt comes in while the temporary table is active, the\nprocessor will start executing at such an arbitrary address, and the\nkernel will crash.\n\nWhile most callers run early, before interrupts are enabled, or\nexplicitly disable interrupts, Finn Thain pointed out that macsonic has\none callsite that doesn\u0027t, causing intermittent boot crashes.\nThere\u0027s another unsafe callsite in hilkbd.\n\nFix this for good by disabling and restoring interrupts inside\nhwreg_present() and hwreg_write().\n\nExplicitly disabling interrupts can be removed from the callsites later.\n\nReported-by: Finn Thain \u003cfthain@telegraphics.com.au\u003e\nSigned-off-by: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "2c9d556d14bc8d18cfa6635d1d5e751508dc7ec8", "tree": "4f7e5969990fa66596680f550c9bd0b5ed5411e0", "parents": [ "f4c4b923165f5c6342898a3428b1997dbc54f8f1" ], "author": { "name": "Andy Adamson", "email": "andros@netapp.com", "time": "Mon Sep 29 12:31:57 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:46 2015 +0800" }, "message": "NFSv4.1: Fix an NFSv4.1 state renewal regression\n\ncommit d1f456b0b9545f1606a54cd17c20775f159bd2ce upstream.\n\nCommit 2f60ea6b8ced (\"NFSv4: The NFSv4.0 client must send RENEW calls if it holds a delegation\") set the NFS4_RENEW_TIMEOUT flag in nfs4_renew_state, and does\nnot put an nfs41_proc_async_sequence call, the NFSv4.1 lease renewal heartbeat\ncall, on the wire to renew the NFSv4.1 state if the flag was not set.\n\nThe NFS4_RENEW_TIMEOUT flag is set when \"now\" is after the last renewal\n(cl_last_renewal) plus the lease time divided by 3. This is arbitrary and\nsometimes does the following:\n\nIn normal operation, the only way a future state renewal call is put on the\nwire is via a call to nfs4_schedule_state_renewal, which schedules a\nnfs4_renew_state workqueue task. nfs4_renew_state determines if the\nNFS4_RENEW_TIMEOUT should be set, and the calls nfs41_proc_async_sequence,\nwhich only gets sent if the NFS4_RENEW_TIMEOUT flag is set.\nThen the nfs41_proc_async_sequence rpc_release function schedules\nanother state remewal via nfs4_schedule_state_renewal.\n\nWithout this change we can get into a state where an application stops\naccessing the NFSv4.1 share, state renewal calls stop due to the\nNFS4_RENEW_TIMEOUT flag _not_ being set. The only way to recover\nfrom this situation is with a clientid re-establishment, once the application\nresumes and the server has timed out the lease and so returns\nNFS4ERR_BAD_SESSION on the subsequent SEQUENCE operation.\n\nAn example application:\nopen, lock, write a file.\n\nsleep for 6 * lease (could be less)\n\nulock, close.\n\nIn the above example with NFSv4.1 delegations enabled, without this change,\nthere are no OP_SEQUENCE state renewal calls during the sleep, and the\nclientid is recovered due to lease expiration on the close.\n\nThis issue does not occur with NFSv4.1 delegations disabled, nor with\nNFSv4.0, with or without delegations enabled.\n\nSigned-off-by: Andy Adamson \u003candros@netapp.com\u003e\nLink: http://lkml.kernel.org/r/1411486536-23401-1-git-send-email-andros@netapp.com\nFixes: 2f60ea6b8ced (NFSv4: The NFSv4.0 client must send RENEW calls...)\nSigned-off-by: Trond Myklebust \u003ctrond.myklebust@primarydata.com\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "f4c4b923165f5c6342898a3428b1997dbc54f8f1", "tree": "94969b4d9bd2a0a3d9e89e9d25f1e2d947ec6028", "parents": [ "ab766b86a074e8a2a600a106418b240497d2d6aa" ], "author": { "name": "Borislav Petkov", "email": "bp@suse.de", "time": "Tue Sep 30 12:55:41 2014 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:46 2015 +0800" }, "message": "mpc85xx_edac: Make L2 interrupt shared too\n\ncommit a18c3f16a907b8977ef65fc8dd71ed3f7b751748 upstream.\n\nThe other two interrupt handlers in this driver are shared, except this\none. When loading the driver, it fails like this.\n\nSo make the IRQ line shared.\n\nFreescale(R) MPC85xx EDAC driver, (C) 2006 Montavista Software\nmpc85xx_mc_err_probe: No ECC DIMMs discovered\nEDAC DEVICE0: Giving out device to module MPC85xx_edac controller mpc85xx_l2_err: DEV mpc85xx_l2_err (INTERRUPT)\ngenirq: Flags mismatch irq 16. 00000000 ([EDAC] L2 err) vs. 00000080 ([EDAC] PCI err)\nmpc85xx_l2_err_probe: Unable to request irq 16 for MPC85xx L2 err\nremove_proc_entry: removing non-empty directory \u0027irq/16\u0027, leaking at least \u0027aerdrv\u0027\n------------[ cut here ]------------\nWARNING: at fs/proc/generic.c:521\nModules linked in:\nCPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.17.0-rc5-dirty #1\ntask: ee058000 ti: ee046000 task.ti: ee046000\nNIP: c016c0c4 LR: c016c0c4 CTR: c037b51c\nREGS: ee047c10 TRAP: 0700 Not tainted (3.17.0-rc5-dirty)\nMSR: 00029000 \u003cCE,EE,ME\u003e CR: 22008022 XER: 20000000\n\nGPR00: c016c0c4 ee047cc0 ee058000 00000053 00029000 00000000 c037c744 00000003\nGPR08: c09aab28 c09aab24 c09aab28 00000156 20008028 00000000 c0002ac8 00000000\nGPR16: 00000000 00000000 00000000 00000000 00000000 00000000 00000139 c0950394\nGPR24: c09f0000 ee5585b0 ee047d08 c0a10000 ee047d08 ee15f808 00000002 ee03f660\nNIP [c016c0c4] remove_proc_entry\nLR [c016c0c4] remove_proc_entry\nCall Trace:\nremove_proc_entry (unreliable)\nunregister_irq_proc\nfree_desc\nirq_free_descs\nmpc85xx_l2_err_probe\nplatform_drv_probe\nreally_probe\n__driver_attach\nbus_for_each_dev\nbus_add_driver\ndriver_register\nmpc85xx_mc_init\ndo_one_initcall\nkernel_init_freeable\nkernel_init\nret_from_kernel_thread\nInstruction dump: ...\n\nReported-and-tested-by: \u003clpb_098@163.com\u003e\nAcked-by: Johannes Thumshirn \u003cjohannes.thumshirn@men.de\u003e\nSigned-off-by: Borislav Petkov \u003cbp@suse.de\u003e\n[lizf: Backported to 3.4: IRQF_DISABLED hasn\u0027t been removed in 3.4]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "ab766b86a074e8a2a600a106418b240497d2d6aa", "tree": "440d7e3e41c3ed1b2b2a82b8213b02af0fa7cd08", "parents": [ "a06f6a5d229bbf9fcb0f39a9dbee56dda06f363a" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Tue Sep 16 12:40:26 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:45 2015 +0800" }, "message": "framebuffer: fix border color\n\ncommit f74a289b9480648a654e5afd8458c2263c03a1e1 upstream.\n\nThe framebuffer code uses the current background color to fill the border\nwhen switching consoles, however, this results in inconsistent behavior.\nFor example:\n- start Midnigh Commander\n- the border is black\n- switch to another console and switch back\n- the border is cyan\n- type something into the command line in mc\n- the border is cyan\n- switch to another console and switch back\n- the border is black\n- press F9 to go to menu\n- the border is black\n- switch to another console and switch back\n- the border is dark blue\n\nWhen switching to a console with Midnight Commander, the border is random\ncolor that was left selected by the slang subsystem.\n\nThis patch fixes this inconsistency by always using black as the\nbackground color when switching consoles.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Tomi Valkeinen \u003ctomi.valkeinen@ti.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "a06f6a5d229bbf9fcb0f39a9dbee56dda06f363a", "tree": "e2fd7bf32bee8b85bf5ef968f5d1e8d85b4aad57", "parents": [ "5a0b8b70d79afe7d77d3737fb6012abcf4157cf2" ], "author": { "name": "Bryan O\u0027Donoghue", "email": "pure.logic@nexus-software.ie", "time": "Tue Sep 23 01:21:11 2014 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:45 2015 +0800" }, "message": "serial: 8250: Add Quark X1000 to 8250_pci.c\n\ncommit 1ede7dcca3c4fa15a518ab0473126f9c3e621e4c upstream.\n\nQuark X1000 contains two designware derived 8250 serial ports.\nEach port has a unique PCI configuration space consisting of\nBAR0:UART BAR1:DMA respectively.\n\nUnlike the standard 8250 the register width is 32 bits for RHR,IER etc\nThe Quark UART has a fundamental clock @ 44.2368 MHz allowing for a\nbitrate of up to about 2.76 megabits per second.\n\nThis patch enables standard 8250 mode\n\nSigned-off-by: Bryan O\u0027Donoghue \u003cpure.logic@nexus-software.ie\u003e\nReviewed-by: Heikki Krogerus \u003cheikki.krogerus@linux.intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "5a0b8b70d79afe7d77d3737fb6012abcf4157cf2", "tree": "f6b4647b748806c968bc00cfc9de9bc7b6e12026", "parents": [ "39aca9c1368c298189f95a77e789bc7f42ff80fc" ], "author": { "name": "Trond Myklebust", "email": "trond.myklebust@primarydata.com", "time": "Sat Sep 27 17:41:51 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:45 2015 +0800" }, "message": "NFSv4: fix open/lock state recovery error handling\n\ncommit df817ba35736db2d62b07de6f050a4db53492ad8 upstream.\n\nThe current open/lock state recovery unfortunately does not handle errors\nsuch as NFS4ERR_CONN_NOT_BOUND_TO_SESSION correctly. Instead of looping,\njust proceeds as if the state manager is finished recovering.\nThis patch ensures that we loop back, handle higher priority errors\nand complete the open/lock state recovery.\n\nSigned-off-by: Trond Myklebust \u003ctrond.myklebust@primarydata.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "39aca9c1368c298189f95a77e789bc7f42ff80fc", "tree": "4228e98914ca4fa294a2c3e02460875b9532810a", "parents": [ "65b412cc6708ed1c5ce325a790a31f12f80ef6ba" ], "author": { "name": "Ondrej Zary", "email": "linux@rainbow-software.org", "time": "Sat Sep 27 00:04:46 2014 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:44 2015 +0800" }, "message": "libata-sff: Fix controllers with no ctl port\n\ncommit 6d8ca28fa688a9354bc9fbc935bdaeb3651b6677 upstream.\n\nCurrently, ata_sff_softreset is skipped for controllers with no ctl port.\nBut that also skips ata_sff_dev_classify required for device detection.\nThis means that libata is currently broken on controllers with no ctl port.\n\nNo device connected:\n[ 1.872480] pata_isapnp 01:01.02: activated\n[ 1.889823] scsi2 : pata_isapnp\n[ 1.890109] ata3: PATA max PIO0 cmd 0x1e8 ctl 0x0 irq 11\n[ 6.888110] ata3.01: qc timeout (cmd 0xec)\n[ 6.888179] ata3.01: failed to IDENTIFY (I/O error, err_mask\u003d0x5)\n[ 16.888085] ata3.01: qc timeout (cmd 0xec)\n[ 16.888147] ata3.01: failed to IDENTIFY (I/O error, err_mask\u003d0x5)\n[ 46.888086] ata3.01: qc timeout (cmd 0xec)\n[ 46.888148] ata3.01: failed to IDENTIFY (I/O error, err_mask\u003d0x5)\n[ 51.888100] ata3.00: qc timeout (cmd 0xec)\n[ 51.888160] ata3.00: failed to IDENTIFY (I/O error, err_mask\u003d0x5)\n[ 61.888079] ata3.00: qc timeout (cmd 0xec)\n[ 61.888141] ata3.00: failed to IDENTIFY (I/O error, err_mask\u003d0x5)\n[ 91.888089] ata3.00: qc timeout (cmd 0xec)\n[ 91.888152] ata3.00: failed to IDENTIFY (I/O error, err_mask\u003d0x5)\n\nATAPI device connected:\n[ 1.882061] pata_isapnp 01:01.02: activated\n[ 1.893430] scsi2 : pata_isapnp\n[ 1.893719] ata3: PATA max PIO0 cmd 0x1e8 ctl 0x0 irq 11\n[ 6.892107] ata3.01: qc timeout (cmd 0xec)\n[ 6.892171] ata3.01: failed to IDENTIFY (I/O error, err_mask\u003d0x5)\n[ 16.892079] ata3.01: qc timeout (cmd 0xec)\n[ 16.892138] ata3.01: failed to IDENTIFY (I/O error, err_mask\u003d0x5)\n[ 46.892079] ata3.01: qc timeout (cmd 0xec)\n[ 46.892138] ata3.01: failed to IDENTIFY (I/O error, err_mask\u003d0x5)\n[ 46.908586] ata3.00: ATAPI: ACER CD-767E/O, V1.5X, max PIO2, CDB intr\n[ 46.924570] ata3.00: configured for PIO0 (device error ignored)\n[ 46.926295] scsi 2:0:0:0: CD-ROM ACER CD-767E/O 1.5X PQ: 0 ANSI: 5\n[ 46.984519] sr0: scsi3-mmc drive: 6x/6x xa/form2 tray\n[ 46.984592] cdrom: Uniform CD-ROM driver Revision: 3.20\n\nSo don\u0027t skip ata_sff_softreset, just skip the reset part of ata_bus_softreset\nif the ctl port is not available.