)]}' { "log": [ { "commit": "df29bdd478affb8d81620e43e70635bef110a20e", "tree": "45cbc26fcc9624de8bc09b69be3465165177b2b9", "parents": [ "f69a26d2cff8533570ca3ef3c59f2e1174b084b1" ], "author": { "name": "Michael Neuling", "email": "mikey@neuling.org", "time": "Mon Nov 25 11:12:20 2013 +1100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:33 2013 -0800" }, "message": "powerpc/signals: Improved mark VSX not saved with small contexts fix\n\ncommit ec67ad82814bee92251fd963bf01c7a173856555 upstream.\n\nIn a recent patch:\n commit c13f20ac48328b05cd3b8c19e31ed6c132b44b42\n Author: Michael Neuling \u003cmikey@neuling.org\u003e\n powerpc/signals: Mark VSX not saved with small contexts\n\nWe fixed an issue but an improved solution was later discussed after the patch\nwas merged.\n\nFirstly, this patch doesn\u0027t handle the 64bit signals case, which could also hit\nthis issue (but has never been reported).\n\nSecondly, the original patch isn\u0027t clear what MSR VSX should be set to. The\nnew approach below always clears the MSR VSX bit (to indicate no VSX is in the\ncontext) and sets it only in the specific case where VSX is available (ie. when\nVSX has been used and the signal context passed has space to provide the\nstate).\n\nThis reverts the original patch and replaces it with the improved solution. It\nalso adds a 64 bit version.\n\nSigned-off-by: Michael Neuling \u003cmikey@neuling.org\u003e\nSigned-off-by: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f69a26d2cff8533570ca3ef3c59f2e1174b084b1", "tree": "158224fbed9c322fbb8c49f18a9d26490a323324", "parents": [ "3ae78536556792344cad475b78aecaf66e9ab3a6" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Thu Nov 14 15:16:15 2013 +1100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:33 2013 -0800" }, "message": "md: fix calculation of stacking limits on level change.\n\ncommit 02e5f5c0a0f726e66e3d8506ea1691e344277969 upstream.\n\nThe various -\u003erun routines of md personalities assume that the \u0027queue\u0027\nhas been initialised by the blk_set_stacking_limits() call in\nmd_alloc().\n\nHowever when the level is changed (by level_store()) the -\u003erun routine\nfor the new level is called for an array which has already had the\nstacking limits modified. This can result in incorrect final\nsettings.\n\nSo call blk_set_stacking_limits() before -\u003erun in level_store().\n\nA specific consequence of this bug is that it causes\ndiscard_granularity to be set incorrectly when reshaping a RAID4 to a\nRAID0.\n\nThis is suitable for any -stable kernel since 3.3 in which\nblk_set_stacking_limits() was introduced.\n\nReported-and-tested-by: \"Baldysiak, Pawel\" \u003cpawel.baldysiak@intel.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "3ae78536556792344cad475b78aecaf66e9ab3a6", "tree": "8a9e3dc066a73c2693d7dc5191794d1c6748ca29", "parents": [ "e21e0c15bcce325c61d67181d1e1d6ff917eda4d" ], "author": { "name": "Jerome Glisse", "email": "jglisse@redhat.com", "time": "Tue Nov 12 10:51:16 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:33 2013 -0800" }, "message": "radeon: workaround pinning failure on low ram gpu\n\ncommit 97b6ff6be9da7675aab339334fda996d6c5077d9 upstream.\n\nGPU with low amount of ram can fails at pinning new framebuffer before\nunpinning old one. On such failure, retry with unpinning old one before\npinning new one allowing to work around the issue. This is somewhat\nugly but only affect those old GPU we care about.\n\nSigned-off-by: Jerome Glisse \u003cjglisse@redhat.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e21e0c15bcce325c61d67181d1e1d6ff917eda4d", "tree": "6e8e8d11d5415a4db958b239119137384878622d", "parents": [ "c417faedff9cf67956760f48a167253609f26fd6" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Mon Oct 28 10:56:23 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:33 2013 -0800" }, "message": "drm/radeon/si: fix define for MC_SEQ_TRAIN_WAKEUP_CNTL\n\ncommit d5693761b2b4ff530c8af8af9ec55b6eae76e617 upstream.\n\nTypo in the register offset.\n\nNoticed-by: Sylvain BERTRAND \u003csylware@legeek.net\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c417faedff9cf67956760f48a167253609f26fd6", "tree": "a7c2589e7ce7073078b6bf1d9fc6d7847b749e2a", "parents": [ "38b24f2c291160842a855899e04e11952da3da3f" ], "author": { "name": "Ben Skeggs", "email": "bskeggs@redhat.com", "time": "Wed Nov 13 15:18:32 2013 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:33 2013 -0800" }, "message": "drm/nouveau: when bailing out of a pushbuf ioctl, do not remove previous fence\n\ncommit 9360bd1112d8874d21942e2ae74f5416b00a8db6 upstream.\n\nSigned-off-by: Ben Skeggs \u003cbskeggs@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "38b24f2c291160842a855899e04e11952da3da3f", "tree": "5b9cbe7a7c3a338bc2ec64a88d2c1a5fd368d835", "parents": [ "6e911aa9fefc5e239e979247aced3b2f6cdb4f38" ], "author": { "name": "Daniel Vetter", "email": "daniel.vetter@ffwll.ch", "time": "Mon Nov 04 08:13:45 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:33 2013 -0800" }, "message": "drm/i915: flush cursors harder\n\ncommit b2ea8ef559b4d94190009f3651b5b3ab7c05afd3 upstream.\n\nApparently they need the same treatment as primary planes. This fixes\nmodesetting failures because of stuck cursors (!) on Thomas\u0027 i830M\nmachine.\n\nI\u0027ve figured while at it I\u0027ll also roll it out for the ivb 3 pipe\nversion of this function. I didn\u0027t do this for i845/i865 since Bspec\nsays the update mechanism works differently, and there\u0027s some\nadditional rules about what can be updated in which order.\n\nTested-by: Thomas Richter \u003cthor@math.tu-berlin.de\u003e\nCc: Thomas Richter \u003cthor@math.tu-berlin.de\u003e\nCc: Ville Syrjälä \u003cville.syrjala@linux.intel.com\u003e\nSigned-off-by: Daniel Vetter \u003cdaniel.vetter@ffwll.ch\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6e911aa9fefc5e239e979247aced3b2f6cdb4f38", "tree": "7c11f2c6b86924a8ddf502af1d1f17c268347974", "parents": [ "230ab9dec1640dabf4c7932cfc626e51a844a6b6" ], "author": { "name": "Jakob Bornecrantz", "email": "jakob@vmware.com", "time": "Wed Oct 30 02:46:56 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:32 2013 -0800" }, "message": "drm/ttm: Handle in-memory region copies\n\ncommit 9a0599ddeae012a771bba5e23393fc52d8a59d89 upstream.\n\nFix the case where the ttm pointer may be NULL causing\na NULL pointer dereference.\n\nSigned-off-by: Jakob Bornecrantz \u003cjakob@vmware.com\u003e\nSigned-off-by: Thomas Hellström \u003cthellstrom@vmware.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "230ab9dec1640dabf4c7932cfc626e51a844a6b6", "tree": "014dcf33b45657dbc7f4a665eb931b4da8b89600", "parents": [ "fb1601f038505840a2c3bfaf7622e1bae949c064" ], "author": { "name": "Dan Williams", "email": "dcbw@redhat.com", "time": "Fri Nov 08 13:39:44 2013 -0600" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:32 2013 -0800" }, "message": "prism54: set netdev type to \"wlan\"\n\ncommit 8e3ffa471091c560deb6738ed9ab7445b7a5fd04 upstream.\n\nUserspace uses the netdev devtype for stuff like device naming and type\ndetection. Be nice and set it. Remove the pointless #if/#endif around\nSET_NETDEV_DEV too.\n\nSigned-off-by: Dan Williams \u003cdcbw@redhat.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "fb1601f038505840a2c3bfaf7622e1bae949c064", "tree": "1389068190cef8c92230c1fb87bde7577b1a4b79", "parents": [ "07cf6ad31d91fd61bb378b3b62c746cbc2cd49ab" ], "author": { "name": "Andreas Bießmann", "email": "andreas@biessmann.de", "time": "Thu Oct 24 12:31:04 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:32 2013 -0800" }, "message": "avr32: fix out-of-range jump in large kernels\n\ncommit d617b338bbfdd77e9cbd8e7dc949cee3dd73d575 upstream.\n\nThis patch fixes following error (for big kernels):\n\n---8\u003c---\narch/avr32/boot/u-boot/head.o: In function `no_tag_table\u0027:\n(.init.text+0x44): relocation truncated to fit: R_AVR32_22H_PCREL against symbol `panic\u0027 defined in .text.unlikely section in kernel/built-in.o\narch/avr32/kernel/built-in.o: In function `bad_return\u0027:\n(.ex.text+0x236): relocation truncated to fit: R_AVR32_22H_PCREL against symbol `panic\u0027 defined in .text.unlikely section in kernel/built-in.o\n---\u003e8---\n\nIt comes up when the kernel increases and \u0027panic()\u0027 is too far away to fit in\nthe +/- 2MiB range. Which in turn issues from the 21-bit displacement in\n\u0027br{cond4}\u0027 mnemonic which is one of the two ways to do jumps (rjmp has just\n10-bit displacement and therefore a way smaller range). This fact was stated\nbefore in 8d29b7b9f81d6b83d869ff054e6c189d6da73f1f.\nOne solution to solve this is to add a local storage for the symbol address\nand just load the $pc with that value.\n\nSigned-off-by: Andreas Bießmann \u003candreas@biessmann.de\u003e\nAcked-by: Hans-Christian Egtvedt \u003cegtvedt@samfundet.no\u003e\nCc: Haavard Skinnemoen \u003chskinnemoen@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "07cf6ad31d91fd61bb378b3b62c746cbc2cd49ab", "tree": "3b9b2d4da7c74aa645c2a3b43a043253d3e6bc60", "parents": [ "17af9d91523a6e44a3721cea48cd3ade66a8b416" ], "author": { "name": "Andreas Bießmann", "email": "andreas@biessmann.de", "time": "Thu Oct 24 12:31:03 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:32 2013 -0800" }, "message": "avr32: setup crt for early panic()\n\ncommit 7a2a74f4b856993218aa7cdeeb6c3103101340db upstream.\n\nBefore the CRT was (fully) set up in kernel_entry (bss cleared before in\n_start, but also not before jump to panic() in no_tag_table case).\n\nThis patch fixes this up to have a fully working CRT when branching to panic()\nin no_tag_table.\n\nSigned-off-by: Andreas Bießmann \u003candreas@biessmann.de\u003e\nAcked-by: Hans-Christian Egtvedt \u003cegtvedt@samfundet.no\u003e\nCc: Haavard Skinnemoen \u003chskinnemoen@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "17af9d91523a6e44a3721cea48cd3ade66a8b416", "tree": "2baf8e6c824c313203cc7ec6000fa243257ee52c", "parents": [ "5d6d6a7a101136aec882cc168c2d6bd4376b3760" ], "author": { "name": "Paul Moore", "email": "pmoore@redhat.com", "time": "Thu Sep 26 17:00:46 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:32 2013 -0800" }, "message": "selinux: correct locking in selinux_netlbl_socket_connect)\n\ncommit 42d64e1add3a1ce8a787116036163b8724362145 upstream.\n\nThe SELinux/NetLabel glue code has a locking bug that affects systems\nwith NetLabel enabled, see the kernel error message below. This patch\ncorrects this problem by converting the bottom half socket lock to a\nmore conventional, and correct for this call-path, lock_sock() call.\n\n \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n [ INFO: suspicious RCU usage. ]\n 3.11.0-rc3+ #19 Not tainted\n -------------------------------\n net/ipv4/cipso_ipv4.c:1928 suspicious rcu_dereference_protected() usage!\n\n other info that might help us debug this:\n\n rcu_scheduler_active \u003d 1, debug_locks \u003d 0\n 2 locks held by ping/731:\n #0: (slock-AF_INET/1){+.-...}, at: [...] selinux_netlbl_socket_connect\n #1: (rcu_read_lock){.+.+..}, at: [\u003c...\u003e] netlbl_conn_setattr\n\n stack backtrace:\n CPU: 1 PID: 731 Comm: ping Not tainted 3.11.0-rc3+ #19\n Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n 0000000000000001 ffff88006f659d28 ffffffff81726b6a ffff88003732c500\n ffff88006f659d58 ffffffff810e4457 ffff88006b845a00 0000000000000000\n 000000000000000c ffff880075aa2f50 ffff88006f659d90 ffffffff8169bec7\n Call Trace:\n [\u003cffffffff81726b6a\u003e] dump_stack+0x54/0x74\n [\u003cffffffff810e4457\u003e] lockdep_rcu_suspicious+0xe7/0x120\n [\u003cffffffff8169bec7\u003e] cipso_v4_sock_setattr+0x187/0x1a0\n [\u003cffffffff8170f317\u003e] netlbl_conn_setattr+0x187/0x190\n [\u003cffffffff8170f195\u003e] ? netlbl_conn_setattr+0x5/0x190\n [\u003cffffffff8131ac9e\u003e] selinux_netlbl_socket_connect+0xae/0xc0\n [\u003cffffffff81303025\u003e] selinux_socket_connect+0x135/0x170\n [\u003cffffffff8119d127\u003e] ? might_fault+0x57/0xb0\n [\u003cffffffff812fb146\u003e] security_socket_connect+0x16/0x20\n [\u003cffffffff815d3ad3\u003e] SYSC_connect+0x73/0x130\n [\u003cffffffff81739a85\u003e] ? sysret_check+0x22/0x5d\n [\u003cffffffff810e5e2d\u003e] ? trace_hardirqs_on_caller+0xfd/0x1c0\n [\u003cffffffff81373d4e\u003e] ? trace_hardirqs_on_thunk+0x3a/0x3f\n [\u003cffffffff815d52be\u003e] SyS_connect+0xe/0x10\n [\u003cffffffff81739a59\u003e] system_call_fastpath+0x16/0x1b\n\nSigned-off-by: Paul Moore \u003cpmoore@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5d6d6a7a101136aec882cc168c2d6bd4376b3760", "tree": "197a7d2091eef7f5593ac651b380adb0eaed9b5b", "parents": [ "4e0c56ab133fcb29fa3709c095f9347a033662c1" ], "author": { "name": "Yinghai Lu", "email": "yinghai@kernel.org", "time": "Mon Nov 18 17:02:45 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:32 2013 -0800" }, "message": "PCI: Remove duplicate pci_disable_device() from pcie_portdrv_remove()\n\ncommit e7cc5cf74544d97d7b69e2701595037474db1f96 upstream.