\n\nThis makes IDE port on ES968 behave correctly:\n\nNo device connected:\n[ 4.670888] pata_isapnp 01:01.02: activated\n[ 4.673207] scsi host2: pata_isapnp\n[ 4.673675] ata3: PATA max PIO0 cmd 0x1e8 ctl 0x0 irq 11\n[ 7.081840] Adding 2541652k swap on /dev/sda2. Priority:-1 extents:1 across:2541652k\n\nATAPI device connected:\n[ 4.704362] pata_isapnp 01:01.02: activated\n[ 4.706620] scsi host2: pata_isapnp\n[ 4.706877] ata3: PATA max PIO0 cmd 0x1e8 ctl 0x0 irq 11\n[ 4.872782] ata3.00: ATAPI: ACER CD-767E/O, V1.5X, max PIO2, CDB intr\n[ 4.888673] ata3.00: configured for PIO0 (device error ignored)\n[ 4.893984] scsi 2:0:0:0: CD-ROM ACER CD-767E/O 1.5X PQ: 0 ANSI: 5\n[ 7.015578] Adding 2541652k swap on /dev/sda2. Priority:-1 extents:1 across:2541652k\n\nSigned-off-by: Ondrej Zary \u003clinux@rainbow-software.org\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "65b412cc6708ed1c5ce325a790a31f12f80ef6ba", "tree": "729be8c8948a1910f194064787e052d1ce97a09a", "parents": [ "a3f3ff3879234e3dc92f4a5b3e08500b0e483b2e" ], "author": { "name": "Xiubo Li", "email": "Li.Xiubo@freescale.com", "time": "Sun Sep 28 17:09:54 2014 +0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:44 2015 +0800" }, "message": "regmap: fix possible ZERO_SIZE_PTR pointer dereferencing error.\n\ncommit d6b41cb06044a7d895db82bdd54f6e4219970510 upstream.\n\nSince we cannot make sure the \u0027val_count\u0027 will always be none zero\nhere, and then if it equals to zero, the kmemdup() will return\nZERO_SIZE_PTR, which equals to ((void *)16).\n\nSo this patch fix this with just doing the zero check before calling\nkmemdup().\n\nSigned-off-by: Xiubo Li \u003cLi.Xiubo@freescale.com\u003e\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n[lizf: Backported to 3.4: release mutex before returning EINVAL]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "a3f3ff3879234e3dc92f4a5b3e08500b0e483b2e", "tree": "d32c59ccdc536014b64346500e04cbe8dd8509d2", "parents": [ "d3c4aba01df7fa991576387660e3fb7dd27431fa" ], "author": { "name": "Xiubo Li", "email": "Li.Xiubo@freescale.com", "time": "Sun Sep 28 11:35:25 2014 +0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:44 2015 +0800" }, "message": "regmap: debugfs: fix possbile NULL pointer dereference\n\ncommit 2c98e0c1cc6b8e86f1978286c3d4e0769ee9d733 upstream.\n\nIf \u0027map-\u003edev\u0027 is NULL and there will lead dev_name() to be NULL pointer\ndereference. So before dev_name(), we need to have check of the map-\u003edev\npionter.\n\nWe also should make sure that the \u0027name\u0027 pointer shouldn\u0027t be NULL for\ndebugfs_create_dir(). So here using one default \"dummy\" debugfs name when\nthe \u0027name\u0027 pointer and \u0027map-\u003edev\u0027 are both NULL.\n\nSigned-off-by: Xiubo Li \u003cLi.Xiubo@freescale.com\u003e\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n[lizf: Backported to 3.4: dev_name() is passed to debugfs_create_dir() in 3.4]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "d3c4aba01df7fa991576387660e3fb7dd27431fa", "tree": "39d72fda0fdb43f017b764a81b4989cedbb5c8d6", "parents": [ "1cb3f30f67c36e6a6a17dc04d7b8d6a8429c94f9" ], "author": { "name": "Willy Tarreau", "email": "w@1wt.eu", "time": "Sat Sep 27 12:31:37 2014 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:44 2015 +0800" }, "message": "lzo: check for length overrun in variable length encoding.\n\ncommit 72cf90124e87d975d0b2114d930808c58b4c05e4 upstream.\n\nThis fix ensures that we never meet an integer overflow while adding\n255 while parsing a variable length encoding. It works differently from\ncommit 206a81c (\"lzo: properly check for overruns\") because instead of\nensuring that we don\u0027t overrun the input, which is tricky to guarantee\ndue to many assumptions in the code, it simply checks that the cumulated\nnumber of 255 read cannot overflow by bounding this number.\n\nThe MAX_255_COUNT is the maximum number of times we can add 255 to a base\ncount without overflowing an integer. The multiply will overflow when\nmultiplying 255 by more than MAXINT/255. The sum will overflow earlier\ndepending on the base count. Since the base count is taken from a u8\nand a few bits, it is safe to assume that it will always be lower than\nor equal to 2*255, thus we can always prevent any overflow by accepting\ntwo less 255 steps.\n\nThis patch also reduces the CPU overhead and actually increases performance\nby 1.1% compared to the initial code, while the previous fix costs 3.1%\n(measured on x86_64).\n\nThe fix needs to be backported to all currently supported stable kernels.\n\nReported-by: Willem Pinckaers \u003cwillem@lekkertech.net\u003e\nCc: \"Don A. Bailey\" \u003cdonb@securitymouse.com\u003e\nSigned-off-by: Willy Tarreau \u003cw@1wt.eu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "1cb3f30f67c36e6a6a17dc04d7b8d6a8429c94f9", "tree": "bab23eede200958e3b0ae29dca4449ddc48c7384", "parents": [ "c6d401effc132d21fb69faa6e1c04428434c375c" ], "author": { "name": "Willy Tarreau", "email": "w@1wt.eu", "time": "Sat Sep 27 12:31:36 2014 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:43 2015 +0800" }, "message": "Revert \"lzo: properly check for overruns\"\n\ncommit af958a38a60c7ca3d8a39c918c1baa2ff7b6b233 upstream.\n\nThis reverts commit 206a81c (\"lzo: properly check for overruns\").\n\nAs analysed by Willem Pinckaers, this fix is still incomplete on\ncertain rare corner cases, and it is easier to restart from the\noriginal code.\n\nReported-by: Willem Pinckaers \u003cwillem@lekkertech.net\u003e\nCc: \"Don A. Bailey\" \u003cdonb@securitymouse.com\u003e\nSigned-off-by: Willy Tarreau \u003cw@1wt.eu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "c6d401effc132d21fb69faa6e1c04428434c375c", "tree": "175610d78d3c63a3729de44b2c81c2150c6a7651", "parents": [ "bbb7a273be2cd8ea01fdb8c542c120ab2ffef6ad" ], "author": { "name": "Willy Tarreau", "email": "w@1wt.eu", "time": "Sat Sep 27 12:31:35 2014 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:43 2015 +0800" }, "message": "Documentation: lzo: document part of the encoding\n\ncommit d98a0526434d27e261f622cf9d2e0028b5ff1a00 upstream.\n\nAdd a complete description of the LZO format as processed by the\ndecompressor. I have not found a public specification of this format\nhence this analysis, which will be used to better understand the code.\n\nCc: Willem Pinckaers \u003cwillem@lekkertech.net\u003e\nCc: \"Don A. Bailey\" \u003cdonb@securitymouse.com\u003e\nSigned-off-by: Willy Tarreau \u003cw@1wt.eu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "bbb7a273be2cd8ea01fdb8c542c120ab2ffef6ad", "tree": "941331eb9487d02264a4e8e62f17884203f37198", "parents": [ "9fa2377fcc46960755f826a2d343b444c6dd5c40" ], "author": { "name": "Stanislaw Gruszka", "email": "sgruszka@redhat.com", "time": "Wed Sep 24 11:24:54 2014 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:43 2015 +0800" }, "message": "rt2800: correct BBP1_TX_POWER_CTRL mask\n\ncommit 01f7feeaf4528bec83798316b3c811701bac5d3e upstream.\n\nTwo bits control TX power on BBP_R1 register. Correct the mask,\notherwise we clear additional bit on BBP_R1 register, what can have\nunknown, possible negative effect.\n\nSigned-off-by: Stanislaw Gruszka \u003csgruszka@redhat.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "9fa2377fcc46960755f826a2d343b444c6dd5c40", "tree": "6c4d0812f62c27b5262e9f8e70c071bb2fde85e9", "parents": [ "8e65d449fb0fd36359fbcfef34198135d223a4d0" ], "author": { "name": "Krzysztof Kozlowski", "email": "k.kozlowski@samsung.com", "time": "Fri Sep 26 13:27:03 2014 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:43 2015 +0800" }, "message": "power: charger-manager: Fix NULL pointer exception with missing cm-fuel-gauge\n\ncommit 661a88860274e059fdb744dfaa98c045db7b5d1d upstream.\n\nNULL pointer exception happens during charger-manager probe if\n\u0027cm-fuel-gauge\u0027 property is not present.\n\n[ 2.448536] Unable to handle kernel NULL pointer dereference at virtual address 00000000\n[ 2.456572] pgd \u003d c0004000\n[ 2.459217] [00000000] *pgd\u003d00000000\n[ 2.462759] Internal error: Oops: 5 [#1] PREEMPT SMP ARM\n[ 2.468047] Modules linked in:\n[ 2.471089] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.17.0-rc6-00251-ge44cf96cd525-dirty #969\n[ 2.479765] task: ea890000 ti: ea87a000 task.ti: ea87a000\n[ 2.485161] PC is at strcmp+0x4/0x30\n[ 2.488719] LR is at power_supply_match_device_by_name+0x10/0x1c\n[ 2.494695] pc : [\u003cc01f4220\u003e] lr : [\u003cc030fe38\u003e] psr: a0000113\n[ 2.494695] sp : ea87bde0 ip : 00000000 fp : eaa97010\n[ 2.506150] r10: 00000004 r9 : ea97269c r8 : ea3bbfd0\n[ 2.511360] r7 : eaa97000 r6 : c030fe28 r5 : 00000000 r4 : ea3b0000\n[ 2.517869] r3 : 0000006d r2 : 00000000 r1 : 00000000 r0 : c057c195\n[ 2.524381] Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel\n[ 2.531671] Control: 10c5387d Table: 4000404a DAC: 00000015\n[ 2.537399] Process swapper/0 (pid: 1, stack limit \u003d 0xea87a240)\n[ 2.543388] Stack: (0xea87bde0 to 0xea87c000)\n[ 2.547733] bde0: ea3b0210 c026b1c8 eaa97010 eaa97000 eaa97010 eabb60a8 ea3b0210 00000000\n[ 2.555891] be00: 00000008 ea2db210 ea1a3410 c030fee0 ea3bbf90 c03138fc c068969c c013526c\n[ 2.564050] be20: eaa040c0 00000000 c068969c 00000000 eaa040c0 ea2da300 00000002 00000000\n[ 2.572208] be40: 00000001 ea2da3c0 00000000 00000001 00000000 eaa97010 c068969c 00000000\n[ 2.580367] be60: 00000000 c068969c 00000000 00000002 00000000 c026b71c c026b6f0 eaa97010\n[ 2.588527] be80: c0e82530 c026a330 00000000 eaa97010 c068969c eaa97044 00000000 c061df50\n[ 2.596686] bea0: ea87a000 c026a4dc 00000000 c068969c c026a448 c0268b5c ea8054a8 eaa8fd50\n[ 2.604845] bec0: c068969c ea2db180 c06801f8 c0269b18 c0590f68 c068969c c0656c98 c068969c\n[ 2.613004] bee0: c0656c98 ea3bbe40 c06988c0 c026aaf0 00000000 c0656c98 c0656c98 c00088a4\n[ 2.621163] bf00: 00000000 c0055f48 00000000 00000004 00000000 ea890000 c05dbc54 c062c178\n[ 2.629323] bf20: c0603518 c005f674 00000001 ea87a000 eb7ff83b c0476440 00000091 c003d41c\n[ 2.637482] bf40: c05db344 00000007 eb7ff858 00000007 c065a76c c0647d24 00000007 c062c170\n[ 2.645642] bf60: c06988c0 00000091 c062c178 c0603518 00000000 c0603cc4 00000007 00000007\n[ 2.653801] bf80: c0603518 c0c0c0c0 00000000 c0453948 00000000 00000000 00000000 00000000\n[ 2.661959] bfa0: 00000000 c0453950 00000000 c000e728 00000000 00000000 00000000 00000000\n[ 2.670118] bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000\n[ 2.678277] bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 c0c0c0c0 c0c0c0c0\n[ 2.686454] [\u003cc01f4220\u003e] (strcmp) from [\u003cc030fe38\u003e] (power_supply_match_device_by_name+0x10/0x1c)\n[ 2.695303] [\u003cc030fe38\u003e] (power_supply_match_device_by_name) from [\u003cc026b1c8\u003e] (class_find_device+0x54/0xac)\n[ 2.705106] [\u003cc026b1c8\u003e] (class_find_device) from [\u003cc030fee0\u003e] (power_supply_get_by_name+0x1c/0x30)\n[ 2.714137] [\u003cc030fee0\u003e] (power_supply_get_by_name) from [\u003cc03138fc\u003e] (charger_manager_probe+0x3d8/0xe58)\n[ 2.723683] [\u003cc03138fc\u003e] (charger_manager_probe) from [\u003cc026b71c\u003e] (platform_drv_probe+0x2c/0x5c)\n[ 2.732532] [\u003cc026b71c\u003e] (platform_drv_probe) from [\u003cc026a330\u003e] (driver_probe_device+0x10c/0x224)\n[ 2.741384] [\u003cc026a330\u003e] (driver_probe_device) from [\u003cc026a4dc\u003e] (__driver_attach+0x94/0x98)\n[ 2.749813] [\u003cc026a4dc\u003e] (__driver_attach) from [\u003cc0268b5c\u003e] (bus_for_each_dev+0x54/0x88)\n[ 2.757969] [\u003cc0268b5c\u003e] (bus_for_each_dev) from [\u003cc0269b18\u003e] (bus_add_driver+0xd4/0x1d0)\n[ 2.766123] [\u003cc0269b18\u003e] (bus_add_driver) from [\u003cc026aaf0\u003e] (driver_register+0x78/0xf4)\n[ 2.774110] [\u003cc026aaf0\u003e] (driver_register) from [\u003cc00088a4\u003e] (do_one_initcall+0x80/0x1bc)\n[ 2.782276] [\u003cc00088a4\u003e] (do_one_initcall) from [\u003cc0603cc4\u003e] (kernel_init_freeable+0x100/0x1cc)\n[ 2.790952] [\u003cc0603cc4\u003e] (kernel_init_freeable) from [\u003cc0453950\u003e] (kernel_init+0x8/0xec)\n[ 2.799029] [\u003cc0453950\u003e] (kernel_init) from [\u003cc000e728\u003e] (ret_from_fork+0x14/0x2c)\n[ 2.806572] Code: e12fff1e e1a03000 eafffff7 e4d03001 (e4d12001)\n[ 2.812832] ---[ end trace 7f12556111b9e7ef ]---\n\nSigned-off-by: Krzysztof Kozlowski \u003ck.kozlowski@samsung.com\u003e\nFixes: 856ee6115e2d (\"charger-manager: Support deivce tree in charger manager driver\")\nSigned-off-by: Sebastian Reichel \u003csre@kernel.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "8e65d449fb0fd36359fbcfef34198135d223a4d0", "tree": "ddea046e20f6dda8837c5409c4c5cf75f1f16f51", "parents": [ "ca3a4163bb5d66c346801c83c9296e7fe97b6132" ], "author": { "name": "Benjamin Coddington", "email": "bcodding@redhat.com", "time": "Tue Sep 23 12:26:20 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:42 2015 +0800" }, "message": "lockd: Try to reconnect if statd has moved\n\ncommit 173b3afceebe76fa2205b2c8808682d5b541fe3c upstream.\n\nIf rpc.statd is restarted, upcalls to monitor hosts can fail with\nECONNREFUSED. In that case force a lookup of statd\u0027s new port and retry the\nupcall.\n\nSigned-off-by: Benjamin Coddington \u003cbcodding@redhat.com\u003e\nSigned-off-by: Trond Myklebust \u003ctrond.myklebust@primarydata.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "ca3a4163bb5d66c346801c83c9296e7fe97b6132", "tree": "229727202f141e417c745965a40e683fed471988", "parents": [ "21ff5d93554d5f1ece80bd7ded145dc786c6469a" ], "author": { "name": "Bryan O\u0027Donoghue", "email": "pure.logic@nexus-software.ie", "time": "Wed Sep 24 00:26:24 2014 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:42 2015 +0800" }, "message": "x86/intel/quark: Switch off CR4.PGE so TLB flush uses CR3 instead\n\ncommit ee1b5b165c0a2f04d2107e634e51f05d0eb107de upstream.\n\nQuark x1000 advertises PGE via the standard CPUID method\nPGE bits exist in Quark X1000\u0027s PTEs. In order to flush\nan individual PTE it is necessary to reload CR3 irrespective\nof the PTE.PGE bit.\n\nSee Quark Core_DevMan_001.pdf section 6.4.11\n\nThis bug was fixed in Galileo kernels, unfixed vanilla kernels are expected to\ncrash and burn on this platform.\n\nSigned-off-by: Bryan O\u0027Donoghue \u003cpure.logic@nexus-software.ie\u003e\nCc: Borislav Petkov \u003cbp@alien8.de\u003e\nLink: http://lkml.kernel.org/r/1411514784-14885-1-git-send-email-pure.logic@nexus-software.ie\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "21ff5d93554d5f1ece80bd7ded145dc786c6469a", "tree": "e471fa5b935d4d97390e959ae46e50c1068eca5a", "parents": [ "92f961b3bf9166e0e5cb1e1d54217db1803c1720" ], "author": { "name": "David Matlack", "email": "dmatlack@google.com", "time": "Fri Sep 19 16:03:25 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:42 2015 +0800" }, "message": "kvm: don\u0027t take vcpu mutex for obviously invalid vcpu ioctls\n\ncommit 2ea75be3219571d0ec009ce20d9971e54af96e09 upstream.\n\nvcpu ioctls can hang the calling thread if issued while a vcpu is running.\nHowever, invalid ioctls can happen when userspace tries to probe the kind\nof file descriptors (e.g. isatty() calls ioctl(TCGETS)); in that case,\nwe know the ioctl is going to be rejected as invalid anyway and we can\nfail before trying to take the vcpu mutex.\n\nThis patch does not change functionality, it just makes invalid ioctls\nfail faster.\n\nSigned-off-by: David Matlack \u003cdmatlack@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "92f961b3bf9166e0e5cb1e1d54217db1803c1720", "tree": "332682ffcc280a4fd871221af4a60d18554c8561", "parents": [ "08b407459f4ece5096105730a2c7d1da1d16fb9e" ], "author": { "name": "Andy Shevchenko", "email": "andriy.shevchenko@linux.intel.com", "time": "Thu Sep 18 20:08:53 2014 +0300" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:41 2015 +0800" }, "message": "spi: dw-mid: terminate ongoing transfers at exit\n\ncommit 8e45ef682cb31fda62ed4eeede5d9745a0a1b1e2 upstream.\n\nDo full clean up at exit, means terminate all ongoing DMA transfers.\n\nSigned-off-by: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "08b407459f4ece5096105730a2c7d1da1d16fb9e", "tree": "c83211eca622b7fe9ba7c2e2504e0f8e449dd2cd", "parents": [ "67ecb11ce62e9d87b29edbf73bf87c562206edcb" ], "author": { "name": "Andy Shevchenko", "email": "andriy.shevchenko@linux.intel.com", "time": "Thu Sep 18 20:08:51 2014 +0300" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:41 2015 +0800" }, "message": "spi: dw-mid: respect 8 bit mode\n\ncommit b41583e7299046abdc578c33f25ed83ee95b9b31 upstream.\n\nIn case of 8 bit mode and DMA usage we end up with every second byte written as\n0. We have to respect bits_per_word settings what this patch actually does.\n\nSigned-off-by: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "67ecb11ce62e9d87b29edbf73bf87c562206edcb", "tree": "33b43e9aa97a96813190dd7b0fe6b5563ff51ff2", "parents": [ "a12dc90d616b4ea7cc2cce6d4c6b2394073daaed" ], "author": { "name": "K. Y. Srinivasan", "email": "kys@microsoft.com", "time": "Wed Aug 27 16:25:33 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:41 2015 +0800" }, "message": "Drivers: hv: vmbus: Cleanup vmbus_close_internal()\n\ncommit 98d731bb064a9d1817a6ca9bf8b97051334a7cfe upstream.\n\nEliminate calls to BUG_ON() in vmbus_close_internal().\nWe have chosen to potentially leak memory, than crash the guest\nin case of failures.\n\nIn this version of the patch I have addressed comments from\nDan Carpenter (dan.carpenter@oracle.com).\n\nSigned-off-by: K. Y. Srinivasan \u003ckys@microsoft.com\u003e\nTested-by: Sitsofe Wheeler \u003csitsofe@yahoo.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n[lizf: Backported to 3.4: s/return ret/return/g]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "a12dc90d616b4ea7cc2cce6d4c6b2394073daaed", "tree": "658858bb46ae545f8f6d7be4464321bd12cdaa84", "parents": [ "1e0293dd0218520d0b8e802e07357b07061882b1" ], "author": { "name": "K. Y. Srinivasan", "email": "kys@microsoft.com", "time": "Wed Aug 27 16:25:35 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:40 2015 +0800" }, "message": "Drivers: hv: vmbus: Fix a bug in vmbus_open()\n\ncommit 45d727cee9e200f5b351528b9fb063b69cf702c8 upstream.\n\nFix a bug in vmbus_open() and properly propagate the error. I would\nlike to thank Dexuan Cui \u003cdecui@microsoft.com\u003e for identifying the\nissue.\n\nSigned-off-by: K. Y. Srinivasan \u003ckys@microsoft.com\u003e\nTested-by: Sitsofe Wheeler \u003csitsofe@yahoo.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "1e0293dd0218520d0b8e802e07357b07061882b1", "tree": "8a052ac8f4596329260ba3c55143c78a4a54dd57", "parents": [ "3adbbcc200f4911123fa5c71f729958a54e9c51d" ], "author": { "name": "K. Y. Srinivasan", "email": "kys@microsoft.com", "time": "Wed Aug 27 16:25:34 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:40 2015 +0800" }, "message": "Drivers: hv: vmbus: Cleanup vmbus_establish_gpadl()\n\ncommit 72c6b71c245dac8f371167d97ef471b367d0b66b upstream.\n\nEliminate the call to BUG_ON() by waiting for the host to respond. We are\ntrying to reclaim the ownership of memory that was given to the host and so\nwe will have to wait until the host responds.\n\nSigned-off-by: K. Y. Srinivasan \u003ckys@microsoft.com\u003e\nTested-by: Sitsofe Wheeler \u003csitsofe@yahoo.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "3adbbcc200f4911123fa5c71f729958a54e9c51d", "tree": "26edd69b7953e1f5d5c48ec3204aef250571e42b", "parents": [ "3aae84bbb972584b095a9d170631d825c1dd9de2" ], "author": { "name": "K. Y. Srinivasan", "email": "kys@microsoft.com", "time": "Wed Aug 27 16:25:32 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:40 2015 +0800" }, "message": "Drivers: hv: vmbus: Cleanup vmbus_teardown_gpadl()\n\ncommit 66be653083057358724d56d817e870e53fb81ca7 upstream.\n\nEliminate calls to BUG_ON() by properly handling errors. In cases where\nrollback is possible, we will return the appropriate error to have the\ncalling code decide how to rollback state. In the case where we are\ntransferring ownership of the guest physical pages to the host,\nwe will wait for the host to respond.\n\nSigned-off-by: K. Y. Srinivasan \u003ckys@microsoft.com\u003e\nTested-by: Sitsofe Wheeler \u003csitsofe@yahoo.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "3aae84bbb972584b095a9d170631d825c1dd9de2", "tree": "4cdc123d4d91d00092b389b37598d3cf4dce2d20", "parents": [ "0bd172d1db29b8379fc8a78dd384c462fe833183" ], "author": { "name": "K. Y. Srinivasan", "email": "kys@microsoft.com", "time": "Wed Aug 27 16:25:31 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:39 2015 +0800" }, "message": "Drivers: hv: vmbus: Cleanup vmbus_post_msg()\n\ncommit fdeebcc62279119dbeafbc1a2e39e773839025fd upstream.\n\nPosting messages to the host can fail because of transient resource\nrelated failures. Correctly deal with these failures and increase the\nnumber of attempts to post the message before giving up.\n\nIn this version of the patch, I have normalized the error code to\nLinux error code.\n\nSigned-off-by: K. Y. Srinivasan \u003ckys@microsoft.com\u003e\nTested-by: Sitsofe Wheeler \u003csitsofe@yahoo.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "0bd172d1db29b8379fc8a78dd384c462fe833183", "tree": "f6f9ae8e60615f3f078485e6d73ea504a07f037a", "parents": [ "eea5a87d270e8d6925063019c3b0f3ff61fcb49a" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Thu Sep 18 11:25:37 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:39 2015 +0800" }, "message": "firmware_class: make sure fw requests contain a name\n\ncommit 471b095dfe0d693a8d624cbc716d1ee4d74eb437 upstream.\n\nAn empty firmware request name will trigger warnings when building\ndevice names. Make sure this is caught earlier and rejected.\n\nThe warning was visible via the test_firmware.ko module interface:\n\necho -ne \"\\x00\" \u003e /sys/devices/virtual/misc/test_firmware/trigger_request\n\nReported-by: Sasha Levin \u003csasha.levin@oracle.com\u003e\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nTested-by: Sasha Levin \u003csasha.levin@oracle.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "eea5a87d270e8d6925063019c3b0f3ff61fcb49a", "tree": "7422b73f51b3980434fa03acba90c65c7ee0a937", "parents": [ "7a6185a12d7bc28267a0917b2cb41e8eb8adb24f" ], "author": { "name": "Lu Baolu", "email": "baolu.lu@linux.intel.com", "time": "Fri Sep 19 10:13:50 2014 +0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:39 2015 +0800" }, "message": "USB: Add device quirk for ASUS T100 Base Station keyboard\n\ncommit ddbe1fca0bcb87ca8c199ea873a456ca8a948567 upstream.\n\nThis full-speed USB device generates spurious remote wakeup event\nas soon as USB_DEVICE_REMOTE_WAKEUP feature is set. As the result,\nLinux can\u0027t enter system suspend and S0ix power saving modes once\nthis keyboard is used.\n\nThis patch tries to introduce USB_QUIRK_IGNORE_REMOTE_WAKEUP quirk.\nWith this quirk set, wakeup capability will be ignored during\ndevice configure.\n\nThis patch could be back-ported to kernels as old as 2.6.39.\n\nSigned-off-by: Lu Baolu \u003cbaolu.lu@linux.intel.com\u003e\nAcked-by: Alan Stern \u003cstern@rowland.harvard.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "7a6185a12d7bc28267a0917b2cb41e8eb8adb24f", "tree": "02dbd71ada8abf1edc2c5a58f2843a9b4233f3b7", "parents": [ "a84663095ae6c00ecb0dcc07a0b82801aa33180f" ], "author": { "name": "Ricardo Ribalda Delgado", "email": "ricardo.ribalda@gmail.com", "time": "Wed Aug 27 14:57:57 2014 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:38 2015 +0800" }, "message": "PCI: Generate uppercase hex for modalias interface class\n\ncommit 89ec3dcf17fd3fa009ecf8faaba36828dd6bc416 upstream.\n\nSome implementations of modprobe fail to load the driver for a PCI device\nautomatically because the \"interface\" part of the modalias from the kernel\nis lowercase, and the modalias from file2alias is uppercase.\n\nThe \"interface\" is the low-order byte of the Class Code, defined in PCI\nr3.0, Appendix D. Most interface types defined in the spec do not use\nalpha characters, so they won\u0027t be affected. For example, 00h, 01h, 10h,\n20h, etc. are unaffected.