\n\nThe pcie_portdrv .probe() method calls pci_enable_device() once, in\npcie_port_device_register(), but the .remove() method calls\npci_disable_device() twice, in pcie_port_device_remove() and in\npcie_portdrv_remove().\n\nThat causes a \"disabling already-disabled device\" warning when removing a\nPCIe port device. This happens all the time when removing Thunderbolt\ndevices, but is also easy to reproduce with, e.g.,\n\"echo 0000:00:1c.3 \u003e /sys/bus/pci/drivers/pcieport/unbind\"\n\nThis patch removes the disable from pcie_portdrv_remove().\n\n[bhelgaas: changelog, tag for stable]\nReported-by: David Bulkow \u003cDavid.Bulkow@stratus.com\u003e\nReported-by: Mika Westerberg \u003cmika.westerberg@linux.intel.com\u003e\nSigned-off-by: Yinghai Lu \u003cyinghai@kernel.org\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "4e0c56ab133fcb29fa3709c095f9347a033662c1", "tree": "4ddbc8a55d63d790669e6319b037870b4166005e", "parents": [ "42979968049cc6a8ed569ae8ceb486e0637c7ce7" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Mon Sep 30 22:04:24 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:32 2013 -0800" }, "message": "audit: fix info leak in AUDIT_GET requests\n\ncommit 64fbff9ae0a0a843365d922e0057fc785f23f0e3 upstream.\n\nWe leak 4 bytes of kernel stack in response to an AUDIT_GET request as\nwe miss to initialize the mask member of status_set. Fix that.\n\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nSigned-off-by: Richard Guy Briggs \u003crgb@redhat.com\u003e\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "42979968049cc6a8ed569ae8ceb486e0637c7ce7", "tree": "8e7f4c4af4dc50d16a46d74ea1a8f9beb1cbab99", "parents": [ "e49ee6c66ebfdf4a4fb0cecad2523c7b61fc0282" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Mon Sep 30 22:04:25 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:31 2013 -0800" }, "message": "audit: use nlmsg_len() to get message payload length\n\ncommit 4d8fe7376a12bf4524783dd95cbc00f1fece6232 upstream.\n\nUsing the nlmsg_len member of the netlink header to test if the message\nis valid is wrong as it includes the size of the netlink header itself.\nThereby allowing to send short netlink messages that pass those checks.\n\nUse nlmsg_len() instead to test for the right message length. The result\nof nlmsg_len() is guaranteed to be non-negative as the netlink message\nalready passed the checks of nlmsg_ok().\n\nAlso switch to min_t() to please checkpatch.pl.\n\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nSigned-off-by: Richard Guy Briggs \u003crgb@redhat.com\u003e\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e49ee6c66ebfdf4a4fb0cecad2523c7b61fc0282", "tree": "6106bc4fc818042ebfb97476a4a1c1cd04572ec9", "parents": [ "d4bb402d7bda612a91235444dd4cf29b464f8eec" ], "author": { "name": "Tyler Hicks", "email": "tyhicks@canonical.com", "time": "Thu Jul 25 18:02:55 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:31 2013 -0800" }, "message": "audit: printk USER_AVC messages when audit isn\u0027t enabled\n\ncommit 0868a5e150bc4c47e7a003367cd755811eb41e0b upstream.\n\nWhen the audit\u003d1 kernel parameter is absent and auditd is not running,\nAUDIT_USER_AVC messages are being silently discarded.\n\nAUDIT_USER_AVC messages should be sent to userspace using printk(), as\nmentioned in the commit message of 4a4cd633 (\"AUDIT: Optimise the\naudit-disabled case for discarding user messages\").\n\nWhen audit_enabled is 0, audit_receive_msg() discards all user messages\nexcept for AUDIT_USER_AVC messages. However, audit_log_common_recv_msg()\nrefuses to allocate an audit_buffer if audit_enabled is 0. The fix is to\nspecial case AUDIT_USER_AVC messages in both functions.\n\nIt looks like commit 50397bd1 (\"[AUDIT] clean up audit_receive_msg()\")\nintroduced this bug.\n\nSigned-off-by: Tyler Hicks \u003ctyhicks@canonical.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Eric Paris \u003ceparis@redhat.com\u003e\nCc: linux-audit@redhat.com\nAcked-by: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: Richard Guy Briggs \u003crgb@redhat.com\u003e\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d4bb402d7bda612a91235444dd4cf29b464f8eec", "tree": "c625228aad4a88a7272effaa9306a924378dcb67", "parents": [ "7094547c201149598a2bd90ef7f04d477dffae1b" ], "author": { "name": "Avinash Patil", "email": "patila@marvell.com", "time": "Tue Nov 05 15:01:44 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:31 2013 -0800" }, "message": "mwifiex: correct packet length for packets from SDIO interface\n\ncommit d03b4aa77e1187b77dfe37d14a923547f00baa66 upstream.\n\nWhile receiving a packet on SDIO interface, we allocate skb with\nsize multiple of SDIO block size. We need to resize this skb\nafter RX using packet length from RX header.\n\nSigned-off-by: Avinash Patil \u003cpatila@marvell.com\u003e\nSigned-off-by: Bing Zhao \u003cbzhao@marvell.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7094547c201149598a2bd90ef7f04d477dffae1b", "tree": "1322f341512653df7c5a93b4a26fed9aaf24217f", "parents": [ "3ccb527f871a225b8eada036d24d41c59e40a2e4" ], "author": { "name": "Aaron Lu", "email": "aaron.lu@intel.com", "time": "Wed Nov 06 08:41:31 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:31 2013 -0800" }, "message": "PM / hibernate: Avoid overflow in hibernate_preallocate_memory()\n\ncommit fd432b9f8c7c88428a4635b9f5a9c6e174df6e36 upstream.\n\nWhen system has a lot of highmem (e.g. 16GiB using a 32 bits kernel),\nthe code to calculate how much memory we need to preallocate in\nnormal zone may cause overflow. As Leon has analysed:\n\n It looks that during computing \u0027alloc\u0027 variable there is overflow:\n alloc \u003d (3943404 - 1970542) - 1978280 \u003d -5418 (signed)\n And this function goes to err_out.\n\nFix this by avoiding that overflow.\n\nReferences: https://bugzilla.kernel.org/show_bug.cgi?id\u003d60817\nReported-and-tested-by: Leon Drugi \u003ceyak@wp.pl\u003e\nSigned-off-by: Aaron Lu \u003caaron.lu@intel.com\u003e\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "3ccb527f871a225b8eada036d24d41c59e40a2e4", "tree": "ea00568bfa02c2f7eda7a5ef17a52efeef2d9808", "parents": [ "b725146ee9fed4d4c19ae5a6b028d5e856730454" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Thu Oct 31 13:55:45 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:31 2013 -0800" }, "message": "dm: allocate buffer for messages with small number of arguments using GFP_NOIO\n\ncommit f36afb3957353d2529cb2b00f78fdccd14fc5e9c upstream.\n\ndm-mpath and dm-thin must process messages even if some device is\nsuspended, so we allocate argv buffer with GFP_NOIO. These messages have\na small fixed number of arguments.\n\nOn the other hand, dm-switch needs to process bulk data using messages\nso excessive use of GFP_NOIO could cause trouble.\n\nThe patch also lowers the default number of arguments from 64 to 8, so\nthat there is smaller load on GFP_NOIO allocations.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nAcked-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b725146ee9fed4d4c19ae5a6b028d5e856730454", "tree": "1dba953747d1306c2eb317bd0bda34ee4cde4e0a", "parents": [ "401a0f388620de353625f3bc4c06916fd94122f0" ], "author": { "name": "Stanislaw Gruszka", "email": "stf_xl@wp.pl", "time": "Tue Oct 15 14:28:48 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:31 2013 -0800" }, "message": "rt2400pci: fix RSSI read\n\ncommit 2bf127a5cc372b9319afcbae10b090663b621c8b upstream.\n\nRSSI value is provided on word3 not on word2.\n\nSigned-off-by: Stanislaw Gruszka \u003cstf_xl@wp.pl\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "401a0f388620de353625f3bc4c06916fd94122f0", "tree": "3a80c987efff8c564bb3d8cc5abd5a8e0c7f3bbd", "parents": [ "dca32a77c5eb1d824e36e459c52a4a4b1901d39a" ], "author": { "name": "Ursula Braun", "email": "ursula.braun@de.ibm.com", "time": "Wed Nov 06 09:04:52 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:30 2013 -0800" }, "message": "qeth: avoid buffer overflow in snmp ioctl\n\ncommit 6fb392b1a63ae36c31f62bc3fc8630b49d602b62 upstream.\n\nCheck user-defined length in snmp ioctl request and allow request\nonly if it fits into a qeth command buffer.\n\nSigned-off-by: Ursula Braun \u003cursula.braun@de.ibm.com\u003e\nSigned-off-by: Frank Blaschka \u003cfrank.blaschka@de.ibm.com\u003e\nReviewed-by: Heiko Carstens \u003cheicars2@linux.vnet.ibm.com\u003e\nReported-by: Nico Golde \u003cnico@ngolde.de\u003e\nReported-by: Fabian Yamaguchi \u003cfabs@goesec.de\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "dca32a77c5eb1d824e36e459c52a4a4b1901d39a", "tree": "f7b9da709dec469a70c520f74b498f3a3a62b6d6", "parents": [ "f59cbdcad5f381475da99c2fbc719d5839dd2fcc" ], "author": { "name": "Larry Finger", "email": "Larry.Finger@lwfinger.net", "time": "Tue Nov 05 15:15:29 2013 -0600" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:30 2013 -0800" }, "message": "rtlwifi: rtl8192cu: Fix incorrect signal strength for unassociated AP\n\ncommit 78dbfecb95be4635b995af3bd29fa10013409fcd upstream.\n\nThe routine that processes received frames was returning the RSSI value for the\nsignal strength; however, that value is available only for associated APs. As\na result, the strength was the absurd value of 10 dBm. As a result, scans\nreturn incorrect values for the strength, which causes unwanted attempts to roam.\n\nSigned-off-by: Larry Finger \u003cLarry.Finger@lwfinger.net\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f59cbdcad5f381475da99c2fbc719d5839dd2fcc", "tree": "f4b78121878e93f8708c24d416a733859c826dad", "parents": [ "80c82f6f9ed328afd7cb183e51626afc348af4b7" ], "author": { "name": "Larry Finger", "email": "Larry.Finger@lwfinger.net", "time": "Tue Nov 05 15:15:28 2013 -0600" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:30 2013 -0800" }, "message": "rtlwifi: rtl8192se: Fix incorrect signal strength for unassociated AP\n\ncommit b4ade797668e33b4e8353c2701ce01d7084dfafa upstream.\n\nThe routine that processes received frames was returning the RSSI value for the\nsignal strength; however, that value is available only for associated APs. As\na result, the strength was the absurd value of 10 dBm. As a result, scans\nreturn incorrect values for the strength, which causes unwanted attempts to roam.\n\nThis patch fixes https://bugzilla.kernel.org/show_bug.cgi?id\u003d63881.\n\nSigned-off-by: Larry Finger \u003cLarry.Finger@lwfinger.net\u003e\nReported-by: Matthieu Baerts \u003cmatttbe@gmail.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "80c82f6f9ed328afd7cb183e51626afc348af4b7", "tree": "1b4d23b5a1da363186e4c7cbb1d91e7f7f904144", "parents": [ "6aefef7eea073c9b0de5c6e69d50cffd5381b969" ], "author": { "name": "Larry Finger", "email": "Larry.Finger@lwfinger.net", "time": "Tue Nov 05 15:15:30 2013 -0600" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:30 2013 -0800" }, "message": "rtlwifi: rtl8192de: Fix incorrect signal strength for unassociated AP\n\ncommit 3545f3d5f4af715c914394123ce7725a9cf0a1c4 upstream.\n\nThe routine that processes received frames was returning the RSSI value for the\nsignal strength; however, that value is available only for associated APs. As\na result, the strength was the absurd value of 10 dBm. As a result, scans\nreturn incorrect values for the strength, which causes unwanted attempts to roam.\n\nSigned-off-by: Larry Finger \u003cLarry.Finger@lwfinger.net\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6aefef7eea073c9b0de5c6e69d50cffd5381b969", "tree": "9cc47f44f2d82ff97dfc8afbd8aaa4a3f6fc991d", "parents": [ "fbd604987d9c53f79abd385fc8d510d7e71dac9e" ], "author": { "name": "Malcolm Priestley", "email": "tvboxspy@gmail.com", "time": "Thu Nov 07 21:49:04 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:30 2013 -0800" }, "message": "staging: vt6656: [BUG] Fix for TX USB resets from vendors driver.