\n\nPrint the \"interface\" byte of the Class Code in uppercase hex, as we\nalready do for the Vendor ID, Device ID, Class, etc.\n\n[bhelgaas: changelog]\nSigned-off-by: Ricardo Ribalda Delgado \u003cricardo.ribalda@gmail.com\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nAcked-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "a84663095ae6c00ecb0dcc07a0b82801aa33180f", "tree": "616ab6e38703e172db72e33ee1ded8595412b2a9", "parents": [ "810c74bd39235ef7b9f166e842efb6f2b42a9c3b" ], "author": { "name": "Andreas Bomholtz", "email": "andreas@seluxit.com", "time": "Mon Sep 22 09:50:43 2014 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:38 2015 +0800" }, "message": "USB: cp210x: add support for Seluxit USB dongle\n\ncommit dee80ad12d2b1b304286a707fde7ab05d1fc7bab upstream.\n\nAdded the Seluxit ApS USB Serial Dongle to cp210x driver.\n\nSigned-off-by: Andreas Bomholtz \u003candreas@seluxit.com\u003e\nSigned-off-by: Johan Hovold \u003cjohan@kernel.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "810c74bd39235ef7b9f166e842efb6f2b42a9c3b", "tree": "696da62c8eada43505f19d905fddab7c1f10595f", "parents": [ "8e48aa5819ec9d87953110ca6ea2079b17d94524" ], "author": { "name": "Joe Savage", "email": "joe.savage@goketra.com", "time": "Sat Sep 20 08:01:16 2014 -0500" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:38 2015 +0800" }, "message": "USB: serial: cp210x: added Ketra N1 wireless interface support\n\ncommit bfc2d7dfdd761ae3beccdb26abebe03cef042f46 upstream.\n\nAdded support for Ketra N1 wireless interface, which uses the\nSilicon Labs\u0027 CP2104 USB to UART bridge with customized PID 8946.\n\nSigned-off-by: Joe Savage \u003cjoe.savage@goketra.com\u003e\nSigned-off-by: Johan Hovold \u003cjohan@kernel.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "8e48aa5819ec9d87953110ca6ea2079b17d94524", "tree": "510239cb99e5e1414bb44338d748ae21a62b10e3", "parents": [ "2d150da34ec69ac10329d01cab11e9334d0faba7" ], "author": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Sun Sep 21 15:04:53 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:38 2015 +0800" }, "message": "Revert \"percpu: free percpu allocation info for uniprocessor system\"\n\ncommit bb2e226b3bef596dd56be97df655d857b4603923 upstream.\n\nThis reverts commit 3189eddbcafc (\"percpu: free percpu allocation info for\nuniprocessor system\").\n\nThe commit causes a hang with a crisv32 image. This may be an architecture\nproblem, but at least for now the revert is necessary to be able to boot a\ncrisv32 image.\n\nCc: Tejun Heo \u003ctj@kernel.org\u003e\nCc: Honggang Li \u003cenjoymindful@gmail.com\u003e\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nFixes: 3189eddbcafc (\"percpu: free percpu allocation info for uniprocessor system\")\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "2d150da34ec69ac10329d01cab11e9334d0faba7", "tree": "7e61aa25c916eb8b2999bd5a2eecdd92eb2b5698", "parents": [ "a66b378950318cc5ab9be8eb3f21dd2383ae18b9" ], "author": { "name": "Johan Hedberg", "email": "johan.hedberg@intel.com", "time": "Thu Sep 18 11:26:32 2014 +0300" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:37 2015 +0800" }, "message": "Bluetooth: Fix setting correct security level when initiating SMP\n\ncommit 5eb596f55cacc2389554a8d7572d90d5e9d4269d upstream.\n\nWe can only determine the final security level when both pairing request\nand response have been exchanged. When initiating pairing the starting\ntarget security level is set to MEDIUM unless explicitly specified to be\nHIGH, so that we can still perform pairing even if the remote doesn\u0027t\nhave MITM capabilities. However, once we\u0027ve received the pairing\nresponse we should re-consult the remote and local IO capabilities and\nupgrade the target security level if necessary.\n\nWithout this patch the resulting Long Term Key will occasionally be\nreported to be unauthenticated when it in reality is an authenticated\none.\n\nSigned-off-by: Johan Hedberg \u003cjohan.hedberg@intel.com\u003e\nSigned-off-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "a66b378950318cc5ab9be8eb3f21dd2383ae18b9", "tree": "4085850ac75896587424f461cb539458a8836278", "parents": [ "7cf009d054e48bea3eb70af362d8c58b22baadec" ], "author": { "name": "Douglas Lehr", "email": "dllehr@us.ibm.com", "time": "Thu Aug 21 09:26:52 2014 +1000" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:37 2015 +0800" }, "message": "PCI: Increase IBM ipr SAS Crocodile BARs to at least system page size\n\ncommit 9fe373f9997b48fcd6222b95baf4a20c134b587a upstream.\n\nThe Crocodile chip occasionally comes up with 4k and 8k BAR sizes. Due to\nan erratum, setting the SR-IOV page size causes the physical function BARs\nto expand to the system page size. Since ppc64 uses 64k pages, when Linux\ntries to assign the smaller resource sizes to the now 64k BARs the address\nwill be truncated and the BARs will overlap.\n\nForce Linux to allocate the resource as a full page, which avoids the\noverlap.\n\n[bhelgaas: print expanded resource, too]\nSigned-off-by: Douglas Lehr \u003cdllehr@us.ibm.com\u003e\nSigned-off-by: Anton Blanchard \u003canton@samba.org\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nAcked-by: Milton Miller \u003cmiltonm@us.ibm.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "7cf009d054e48bea3eb70af362d8c58b22baadec", "tree": "38e2abb9036f594eb18d50ae7cbe5bd315fe2c95", "parents": [ "c002aa006faa936b9b1c29431807fe8ab97df1b2" ], "author": { "name": "Andreas Noever", "email": "andreas.noever@gmail.com", "time": "Tue Sep 16 15:16:02 2014 -0600" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:37 2015 +0800" }, "message": "PCI: pciehp: Prevent NULL dereference during probe\n\ncommit bceee4a97eb58bd0e80e39eff11b506ddd9e7ad3 upstream.\n\npciehp assumes that dev-\u003esubordinate, the struct pci_bus for a bridge\u0027s\nsecondary bus, exists. But we do not create that bus if we run out of bus\nnumbers during enumeration. This leads to a NULL dereference in\ninit_slot() (and other places).\n\nChange pciehp_probe() to return -ENODEV when no secondary bus is present.\n\nSigned-off-by: Andreas Noever \u003candreas.noever@gmail.com\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "c002aa006faa936b9b1c29431807fe8ab97df1b2", "tree": "47f40fe389a61edd112b5e2648c1df612e1012bb", "parents": [ "d480591d22c6ccf8327da5716f96a41ae1cb9663" ], "author": { "name": "Christian Borntraeger", "email": "borntraeger@de.ibm.com", "time": "Wed Sep 03 16:21:32 2014 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:37 2015 +0800" }, "message": "KVM: s390: unintended fallthrough for external call\n\ncommit f346026e55f1efd3949a67ddd1dcea7c1b9a615e upstream.\n\nWe must not fallthrough if the conditions for external call are not met.\n\nSigned-off-by: Christian Borntraeger \u003cborntraeger@de.ibm.com\u003e\nReviewed-by: Thomas Huth \u003cthuth@linux.vnet.ibm.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "d480591d22c6ccf8327da5716f96a41ae1cb9663", "tree": "4e3f418298e416233ef48be95e482ced6becd1a1", "parents": [ "82508e0f0bdd4fd1090fc8ee09c6b94e170f78a5" ], "author": { "name": "Champion Chen", "email": "champion_chen@realsil.com.cn", "time": "Sat Sep 06 14:06:08 2014 -0500" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:36 2015 +0800" }, "message": "Bluetooth: Fix issue with USB suspend in btusb driver\n\ncommit 85560c4a828ec9c8573840c9b66487b6ae584768 upstream.\n\nSuspend could fail for some platforms because\nbtusb_suspend\u003d\u003d\u003e btusb_stop_traffic \u003d\u003d\u003e usb_kill_anchored_urbs.\n\nWhen btusb_bulk_complete returns before system suspend and resubmits\nan URB, the system cannot enter suspend state.\n\nSigned-off-by: Champion Chen \u003cchampion_chen@realsil.com.cn\u003e\nSigned-off-by: Larry Finger \u003cLarry.Finger@lwfinger.net\u003e\nSigned-off-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "82508e0f0bdd4fd1090fc8ee09c6b94e170f78a5", "tree": "ee230ebbd462972bd7e4101c301e360478eee4d7", "parents": [ "db73d4fcba98f8427d820b9e3cae01f1ec604233" ], "author": { "name": "Artem Bityutskiy", "email": "artem.bityutskiy@linux.intel.com", "time": "Wed Jul 16 15:22:29 2014 +0300" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:36 2015 +0800" }, "message": "UBIFS: fix free log space calculation\n\ncommit ba29e721eb2df6df8f33c1f248388bb037a47914 upstream.\n\nHu (hujianyang \u003chujianyang@huawei.com\u003e) discovered an issue in the\n\u0027empty_log_bytes()\u0027 function, which calculates how many bytes are left in the\nlog:\n\n\"\nIf \u0027c-\u003elhead_lnum + 1 \u003d\u003d c-\u003eltail_lnum\u0027 and \u0027c-\u003elhead_offs \u003d\u003d c-\u003eleb_size\u0027, \u0027h\u0027\nwould equalent to \u0027t\u0027 and \u0027empty_log_bytes()\u0027 would return \u0027c-\u003elog_bytes\u0027\ninstead of 0.\n\"\n\nAt this point it is not clear what would be the consequences of this, and\nwhether this may lead to any problems, but this patch addresses the issue just\nin case.\n\nTested-by: hujianyang \u003chujianyang@huawei.com\u003e\nReported-by: hujianyang \u003chujianyang@huawei.com\u003e\nSigned-off-by: Artem Bityutskiy \u003cartem.bityutskiy@linux.intel.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "db73d4fcba98f8427d820b9e3cae01f1ec604233", "tree": "4b0eaf26456902d39005248aa18c2a43e969401a", "parents": [ "a5b4755f4bd37cef9498e2d53a8cd666361e3cbe" ], "author": { "name": "Artem Bityutskiy", "email": "artem.bityutskiy@linux.intel.com", "time": "Sun Jun 29 17:00:45 2014 +0300" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:36 2015 +0800" }, "message": "UBIFS: fix a race condition\n\ncommit 052c28073ff26f771d44ef33952a41d18dadd255 upstream.\n\nHu (hujianyang@huawei.com) discovered a race condition which may lead to a\nsituation when UBIFS is unable to mount the file-system after an unclean\nreboot. The problem is theoretical, though.\n\nIn UBIFS, we have the log, which basically a set of LEBs in a certain area. The\nlog has the tail and the head.\n\nEvery time user writes data to the file-system, the UBIFS journal grows, and\nthe log grows as well, because we append new reference nodes to the head of the\nlog. So the head moves forward all the time, while the log tail stays at the\nsame position.\n\nAt any time, the UBIFS master node points to the tail of the log. When we mount\nthe file-system, we scan the log, and we always start from its tail, because\nthis is where the master node points to. The only occasion when the tail of the\nlog changes is the commit operation.\n\nThe commit operation has 2 phases - \"commit start\" and \"commit end\". The former\nis relatively short, and does not involve much I/O. During this phase we mostly\njust build various in-memory lists of the things which have to be written to\nthe flash media during \"commit end\" phase.\n\nDuring the commit start phase, what we do is we \"clean\" the log. Indeed, the\ncommit operation will index all the data in the journal, so the entire journal\n\"disappears\", and therefore the data in the log become unneeded. So we just\nmove the head of the log to the next LEB, and write the CS node there. This LEB\nwill be the tail of the new log when the commit operation finishes.\n\nWhen the \"commit start\" phase finishes, users may write more data to the\nfile-system, in parallel with the ongoing \"commit end\" operation. At this point\nthe log tail was not changed yet, it is the same as it had been before we\nstarted the commit. The log head keeps moving forward, though.\n\nThe commit operation now needs to write the new master node, and the new master\nnode should point to the new log tail. After this the LEBs between the old log\ntail and the new log tail can be unmapped and re-used again.\n\nAnd here is the possible problem. We do 2 operations: (a) We first update the\nlog tail position in memory (see \u0027ubifs_log_end_commit()\u0027). (b) And then we\nwrite the master node (see the big lock of code in \u0027do_commit()\u0027).\n\nBut nothing prevents the log head from moving forward between (a) and (b), and\nthe log head may \"wrap\" now to the old log tail. And when the \"wrap\" happens,\nthe contends of the log tail gets erased. Now a power cut happens and we are in\ntrouble. We end up with the old master node pointing to the old tail, which was\nerased. And replay fails because it expects the master node to point to the\ncorrect log tail at all times.\n\nThis patch merges the abovementioned (a) and (b) operations by moving the master\nnode change code to the \u0027ubifs_log_end_commit()\u0027 function, so that it runs with\nthe log mutex locked, which will prevent the log from being changed benween\noperations (a) and (b).\n\nReported-by: hujianyang \u003chujianyang@huawei.com\u003e\nTested-by: hujianyang \u003chujianyang@huawei.com\u003e\nSigned-off-by: Artem Bityutskiy \u003cartem.bityutskiy@linux.intel.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "a5b4755f4bd37cef9498e2d53a8cd666361e3cbe", "tree": "db71b55d23c4b3a36ff86801606e63c8cccfb885", "parents": [ "9083cb065a03722697dc5b81cfb2d0d426a73f82" ], "author": { "name": "Artem Bityutskiy", "email": "artem.bityutskiy@linux.intel.com", "time": "Sun Jun 29 16:55:02 2014 +0300" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:35 2015 +0800" }, "message": "UBIFS: remove mst_mutex\n\ncommit 07e19dff63e3d5d6500d831e36554ac9b1b0560e upstream.\n\nThe \u0027mst_mutex\u0027 is not needed since because \u0027ubifs_write_master()\u0027 is only\ncalled on the mount path and commit path. The mount path is sequential and\nthere is no parallelism, and the commit path is also serialized - there is only\none commit going on at a time.\n\nSigned-off-by: Artem Bityutskiy \u003cartem.bityutskiy@linux.intel.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "9083cb065a03722697dc5b81cfb2d0d426a73f82", "tree": "195959fd3f66e133ca7a80d3865b84e6280f707f", "parents": [ "7fd7a446b1c2b96252e4389746e5419eae04faef" ], "author": { "name": "David Matlack", "email": "dmatlack@google.com", "time": "Mon Aug 18 15:46:07 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:35 2015 +0800" }, "message": "kvm: x86: fix stale mmio cache bug\n\ncommit 56f17dd3fbc44adcdbc3340fe3988ddb833a47a7 upstream.\n\nThe following events can lead to an incorrect KVM_EXIT_MMIO bubbling\nup to userspace:\n\n(1) Guest accesses gpa X without a memory slot. The gfn is cached in\nstruct kvm_vcpu_arch (mmio_gfn). On Intel EPT-enabled hosts, KVM sets\nthe SPTE write-execute-noread so that future accesses cause\nEPT_MISCONFIGs.\n\n(2) Host userspace creates a memory slot via KVM_SET_USER_MEMORY_REGION\ncovering the page just accessed.\n\n(3) Guest attempts to read or write to gpa X again. On Intel, this\ngenerates an EPT_MISCONFIG. The memory slot generation number that\nwas incremented in (2) would normally take care of this but we fast\npath mmio faults through quickly_check_mmio_pf(), which only checks\nthe per-vcpu mmio cache. Since we hit the cache, KVM passes a\nKVM_EXIT_MMIO up to userspace.\n\nThis patch fixes the issue by using the memslot generation number\nto validate the mmio cache.\n\nSigned-off-by: David Matlack \u003cdmatlack@google.com\u003e\n[xiaoguangrong: adjust the code to make it simpler for stable-tree fix.]\nSigned-off-by: Xiao Guangrong \u003cxiaoguangrong@linux.vnet.ibm.com\u003e\nReviewed-by: David Matlack \u003cdmatlack@google.com\u003e\nReviewed-by: Xiao Guangrong \u003cxiaoguangrong@linux.vnet.ibm.com\u003e\nTested-by: David Matlack \u003cdmatlack@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "7fd7a446b1c2b96252e4389746e5419eae04faef", "tree": "1fc0ba82bc4e90a3f213e737e7103733e43de9aa", "parents": [ "4290973d9aa3a5ff64acb03e004762260e8271a4" ], "author": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:45 2014 +0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:45 2014 +0800" }, "message": "Linux 3.4.105\n" }, { "commit": "4290973d9aa3a5ff64acb03e004762260e8271a4", "tree": "424afbc23fa039fe2a4113f5ea8c90141edcb9f2", "parents": [ "9024225cf3c5f0fe29e87aa46330d41816ca91b6" ], "author": { "name": "Guillaume Nault", "email": "g.nault@alphalink.fr", "time": "Wed Sep 03 14:12:55 2014 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:45 2014 +0800" }, "message": "l2tp: fix race while getting PMTU on PPP pseudo-wire\n\ncommit eed4d839b0cdf9d84b0a9bc63de90fd5e1e886fb upstream.\n\nUse dst_entry held by sk_dst_get() to retrieve tunnel\u0027s PMTU.\n\nThe dst_mtu(__sk_dst_get(tunnel-\u003esock)) call was racy. __sk_dst_get()\ncould return NULL if tunnel-\u003esock-\u003esk_dst_cache was reset just before the\ncall, thus making dst_mtu() dereference a NULL pointer:\n\n[ 1937.661598] BUG: unable to handle kernel NULL pointer dereference at 0000000000000020\n[ 1937.664005] IP: [\u003cffffffffa049db88\u003e] pppol2tp_connect+0x33d/0x41e [l2tp_ppp]\n[ 1937.664005] PGD daf0c067 PUD d9f93067 PMD 0\n[ 1937.664005] Oops: 0000 [#1] SMP\n[ 1937.664005] Modules linked in: l2tp_ppp l2tp_netlink l2tp_core ip6table_filter ip6_tables iptable_filter ip_tables ebtable_nat ebtables x_tables udp_tunnel pppoe pppox ppp_generic slhc deflate ctr twofish_generic twofish_x86_64_3way xts lrw gf128mul glue_helper twofish_x86_64 twofish_common blowfish_generic blowfish_x86_64 blowfish_common des_generic cbc xcbc rmd160 sha512_generic hmac crypto_null af_key xfrm_algo 8021q garp bridge stp llc tun atmtcp clip atm ext3 mbcache jbd iTCO_wdt coretemp kvm_intel iTCO_vendor_support kvm pcspkr evdev ehci_pci lpc_ich mfd_core i5400_edac edac_core i5k_amb shpchp button processor thermal_sys xfs crc32c_generic libcrc32c dm_mod usbhid sg hid sr_mod sd_mod cdrom crc_t10dif crct10dif_common ata_generic ahci ata_piix tg3 libahci libata uhci_hcd ptp ehci_hcd pps_core usbcore scsi_mod libphy usb_common [last unloaded: l2tp_core]\n[ 1937.664005] CPU: 0 PID: 10022 Comm: l2tpstress Tainted: G O 3.17.0-rc1 #1\n[ 1937.664005] Hardware name: HP ProLiant DL160 G5, BIOS O12 08/22/2008\n[ 1937.664005] task: ffff8800d8fda790 ti: ffff8800c43c4000 task.ti: ffff8800c43c4000\n[ 1937.664005] RIP: 0010:[\u003cffffffffa049db88\u003e] [\u003cffffffffa049db88\u003e] pppol2tp_connect+0x33d/0x41e [l2tp_ppp]\n[ 1937.664005] RSP: 0018:ffff8800c43c7de8 EFLAGS: 00010282\n[ 1937.664005] RAX: ffff8800da8a7240 RBX: ffff8800d8c64600 RCX: 000001c325a137b5\n[ 1937.664005] RDX: 8c6318c6318c6320 RSI: 000000000000010c RDI: 0000000000000000\n[ 1937.664005] RBP: ffff8800c43c7ea8 R08: 0000000000000000 R09: 0000000000000000\n[ 1937.664005] R10: ffffffffa048e2c0 R11: ffff8800d8c64600 R12: ffff8800ca7a5000\n[ 1937.664005] R13: ffff8800c439bf40 R14: 000000000000000c R15: 0000000000000009\n[ 1937.664005] FS: 00007fd7f610f700(0000) GS:ffff88011a600000(0000) knlGS:0000000000000000\n[ 1937.664005] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n[ 1937.664005] CR2: 0000000000000020 CR3: 00000000d9d75000 CR4: 00000000000027e0\n[ 1937.664005] Stack:\n[ 1937.664005] ffffffffa049da80 ffff8800d8fda790 000000000000005b ffff880000000009\n[ 1937.664005] ffff8800daf3f200 0000000000000003 ffff8800c43c7e48 ffffffff81109b57\n[ 1937.664005] ffffffff81109b0e ffffffff8114c566 0000000000000000 0000000000000000\n[ 1937.664005] Call Trace:\n[ 1937.664005] [\u003cffffffffa049da80\u003e] ? pppol2tp_connect+0x235/0x41e [l2tp_ppp]\n[ 1937.664005] [\u003cffffffff81109b57\u003e] ? might_fault+0x9e/0xa5\n[ 1937.664005] [\u003cffffffff81109b0e\u003e] ? might_fault+0x55/0xa5\n[ 1937.664005] [\u003cffffffff8114c566\u003e] ? rcu_read_unlock+0x1c/0x26\n[ 1937.664005] [\u003cffffffff81309196\u003e] SYSC_connect+0x87/0xb1\n[ 1937.664005] [\u003cffffffff813e56f7\u003e] ? sysret_check+0x1b/0x56\n[ 1937.664005] [\u003cffffffff8107590d\u003e] ? trace_hardirqs_on_caller+0x145/0x1a1\n[ 1937.664005] [\u003cffffffff81213dee\u003e] ? trace_hardirqs_on_thunk+0x3a/0x3f\n[ 1937.664005] [\u003cffffffff8114c262\u003e] ? spin_lock+0x9/0xb\n[ 1937.664005] [\u003cffffffff813092b4\u003e] SyS_connect+0x9/0xb\n[ 1937.664005] [\u003cffffffff813e56d2\u003e] system_call_fastpath+0x16/0x1b\n[ 1937.664005] Code: 10 2a 84 81 e8 65 76 bd e0 65 ff 0c 25 10 bb 00 00 4d 85 ed 74 37 48 8b 85 60 ff ff ff 48 8b 80 88 01 00 00 48 8b b8 10 02 00 00 \u003c48\u003e 8b 47 20 ff 50 20 85 c0 74 0f 83 e8 28 89 83 10 01 00 00 89\n[ 1937.664005] RIP [\u003cffffffffa049db88\u003e] pppol2tp_connect+0x33d/0x41e [l2tp_ppp]\n[ 1937.664005] RSP \u003cffff8800c43c7de8\u003e\n[ 1937.664005] CR2: 0000000000000020\n[ 1939.559375] ---[ end trace 82d44500f28f8708 ]---\n\nFixes: f34c4a35d879 (\"l2tp: take PMTU from tunnel UDP socket\")\nSigned-off-by: Guillaume Nault \u003cg.nault@alphalink.fr\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nCc: Guillaume Nault \u003cg.nault@alphalink.fr\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "9024225cf3c5f0fe29e87aa46330d41816ca91b6", "tree": "60f6cc8c405d0d0cd8dd7c2938d83eb665c9b7a1", "parents": [ "10d5d534765ccd203e34e3ccf5f67edba5e577c7" ], "author": { "name": "Narendra K", "email": "narendra_k@dell.com", "time": "Mon Jul 16 15:24:41 2012 +0000" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:45 2014 +0800" }, "message": "ixgbevf: Prevent RX/TX statistics getting reset to zero\n\ncommit 936597631dd310e220544dc5c6075d924efd39b2 upstream.\n\nThe commit 4197aa7bb81877ebb06e4f2cc1b5fea2da23a7bd implements 64 bit\nper ring statistics. But the driver resets the \u0027total_bytes\u0027 and\n\u0027total_packets\u0027 from RX and TX rings in the RX and TX interrupt\nhandlers to zero. This results in statistics being lost and user space\nreporting RX and TX statistics as zero. This patch addresses the\nissue by preventing the resetting of RX and TX ring statistics to\nzero.\n\nSigned-off-by: Narendra K \u003cnarendra_k@dell.com\u003e\nTested-by: Sibai Li \u003csibai.li@intel.com\u003e\nSigned-off-by: Jeff Kirsher \u003cjeffrey.t.kirsher@intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nCc: Weng Meiling \u003cwengmeiling.weng@huawei.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "10d5d534765ccd203e34e3ccf5f67edba5e577c7", "tree": "bdbf18756a2e846f13dd2cdcd3f1124a81e40db7", "parents": [ "c58038a16f106bf0b63068eaabbdc088ca70449f" ], "author": { "name": "Benjamin Poirier", "email": "bpoirier@suse.de", "time": "Tue Jan 07 10:11:10 2014 -0500" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:45 2014 +0800" }, "message": "net: Do not enable tx-nocache-copy by default\n\ncommit cdb3f4a31b64c3a1c6eef40bc01ebc9594c58a8c upstream.\n\nThere are many cases where this feature does not improve performance or even\nreduces it.\n\nFor example, here are the results from tests that I\u0027ve run using 3.12.6 on one\nIntel Xeon W3565 and one i7 920 connected by ixgbe adapters. The results are\nfrom the Xeon, but they\u0027re similar on the i7. All numbers report the\nmean±stddev over 10 runs of 10s.\n\n1) latency tests similar to what is described in \"c6e1a0d net: Allow no-cache\ncopy from user on transmit\"\nThere is no statistically significant difference between tx-nocache-copy\non/off.\nnic irqs spread out (one queue per cpu)\n\n200x netperf -r 1400,1\ntx-nocache-copy off\n 692000±1000 tps\n 50/90/95/99% latency (us): 275±2/643.8±0.4/799±1/2474.4±0.3\ntx-nocache-copy on\n 693000±1000 tps\n 50/90/95/99% latency (us): 274±1/644.1±0.7/800±2/2474.5±0.7\n\n200x netperf -r 14000,14000\ntx-nocache-copy off\n 86450±80 tps\n 50/90/95/99% latency (us): 334.37±0.02/838±1/2100±20/3990±40\ntx-nocache-copy on\n 86110±60 tps\n 50/90/95/99% latency (us): 334.28±0.01/837±2/2110±20/3990±20\n\n2) single stream throughput tests\ntx-nocache-copy leads to higher service demand\n\n throughput cpu0 cpu1 demand\n (Gb/s) (Gcycle) (Gcycle) (cycle/B)\n\nnic irqs and netperf on cpu0 (1x netperf -T0,0 -t omni -- -d send)\n\ntx-nocache-copy off 9402±5 9.4±0.2 0.80±0.01\ntx-nocache-copy on 9403±3 9.85±0.04 0.838±0.004\n\nnic irqs on cpu0, netperf on cpu1 (1x netperf -T1,1 -t omni -- -d send)\n\ntx-nocache-copy off 9401±5 5.83±0.03 5.0±0.1 0.923±0.007\ntx-nocache-copy on 9404±2 5.74±0.03 5.523±0.009 0.958±0.002\n\nAs a second example, here are some results from Eric Dumazet with latest\nnet-next.