\n\ncommit 9df682927c2e3a92f43803d6b52095992e3b2ab8 upstream.\n\nThis fixes resets on heavy TX data traffic.\n\nVendor driver\nVT6656_Linux_src_v1.21.03_x86_11.04.zip\nhttp://www.viaembedded.com/servlet/downloadSvl?id\u003d1890\u0026download_file_id\u003d14704\nThis is GPL-licensed code.\n\noriginal code\nBBbVT3184Init\n...\n//2007-0725, RobertChang add, Enable Squelch detect reset option(SQ_RST_Opt), USB (register4, bit1)\nCONTROLnsRequestIn(pDevice,\n MESSAGE_TYPE_READ,\n (WORD)0x600+4, // USB\u0027s Reg4\u0027s bit1\n MESSAGE_REQUEST_MEM,\n 1,\n (PBYTE) \u0026byData);\nbyData \u003d byData|2 ;\nCONTROLnsRequestOut(pDevice,\n MESSAGE_TYPE_WRITE,\n (WORD)0x600+4, // USB\u0027s Reg4\u0027s bit1\n MESSAGE_REQUEST_MEM,\n 1,\n (PBYTE) \u0026byData);\n\nreturn TRUE;//ntStatus;\n....\n\nA back port patch is needed for kernels less than 3.10.\n\nSigned-off-by: Malcolm Priestley \u003ctvboxspy@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "fbd604987d9c53f79abd385fc8d510d7e71dac9e", "tree": "6852711fea5c7385233c48b8ccd70e3ce1c2c27d", "parents": [ "dc51161bf8064f63470ee718843a1b4fd75d0bb5" ], "author": { "name": "Vegard Nossum", "email": "vegard.nossum@oracle.com", "time": "Thu Sep 05 13:00:14 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:30 2013 -0800" }, "message": "xen/blkback: fix reference counting\n\ncommit ea5ec76d76da9279d12027c1828544c5ccbe7932 upstream.\n\nIf the permission check fails, we drop a reference to the blkif without\nhaving taken it in the first place. The bug was introduced in commit\n604c499cbbcc3d5fe5fb8d53306aa0fae1990109 (xen/blkback: Check device\npermissions before allowing OP_DISCARD).\n\nCc: Jan Beulich \u003cJBeulich@suse.com\u003e\nCc: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\nSigned-off-by: Vegard Nossum \u003cvegard.nossum@oracle.com\u003e\nSigned-off-by: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "dc51161bf8064f63470ee718843a1b4fd75d0bb5", "tree": "88eab7fa3ac735920f240efa5abe78a03d026c42", "parents": [ "1eb9c3425abb5a187ef7b52206eb395aa896151e" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Thu Oct 31 23:00:24 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:30 2013 -0800" }, "message": "ext4: avoid bh leak in retry path of ext4_expand_extra_isize_ea()\n\ncommit dcb9917ba041866686fe152850364826c4622a36 upstream.\n\nReported-by: Dave Jones \u003cdavej@redhat.com\u003e\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1eb9c3425abb5a187ef7b52206eb395aa896151e", "tree": "1c2e0bd43c3cd7ec0f5a7a67b2ac109e20af0991", "parents": [ "09f665049d7ecde55c5fbe4bb419b992288c4608" ], "author": { "name": "Huang Shijie", "email": "b32955@freescale.com", "time": "Mon Nov 11 12:13:45 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:29 2013 -0800" }, "message": "mtd: gpmi: fix kernel BUG due to racing DMA operations\n\ncommit 7b3d2fb92067bcb29f0f085a9fa9fa64920a6646 upstream.\n\n[1] The gpmi uses the nand_command_lp to issue the commands to NAND chips.\n The gpmi issues a DMA operation with gpmi_cmd_ctrl when it handles\n a NAND_CMD_NONE control command. So when we read a page(NAND_CMD_READ0)\n from the NAND, we may send two DMA operations back-to-back.\n\n If we do not serialize the two DMA operations, we will meet a bug when\n\n 1.1) we enable CONFIG_DMA_API_DEBUG, CONFIG_DMADEVICES_DEBUG,\n and CONFIG_DEBUG_SG.\n\n 1.2) Use the following commands in an UART console and a SSH console:\n cmd 1: while true;do dd if\u003d/dev/mtd0 of\u003d/dev/null;done\n cmd 1: while true;do dd if\u003d/dev/mmcblk0 of\u003d/dev/null;done\n\n The kernel log shows below:\n -----------------------------------------------------------------\n kernel BUG at lib/scatterlist.c:28!\n Unable to handle kernel NULL pointer dereference at virtual address 00000000\n .........................\n [\u003c80044a0c\u003e] (__bug+0x18/0x24) from [\u003c80249b74\u003e] (sg_next+0x48/0x4c)\n [\u003c80249b74\u003e] (sg_next+0x48/0x4c) from [\u003c80255398\u003e] (debug_dma_unmap_sg+0x170/0x1a4)\n [\u003c80255398\u003e] (debug_dma_unmap_sg+0x170/0x1a4) from [\u003c8004af58\u003e] (dma_unmap_sg+0x14/0x6c)\n [\u003c8004af58\u003e] (dma_unmap_sg+0x14/0x6c) from [\u003c8027e594\u003e] (mxs_dma_tasklet+0x18/0x1c)\n [\u003c8027e594\u003e] (mxs_dma_tasklet+0x18/0x1c) from [\u003c8007d444\u003e] (tasklet_action+0x114/0x164)\n -----------------------------------------------------------------\n\n 1.3) Assume the two DMA operations is X (first) and Y (second).\n\n The root cause of the bug:\n\t Assume process P issues DMA X, and sleep on the completion\n\t @this-\u003edma_done. X\u0027s tasklet callback is dma_irq_callback. It firstly\n\t wake up the process sleeping on the completion @this-\u003edma_done,\n\t and then trid to unmap the scatterlist S. The waked process P will\n\t issue Y in another ARM core. Y initializes S-\u003esg_magic to zero\n\t with sg_init_one(), while dma_irq_callback is unmapping S at the same\n\t time.\n\n\t See the diagram:\n\n ARM core 0 | ARM core 1\n\t -------------------------------------------------------------\n (P issues DMA X, then sleep) --\u003e |\n |\n (X\u0027s tasklet wakes P) --\u003e |\n |\n | \u003c-- (P begin to issue DMA Y)\n |\n (X\u0027s tasklet unmap the |\n scatterlist S with dma_unmap_sg) --\u003e | \u003c-- (Y calls sg_init_one() to init\n | scatterlist S)\n |\n\n[2] This patch serialize both the X and Y in the following way:\n Unmap the DMA scatterlist S firstly, and wake up the process at the end\n of the DMA callback, in such a way, Y will be executed after X.\n\n After this patch:\n\n ARM core 0 | ARM core 1\n\t -------------------------------------------------------------\n (P issues DMA X, then sleep) --\u003e |\n |\n (X\u0027s tasklet unmap the |\n scatterlist S with dma_unmap_sg) --\u003e |\n |\n (X\u0027s tasklet wakes P) --\u003e |\n |\n | \u003c-- (P begin to issue DMA Y)\n |\n | \u003c-- (Y calls sg_init_one() to init\n | scatterlist S)\n |\n\nSigned-off-by: Huang Shijie \u003cb32955@freescale.com\u003e\nSigned-off-by: Brian Norris \u003ccomputersforpeace@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "09f665049d7ecde55c5fbe4bb419b992288c4608", "tree": "a2dcc09fe7f79b93406573082baa79fa8d797744", "parents": [ "b22831e6611bec1fdf84e71d80f7917199212ee8" ], "author": { "name": "Wang Haitao", "email": "wang.haitao1@zte.com.cn", "time": "Thu Aug 22 19:32:38 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:29 2013 -0800" }, "message": "mtd: map: fixed bug in 64-bit systems\n\ncommit a4d62babf988fe5dfde24437fa135ef147bc7aa0 upstream.\n\nHardware:\n\tCPU: XLP832,the 64-bit OS\n\tNOR Flash:S29GL128S 128M\nSoftware:\n\tKernel:2.6.32.41\n\tFilesystem:JFFS2\nWhen writing files, errors appear:\n\tWrite len 182 but return retlen 180\n\tWrite of 182 bytes at 0x072c815c failed. returned -5, retlen 180\n\tWrite len 186 but return retlen 184\n\tWrite of 186 bytes at 0x072caff4 failed. returned -5, retlen 184\nThese errors exist only in 64-bit systems,not in 32-bit systems. After analysis, we\nfound that the left shift operation is wrong in map_word_load_partial. For instance:\n\tunsigned char buf[3] \u003d{0x9e,0x3a,0xea};\n\tmap_bankwidth(map) is 4;\n\tfor (i\u003d0; i \u003c 3; i++) {\n\t\tint bitpos;\n\t\tbitpos \u003d (map_bankwidth(map)-1-i)*8;\n\t\torig.x[0] \u0026\u003d ~(0xff \u003c\u003c bitpos);\n\t\torig.x[0] |\u003d buf[i] \u003c\u003c bitpos;\n\t}\n\nThe value of orig.x[0] is expected to be 0x9e3aeaff, but in this situation(64-bit\nSystem) we\u0027ll get the wrong value of 0xffffffff9e3aeaff due to the 64-bit sign\nextension:\nbuf[i] is defined as \"unsigned char\" and the left-shift operation will convert it\nto the type of \"signed int\", so when left-shift buf[i] by 24 bits, the final result\nwill get the wrong value: 0xffffffff9e3aeaff.\n\nIf the left-shift bits are less than 24, then sign extension will not occur. Whereas\nthe bankwidth of the nor flash we used is 4, therefore this BUG emerges.\n\nSigned-off-by: Pang Xunlei \u003cpang.xunlei@zte.com.cn\u003e\nSigned-off-by: Zhang Yi \u003czhang.yi20@zte.com.cn\u003e\nSigned-off-by: Lu Zhongjun \u003clu.zhongjun@zte.com.cn\u003e\nSigned-off-by: Brian Norris \u003ccomputersforpeace@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b22831e6611bec1fdf84e71d80f7917199212ee8", "tree": "27fcd58be5c25b704b053f50f25346309fc999ec", "parents": [ "0aa9fced961d071a0e19c384b2f2c2e50a676602" ], "author": { "name": "Brian Norris", "email": "computersforpeace@gmail.com", "time": "Tue Aug 27 18:45:10 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:28 2013 -0800" }, "message": "mtd: nand: hack ONFI for non-power-of-2 dimensions\n\ncommit 4355b70cf48363c50a9de450b01178c83aba8f6a upstream.\n\nSome bright specification writers decided to write this in the ONFI spec\n(from ONFI 3.0, Section 3.1):\n\n \"The number of blocks and number of pages per block is not required to\n be a power of two. In the case where one of these values is not a\n power of two, the corresponding address shall be rounded to an\n integral number of bits such that it addresses a range up to the\n subsequent power of two value. The host shall not access upper\n addresses in a range that is shown as not supported.\"\n\nThis breaks every assumption MTD makes about NAND block/chip-size\ndimensions -- they *must* be a power of two!\n\nAnd of course, an enterprising manufacturer has made use of this lovely\nfreedom. Exhibit A: Micron MT29F32G08CBADAWP\n\n \"- Plane size: 2 planes x 1064 blocks per plane\n - Device size: 32Gb: 2128 blockss [sic]\"\n\nThis quickly hits a BUG() in nand_base.c, since the extra dimensions\noverflow so we think it\u0027s a second chip (on my single-chip setup):\n\n ONFI param page 0 valid\n ONFI flash detected\n NAND device: Manufacturer ID: 0x2c, Chip ID: 0x44 (Micron MT29F32G08CBADAWP), 4256MiB, page size: 8192, OOB size: 744\n ------------[ cut here ]------------\n kernel BUG at drivers/mtd/nand/nand_base.c:203!\n Internal error: Oops - BUG: 0 [#1] SMP ARM\n [... trim ...]\n [\u003cc02cf3e4\u003e] (nand_select_chip+0x18/0x2c) from [\u003cc02d25c0\u003e] (nand_do_read_ops+0x90/0x424)\n [\u003cc02d25c0\u003e] (nand_do_read_ops+0x90/0x424) from [\u003cc02d2dd8\u003e] (nand_read+0x54/0x78)\n [\u003cc02d2dd8\u003e] (nand_read+0x54/0x78) from [\u003cc02ad2c8\u003e] (mtd_read+0x84/0xbc)\n [\u003cc02ad2c8\u003e] (mtd_read+0x84/0xbc) from [\u003cc02d4b28\u003e] (scan_read.clone.4+0x4c/0x64)\n [\u003cc02d4b28\u003e] (scan_read.clone.4+0x4c/0x64) from [\u003cc02d4c88\u003e] (search_bbt+0x148/0x290)\n [\u003cc02d4c88\u003e] (search_bbt+0x148/0x290) from [\u003cc02d4ea4\u003e] (nand_scan_bbt+0xd4/0x5c0)\n [... trim ...]\n ---[ end trace 0c9363860d865ff2 ]---\n\nSo to fix this, just truncate these dimensions down to the greatest\npower-of-2 dimension that is less than or equal to the specified\ndimension.\n\nSigned-off-by: Brian Norris \u003ccomputersforpeace@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0aa9fced961d071a0e19c384b2f2c2e50a676602", "tree": "3f7e5111509aae06aba29e741514208dfdd22901", "parents": [ "ac6638ed78e168e6c6c77e5ac6d9a6c4f49d0040" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Mon Oct 14 12:12:24 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:28 2013 -0800" }, "message": "loop: fix crash if blk_alloc_queue fails\n\ncommit 3ec981e30fae1f3c8728a05c730acaa1f627bcfb upstream.\n\nloop: fix crash if blk_alloc_queue fails\n\nIf blk_alloc_queue fails, loop_add cleans up, but it doesn\u0027t clean up the\nidentifier allocated with idr_alloc. That causes crash on module unload in\nidr_for_each(\u0026loop_index_idr, \u0026loop_exit_cb, NULL); where we attempt to\nremove non-existed device with that id.\n\nBUG: unable to handle kernel NULL pointer dereference at 0000000000000380\nIP: [\u003cffffffff812057c9\u003e] del_gendisk+0x19/0x2d0\nPGD 43d399067 PUD 43d0ad067 PMD 0\nOops: 0000 [#1] PREEMPT SMP\nModules linked in: loop(-) dm_snapshot dm_zero dm_mirror dm_region_hash dm_log dm_loop dm_mod ip6table_filter ip6_tables uvesafb cfbcopyarea cfbimgblt cfbfillrect fbcon font bitblit fbcon_rotate fbcon_cw fbcon_ud fbcon_ccw softcursor fb fbdev msr ipt_MASQUERADE iptable_nat nf_nat_ipv4 nf_conntrack_ipv4 nf_defrag_ipv4 xt_state ipt_REJECT xt_tcpudp iptable_filter ip_tables x_tables bridge stp llc tun ipv6 cpufreq_userspace cpufreq_stats cpufreq_ondemand cpufreq_conservative cpufreq_powersave spadfs fuse hid_generic usbhid hid raid0 md_mod dmi_sysfs nf_nat_ftp nf_nat nf_conntrack_ftp nf_conntrack snd_usb_audio snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_page_alloc lm85 hwmon_vid snd_hwdep snd_usbmidi_lib snd_rawmidi snd soundcore acpi_cpufreq ohci_hcd freq_table tg3 ehci_pci mperf ehci_hcd kvm_amd kvm sata_svw serverworks libphy libata ide_core k10temp usbcore hwmon microcode ptp pcspkr pps_core e100 skge mii usb_common i2c_piix4 floppy evdev rtc_cmos i2c_core processor but!