\ntx-nocache-copy also leads to higher service demand\n\n(cpu is Intel(R) Xeon(R) CPU X5660 @ 2.80GHz)\n\nlpq83:~# ./ethtool -K eth0 tx-nocache-copy on\nlpq83:~# perf stat ./netperf -H lpq84 -c\nMIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to lpq84.prod.google.com () port 0 AF_INET\nRecv Send Send Utilization Service Demand\nSocket Socket Message Elapsed Send Recv Send Recv\nSize Size Size Time Throughput local remote local remote\nbytes bytes bytes secs. 10^6bits/s % S % U us/KB us/KB\n\n 87380 16384 16384 10.00 9407.44 2.50 -1.00 0.522 -1.000\n\n Performance counter stats for \u0027./netperf -H lpq84 -c\u0027:\n\n 4282.648396 task-clock # 0.423 CPUs utilized\n 9,348 context-switches # 0.002 M/sec\n 88 CPU-migrations # 0.021 K/sec\n 355 page-faults # 0.083 K/sec\n 11,812,797,651 cycles # 2.758 GHz [82.79%]\n 9,020,522,817 stalled-cycles-frontend # 76.36% frontend cycles idle [82.54%]\n 4,579,889,681 stalled-cycles-backend # 38.77% backend cycles idle [67.33%]\n 6,053,172,792 instructions # 0.51 insns per cycle\n # 1.49 stalled cycles per insn [83.64%]\n 597,275,583 branches # 139.464 M/sec [83.70%]\n 8,960,541 branch-misses # 1.50% of all branches [83.65%]\n\n 10.128990264 seconds time elapsed\n\nlpq83:~# ./ethtool -K eth0 tx-nocache-copy off\nlpq83:~# perf stat ./netperf -H lpq84 -c\nMIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to lpq84.prod.google.com () port 0 AF_INET\nRecv Send Send Utilization Service Demand\nSocket Socket Message Elapsed Send Recv Send Recv\nSize Size Size Time Throughput local remote local remote\nbytes bytes bytes secs. 10^6bits/s % S % U us/KB us/KB\n\n 87380 16384 16384 10.00 9412.45 2.15 -1.00 0.449 -1.000\n\n Performance counter stats for \u0027./netperf -H lpq84 -c\u0027:\n\n 2847.375441 task-clock # 0.281 CPUs utilized\n 11,632 context-switches # 0.004 M/sec\n 49 CPU-migrations # 0.017 K/sec\n 354 page-faults # 0.124 K/sec\n 7,646,889,749 cycles # 2.686 GHz [83.34%]\n 6,115,050,032 stalled-cycles-frontend # 79.97% frontend cycles idle [83.31%]\n 1,726,460,071 stalled-cycles-backend # 22.58% backend cycles idle [66.55%]\n 2,079,702,453 instructions # 0.27 insns per cycle\n # 2.94 stalled cycles per insn [83.22%]\n 363,773,213 branches # 127.757 M/sec [83.29%]\n 4,242,732 branch-misses # 1.17% of all branches [83.51%]\n\n 10.128449949 seconds time elapsed\n\nCC: Tom Herbert \u003ctherbert@google.com\u003e\nSigned-off-by: Benjamin Poirier \u003cbpoirier@suse.de\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "c58038a16f106bf0b63068eaabbdc088ca70449f", "tree": "06a47affacebe831eed7f449a4825279ff3fad8a", "parents": [ "4b7f15c26a453b1aa19965d515476700b8faaa0e" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Fri Feb 21 02:55:35 2014 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:44 2014 +0800" }, "message": "ipv6: reuse ip6_frag_id from ip6_ufo_append_data\n\ncommit 916e4cf46d0204806c062c8c6c4d1f633852c5b6 upstream.\n\nCurrently we generate a new fragmentation id on UFO segmentation. It\nis pretty hairy to identify the correct net namespace and dst there.\nEspecially tunnels use IFF_XMIT_DST_RELEASE and thus have no skb_dst\navailable at all.\n\nThis causes unreliable or very predictable ipv6 fragmentation id\ngeneration while segmentation.\n\nLuckily we already have pregenerated the ip6_frag_id in\nip6_ufo_append_data and can use it here.\n\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n[bwh: Backported to 3.2: adjust filename, indentation]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "4b7f15c26a453b1aa19965d515476700b8faaa0e", "tree": "4dfb3adb411b2c25a4f363f2c6e82ecd2039032c", "parents": [ "50f1b3d5a47088a67176ae72ffefda3e25873cf8" ], "author": { "name": "Ben Hutchings", "email": "ben@decadent.org.uk", "time": "Sat Apr 19 14:36:43 2014 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:44 2014 +0800" }, "message": "rtl8192ce: Fix null dereference in watchdog\n\nDmitry Semyonov reported that after upgrading from 3.2.54 to\n3.2.57 the rtl8192ce driver will crash when its interface is brought\nup. The oops message shows:\n\n[ 1833.611397] BUG: unable to handle kernel NULL pointer dereference at 0000000000000010\n[ 1833.611455] IP: [\u003cffffffffa0410c6a\u003e] rtl92ce_update_hal_rate_tbl+0x29/0x4db [rtl8192ce]\n...\n[ 1833.613326] Call Trace:\n[ 1833.613346] [\u003cffffffffa02ad9c6\u003e] ? rtl92c_dm_watchdog+0xd0b/0xec9 [rtl8192c_common]\n[ 1833.613391] [\u003cffffffff8105b5cf\u003e] ? process_one_work+0x161/0x269\n[ 1833.613425] [\u003cffffffff8105c598\u003e] ? worker_thread+0xc2/0x145\n[ 1833.613458] [\u003cffffffff8105c4d6\u003e] ? manage_workers.isra.25+0x15b/0x15b\n[ 1833.613496] [\u003cffffffff8105f6d9\u003e] ? kthread+0x76/0x7e\n[ 1833.613527] [\u003cffffffff81356b74\u003e] ? kernel_thread_helper+0x4/0x10\n[ 1833.613563] [\u003cffffffff8105f663\u003e] ? kthread_worker_fn+0x139/0x139\n[ 1833.613598] [\u003cffffffff81356b70\u003e] ? gs_change+0x13/0x13\n\nDisassembly of rtl92ce_update_hal_rate_tbl() shows that the \u0027sta\u0027\nparameter was null. None of the changes to the rtlwifi family between\n3.2.54 and 3.2.57 seem to directly cause this, and reverting commit\nf78bccd79ba3 (\u0027rtlwifi: rtl8192ce: Fix too long disable of IRQs\u0027)\ndoesn\u0027t fix it.\n\nrtl92c_dm_watchdog() calls rtl92ce_update_hal_rate_tbl() via\nrtl92c_dm_refresh_rate_adaptive_mask(), which does not appear in the\ncall trace as it was inlined. That function has been completely\nremoved upstream which may explain why this crash wasn\u0027t seen there.\n\nI\u0027m not sure that it is sensible to completely remove\nrtl92c_dm_refresh_rate_adaptive_mask() without making other\ncompensating changes elsewhere, so try to work around this for 3.2 by\nchecking for a null pointer in rtl92c_dm_refresh_rate_adaptive_mask()\nand then skipping the call to rtl92ce_update_hal_rate_tbl().\n\nReferences: https://bugs.debian.org/745137\nReferences: https://bugs.debian.org/745462\nReported-by: Dmitry Semyonov \u003clinulin@gmail.com\u003e\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Larry Finger \u003cLarry.Finger@lwfinger.net\u003e\nCc: Chaoming Li \u003cchaoming_li@realsil.com.cn\u003e\nCc: Satoshi IWAMOTO \u003csatoshi.iwamoto@nifty.ne.jp\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "50f1b3d5a47088a67176ae72ffefda3e25873cf8", "tree": "3bf878427cabd4934ce51a68e40382ec935a6c29", "parents": [ "b54ca6089908121df8ea66545520c08048db7d80" ], "author": { "name": "Marcelo Ricardo Leitner", "email": "mleitner@redhat.com", "time": "Mon Oct 13 14:03:30 2014 -0300" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:44 2014 +0800" }, "message": "ipv4: disable bh while doing route gc\n\nFurther tests revealed that after moving the garbage collector to a work\nqueue and protecting it with a spinlock may leave the system prone to\nsoft lockups if bottom half gets very busy.\n\nIt was reproced with a set of firewall rules that REJECTed packets. If\nthe NIC bottom half handler ends up running on the same CPU that is\nrunning the garbage collector on a very large cache, the garbage\ncollector will not be able to do its job due to the amount of work\nneeded for handling the REJECTs and also won\u0027t reschedule.\n\nThe fix is to disable bottom half during the garbage collecting, as it\nalready was in the first place (most calls to it came from softirqs).\n\nSigned-off-by: Marcelo Ricardo Leitner \u003cmleitner@redhat.com\u003e\nAcked-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nAcked-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "b54ca6089908121df8ea66545520c08048db7d80", "tree": "686c02914c94f0349584aab29b6d510074dcba1b", "parents": [ "b6153ead0de0592c14333a9d39b05bb92a3949b3" ], "author": { "name": "Marcelo Ricardo Leitner", "email": "mleitner@redhat.com", "time": "Thu Aug 14 16:44:53 2014 -0300" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:44 2014 +0800" }, "message": "ipv4: avoid parallel route cache gc executions\n\nWhen rt_intern_hash() has to deal with neighbour cache overflowing,\nit triggers the route cache garbage collector in an attempt to free\nsome references on neighbour entries.\n\nSuch call cannot be done async but should also not run in parallel with\nan already-running one, so that they don\u0027t collapse fighting over the\nhash lock entries.\n\nThis patch thus blocks parallel executions with spinlocks:\n- A call from worker and from rt_intern_hash() are not the same, and\ncannot be merged, thus they will wait each other on rt_gc_lock.\n- Calls to gc from rt_intern_hash() may happen in parallel but we must\nwait for it to finish in order to try again. This dedup and\nsynchrinozation is then performed by the locking just before calling\n__do_rt_garbage_collect().\n\nSigned-off-by: Marcelo Ricardo Leitner \u003cmleitner@redhat.com\u003e\nAcked-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "b6153ead0de0592c14333a9d39b05bb92a3949b3", "tree": "b3d14258bfba50ac55912c6d9c98058ed6050eec", "parents": [ "23dd72fe868c722983999aaf13fa4ede1642a322" ], "author": { "name": "Marcelo Ricardo Leitner", "email": "mleitner@redhat.com", "time": "Thu Aug 14 16:44:52 2014 -0300" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:43 2014 +0800" }, "message": "ipv4: move route garbage collector to work queue\n\nCurrently the route garbage collector gets called by dst_alloc() if it\nhave more entries than the threshold. But it\u0027s an expensive call, that\ndon\u0027t really need to be done by then.\n\nAnother issue with current way is that it allows running the garbage\ncollector with the same start parameters on multiple CPUs at once, which\nis not optimal. A system may even soft lockup if the cache is big enough\nas the garbage collectors will be fighting over the hash lock entries.\n\nThis patch thus moves the garbage collector to run asynchronously on a\nwork queue, much similar to how rt_expire_check runs.\n\nThere is one condition left that allows multiple executions, which is\nhandled by the next patch.\n\nSigned-off-by: Marcelo Ricardo Leitner \u003cmleitner@redhat.com\u003e\nAcked-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "23dd72fe868c722983999aaf13fa4ede1642a322", "tree": "df2eb262d71e6a8839770cc14ef4f9d8a8246e1e", "parents": [ "be73621bd21353b97ba55fb5ad9b4c35aa09271a" ], "author": { "name": "James Bottomley", "email": "JBottomley@Parallels.com", "time": "Fri Mar 28 10:50:17 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:43 2014 +0800" }, "message": "Fix spurious request sense in error handling\n\ncommit d555a2abf3481f81303d835046a5ec2c4fb3ca8e upstream.\n\nWe unconditionally execute scsi_eh_get_sense() to make sure all failed\ncommands that should have sense attached, do. However, the routine forgets\nthat some commands, because of the way they fail, will not have any sense code\n... we should not bother them with a REQUEST_SENSE command. Fix this by\ntesting to see if we actually got a CHECK_CONDITION return and skip asking for\nsense if we don\u0027t.\n\nTested-by: Alan Stern \u003cstern@rowland.harvard.edu\u003e\nSigned-off-by: James Bottomley \u003cJBottomley@Parallels.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "be73621bd21353b97ba55fb5ad9b4c35aa09271a", "tree": "445b9b3aedb2a36af450d3a923a5b76847035047", "parents": [ "b47d65db8f8e765ef0267d13681c9bf12a148fb5" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Thu Aug 28 11:09:31 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:43 2014 +0800" }, "message": "dm crypt: fix access beyond the end of allocated space\n\ncommit d49ec52ff6ddcda178fc2476a109cf1bd1fa19ed upstream.