\n ton unix\nCPU: 7 PID: 2735 Comm: rmmod Tainted: G W 3.10.15-devel #15\nHardware name: empty empty/S3992-E, BIOS \u0027V1.06 \u0027 06/09/2009\ntask: ffff88043d38e780 ti: ffff88043d21e000 task.ti: ffff88043d21e000\nRIP: 0010:[\u003cffffffff812057c9\u003e] [\u003cffffffff812057c9\u003e] del_gendisk+0x19/0x2d0\nRSP: 0018:ffff88043d21fe10 EFLAGS: 00010282\nRAX: ffffffffa05102e0 RBX: 0000000000000000 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffff88043ea82800 RDI: 0000000000000000\nRBP: ffff88043d21fe48 R08: 0000000000000000 R09: 0000000000000001\nR10: 0000000000000001 R11: 0000000000000000 R12: 00000000000000ff\nR13: 0000000000000080 R14: 0000000000000000 R15: ffff88043ea82800\nFS: 00007ff646534700(0000) GS:ffff880447000000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b\nCR2: 0000000000000380 CR3: 000000043e9bf000 CR4: 00000000000007e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\nStack:\n ffffffff8100aba4 0000000000000092 ffff88043d21fe48 ffff88043ea82800\n 00000000000000ff ffff88043d21fe98 0000000000000000 ffff88043d21fe60\n ffffffffa05102b4 0000000000000000 ffff88043d21fe70 ffffffffa05102ec\nCall Trace:\n [\u003cffffffff8100aba4\u003e] ? native_sched_clock+0x24/0x80\n [\u003cffffffffa05102b4\u003e] loop_remove+0x14/0x40 [loop]\n [\u003cffffffffa05102ec\u003e] loop_exit_cb+0xc/0x10 [loop]\n [\u003cffffffff81217b74\u003e] idr_for_each+0x104/0x190\n [\u003cffffffffa05102e0\u003e] ? loop_remove+0x40/0x40 [loop]\n [\u003cffffffff8109adc5\u003e] ? trace_hardirqs_on_caller+0x105/0x1d0\n [\u003cffffffffa05135dc\u003e] loop_exit+0x34/0xa58 [loop]\n [\u003cffffffff810a98ea\u003e] SyS_delete_module+0x13a/0x260\n [\u003cffffffff81221d5e\u003e] ? trace_hardirqs_on_thunk+0x3a/0x3f\n [\u003cffffffff813cff16\u003e] system_call_fastpath+0x1a/0x1f\nCode: f0 4c 8b 6d f8 c9 c3 66 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 56 41 55 4c 8d af 80 00 00 00 41 54 53 48 89 fb 48 83 ec 18 \u003c48\u003e 83 bf 80 03 00\n00 00 74 4d e8 98 fe ff ff 31 f6 48 c7 c7 20\nRIP [\u003cffffffff812057c9\u003e] del_gendisk+0x19/0x2d0\n RSP \u003cffff88043d21fe10\u003e\nCR2: 0000000000000380\n---[ end trace 64ec069ec70f1309 ]---\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nAcked-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ac6638ed78e168e6c6c77e5ac6d9a6c4f49d0040", "tree": "0da2bdbbd4354188f4d47919767490747851569d", "parents": [ "27c0008c75ddfa759d5645ecbc3f86e0de37472a" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Fri Oct 04 09:29:06 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:28 2013 -0800" }, "message": "IB/ipath: Convert ipath_user_sdma_pin_pages() to use get_user_pages_fast()\n\ncommit 4adcf7fb6783e354aab38824d803fa8c4f8e8a27 upstream.\n\nipath_user_sdma_queue_pkts() gets called with mmap_sem held for\nwriting. Except for get_user_pages() deep down in\nipath_user_sdma_pin_pages() we don\u0027t seem to need mmap_sem at all.\n\nEven more interestingly the function ipath_user_sdma_queue_pkts() (and\nalso ipath_user_sdma_coalesce() called somewhat later) call\ncopy_from_user() which can hit a page fault and we deadlock on trying\nto get mmap_sem when handling that fault. So just make\nipath_user_sdma_pin_pages() use get_user_pages_fast() and leave\nmmap_sem locking for mm.\n\nThis deadlock has actually been observed in the wild when the node\nis under memory pressure.\n\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Mike Marciniszyn \u003cmike.marciniszyn@intel.com\u003e\n[ Merged in fix for call to get_user_pages_fast from Tetsuo Handa\n \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e. - Roland ]\nSigned-off-by: Roland Dreier \u003croland@purestorage.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "27c0008c75ddfa759d5645ecbc3f86e0de37472a", "tree": "e9fde1aec4d5fb1de9ca537767279e698a8526b9", "parents": [ "7dac7f101e7b6e5b1dd5164cba7cf7268311e13e" ], "author": { "name": "Eric Seppanen", "email": "eric@purestorage.com", "time": "Wed Nov 20 14:19:52 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:28 2013 -0800" }, "message": "iscsi-target: chap auth shouldn\u0027t match username with trailing garbage\n\ncommit 86784c6bdeeef78eed94d298be7a8879f6a97ee2 upstream.\n\nIn iSCSI negotiations with initiator CHAP enabled, usernames with\ntrailing garbage are permitted, because the string comparison only\nchecks the strlen of the configured username.\n\ne.g. \"usernameXXXXX\" will be permitted to match \"username\".\n\nJust check one more byte so the trailing null char is also matched.\n\nSigned-off-by: Eric Seppanen \u003ceric@purestorage.com\u003e\nSigned-off-by: Nicholas Bellinger \u003cnab@linux-iscsi.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7dac7f101e7b6e5b1dd5164cba7cf7268311e13e", "tree": "ee905090ef9fed06f3b67ac1c732b90e9a5b2bf3", "parents": [ "34bf7634b6d5dd7ce87588b51420cc0a23f3d9d6" ], "author": { "name": "Eric Seppanen", "email": "eric@purestorage.com", "time": "Wed Nov 20 14:19:51 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:27 2013 -0800" }, "message": "iscsi-target: fix extract_param to handle buffer length corner case\n\ncommit 369653e4fb511928511b0ce81f41c812ff1f28b6 upstream.\n\nextract_param() is called with max_length set to the total size of the\noutput buffer. It\u0027s not safe to allow a parameter length equal to the\nbuffer size as the terminating null would be written one byte past the\nend of the output buffer.\n\nSigned-off-by: Eric Seppanen \u003ceric@purestorage.com\u003e\nSigned-off-by: Nicholas Bellinger \u003cnab@linux-iscsi.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "34bf7634b6d5dd7ce87588b51420cc0a23f3d9d6", "tree": "50b66a08064fd93ef9647cdaa167cfe6f55d4d03", "parents": [ "6ca439d8f323780eec60f52c90a6cc61a39347ac" ], "author": { "name": "Samir Benmendil", "email": "samir.benmendil@gmail.com", "time": "Sun Nov 17 23:56:17 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:22 2013 -0800" }, "message": "ahci: add Marvell 9230 to the AHCI PCI device list\n\ncommit 6d5278a68a75891db1df5ae1ecf83d288fc58c65 upstream.\n\nTested with a DAWICONTROL DC-624e on 3.10.10\n\nSigned-off-by: Samir Benmendil \u003csamir.benmendil@gmail.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReviewed-by: Levente Kurusa \u003clevex@linux.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6ca439d8f323780eec60f52c90a6cc61a39347ac", "tree": "ff26a4ecb22c82acdc626e24597890fa13e4b2ef", "parents": [ "4b2162b7f846b9b4326734e305138137ae3491d3" ], "author": { "name": "xiangliang yu", "email": "yxlraid@gmail.com", "time": "Sun Oct 27 08:03:04 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:15 2013 -0800" }, "message": "ahci: disabled FBS prior to issuing software reset\n\ncommit 89dafa20f3daab5b3e0c13d0068a28e8e64e2102 upstream.\n\nTested with Marvell 88se9125, attached with one port mulitplier(5 ports)\nand one disk, we will get following boot log messages if using current\ncode:\n\n ata8: SATA link up 6.0 Gbps (SStatus 133 SControl 330)\n ata8.15: Port Multiplier 1.2, 0x1b4b:0x9715 r160, 5 ports, feat 0x1/0x1f\n ahci 0000:03:00.0: FBS is enabled\n ata8.00: hard resetting link\n ata8.00: SATA link down (SStatus 0 SControl 330)\n ata8.01: hard resetting link\n ata8.01: SATA link down (SStatus 0 SControl 330)\n ata8.02: hard resetting link\n ata8.02: SATA link down (SStatus 0 SControl 330)\n ata8.03: hard resetting link\n ata8.03: SATA link up 6.0 Gbps (SStatus 133 SControl 133)\n ata8.04: hard resetting link\n ata8.04: failed to resume link (SControl 133)\n ata8.04: failed to read SCR 0 (Emask\u003d0x40)\n ata8.04: failed to read SCR 0 (Emask\u003d0x40)\n ata8.04: failed to read SCR 1 (Emask\u003d0x40)\n ata8.04: failed to read SCR 0 (Emask\u003d0x40)\n ata8.03: native sectors (2) is smaller than sectors (976773168)\n ata8.03: ATA-8: ST3500413AS, JC4B, max UDMA/133\n ata8.03: 976773168 sectors, multi 0: LBA48 NCQ (depth 31/32)\n ata8.03: configured for UDMA/133\n ata8.04: failed to IDENTIFY (I/O error, err_mask\u003d0x100)\n ata8.15: hard resetting link\n ata8.15: SATA link up 6.0 Gbps (SStatus 133 SControl 330)\n ata8.15: Port Multiplier vendor mismatch \u00270x1b4b\u0027 !\u003d \u00270x133\u0027\n ata8.15: PMP revalidation failed (errno\u003d-19)\n ata8.15: hard resetting link\n ata8.15: SATA link up 6.0 Gbps (SStatus 133 SControl 330)\n ata8.15: Port Multiplier vendor mismatch \u00270x1b4b\u0027 !\u003d \u00270x133\u0027\n ata8.15: PMP revalidation failed (errno\u003d-19)\n ata8.15: limiting SATA link speed to 3.0 Gbps\n ata8.15: hard resetting link\n ata8.15: SATA link up 3.0 Gbps (SStatus 123 SControl 320)\n ata8.15: Port Multiplier vendor mismatch \u00270x1b4b\u0027 !\u003d \u00270x133\u0027\n ata8.15: PMP revalidation failed (errno\u003d-19)\n ata8.15: failed to recover PMP after 5 tries, giving up\n ata8.15: Port Multiplier detaching\n ata8.03: disabled\n ata8.00: disabled\n ata8: EH complete\n\nThe reason is that current detection code doesn\u0027t follow AHCI spec:\n\nFirst,the port multiplier detection process look like this:\n\n\tahci_hardreset(link, class, deadline)\n\tif (class \u003d\u003d ATA_DEV_PMP) {\n\t\tsata_pmp_attach(dev)\t/* will enable FBS */\n\t\tsata_pmp_init_links(ap, nr_ports);\n\t\tata_for_each_link(link, ap, EDGE) {\n\t\t\tsata_std_hardreset(link, class, deadline);\n\t\t\tif (link_is_online)\t/* do soft reset */\n\t\t\t\tahci_softreset(link, class, deadline);\n\t\t}\n\t}\nBut, according to chapter 9.3.9 in AHCI spec: Prior to issuing software\nreset, software shall clear PxCMD.ST to \u00270\u0027 and then clear PxFBS.EN to\n\u00270\u0027.\n\nThe patch test ok with kernel 3.11.1.\n\ntj: Patch white space contaminated, applied manually with trivial\n updates.\n\nSigned-off-by: Xiangliang Yu \u003cyuxiangl@marvell.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "4b2162b7f846b9b4326734e305138137ae3491d3", "tree": "74a429aad225bfc10a2077e1832346203119d5db", "parents": [ "bb513cf8a564f6b05836354591435362334e3c66" ], "author": { "name": "Larry Finger", "email": "Larry.Finger@lwfinger.net", "time": "Sun Nov 10 22:11:16 2013 -0600" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:15 2013 -0800" }, "message": "rtlwifi: rtl8192cu: Fix more pointer arithmetic errors\n\ncommit eafbdde9c5629bea58df07275c5917eb42afbbe7 upstream.\n\nThis driver uses a number of macros to get and set various fields in the\nRX and TX descriptors. To work correctly, a u8 pointer to the descriptor\nmust be used; however, in some cases a descriptor structure pointer is used\ninstead. In addition, a duplicated statement is removed.\n\nSigned-off-by: Larry Finger \u003cLarry.Finger@lwfinger.net\u003e\nReported-by: Mark Cave-Ayland \u003cmark.cave-ayland@ilande.co.uk\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "bb513cf8a564f6b05836354591435362334e3c66", "tree": "40a236f0f60eda210dff4f2249ceef994fb03a7d", "parents": [ "22363fb4b996766c83d25f47f2de605a6720ccf0" ], "author": { "name": "Felipe Pena", "email": "felipensp@gmail.com", "time": "Fri Oct 18 21:52:40 2013 -0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:15 2013 -0800" }, "message": "rtlwifi: rtl8192se: Fix wrong assignment\n\ncommit 3aef7dde8dcf09e0124f0a2665845a507331972b upstream.\n\nThere is a typo in the struct member name on assignment when checking\nrtlphy-\u003ecurrent_chan_bw \u003d\u003d HT_CHANNEL_WIDTH_20_40, the check uses pwrgroup_ht40\nfor bound limit and uses pwrgroup_ht20 when assigning instead.\n\nSigned-off-by: Felipe Pena \u003cfelipensp@gmail.com\u003e\nAcked-by: Larry Finger \u003cLarry.Finger@lwfinger.net\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "22363fb4b996766c83d25f47f2de605a6720ccf0", "tree": "193bfb63664b150c614b055926dcd71461e74bad", "parents": [ "80b41caaa1455afd259de89e3d430334f8b57156" ], "author": { "name": "Ryan Mallon", "email": "rmallon@gmail.com", "time": "Tue Nov 12 15:08:51 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:14 2013 -0800" }, "message": "vsprintf: check real user/group id for %pK\n\ncommit 312b4e226951f707e120b95b118cbc14f3d162b2 upstream.\n\nSome setuid binaries will allow reading of files which have read\npermission by the real user id. This is problematic with files which\nuse %pK because the file access permission is checked at open() time,\nbut the kptr_restrict setting is checked at read() time. If a setuid\nbinary opens a %pK file as an unprivileged user, and then elevates\npermissions before reading the file, then kernel pointer values may be\nleaked.\n\nThis happens for example with the setuid pppd application on Ubuntu 12.04:\n\n $ head -1 /proc/kallsyms\n 00000000 T startup_32\n\n $ pppd file /proc/kallsyms\n pppd: In file /proc/kallsyms: unrecognized option \u0027c1000000\u0027\n\nThis will only leak the pointer value from the first line, but other\nsetuid binaries may leak more information.\n\nFix this by adding a check that in addition to the current process having\nCAP_SYSLOG, that effective user and group ids are equal to the real ids.\nIf a setuid binary reads the contents of a file which uses %pK then the\npointer values will be printed as NULL if the real user is unprivileged.\n\nUpdate the sysctl documentation to reflect the changes, and also correct\nthe documentation to state the kptr_restrict\u003d0 is the default.\n\nThis is a only temporary solution to the issue. The correct solution is\nto do the permission check at open() time on files, and to replace %pK\nwith a function which checks the open() time permission. %pK uses in\nprintk should be removed since no sane permission check can be done, and\ninstead protected by using dmesg_restrict.\n\nSigned-off-by: Ryan Mallon \u003crmallon@gmail.com\u003e\nCc: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Alexander Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Joe Perches \u003cjoe@perches.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "80b41caaa1455afd259de89e3d430334f8b57156", "tree": "d053bdf6a65d53045fcb69acaa125bb245dbba98", "parents": [ "e90d50f73953118725bff5b1449e2cbbb9ee3554" ], "author": { "name": "Shan Hai", "email": "shan.hai@windriver.com", "time": "Mon Oct 28 16:08:01 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:14 2013 -0800" }, "message": "drivers/libata: Set max sector to 65535 for Slimtype DVD A DS8A9SH drive\n\ncommit 0523f037f65dba10191b0fa9c51266f90ba64630 upstream.\n\nThe \"Slimtype DVD A DS8A9SH\" drive locks up with following backtrace when\nthe max sector is smaller than 65535 bytes, fix it by adding a quirk to set\nthe max sector to 65535 bytes.\n\nINFO: task flush-11:0:663 blocked for more than 120 seconds.\n\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\nflush-11:0 D 00000000ffff5ceb 0 663 2 0x00000000\n ffff88026d3b1710 0000000000000046 0000000000000001 0000000000000000\n ffff88026f2530c0 ffff88026d365860 ffff88026d3b16e0 ffffffff812ffd52\n ffff88026d4fd3d0 0000000100000001 ffff88026d3b16f0 ffff88026d3b1fd8\nCall Trace:\n [\u003cffffffff812ffd52\u003e] ? cfq_may_queue+0x52/0xf0\n [\u003cffffffff81604338\u003e] schedule+0x18/0x30\n [\u003cffffffff81604392\u003e] io_schedule+0x42/0x60\n [\u003cffffffff812f22bb\u003e] get_request_wait+0xeb/0x1f0\n [\u003cffffffff81065660\u003e] ? autoremove_wake_function+0x0/0x40\n [\u003cffffffff812eb382\u003e] ? elv_merge+0x42/0x210\n [\u003cffffffff812f26ae\u003e] __make_request+0x8e/0x4e0\n [\u003cffffffff812f068e\u003e] generic_make_request+0x21e/0x5e0\n [\u003cffffffff812f0aad\u003e] submit_bio+0x5d/0xd0\n [\u003cffffffff81141422\u003e] submit_bh+0xf2/0x130\n [\u003cffffffff8114474c\u003e] __block_write_full_page+0x1dc/0x3a0\n [\u003cffffffff81143f60\u003e] ? end_buffer_async_write+0x0/0x120\n [\u003cffffffff811474e0\u003e] ? blkdev_get_block+0x0/0x70\n [\u003cffffffff811474e0\u003e] ? blkdev_get_block+0x0/0x70\n [\u003cffffffff81143f60\u003e] ? end_buffer_async_write+0x0/0x120\n [\u003cffffffff811449ee\u003e] block_write_full_page_endio+0xde/0x100\n [\u003cffffffff81144a20\u003e] block_write_full_page+0x10/0x20\n [\u003cffffffff81148703\u003e] blkdev_writepage+0x13/0x20\n [\u003cffffffff810d7525\u003e] __writepage+0x15/0x40\n [\u003cffffffff810d7c0f\u003e] write_cache_pages+0x1cf/0x3e0\n [\u003cffffffff810d7510\u003e] ? __writepage+0x0/0x40\n [\u003cffffffff810d7e42\u003e] generic_writepages+0x22/0x30\n [\u003cffffffff810d7e6f\u003e] do_writepages+0x1f/0x40\n [\u003cffffffff8113ae67\u003e] writeback_single_inode+0xe7/0x3b0\n [\u003cffffffff8113b574\u003e] writeback_sb_inodes+0x184/0x280\n [\u003cffffffff8113bedb\u003e] writeback_inodes_wb+0x6b/0x1a0\n [\u003cffffffff8113c24b\u003e] wb_writeback+0x23b/0x2a0\n [\u003cffffffff8113c42d\u003e] wb_do_writeback+0x17d/0x190\n [\u003cffffffff8113c48b\u003e] bdi_writeback_task+0x4b/0xe0\n [\u003cffffffff810e82a0\u003e] ? bdi_start_fn+0x0/0x100\n [\u003cffffffff810e8321\u003e] bdi_start_fn+0x81/0x100\n [\u003cffffffff810e82a0\u003e] ? bdi_start_fn+0x0/0x100\n [\u003cffffffff8106522e\u003e] kthread+0x8e/0xa0\n [\u003cffffffff81039274\u003e] ? finish_task_switch+0x54/0xc0\n [\u003cffffffff81003334\u003e] kernel_thread_helper+0x4/0x10\n [\u003cffffffff810651a0\u003e] ? kthread+0x0/0xa0\n [\u003cffffffff81003330\u003e] ? kernel_thread_helper+0x0/0x10\n\n The above trace was triggered by\n \"dd if\u003d/dev/zero of\u003d/dev/sr0 bs\u003d2048 count\u003d32768\"\n\nSigned-off-by: Shan Hai \u003cshan.hai@windriver.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e90d50f73953118725bff5b1449e2cbbb9ee3554", "tree": "07d5fe5db1e440fb87b6c9f15d6acdaf78a5f695", "parents": [ "799ed0d9c5ee00600823c5762a9e5b20776a1391" ], "author": { "name": "Gwendal Grignou", "email": "gwendal@google.com", "time": "Fri Oct 25 16:28:57 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:14 2013 -0800" }, "message": "libata: Fix display of sata speed\n\ncommit 3e85c3ecbc520751324a191d23bb94873ed01b10 upstream.\n\n6.0 Gbps link speed was not decoded properly:\nspeed was reported at 3.0 Gbps only.\n\nTested: On a machine where libata reports 6.0 Gbps in\n /var/log/messages:\n ata1: SATA link up 6.0 Gbps (SStatus 133 SControl 300)\n\n Before:\n \tcat /sys/class/ata_link/link1/sata_spd\n \t3.0 Gbps\n After:\n \tcat /sys/class/ata_link/link1/sata_spd\n \t6.0 Gbps\n\nSigned-off-by: Gwendal Grignou \u003cgwendal@google.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "799ed0d9c5ee00600823c5762a9e5b20776a1391", "tree": "69caf763885acfb797a36ea190ccabb2e6a4eb06", "parents": [ "510e627f364a15db3b0848de1429d15f1473b95e" ], "author": { "name": "Marc Kleine-Budde", "email": "mkl@pengutronix.de", "time": "Fri Sep 27 12:15:05 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:14 2013 -0800" }, "message": "can: flexcan: fix flexcan_chip_start() on imx6\n\ncommit 0d1862ea1a5bb876cf05555a7307080cb75bf379 upstream.\n\nIn the flexcan_chip_start() function first the flexcan core is going through\nthe soft reset sequence, then the RX FIFO is enabled.\n\nWith the hardware is put into FIFO mode, message buffers 1...7 are reserved by\nthe FIFO engine. The remaining message buffers are in reset default values.\nThis patch removes the bogus initialization of the message buffers, as it\ncauses an imprecise external abort on imx6.\n\nReported-by: Lothar Waßmann \u003cLW@KARO-electronics.de\u003e\nTested-by: Lothar Waßmann \u003cLW@KARO-electronics.de\u003e\n[mkl: adjusted context for stable]\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "510e627f364a15db3b0848de1429d15f1473b95e", "tree": "0f3c532e32932e857fc15855e034421fe4107bb4", "parents": [ "3e05092412210f3a298ef2a4e5f58857513e9954" ], "author": { "name": "Ilija Hadzic", "email": "ihadzic@research.bell-labs.com", "time": "Tue Nov 12 15:11:45 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:14 2013 -0800" }, "message": "devpts: plug the memory leak in kill_sb\n\ncommit 66da0e1f9034140ae2f571ef96e254a25083906c upstream.\n\nWhen devpts is unmounted, there may be a no-longer-used IDR tree hanging\noff the superblock we are about to kill. This needs to be cleaned up\nbefore destroying the SB.\n\nThe leak is usually not a big deal because unmounting devpts is typically\ndone when shutting down the whole machine. However, shutting down an LXC\ncontainer instead of a physical machine exposes the problem (the garbage\nis detectable with kmemleak).\n\nSigned-off-by: Ilija Hadzic \u003cihadzic@research.bell-labs.com\u003e\nCc: Sukadev Bhattiprolu \u003csukadev@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "3e05092412210f3a298ef2a4e5f58857513e9954", "tree": "d9bb8d5c47986907e7ac939ef90cad5a32708c2b", "parents": [ "664eaaa26bca6272673eff01ba5468f95905039d" ], "author": { "name": "KOSAKI Motohiro", "email": "kosaki.motohiro@jp.fujitsu.com", "time": "Mon Oct 14 17:33:16 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:14 2013 -0800" }, "message": "alarmtimer: return EINVAL instead of ENOTSUPP if rtcdev doesn\u0027t exist\n\ncommit 98d6f4dd84a134d942827584a3c5f67ffd8ec35f upstream.\n\nFedora Ruby maintainer reported latest Ruby doesn\u0027t work on Fedora Rawhide\non ARM. (http://bugs.ruby-lang.org/issues/9008)\n\nBecause of, commit 1c6b39ad3f (alarmtimers: Return -ENOTSUPP if no\nRTC device is present) intruduced to return ENOTSUPP when\nclock_get{time,res} can\u0027t find a RTC device. However this is incorrect.\n\nFirst, ENOTSUPP isn\u0027t exported to userland (ENOTSUP or EOPNOTSUP are the\nclosest userland equivlents).\n\nSecond, Posix and Linux man pages agree that clock_gettime and\nclock_getres should return EINVAL if clk_id argument is invalid.\nWhile the arugment that the clockid is valid, but just not supported\non this hardware could be made, this is just a technicality that\ndoesn\u0027t help userspace applicaitons, and only complicates error\nhandling.\n\nThus, this patch changes the code to use EINVAL.\n\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nReported-by: Vit Ondruch \u003cv.ondruch@tiscali.cz\u003e\nSigned-off-by: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\n[jstultz: Tweaks to commit message to include full rational]\nSigned-off-by: John Stultz \u003cjohn.stultz@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "664eaaa26bca6272673eff01ba5468f95905039d", "tree": "daaf5c831bae4d8151b6a5e3f9dccd168795b037", "parents": [ "f5f4825a345b637c81a017ed19a6ea47783cf811" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Nov 13 17:15:00 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:14 2013 -0800" }, "message": "ASoC: blackfin: Fix missing break\n\ncommit afed4dbe3a043dbd833a53b6b4951e155708afd2 upstream.\n\nFixes: 4b2ffc205cb9 (\u0027ASoC: Blackfin I2S: add 8-bit sample support\u0027)\nReported-by: David Binderman\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Mark Brown \u003cbroonie@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f5f4825a345b637c81a017ed19a6ea47783cf811", "tree": "98cc36912eb582c60d45f21a2761331bead1b5ee", "parents": [ "6a4e636d9f9bab7410c90ac091154d85a81e21ee" ], "author": { "name": "Nicolin Chen", "email": "b42378@freescale.com", "time": "Thu Nov 14 11:59:21 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:13 2013 -0800" }, "message": "ASoC: wm8962: Turn on regcache_cache_only before disabling regulator\n\ncommit 50bfcf2df2fadf77e143d6099150e6fa7ef4d78c upstream.\n\nIt\u0027s safer to turn on regcache_cache_only before disabling regulator since\nthe driver will turn off the regcache_cache_only after enabling regulator.\n\nIf we remain cache_only false, some command like \u0027amixer cset\u0027 would get\nfailure if being run before wm8962_resume().\n\nSigned-off-by: Nicolin Chen \u003cb42378@freescale.com\u003e\nSigned-off-by: Mark Brown \u003cbroonie@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6a4e636d9f9bab7410c90ac091154d85a81e21ee", "tree": "394395318ba74fcbf5b5394dfbe8fd161b30c03a", "parents": [ "c504aa16ae29f5c60754eff219a1462aa6548b21" ], "author": { "name": "Phil Edworthy", "email": "phil.edworthy@renesas.com", "time": "Thu Oct 31 23:06:17 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:13 2013 -0800" }, "message": "ASoC: ak4642: prevent un-necessary changes to SG_SL1\n\ncommit 7b5bfb82882b9b1c8423ce0ed6852ca3762d967a upstream.\n\nIf you record the sound during playback,\nthe playback sound becomes silent.