\n\nThe DM crypt target accesses memory beyond allocated space resulting in\na crash on 32 bit x86 systems.\n\nThis bug is very old (it dates back to 2.6.25 commit 3a7f6c990ad04 \"dm\ncrypt: use async crypto\"). However, this bug was masked by the fact\nthat kmalloc rounds the size up to the next power of two. This bug\nwasn\u0027t exposed until 3.17-rc1 commit 298a9fa08a (\"dm crypt: use per-bio\ndata\"). By switching to using per-bio data there was no longer any\npadding beyond the end of a dm-crypt allocated memory block.\n\nTo minimize allocation overhead dm-crypt puts several structures into one\nblock allocated with kmalloc. The block holds struct ablkcipher_request,\ncipher-specific scratch pad (crypto_ablkcipher_reqsize(any_tfm(cc))),\nstruct dm_crypt_request and an initialization vector.\n\nThe variable dmreq_start is set to offset of struct dm_crypt_request\nwithin this memory block. dm-crypt allocates the block with this size:\ncc-\u003edmreq_start + sizeof(struct dm_crypt_request) + cc-\u003eiv_size.\n\nWhen accessing the initialization vector, dm-crypt uses the function\niv_of_dmreq, which performs this calculation: ALIGN((unsigned long)(dmreq\n+ 1), crypto_ablkcipher_alignmask(any_tfm(cc)) + 1).\n\ndm-crypt allocated \"cc-\u003eiv_size\" bytes beyond the end of dm_crypt_request\nstructure. However, when dm-crypt accesses the initialization vector, it\ntakes a pointer to the end of dm_crypt_request, aligns it, and then uses\nit as the initialization vector. If the end of dm_crypt_request is not\naligned on a crypto_ablkcipher_alignmask(any_tfm(cc)) boundary the\nalignment causes the initialization vector to point beyond the allocated\nspace.\n\nFix this bug by calculating the variable iv_size_padding and adding it\nto the allocated size.\n\nAlso correct the alignment of dm_crypt_request. struct dm_crypt_request\nis specific to dm-crypt (it isn\u0027t used by the crypto subsystem at all),\nso it is aligned on __alignof__(struct dm_crypt_request).\n\nAlso align per_bio_data_size on ARCH_KMALLOC_MINALIGN, so that it is\naligned as if the block was allocated with kmalloc.\n\nReported-by: Krzysztof Kolasa \u003ckkolasa@winsoft.pl\u003e\nTested-by: Milan Broz \u003cgmazyland@gmail.com\u003e\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\n[lizf: Backported by Mikulas]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "b47d65db8f8e765ef0267d13681c9bf12a148fb5", "tree": "bae1470ac9ca843e700bbf3a6008f179c377dbe8", "parents": [ "ae552f6b54840fc7fb7a7ee688632b55e7eb9cef" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Mon Jul 28 16:26:53 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:42 2014 +0800" }, "message": "mnt: Only change user settable mount flags in remount\n\ncommit a6138db815df5ee542d848318e5dae681590fccd upstream.\n\nKenton Varda \u003ckenton@sandstorm.io\u003e discovered that by remounting a\nread-only bind mount read-only in a user namespace the\nMNT_LOCK_READONLY bit would be cleared, allowing an unprivileged user\nto the remount a read-only mount read-write.\n\nCorrect this by replacing the mask of mount flags to preserve\nwith a mask of mount flags that may be changed, and preserve\nall others. This ensures that any future bugs with this mask and\nremount will fail in an easy to detect way where new mount flags\nsimply won\u0027t change.\n\nAcked-by: Serge E. Hallyn \u003cserge.hallyn@ubuntu.com\u003e\nSigned-off-by: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: Francis Moreau \u003cfrancis.moro@gmail.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "ae552f6b54840fc7fb7a7ee688632b55e7eb9cef", "tree": "15a41fb40bde267fc8ebddc02797b932c1efa44c", "parents": [ "2f1eef27008bd0abf9879e51a74fb9d0418634e8" ], "author": { "name": "Felipe Balbi", "email": "balbi@ti.com", "time": "Wed Apr 23 09:58:26 2014 -0500" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:42 2014 +0800" }, "message": "bluetooth: hci_ldisc: fix deadlock condition\n\ncommit da64c27d3c93ee9f89956b9de86c4127eb244494 upstream.\n\nLDISCs shouldn\u0027t call tty-\u003eops-\u003ewrite() from within\n-\u003ewrite_wakeup().\n\n-\u003ewrite_wakeup() is called with port lock taken and\nIRQs disabled, tty-\u003eops-\u003ewrite() will try to acquire\nthe same port lock and we will deadlock.\n\nAcked-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nReviewed-by: Peter Hurley \u003cpeter@hurleysoftware.com\u003e\nReported-by: Huang Shijie \u003cb32955@freescale.com\u003e\nSigned-off-by: Felipe Balbi \u003cbalbi@ti.com\u003e\nTested-by: Andreas Bießmann \u003candreas@biessmann.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n[tim.niemeyer@corscience.de: rebased on 3.4.103]\nSigned-off-by: Tim Niemeyer \u003ctim.niemeyer@corscience.de\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "2f1eef27008bd0abf9879e51a74fb9d0418634e8", "tree": "363bbc5f67cd1ec1305010bd0a32e7f7093b8746", "parents": [ "69724a603fc759242348f931068b97c6634e40f9" ], "author": { "name": "Pawel Moll", "email": "pawel.moll@arm.com", "time": "Fri Jun 13 16:03:32 2014 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:42 2014 +0800" }, "message": "perf: Handle compat ioctl\n\ncommit b3f207855f57b9c8f43a547a801340bb5cbc59e5 upstream.\n\nWhen running a 32-bit userspace on a 64-bit kernel (eg. i386\napplication on x86_64 kernel or 32-bit arm userspace on arm64\nkernel) some of the perf ioctls must be treated with special\ncare, as they have a pointer size encoded in the command.\n\nFor example, PERF_EVENT_IOC_ID in 32-bit world will be encoded\nas 0x80042407, but 64-bit kernel will expect 0x80082407. In\nresult the ioctl will fail returning -ENOTTY.\n\nThis patch solves the problem by adding code fixing up the\nsize as compat_ioctl file operation.\n\nReported-by: Drew Richardson \u003cdrew.richardson@arm.com\u003e\nSigned-off-by: Pawel Moll \u003cpawel.moll@arm.com\u003e\nSigned-off-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Arnaldo Carvalho de Melo \u003cacme@kernel.org\u003e\nCc: Jiri Olsa \u003cjolsa@redhat.com\u003e\nLink: http://lkml.kernel.org/r/1402671812-9078-1-git-send-email-pawel.moll@arm.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: David Ahern \u003cdsahern@gmail.com\u003e\n[lizf: Backported to 3.4 by David Ahern]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "69724a603fc759242348f931068b97c6634e40f9", "tree": "ee1494d332a6b706006658789135a62068101469", "parents": [ "efdbbff6f413513eb11aaa7bce3b289faee88f29" ], "author": { "name": "Sergio Gelato", "email": "Sergio.Gelato@astro.su.se", "time": "Fri Oct 10 22:46:36 2014 +0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:42 2014 +0800" }, "message": "NFS: fix stable regression\n\nBugLink: http://bugs.launchpad.net/bugs/1348670\n\nFix regression introduced in pre-3.14 kernels by cherry-picking\naa07c713ecfc0522916f3cd57ac628ea6127c0ec\n(NFSD: Call -\u003eset_acl with a NULL ACL structure if no entries).\n\nThe affected code was removed in 3.14 by commit\n4ac7249ea5a0ceef9f8269f63f33cc873c3fac61\n(nfsd: use get_acl and -\u003eset_acl).\nThe -\u003eset_acl methods are already able to cope with a NULL argument.\n\nSigned-off-by: Sergio Gelato \u003cSergio.Gelato@astro.su.se\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "efdbbff6f413513eb11aaa7bce3b289faee88f29", "tree": "6d43fb009b3b2e68ef2e13815478a274e0e97ff8", "parents": [ "df22b9ebd5c3b63bfb2582470b53771bf276f252" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Wed Sep 03 09:33:00 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:41 2014 +0800" }, "message": "ext4: avoid trying to kfree an ERR_PTR pointer\n\ncommit a9cfcd63e8d206ce4235c355d857c4fbdf0f4587 upstream.\n\nThanks to Dan Carpenter for extending smatch to find bugs like this.\n(This was found using a development version of smatch.)\n\nFixes: 36de928641ee48b2078d3fe9514242aaa2f92013\nReported-by: Dan Carpenter \u003cdan.carpenter@oracle.com\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\n[lizf: Backported to 3.4:\n- s/new.bh/new_bh/\n- drop the change to ext4_cross_rename()]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "df22b9ebd5c3b63bfb2582470b53771bf276f252", "tree": "be6647d8b44023474cd11eba135a6c5bfce9cf03", "parents": [ "50d6b91ac79a7ca600f62dbd917dec65e7751c85" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Sat Aug 23 17:47:19 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:41 2014 +0800" }, "message": "ext4: propagate errors up to ext4_find_entry()\u0027s callers\n\ncommit 36de928641ee48b2078d3fe9514242aaa2f92013 upstream.\n\nIf we run into some kind of error, such as ENOMEM, while calling\next4_getblk() or ext4_dx_find_entry(), we need to make sure this error\ngets propagated up to ext4_find_entry() and then to its callers. This\nway, transient errors such as ENOMEM can get propagated to the VFS.\nThis is important so that the system calls return the appropriate\nerror, and also so that in the case of ext4_lookup(), we return an\nerror instead of a NULL inode, since that will result in a negative\ndentry cache entry that will stick around long past the OOM condition\nwhich caused a transient ENOMEM error.\n\nGoogle-Bug-Id: #17142205\n\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\n[lizf: Backported to 3.4:\n- adjust context\n- s/old.bh/old_bh/g\n- s/new.bh/new_bh/g\n- drop the changes to ext4_find_delete_entry() and ext4_cross_rename()\n- add return value check for one more exr4_find_entry() in ext4_rename()]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "50d6b91ac79a7ca600f62dbd917dec65e7751c85", "tree": "bd909c2f453c8e8febcb41f7f908814d7eda0cf1", "parents": [ "62db31b50ea97524defc93b74a851e6d7ca864ed" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Wed Jul 30 14:55:26 2014 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:41 2014 +0800" }, "message": "nl80211: clear skb cb before passing to netlink\n\ncommit bd8c78e78d5011d8111bc2533ee73b13a3bd6c42 upstream.\n\nIn testmode and vendor command reply/event SKBs we use the\nskb cb data to store nl80211 parameters between allocation\nand sending. This causes the code for CONFIG_NETLINK_MMAP\nto get confused, because it takes ownership of the skb cb\ndata when the SKB is handed off to netlink, and it doesn\u0027t\nexplicitly clear it.\n\nClear the skb cb explicitly when we\u0027re done and before it\ngets passed to netlink to avoid this issue.\n\nReported-by: Assaf Azulay \u003cassaf.azulay@intel.com\u003e\nReported-by: David Spinadel \u003cdavid.spinadel@intel.com\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "62db31b50ea97524defc93b74a851e6d7ca864ed", "tree": "8d499e801fcce592920be8d578929e7cbfd61fed", "parents": [ "48dd9ce77c7e5e4f4ad5be567bf0b939bbfb7872" ], "author": { "name": "Jens Axboe", "email": "axboe@fb.com", "time": "Tue Sep 16 13:38:51 2014 -0600" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:41 2014 +0800" }, "message": "genhd: fix leftover might_sleep() in blk_free_devt()\n\ncommit 46f341ffcfb5d8530f7d1e60f3be06cce6661b62 upstream.\n\nCommit 2da78092 changed the locking from a mutex to a spinlock,\nso we now longer sleep in this context. But there was a leftover\nmight_sleep() in there, which now triggers since we do the final\nfree from an RCU callback. Get rid of it.\n\nReported-by: Pontus Fuchs \u003cpontus.fuchs@gmail.com\u003e\nSigned-off-by: Jens Axboe \u003caxboe@fb.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "48dd9ce77c7e5e4f4ad5be567bf0b939bbfb7872", "tree": "56cadac5006ba46a4b51c669242862124f6b2b8e", "parents": [ "232beb6ef710cf53def84d01276f59766b62756e" ], "author": { "name": "Josh Triplett", "email": "josh@joshtriplett.org", "time": "Fri Oct 03 16:00:54 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:40 2014 +0800" }, "message": "init/Kconfig: Hide printk log config if CONFIG_PRINTK\u003dn\n\ncommit 361e9dfbaae84b0b246ed18d1ab7c82a1a41b53e upstream.