\nModify so that the codec driver does not clear\nSG_SL1::DACL bit which is controlled under widget\n\nSigned-off-by: Phil Edworthy \u003cphil.edworthy@renesas.com\u003e\nSigned-off-by: Kuninori Morimoto \u003ckuninori.morimoto.gx@renesas.com\u003e\nSigned-off-by: Mark Brown \u003cbroonie@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c504aa16ae29f5c60754eff219a1462aa6548b21", "tree": "d250d41f50be15a8ccf15526bbdc783996e6c57d", "parents": [ "e3f8bcd36db9a86b78738224ff37e875cc793782" ], "author": { "name": "Johan Hovold", "email": "jhovold@gmail.com", "time": "Tue Nov 12 15:09:38 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:13 2013 -0800" }, "message": "backlight: atmel-pwm-bl: fix reported brightness\n\ncommit 185d91442550110db67a7dc794a32efcea455a36 upstream.\n\nThe driver supports 16-bit brightness values, but the value returned\nfrom get_brightness was truncated to eight bits.\n\nSigned-off-by: Johan Hovold \u003cjhovold@gmail.com\u003e\nCc: Jingoo Han \u003cjg1.han@samsung.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e3f8bcd36db9a86b78738224ff37e875cc793782", "tree": "6728990b6380fc446615b7dc92513d1880842e7c", "parents": [ "b823b82878ad6c8d938bb99fb3ed3f6c75b0f323" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 27 09:32:49 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:13 2013 -0800" }, "message": "Staging: tidspbridge: disable driver\n\ncommit 930ba4a374b96560ef9fde2145cdc454a164ddcc upstream.\n\nThere seems to be no active maintainer for the driver, and there is an\nunfixed security bug, so disable the driver for now.\n\nHopefully someone steps up to be the maintainer, and works to get this\nout of staging, otherwise it will be deleted soon.\n\nReported-by: Nico Golde \u003cnico@ngolde.de\u003e\nReported-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nCc: Omar Ramirez Luna \u003comar.ramirez@copitl.com\u003e\nCc: Omar Ramirez Luna \u003comar.ramirez@ti.com\u003e\nCc: Kanigeri, Hari \u003ch-kanigeri2@ti.com\u003e\nCc: Ameya Palande \u003cameya.palande@nokia.com\u003e\nCc: Guzman Lugo, Fernando \u003cfernando.lugo@ti.com\u003e\nCc: Hebbar, Shivananda \u003cx0hebbar@ti.com\u003e\nCc: Ramos Falcon, Ernesto \u003cernesto@ti.com\u003e\nCc: Felipe Contreras \u003cfelipe.contreras@gmail.com\u003e\nCc: Anna, Suman \u003cs-anna@ti.com\u003e\nCc: Gupta, Ramesh \u003cgrgupta@ti.com\u003e\nCc: Gomez Castellanos, Ivan \u003civan.gomez@ti.com\u003e\nCc: Andy Shevchenko \u003cext-andriy.shevchenko@nokia.com\u003e\nCc: Armando Uribe De Leon \u003cx0095078@ti.com\u003e\nCc: Deepak Chitriki \u003cdeepak.chitriki@ti.com\u003e\nCc: Menon, Nishanth \u003cnm@ti.com\u003e\nCc: Phil Carmody \u003cext-phil.2.carmody@nokia.com\u003e\nCc: Ohad Ben-Cohen \u003cohad@wizery.com\u003e\nCc: stable \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b823b82878ad6c8d938bb99fb3ed3f6c75b0f323", "tree": "67c3ebd766e2e3f80459a1b86784296c45f2f119", "parents": [ "d88da9d09672eddc30d50dec14cd8ddc3fbc284c" ], "author": { "name": "Jonathan Austin", "email": "jonathan.austin@arm.com", "time": "Thu Aug 29 18:41:11 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:13 2013 -0800" }, "message": "ARM: integrator_cp: Set LCD{0,1} enable lines when turning on CLCD\n\ncommit 30aeadd44deea3f3b0df45b9a70ee0fd5f8d6dc2 upstream.\n\nThis turns on the internal integrator LCD display(s). It seems that the code\nto do this got lost in refactoring of the CLCD driver.\n\nSigned-off-by: Jonathan Austin \u003cjonathan.austin@arm.com\u003e\nAcked-by: Linus Walleij \u003clinus.walleij@linaro.org\u003e\nSigned-off-by: Olof Johansson \u003colof@lixom.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d88da9d09672eddc30d50dec14cd8ddc3fbc284c", "tree": "7154b09b2756d659ecd6d83d12785d315a7f8dd8", "parents": [ "71ea1738746efcffab98ff04a8a634a2e2a94400" ], "author": { "name": "Russell King", "email": "rmk+kernel@arm.linux.org.uk", "time": "Wed Oct 16 00:09:02 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:13 2013 -0800" }, "message": "ARM: sa11x0/assabet: ensure CS2 is configured appropriately\n\ncommit f3964fe1c9d9a887d65faf594669852e4dec46e0 upstream.\n\nThe CS2 region contains the Assabet board configuration and status\nregisters, which are 32-bit. Unfortunately, some boot loaders do not\nconfigure this region correctly, leaving it setup as a 16-bit region.\nFix this.\n\nSigned-off-by: Russell King \u003crmk+kernel@arm.linux.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "71ea1738746efcffab98ff04a8a634a2e2a94400", "tree": "f13d9330458381ebde444e6d056589e4ef43a7e3", "parents": [ "778409c66ec599e51e5c1901b9f3631356df5a13" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:58 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:58 2013 -0800" }, "message": "Linux 3.4.71\n" }, { "commit": "778409c66ec599e51e5c1901b9f3631356df5a13", "tree": "d56615bc29df0e8399b205fa03a5bba73b3d2733", "parents": [ "b4db55f32a9b0172a24fb52143f10609708c17ff" ], "author": { "name": "Mauro Carvalho Chehab", "email": "m.chehab@samsung.com", "time": "Tue Nov 12 15:06:49 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:37 2013 -0800" }, "message": "cris: media platform drivers: fix build\n\ncommit 72a0c5571351f5184195754d23db3e14495b2080 upstream.\n\nOn cris arch, the functions below aren\u0027t defined:\n\n drivers/media/platform/sh_veu.c: In function \u0027sh_veu_reg_read\u0027:\n\n drivers/media/platform/sh_veu.c:228:2: error: implicit declaration of function \u0027ioread32\u0027 [-Werror\u003dimplicit-function-declaration]\n drivers/media/platform/sh_veu.c: In function \u0027sh_veu_reg_write\u0027:\n\n drivers/media/platform/sh_veu.c:234:2: error: implicit declaration of function \u0027iowrite32\u0027 [-Werror\u003dimplicit-function-declaration]\n drivers/media/platform/vsp1/vsp1.h: In function \u0027vsp1_read\u0027:\n drivers/media/platform/vsp1/vsp1.h:66:2: error: implicit declaration of function \u0027ioread32\u0027 [-Werror\u003dimplicit-function-declaration]\n drivers/media/platform/vsp1/vsp1.h: In function \u0027vsp1_write\u0027:\n drivers/media/platform/vsp1/vsp1.h:71:2: error: implicit declaration of function \u0027iowrite32\u0027 [-Werror\u003dimplicit-function-declaration]\n drivers/media/platform/vsp1/vsp1.h: In function \u0027vsp1_read\u0027:\n drivers/media/platform/vsp1/vsp1.h:66:2: error: implicit declaration of function \u0027ioread32\u0027 [-Werror\u003dimplicit-function-declaration]\n drivers/media/platform/vsp1/vsp1.h: In function \u0027vsp1_write\u0027:\n drivers/media/platform/vsp1/vsp1.h:71:2: error: implicit declaration of function \u0027iowrite32\u0027 [-Werror\u003dimplicit-function-declaration]\n drivers/media/platform/soc_camera/rcar_vin.c: In function \u0027rcar_vin_setup\u0027:\n drivers/media/platform/soc_camera/rcar_vin.c:284:3: error: implicit declaration of function \u0027iowrite32\u0027 [-Werror\u003dimplicit-function-declaration]\n\n drivers/media/platform/soc_camera/rcar_vin.c: In function \u0027rcar_vin_request_capture_stop\u0027:\n drivers/media/platform/soc_camera/rcar_vin.c:353:2: error: implicit declaration of function \u0027ioread32\u0027 [-Werror\u003dimplicit-function-declaration]\n\nYet, they\u0027re available, as CONFIG_GENERIC_IOMAP is defined. What happens\nis that asm/io.h was not including asm-generic/iomap.h.\n\nSuggested-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cm.chehab@samsung.com\u003e\nCc: Mikael Starvik \u003cstarvik@axis.com\u003e\nCc: Jesper Nilsson \u003cjesper.nilsson@axis.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b4db55f32a9b0172a24fb52143f10609708c17ff", "tree": "fbe57185503c568c2a5e094a9f0a4742ae59f3dd", "parents": [ "f087a3e5c6d46a7ce7eeb5481612118104abebb8" ], "author": { "name": "Junxiao Bi", "email": "junxiao.bi@oracle.com", "time": "Thu Nov 21 14:31:56 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:37 2013 -0800" }, "message": "configfs: fix race between dentry put and lookup\n\ncommit 76ae281f6307331aa063288edb6422ae99f435f0 upstream.\n\nA race window in configfs, it starts from one dentry is UNHASHED and end\nbefore configfs_d_iput is called. In this window, if a lookup happen,\nsince the original dentry was UNHASHED, so a new dentry will be\nallocated, and then in configfs_attach_attr(), sd-\u003es_dentry will be\nupdated to the new dentry. Then in configfs_d_iput(),\nBUG_ON(sd-\u003es_dentry !\u003d dentry) will be triggered and system panic.\n\nsys_open: sys_close:\n ... fput\n dput\n dentry_kill\n __d_drop \u003c--- dentry unhashed here,\n but sd-\u003edentry still point\n to this dentry.\n\n lookup_real\n configfs_lookup\n configfs_attach_attr---\u003e update sd-\u003es_dentry\n to new allocated dentry here.\n\n d_kill\n configfs_d_iput \u003c--- BUG_ON(sd-\u003es_dentry !\u003d dentry)\n triggered here.\n\nTo fix it, change configfs_d_iput to not update sd-\u003es_dentry if\nsd-\u003es_count \u003e 2, that means there are another dentry is using the sd\nbeside the one that is going to be put. Use configfs_dirent_lock in\nconfigfs_attach_attr to sync with configfs_d_iput.\n\nWith the following steps, you can reproduce the bug.\n\n1. enable ocfs2, this will mount configfs at /sys/kernel/config and\n fill configure in it.\n\n2. run the following script.\n\twhile [ 1 ]; do cat /sys/kernel/config/cluster/$your_cluster_name/idle_timeout_ms \u003e /dev/null; done \u0026\n\twhile [ 1 ]; do cat /sys/kernel/config/cluster/$your_cluster_name/idle_timeout_ms \u003e /dev/null; done \u0026\n\nSigned-off-by: Junxiao Bi \u003cjunxiao.bi@oracle.com\u003e\nCc: Joel Becker \u003cjlbec@evilplan.org\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f087a3e5c6d46a7ce7eeb5481612118104abebb8", "tree": "7f8440ca234b1066dc78e22c0f26b0100bfcd7fe", "parents": [ "53c620ea44ffb999ab52975e42ff3dce19937a86" ], "author": { "name": "Stanislaw Gruszka", "email": "sgruszka@redhat.com", "time": "Fri Oct 18 11:36:54 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:37 2013 -0800" }, "message": "rt2800usb: slow down TX status polling\n\ncommit 36165fd5b00bf8163f89c21bb16a3e9834555b10 upstream.\n\nPolling TX statuses too frequently has two negative effects. First is\nrandomly peek CPU usage, causing overall system functioning delays.\nSecond bad effect is that device is not able to fill TX statuses in\nH/W register on some workloads and we get lot of timeouts like below:\n\nieee80211 phy4: rt2800usb_entry_txstatus_timeout: Warning - TX status timeout for entry 7 in queue 2\nieee80211 phy4: rt2800usb_entry_txstatus_timeout: Warning - TX status timeout for entry 7 in queue 2\nieee80211 phy4: rt2800usb_txdone: Warning - Got TX status for an empty queue 2, dropping\n\nThis not only cause flood of messages in dmesg, but also bad throughput,\nsince rate scaling algorithm can not work optimally.\n\nIn the future, we should probably make polling interval be adjusted\nautomatically, but for now just increase values, this make mentioned\nproblems gone.\n\nResolve:\nhttps://bugzilla.kernel.org/show_bug.cgi?id\u003d62781\n\nSigned-off-by: Stanislaw Gruszka \u003csgruszka@redhat.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "53c620ea44ffb999ab52975e42ff3dce19937a86", "tree": "b906d4cfafc3e0241e0155ef635c42240a18f967", "parents": [ "6beceb767ed86175601237fb3f2d2ff9678fca86" ], "author": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Fri Nov 08 16:03:50 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:36 2013 -0800" }, "message": "SUNRPC: Fix a data corruption issue when retransmitting RPC calls\n\ncommit a6b31d18b02ff9d7915c5898c9b5ca41a798cd73 upstream.\n\nThe following scenario can cause silent data corruption when doing\nNFS writes. It has mainly been observed when doing database writes\nusing O_DIRECT.\n\n1) The RPC client uses sendpage() to do zero-copy of the page data.\n2) Due to networking issues, the reply from the server is delayed,\n and so the RPC client times out.\n\n3) The client issues a second sendpage of the page data as part of\n an RPC call retransmission.\n\n4) The reply to the first transmission arrives from the server\n _before_ the client hardware has emptied the TCP socket send\n buffer.\n5) After processing the reply, the RPC state machine rules that\n the call to be done, and triggers the completion callbacks.\n6) The application notices the RPC call is done, and reuses the\n pages to store something else (e.g. a new write).\n\n7) The client NIC drains the TCP socket send buffer. Since the\n page data has now changed, it reads a corrupted version of the\n initial RPC call, and puts it on the wire.\n\nThis patch fixes the problem in the following manner:\n\nThe ordering guarantees of TCP ensure that when the server sends a\nreply, then we know that the _first_ transmission has completed. Using\nzero-copy in that situation is therefore safe.\nIf a time out occurs, we then send the retransmission using sendmsg()\n(i.e. no zero-copy), We then know that the socket contains a full copy of\nthe data, and so it will retransmit a faithful reproduction even if the\nRPC call completes, and the application reuses the O_DIRECT buffer in\nthe meantime.\n\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6beceb767ed86175601237fb3f2d2ff9678fca86", "tree": "eefe3b1c389ac114125edf94a54ec703d4887be8", "parents": [ "b745b007adf0d7786a9b63a8e2ec91b8bbcdbb61" ], "author": { "name": "Michael Neuling", "email": "mikey@neuling.org", "time": "Wed Nov 20 16:18:54 2013 +1100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:36 2013 -0800" }, "message": "powerpc/signals: Mark VSX not saved with small contexts\n\ncommit c13f20ac48328b05cd3b8c19e31ed6c132b44b42 upstream.\n\nThe VSX MSR bit in the user context indicates if the context contains VSX\nstate. Currently we set this when the process has touched VSX at any stage.\n\nUnfortunately, if the user has not provided enough space to save the VSX state,\nwe can\u0027t save it but we currently still set the MSR VSX bit.\n\nThis patch changes this to clear the MSR VSX bit when the user doesn\u0027t provide\nenough space. This indicates that there is no valid VSX state in the user\ncontext.\n\nThis is needed to support get/set/make/swapcontext for applications that use\nVSX but only provide a small context. For example, getcontext in glibc\nprovides a smaller context since the VSX registers don\u0027t need to be saved over\nthe glibc function call. But since the program calling getcontext may have\nused VSX, the kernel currently says the VSX state is valid when it\u0027s not. If\nthe returned context is then used in setcontext (ie. a small context without\nVSX but with MSR VSX set), the kernel will refuse the context. This situation\nhas been reported by the glibc community.\n\nBased on patch from Carlos O\u0027Donell.\n\nTested-by: Haren Myneni \u003charen@linux.vnet.ibm.com\u003e\nSigned-off-by: Michael Neuling \u003cmikey@neuling.org\u003e\nSigned-off-by: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b745b007adf0d7786a9b63a8e2ec91b8bbcdbb61", "tree": "4fc6a5169d5156af8d83c77823a23d46260ae417", "parents": [ "49aa69febe1dc8643e2d75ffcdf9504337fe4f7e" ], "author": { "name": "Gavin Shan", "email": "shangw@linux.vnet.ibm.com", "time": "Mon Nov 04 16:32:46 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:36 2013 -0800" }, "message": "powerpc/powernv: Add PE to its own PELTV\n\ncommit 631ad691b5818291d89af9be607d2fe40be0886e upstream.\n\nWe need add PE to its own PELTV. Otherwise, the errors originated\nfrom the PE might contribute to other PEs. In the result, we can\u0027t\nclear up the error successfully even we\u0027re checking and clearing\nerrors during access to PCI config space.\n\nReported-by: kalshett@in.ibm.com\nSigned-off-by: Gavin Shan \u003cshangw@linux.vnet.ibm.com\u003e\nSigned-off-by: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "49aa69febe1dc8643e2d75ffcdf9504337fe4f7e", "tree": "6413c65343ceda85d09b739689d25c96571505f9", "parents": [ "801327994060b0ae3749257d264a7bfea119b46c" ], "author": { "name": "Prarit Bhargava", "email": "prarit@redhat.com", "time": "Thu Oct 17 08:00:11 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:36 2013 -0800" }, "message": "powerpc/vio: use strcpy in modalias_show\n\ncommit 411cabf79e684171669ad29a0628c400b4431e95 upstream.\n\nCommit e82b89a6f19bae73fb064d1b3dd91fcefbb478f4 used strcat instead of\nstrcpy which can result in an overflow of newlines on the buffer.\n\nSigned-off-by: Prarit Bhargava\nCc: benh@kernel.crashing.org\nCc: ben@decadent.org.uk\nSigned-off-by: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "801327994060b0ae3749257d264a7bfea119b46c", "tree": "f06d24743c51b4aa314d44c452ccc6642298ce74", "parents": [ "82b80fae0eb0c2d18414f7e678e04a4e7f88ecbe" ], "author": { "name": "Mike Snitzer", "email": "snitzer@redhat.com", "time": "Fri Oct 18 09:44:49 2013 -0600" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:36 2013 -0800" }, "message": "block: properly stack underlying max_segment_size to DM device\n\ncommit d82ae52e68892338068e7559a0c0657193341ce4 upstream.\n\nWithout this patch all DM devices will default to BLK_MAX_SEGMENT_SIZE\n(65536) even if the underlying device(s) have a larger value -- this is\ndue to blk_stack_limits() using min_not_zero() when stacking the\nmax_segment_size limit.\n\n1073741824\n\nbefore patch:\n65536\n\nafter patch:\n1073741824\n\nReported-by: Lukasz Flis \u003cl.flis@cyfronet.pl\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "82b80fae0eb0c2d18414f7e678e04a4e7f88ecbe", "tree": "99866aa3ecfb37f6ec3afaa3eecdf6b796d6de87", "parents": [ "5413d6c032afde960c16c735eef40f9b85fa9132" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Mon Oct 14 12:13:24 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:36 2013 -0800" }, "message": "block: fix a probe argument to blk_register_region\n\ncommit a207f5937630dd35bd2550620bef416937a1365e upstream.\n\nThe probe function is supposed to return NULL on failure (as we can see in\nkobj_lookup: kobj \u003d probe(dev, index, data); ... if (kobj) return kobj;\n\nHowever, in loop and brd, it returns negative error from ERR_PTR.\n\nThis causes a crash if we simulate disk allocation failure and run\nless -f /dev/loop0 because the negative number is interpreted as a pointer:\n\nBUG: unable to handle kernel NULL pointer dereference at 00000000000002b4\nIP: [\u003cffffffff8118b188\u003e] __blkdev_get+0x28/0x450\nPGD 23c677067 PUD 23d6d1067 PMD 0\nOops: 0000 [#1] PREEMPT SMP\nModules linked in: loop hpfs nvidia(PO) ip6table_filter ip6_tables uvesafb cfbcopyarea cfbimgblt cfbfillrect fbcon font bitblit fbcon_rotate fbcon_cw fbcon_ud fbcon_ccw softcursor fb fbdev msr ipt_MASQUERADE iptable_nat nf_nat_ipv4 nf_conntrack_ipv4 nf_defrag_ipv4 xt_state ipt_REJECT xt_tcpudp iptable_filter ip_tables x_tables bridge stp llc tun ipv6 cpufreq_stats cpufreq_ondemand cpufreq_userspace cpufreq_powersave cpufreq_conservative hid_generic spadfs usbhid hid fuse raid0 snd_usb_audio snd_pcm_oss snd_mixer_oss md_mod snd_pcm snd_timer snd_page_alloc snd_hwdep snd_usbmidi_lib dmi_sysfs snd_rawmidi nf_nat_ftp nf_nat nf_conntrack_ftp nf_conntrack snd soundcore lm85 hwmon_vid ohci_hcd ehci_pci ehci_hcd serverworks sata_svw libata acpi_cpufreq freq_table mperf ide_core usbcore kvm_amd kvm tg3 i2c_piix4 libphy microcode e100 usb_common ptp skge i2c_core pcspkr k10temp evdev floppy hwmon pps_core mii rtc_cmos button processor unix [last unloaded: nvidia]\nCPU: 1 PID: 6831 Comm: less Tainted: P W O 3.10.15-devel #18\nHardware name: empty empty/S3992-E, BIOS \u0027V1.06 \u0027 06/09/2009\ntask: ffff880203cc6bc0 ti: ffff88023e47c000 task.ti: ffff88023e47c000\nRIP: 0010:[\u003cffffffff8118b188\u003e] [\u003cffffffff8118b188\u003e] __blkdev_get+0x28/0x450\nRSP: 0018:ffff88023e47dbd8 EFLAGS: 00010286\nRAX: ffffffffffffff74 RBX: ffffffffffffff74 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001\nRBP: ffff88023e47dc18 R08: 0000000000000002 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffff88023f519658\nR13: ffffffff8118c300 R14: 0000000000000000 R15: ffff88023f519640\nFS: 00007f2070bf7700(0000) GS:ffff880247400000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000000002b4 CR3: 000000023da1d000 CR4: 00000000000007e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\nStack:\n 0000000000000002 0000001d00000000 000000003e47dc50 ffff88023f519640\n ffff88043d5bb668 ffffffff8118c300 ffff88023d683550 ffff88023e47de60\n ffff88023e47dc98 ffffffff8118c10d 0000001d81605698 0000000000000292\nCall Trace:\n [\u003cffffffff8118c300\u003e] ? blkdev_get_by_dev+0x60/0x60\n [\u003cffffffff8118c10d\u003e] blkdev_get+0x1dd/0x370\n [\u003cffffffff8118c300\u003e] ? blkdev_get_by_dev+0x60/0x60\n [\u003cffffffff813cea6c\u003e] ? _raw_spin_unlock+0x2c/0x50\n [\u003cffffffff8118c300\u003e] ? blkdev_get_by_dev+0x60/0x60\n [\u003cffffffff8118c365\u003e] blkdev_open+0x65/0x80\n [\u003cffffffff8114d12e\u003e] do_dentry_open.isra.18+0x23e/0x2f0\n [\u003cffffffff8114d214\u003e] finish_open+0x34/0x50\n [\u003cffffffff8115e122\u003e] do_last.isra.62+0x2d2/0xc50\n [\u003cffffffff8115eb58\u003e] path_openat.isra.63+0xb8/0x4d0\n [\u003cffffffff81115a8e\u003e] ? might_fault+0x4e/0xa0\n [\u003cffffffff8115f4f0\u003e] do_filp_open+0x40/0x90\n [\u003cffffffff813cea6c\u003e] ? _raw_spin_unlock+0x2c/0x50\n [\u003cffffffff8116db85\u003e] ? __alloc_fd+0xa5/0x1f0\n [\u003cffffffff8114e45f\u003e] do_sys_open+0xef/0x1d0\n [\u003cffffffff8114e559\u003e] SyS_open+0x19/0x20\n [\u003cffffffff813cff16\u003e] system_call_fastpath+0x1a/0x1f\nCode: 44 00 00 55 48 89 e5 41 57 49 89 ff 41 56 41 89 d6 41 55 41 54 4c 8d 67 18 53 48 83 ec 18 89 75 cc e9 f2 00 00 00 0f 1f 44 00 00 \u003c48\u003e 8b 80 40 03 00 00 48 89 df 4c 8b 68 58 e8 d5\na4 07 00 44 89\nRIP [\u003cffffffff8118b188\u003e] __blkdev_get+0x28/0x450\n RSP \u003cffff88023e47dbd8\u003e\nCR2: 00000000000002b4\n---[ end trace bb7f32dbf02398dc ]---\n\nThe brd change should be backported to stable kernels starting with 2.6.25.\nThe loop change should be backported to stable kernels starting with 2.6.22.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nAcked-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5413d6c032afde960c16c735eef40f9b85fa9132", "tree": "91bf53b9f824ea6d87495c7cd5a113a9a66fffe4", "parents": [ "cf359232f6c3eaf6ddff242a2b8247e20b29c436" ], "author": { "name": "Jeff Moyer", "email": "jmoyer@redhat.com", "time": "Tue Oct 08 14:36:41 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:35 2013 -0800" }, "message": "block: fix race between request completion and timeout handling\n\ncommit 4912aa6c11e6a5d910264deedbec2075c6f1bb73 upstream.\n\ncrocode i2c_i801 i2c_core iTCO_wdt iTCO_vendor_support shpchp ioatdma dca be2net sg ses enclosure ext4 mbcache jbd2 sd_mod crc_t10dif ahci megaraid_sas(U) dm_mirror dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan]\n\nPid: 491, comm: scsi_eh_0 Tainted: G W ---------------- 2.6.32-220.13.1.el6.x86_64 #1 IBM -[8722PAX]-/00D1461\nRIP: 0010:[\u003cffffffff8124e424\u003e] [\u003cffffffff8124e424\u003e] blk_requeue_request+0x94/0xa0\nRSP: 0018:ffff881057eefd60 EFLAGS: 00010012\nRAX: ffff881d99e3e8a8 RBX: ffff881d99e3e780 RCX: ffff881d99e3e8a8\nRDX: ffff881d99e3e8a8 RSI: ffff881d99e3e780 RDI: ffff881d99e3e780\nRBP: ffff881057eefd80 R08: ffff881057eefe90 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffff881057f92338\nR13: 0000000000000000 R14: ffff881057f92338 R15: ffff883058188000\nFS: 0000000000000000(0000) GS:ffff880040200000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b\nCR2: 00000000006d3ec0 CR3: 000000302cd7d000 CR4: 00000000000406b0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\nProcess scsi_eh_0 (pid: 491, threadinfo ffff881057eee000, task ffff881057e29540)\nStack:\n 0000000000001057 0000000000000286 ffff8810275efdc0 ffff881057f16000\n\u003c0\u003e ffff881057eefdd0 ffffffff81362323 ffff881057eefe20 ffffffff8135f393\n\u003c0\u003e ffff881057e29af8 ffff8810275efdc0 ffff881057eefe78 ffff881057eefe90\nCall Trace:\n [\u003cffffffff81362323\u003e] __scsi_queue_insert+0xa3/0x150\n [\u003cffffffff8135f393\u003e] ? scsi_eh_ready_devs+0x5e3/0x850\n [\u003cffffffff81362a23\u003e] scsi_queue_insert+0x13/0x20\n [\u003cffffffff8135e4d4\u003e] scsi_eh_flush_done_q+0x104/0x160\n [\u003cffffffff8135fb6b\u003e] scsi_error_handler+0x35b/0x660\n [\u003cffffffff8135f810\u003e] ? scsi_error_handler+0x0/0x660\n [\u003cffffffff810908c6\u003e] kthread+0x96/0xa0\n [\u003cffffffff8100c14a\u003e] child_rip+0xa/0x20\n [\u003cffffffff81090830\u003e] ? kthread+0x0/0xa0\n [\u003cffffffff8100c140\u003e] ? child_rip+0x0/0x20\nCode: 00 00 eb d1 4c 8b 2d 3c 8f 97 00 4d 85 ed 74 bf 49 8b 45 00 49 83 c5 08 48 89 de 4c 89 e7 ff d0 49 8b 45 00 48 85 c0 75 eb eb a4 \u003c0f\u003e 0b eb fe 0f 1f 84 00 00 00 00 00 55 48 89 e5 0f 1f 44 00 00\nRIP [\u003cffffffff8124e424\u003e] blk_requeue_request+0x94/0xa0\n RSP \u003cffff881057eefd60\u003e\n\nThe RIP is this line:\n BUG_ON(blk_queued_rq(rq));\n\nAfter digging through the code, I think there may be a race between the\nrequest completion and the timer handler running.