\n\nThe buffers sized by CONFIG_LOG_BUF_SHIFT and\nCONFIG_LOG_CPU_MAX_BUF_SHIFT do not exist if CONFIG_PRINTK\u003dn, so don\u0027t\nask about their size at all.\n\nSigned-off-by: Josh Triplett \u003cjosh@joshtriplett.org\u003e\nAcked-by: Randy Dunlap \u003crdunlap@infradead.org\u003e\n[lizf: Backported to 3.4:\n - drop the change to CONFIG_LOG_CPU_MAX_BUF_SHIFT as it doesn\u0027t exist in 3.4]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "232beb6ef710cf53def84d01276f59766b62756e", "tree": "25de72e5898ba09f9a0ad97743e1aa47f8f3df18", "parents": [ "ea38cd4170bdf0aa767d04df8363d08d5cc45dd2" ], "author": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Thu Oct 02 16:17:02 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:40 2014 +0800" }, "message": "perf: fix perf bug in fork()\n\ncommit 6c72e3501d0d62fc064d3680e5234f3463ec5a86 upstream.\n\nOleg noticed that a cleanup by Sylvain actually uncovered a bug; by\ncalling perf_event_free_task() when failing sched_fork() we will not yet\nhave done the memset() on -\u003eperf_event_ctxp[] and will therefore try and\n\u0027free\u0027 the inherited contexts, which are still in use by the parent\nprocess. This is bad..\n\nSuggested-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nReported-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nReported-by: Sylvain \u0027ythier\u0027 Hitier \u003csylvain.hitier@gmail.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "ea38cd4170bdf0aa767d04df8363d08d5cc45dd2", "tree": "d3e20c5f3459264af1cc20ae4258265c853b84c2", "parents": [ "e5b741351f667d05dd8be1a297202682d0cb4969" ], "author": { "name": "Mel Gorman", "email": "mgorman@suse.de", "time": "Thu Oct 02 19:47:41 2014 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:40 2014 +0800" }, "message": "mm: migrate: Close race between migration completion and mprotect\n\ncommit d3cb8bf6081b8b7a2dabb1264fe968fd870fa595 upstream.\n\nA migration entry is marked as write if pte_write was true at the time the\nentry was created. The VMA protections are not double checked when migration\nentries are being removed as mprotect marks write-migration-entries as\nread. It means that potentially we take a spurious fault to mark PTEs write\nagain but it\u0027s straight-forward. However, there is a race between write\nmigrations being marked read and migrations finishing. This potentially\nallows a PTE to be write that should have been read. Close this race by\ndouble checking the VMA permissions using maybe_mkwrite when migration\ncompletes.\n\n[torvalds@linux-foundation.org: use maybe_mkwrite]\nSigned-off-by: Mel Gorman \u003cmgorman@suse.de\u003e\nAcked-by: Rik van Riel \u003criel@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "e5b741351f667d05dd8be1a297202682d0cb4969", "tree": "020a27d45c07f48583b14d388187a49b878ab22e", "parents": [ "3efcfa5433a7c6ff5e04489398b1d7434f51b733" ], "author": { "name": "Xiubo Li", "email": "Li.Xiubo@freescale.com", "time": "Sun Sep 28 17:29:37 2014 +0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:39 2014 +0800" }, "message": "ASoC: core: fix possible ZERO_SIZE_PTR pointer dereferencing error.\n\ncommit 6596aa047b624aeec2ea321962cfdecf9953a383 upstream.\n\nSince we cannot make sure the \u0027params-\u003enum_regs\u0027 will always be none\nzero here, and then if it equals to zero, the kmemdup() will return\nZERO_SIZE_PTR, which equals to ((void *)16).\n\nSo this patch fix this with just doing the zero check before calling\nkmemdup().\n\nSigned-off-by: Xiubo Li \u003cLi.Xiubo@freescale.com\u003e\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "3efcfa5433a7c6ff5e04489398b1d7434f51b733", "tree": "1c027c72d9404081209070c1b3d355ed7c2020c1", "parents": [ "8c3c6b9ee4d81b84b19dd07cb46d99fbf33850ab" ], "author": { "name": "Robin Murphy", "email": "robin.murphy@arm.com", "time": "Thu Sep 25 11:56:19 2014 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:39 2014 +0800" }, "message": "ARM: 8165/1: alignment: don\u0027t break misaligned NEON load/store\n\ncommit 5ca918e5e3f9df4634077c06585c42bc6a8d699a upstream.\n\nThe alignment fixup incorrectly decodes faulting ARM VLDn/VSTn\ninstructions (where the optional alignment hint is given but incorrect)\nas LDR/STR, leading to register corruption. Detect these and correctly\ntreat them as unhandled, so that userspace gets the fault it expects.\n\nReported-by: Simon Hosie \u003csimon.hosie@arm.com\u003e\nSigned-off-by: Robin Murphy \u003crobin.murphy@arm.com\u003e\nSigned-off-by: Russell King \u003crmk+kernel@arm.linux.org.uk\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "8c3c6b9ee4d81b84b19dd07cb46d99fbf33850ab", "tree": "d7a03f5f8be55dbe5728cf0f1a805ed5f92ae32b", "parents": [ "8b4675102596aa0f550fd7c32b9ed576b30e020a" ], "author": { "name": "Miklos Szeredi", "email": "mszeredi@suse.cz", "time": "Wed Sep 24 17:56:17 2014 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:39 2014 +0800" }, "message": "shmem: fix nlink for rename overwrite directory\n\ncommit b928095b0a7cff7fb9fcf4c706348ceb8ab2c295 upstream.\n\nIf overwriting an empty directory with rename, then need to drop the extra\nnlink.\n\nTest prog:\n\n#include \u003cstdio.h\u003e\n#include \u003cfcntl.h\u003e\n#include \u003cerr.h\u003e\n#include \u003csys/stat.h\u003e\n\nint main(void)\n{\n\tconst char *test_dir1 \u003d \"test-dir1\";\n\tconst char *test_dir2 \u003d \"test-dir2\";\n\tint res;\n\tint fd;\n\tstruct stat statbuf;\n\n\tres \u003d mkdir(test_dir1, 0777);\n\tif (res \u003d\u003d -1)\n\t\terr(1, \"mkdir(\\\"%s\\\")\", test_dir1);\n\n\tres \u003d mkdir(test_dir2, 0777);\n\tif (res \u003d\u003d -1)\n\t\terr(1, \"mkdir(\\\"%s\\\")\", test_dir2);\n\n\tfd \u003d open(test_dir2, O_RDONLY);\n\tif (fd \u003d\u003d -1)\n\t\terr(1, \"open(\\\"%s\\\")\", test_dir2);\n\n\tres \u003d rename(test_dir1, test_dir2);\n\tif (res \u003d\u003d -1)\n\t\terr(1, \"rename(\\\"%s\\\", \\\"%s\\\")\", test_dir1, test_dir2);\n\n\tres \u003d fstat(fd, \u0026statbuf);\n\tif (res \u003d\u003d -1)\n\t\terr(1, \"fstat(%i)\", fd);\n\n\tif (statbuf.st_nlink !\u003d 0) {\n\t\tfprintf(stderr, \"nlink is %lu, should be 0\\n\", statbuf.st_nlink);\n\t\treturn 1;\n\t}\n\n\treturn 0;\n}\n\nSigned-off-by: Miklos Szeredi \u003cmszeredi@suse.cz\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "8b4675102596aa0f550fd7c32b9ed576b30e020a", "tree": "e0b3a9abce7cc70bd839a12601cf76fc57595bb0", "parents": [ "78d8eefded616224fc40ba2f9269bb53b7e6604e" ], "author": { "name": "Joseph Qi", "email": "joseph.qi@huawei.com", "time": "Thu Sep 25 16:05:16 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:39 2014 +0800" }, "message": "ocfs2/dlm: do not get resource spinlock if lockres is new\n\ncommit 5760a97c7143c208fa3a8f8cad0ed7dd672ebd28 upstream.\n\nThere is a deadlock case which reported by Guozhonghua:\n https://oss.oracle.com/pipermail/ocfs2-devel/2014-September/010079.html\n\nThis case is caused by \u0026res-\u003espinlock and \u0026dlm-\u003emaster_lock\nmisordering in different threads.\n\nIt was introduced by commit 8d400b81cc83 (\"ocfs2/dlm: Clean up refmap\nhelpers\"). Since lockres is new, it doesn\u0027t not require the\n\u0026res-\u003espinlock. So remove it.\n\nFixes: 8d400b81cc83 (\"ocfs2/dlm: Clean up refmap helpers\")\nSigned-off-by: Joseph Qi \u003cjoseph.qi@huawei.com\u003e\nReviewed-by: joyce.xue \u003cxuejiufei@huawei.com\u003e\nReported-by: Guozhonghua \u003cguozhonghua@h3c.com\u003e\nCc: Joel Becker \u003cjlbec@evilplan.org\u003e\nCc: Mark Fasheh \u003cmfasheh@suse.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "78d8eefded616224fc40ba2f9269bb53b7e6604e", "tree": "065b9945fc4e96b508fa5d8270f4fe335b4afb9e", "parents": [ "504c4611c9da8b2cade4a45a31376293a4d53ed1" ], "author": { "name": "Andreas Rohner", "email": "andreas.rohner@gmx.net", "time": "Thu Sep 25 16:05:14 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:38 2014 +0800" }, "message": "nilfs2: fix data loss with mmap()\n\ncommit 56d7acc792c0d98f38f22058671ee715ff197023 upstream.\n\nThis bug leads to reproducible silent data loss, despite the use of\nmsync(), sync() and a clean unmount of the file system. It is easily\nreproducible with the following script:\n\n ----------------[BEGIN SCRIPT]--------------------\n mkfs.nilfs2 -f /dev/sdb\n mount /dev/sdb /mnt\n\n dd if\u003d/dev/zero bs\u003d1M count\u003d30 of\u003d/mnt/testfile\n\n umount /mnt\n mount /dev/sdb /mnt\n CHECKSUM_BEFORE\u003d\"$(md5sum /mnt/testfile)\"\n\n /root/mmaptest/mmaptest /mnt/testfile 30 10 5\n\n sync\n CHECKSUM_AFTER\u003d\"$(md5sum /mnt/testfile)\"\n umount /mnt\n mount /dev/sdb /mnt\n CHECKSUM_AFTER_REMOUNT\u003d\"$(md5sum /mnt/testfile)\"\n umount /mnt\n\n echo \"BEFORE MMAP:\\t$CHECKSUM_BEFORE\"\n echo \"AFTER MMAP:\\t$CHECKSUM_AFTER\"\n echo \"AFTER REMOUNT:\\t$CHECKSUM_AFTER_REMOUNT\"\n ----------------[END SCRIPT]--------------------\n\nThe mmaptest tool looks something like this (very simplified, with\nerror checking removed):\n\n ----------------[BEGIN mmaptest]--------------------\n data \u003d mmap(NULL, file_size - file_offset, PROT_READ | PROT_WRITE,\n MAP_SHARED, fd, file_offset);\n\n for (i \u003d 0; i \u003c write_count; ++i) {\n memcpy(data + i * 4096, buf, sizeof(buf));\n msync(data, file_size - file_offset, MS_SYNC))\n }\n ----------------[END mmaptest]--------------------\n\nThe output of the script looks something like this:\n\n BEFORE MMAP: 281ed1d5ae50e8419f9b978aab16de83 /mnt/testfile\n AFTER MMAP: 6604a1c31f10780331a6850371b3a313 /mnt/testfile\n AFTER REMOUNT: 281ed1d5ae50e8419f9b978aab16de83 /mnt/testfile\n\nSo it is clear, that the changes done using mmap() do not survive a\nremount. This can be reproduced a 100% of the time. The problem was\nintroduced in commit 136e8770cd5d (\"nilfs2: fix issue of\nnilfs_set_page_dirty() for page at EOF boundary\").\n\nIf the page was read with mpage_readpage() or mpage_readpages() for\nexample, then it has no buffers attached to it. In that case\npage_has_buffers(page) in nilfs_set_page_dirty() will be false.\nTherefore nilfs_set_file_dirty() is never called and the pages are never\ncollected and never written to disk.\n\nThis patch fixes the problem by also calling nilfs_set_file_dirty() if the\npage has no buffers attached to it.\n\n[akpm@linux-foundation.org: s/PAGE_SHIFT/PAGE_CACHE_SHIFT/]\nSigned-off-by: Andreas Rohner \u003candreas.rohner@gmx.net\u003e\nTested-by: Andreas Rohner \u003candreas.rohner@gmx.net\u003e\nSigned-off-by: Ryusuke Konishi \u003ckonishi.ryusuke@lab.ntt.co.jp\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "504c4611c9da8b2cade4a45a31376293a4d53ed1", "tree": "04f9cece0aec0d44b4603095e5c5f7819c63801d", "parents": [ "4fae6ccac642aa30d189dea30ef14306aad4d2d2" ], "author": { "name": "Markos Chandras", "email": "markos.chandras@imgtec.com", "time": "Tue Sep 16 15:55:12 2014 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:38 2014 +0800" }, "message": "MIPS: mcount: Adjust stack pointer for static trace in MIPS32\n\ncommit 8a574cfa2652545eb95595d38ac2a0bb501af0ae upstream.\n\nEvery mcount() call in the MIPS 32-bit kernel is done as follows:\n\n[...]\nmove at, ra\njal _mcount\naddiu sp, sp, -8\n[...]\n\nbut upon returning from the mcount() function, the stack pointer\nis not adjusted properly. This is explained in details in 58b69401c797\n(MIPS: Function tracer: Fix broken function tracing).\n\nCommit ad8c396936e3 (\"MIPS: Unbreak function tracer for 64-bit kernel.)\nfixed the stack manipulation for 64-bit but it didn\u0027t fix it completely\nfor MIPS32.\n\nSigned-off-by: Markos Chandras \u003cmarkos.chandras@imgtec.com\u003e\nCc: linux-mips@linux-mips.org\nPatchwork: https://patchwork.linux-mips.org/patch/7792/\nSigned-off-by: Ralf Baechle \u003cralf@linux-mips.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" } ], "next": "4fae6ccac642aa30d189dea30ef14306aad4d2d2" }