\n\nA timer is started for each request put on the device\u0027s queue (see\nblk_start_request-\u003eblk_add_timer). If the request does not complete\nbefore the timer expires, the timer handler (blk_rq_timed_out_timer)\nwill mark the request complete atomically:\n\nstatic inline int blk_mark_rq_complete(struct request *rq)\n{\n return test_and_set_bit(REQ_ATOM_COMPLETE, \u0026rq-\u003eatomic_flags);\n}\n\nand then call blk_rq_timed_out. The latter function will call\nscsi_times_out, which will return one of BLK_EH_HANDLED,\nBLK_EH_RESET_TIMER or BLK_EH_NOT_HANDLED. If BLK_EH_RESET_TIMER is\nreturned, blk_clear_rq_complete is called, and blk_add_timer is again\ncalled to simply wait longer for the request to complete.\n\nNow, if the request happens to complete while this is going on, what\nhappens? Given that we know the completion handler will bail if it\nfinds the REQ_ATOM_COMPLETE bit set, we need to focus on the completion\nhandler running after that bit is cleared. So, from the above\nparagraph, after the call to blk_clear_rq_complete. If the completion\nsets REQ_ATOM_COMPLETE before the BUG_ON in blk_add_timer, we go boom\nthere (I haven\u0027t seen this in the cores). Next, if we get the\ncompletion before the call to list_add_tail, then the timer will\neventually fire for an old req, which may either be freed or reallocated\n(there is evidence that this might be the case). Finally, if the\ncompletion comes in *after* the addition to the timeout list, I think\nit\u0027s harmless. The request will be removed from the timeout list,\nreq_atom_complete will be set, and all will be well.\n\nThis will only actually explain the coredumps *IF* the request\nstructure was freed, reallocated *and* queued before the error handler\nthread had a chance to process it. That is possible, but it may make\nsense to keep digging for another race. I think that if this is what\nwas happening, we would see other instances of this problem showing up\nas null pointer or garbage pointer dereferences, for example when the\nrequest structure was not re-used. It looks like we actually do run\ninto that situation in other reports.\n\nThis patch moves the BUG_ON(test_bit(REQ_ATOM_COMPLETE,\n\u0026req-\u003eatomic_flags)); from blk_add_timer to the only caller that could\ntrip over it (blk_start_request). It then inverts the calls to\nblk_clear_rq_complete and blk_add_timer in blk_rq_timed_out to address\nthe race. I\u0027ve boot tested this patch, but nothing more.\n\nSigned-off-by: Jeff Moyer \u003cjmoyer@redhat.com\u003e\nAcked-by: Hannes Reinecke \u003chare@suse.de\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "cf359232f6c3eaf6ddff242a2b8247e20b29c436", "tree": "ed78117b8b2ace3ff821d4ee8053e0076013b703", "parents": [ "b227aa81f4a892ad31e202aba1de8449d131e670" ], "author": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Fri Nov 15 10:40:38 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:35 2013 -0800" }, "message": "hwmon: (lm90) Fix max6696 alarm handling\n\ncommit e41fae2b1ed8c78283d73651cd65be0228c0dd1c upstream.\n\nBit 2 of status register 2 on MAX6696 (external diode 2 open)\nsets ALERT; the bit thus has to be listed in alert_alarms.\nAlso display a message in the alert handler if the condition\nis encountered.\n\nEven though not all overtemperature conditions cause ALERT\nto be set, we should not ignore them in the alert handler.\nDisplay messages for all out-of-range conditions.\n\nReported-by: Jean Delvare \u003ckhali@linux-fr.org\u003e\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\nSigned-off-by: Jean Delvare \u003ckhali@linux-fr.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b227aa81f4a892ad31e202aba1de8449d131e670", "tree": "6dd8b1eff44d1c8c9ea5de7a975d8f123c3ec5ce", "parents": [ "107bb3cc6b12d800f9949f5ecae808caae38a9f5" ], "author": { "name": "Thomas Renninger", "email": "trenn@suse.de", "time": "Tue Nov 12 17:39:43 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:35 2013 -0800" }, "message": "x86/microcode/amd: Tone down printk(), don\u0027t treat a missing firmware file as an error\n\ncommit 11f918d3e2d3861b6931e97b3aa778e4984935aa upstream.\n\nDo it the same way as done in microcode_intel.c: use pr_debug()\nfor missing firmware files.\n\nThere seem to be CPUs out there for which no microcode update\nhas been submitted to kernel-firmware repo yet resulting in\nscary sounding error messages in dmesg:\n\n microcode: failed to load file amd-ucode/microcode_amd_fam16h.bin\n\nSigned-off-by: Thomas Renninger \u003ctrenn@suse.de\u003e\nAcked-by: Borislav Petkov \u003cbp@suse.de\u003e\nLink: http://lkml.kernel.org/r/1384274383-43510-1-git-send-email-trenn@suse.de\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "107bb3cc6b12d800f9949f5ecae808caae38a9f5", "tree": "66ebf2132601b2892acf0e6a9b81c6f3bec43341", "parents": [ "6ee4fd261478ff5eed6b83cb5a18421c01707ad3" ], "author": { "name": "Christoph Hellwig", "email": "hch@infradead.org", "time": "Mon Nov 18 05:07:47 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:35 2013 -0800" }, "message": "nfsd: make sure to balance get/put_write_access\n\ncommit 987da4791052fa298b7cfcde4dea9f6f2bbc786b upstream.\n\nUse a straight goto error label style in nfsd_setattr to make sure\nwe always do the put_write_access call after we got it earlier.\n\nNote that the we have been failing to do that in the case\nnfsd_break_lease() returns an error, a bug introduced into 2.6.38 with\n6a76bebefe15d9a08864f824d7f8d5beaf37c997 \"nfsd4: break lease on nfsd\nsetattr\".\n\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6ee4fd261478ff5eed6b83cb5a18421c01707ad3", "tree": "47f157c25e6430faf0df862420f09b6ac1df33b4", "parents": [ "1ac50b943ce53d5f8ce077240191fc50d0e84662" ], "author": { "name": "Christoph Hellwig", "email": "hch@infradead.org", "time": "Mon Nov 18 05:07:30 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:35 2013 -0800" }, "message": "nfsd: split up nfsd_setattr\n\ncommit 818e5a22e907fbae75e9c1fd78233baec9fa64b6 upstream.\n\nSplit out two helpers to make the code more readable and easier to verify\nfor correctness.\n\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1ac50b943ce53d5f8ce077240191fc50d0e84662", "tree": "1b1743dbf76ee781c9bc0b0a57e6bdf3346aa0e5", "parents": [ "eaea722ea81a2e9dab5a81ff00b3cf9b88cca9b5" ], "author": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Tue Oct 01 14:24:58 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:34 2013 -0800" }, "message": "NFSv4: Fix a use-after-free situation in _nfs4_proc_getlk()\n\ncommit a6f951ddbdfb7bd87d31a44f61abe202ed6ce57f upstream.\n\nIn nfs4_proc_getlk(), when some error causes a retry of the call to\n_nfs4_proc_getlk(), we can end up with Oopses of the form\n\n BUG: unable to handle kernel NULL pointer dereference at 0000000000000134\n IP: [\u003cffffffff8165270e\u003e] _raw_spin_lock+0xe/0x30\n\u003csnip\u003e\n Call Trace:\n [\u003cffffffff812f287d\u003e] _atomic_dec_and_lock+0x4d/0x70\n [\u003cffffffffa053c4f2\u003e] nfs4_put_lock_state+0x32/0xb0 [nfsv4]\n [\u003cffffffffa053c585\u003e] nfs4_fl_release_lock+0x15/0x20 [nfsv4]\n [\u003cffffffffa0522c06\u003e] _nfs4_proc_getlk.isra.40+0x146/0x170 [nfsv4]\n [\u003cffffffffa052ad99\u003e] nfs4_proc_lock+0x399/0x5a0 [nfsv4]\n\nThe problem is that we don\u0027t clear the request-\u003efl_ops after the first\ntry and so when we retry, nfs4_set_lock_state() exits early without\nsetting the lock stateid.\nRegression introduced by commit 70cc6487a4e08b8698c0e2ec935fb48d10490162\n(locks: make -\u003elock release private data before returning in GETLK case)\n\nReported-by: Weston Andros Adamson \u003cdros@netapp.com\u003e\nReported-by: Jorge Mora \u003cmora@netapp.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "eaea722ea81a2e9dab5a81ff00b3cf9b88cca9b5", "tree": "df6c0c658be0163b1b32347cef9b4522bb3c8189", "parents": [ "1b443352fed11fd666c719d7b1399674c62437bf" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Tue Nov 12 08:06:20 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:34 2013 -0800" }, "message": "ALSA: msnd: Avoid duplicated driver name\n\ncommit 092f9cd16aac7d054af1755c945f37c1b33399e6 upstream.\n\nmsnd_pinnacle.c is used for both snd-msnd-pinnacle and\nsnd-msnd-classic drivers, and both should have different driver\nnames. Using the same driver name results in the sysfs warning for\nduplicated entries like\n kobject: \u0027msnd-pinnacle.7\u0027 (cec33408): kobject_release, parent (null) (delayed)\n kobject: \u0027msnd-pinnacle\u0027 (cecd4980): kobject_release, parent cf3ad9b0 (delayed)\n ------------[ cut here ]------------\n WARNING: CPU: 0 PID: 1 at fs/sysfs/dir.c:486 sysfs_warn_dup+0x7d/0xa0()\n sysfs: cannot create duplicate filename \u0027/bus/isa/drivers/msnd-pinnacle\u0027\n ......\n\nReported-by: Fengguang Wu \u003cfengguang.wu@intel.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1b443352fed11fd666c719d7b1399674c62437bf", "tree": "c8b43b7ed0ec451d4622654f3d0015b376edcd75", "parents": [ "c0d30628ff1b424f041d83fee37daea5f84eb0a2" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Mon Oct 28 11:24:23 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:34 2013 -0800" }, "message": "ALSA: 6fire: Fix probe of multiple cards\n\ncommit 9b389a8a022110b4bc055a19b888283544d9eba6 upstream.\n\nThe probe code of snd-usb-6fire driver overrides the devices[] pointer\nwrongly without checking whether it\u0027s already occupied or not. This\nwould screw up the device disconnection later.\n\nSpotted by coverity CID 141423.\n\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c0d30628ff1b424f041d83fee37daea5f84eb0a2", "tree": "d7bc2b3b5824eeddeb687c3547c21984e1d6c422", "parents": [ "7288f91dd5b55d82e1dee9f0d24e9f4730d57392" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Tue Nov 12 15:11:17 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:34 2013 -0800" }, "message": "exec/ptrace: fix get_dumpable() incorrect tests\n\ncommit d049f74f2dbe71354d43d393ac3a188947811348 upstream.\n\nThe get_dumpable() return value is not boolean. Most users of the\nfunction actually want to be testing for non-SUID_DUMP_USER(1) rather than\nSUID_DUMP_DISABLE(0). The SUID_DUMP_ROOT(2) is also considered a\nprotected state. Almost all places did this correctly, excepting the two\nplaces fixed in this patch.\n\nWrong logic:\n if (dumpable \u003d\u003d SUID_DUMP_DISABLE) { /* be protective */ }\n or\n if (dumpable \u003d\u003d 0) { /* be protective */ }\n or\n if (!dumpable) { /* be protective */ }\n\nCorrect logic:\n if (dumpable !\u003d SUID_DUMP_USER) { /* be protective */ }\n or\n if (dumpable !\u003d 1) { /* be protective */ }\n\nWithout this patch, if the system had set the sysctl fs/suid_dumpable\u003d2, a\nuser was able to ptrace attach to processes that had dropped privileges to\nthat user. (This may have been partially mitigated if Yama was enabled.)\n\nThe macros have been moved into the file that declares get/set_dumpable(),\nwhich means things like the ia64 code can see them too.\n\nCVE-2013-2929\n\nReported-by: Vasily Kulikov \u003csegoon@openwall.com\u003e\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: \"Luck, Tony\" \u003ctony.luck@intel.com\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7288f91dd5b55d82e1dee9f0d24e9f4730d57392", "tree": "ddacb42865accbcdfa64f3562b68e4df3ff5f11a", "parents": [ "7eebf56b11ac00f164583a217b65fa264f62cb07" ], "author": { "name": "Mimi Zohar", "email": "zohar@linux.vnet.ibm.com", "time": "Thu Oct 17 07:34:02 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:34 2013 -0800" }, "message": "Revert \"ima: policy for RAMFS\"\n\ncommit 08de59eb144d7c41351a467442f898d720f0f15f upstream.\n\nThis reverts commit 4c2c392763a682354fac65b6a569adec4e4b5387.\n\nEverything in the initramfs should be measured and appraised,\nbut until the initramfs has extended attribute support, at\nleast measured.\n\nSigned-off-by: Mimi Zohar \u003czohar@us.ibm.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7eebf56b11ac00f164583a217b65fa264f62cb07", "tree": "0fb4bd321b2baf65670e4f473fe43e41f272c90f", "parents": [ "d134082b7a9bb0e09158a2cc2e551841a84ddfa7" ], "author": { "name": "Stanislaw Gruszka", "email": "stf_xl@wp.pl", "time": "Tue Oct 15 14:31:12 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:33 2013 -0800" }, "message": "rt2x00: check if device is still available on rt2x00mac_flush()\n\ncommit 5671ab05cf2a579218985ef56595387932d78ee4 upstream.\n\nFix random kernel panic with below messages when remove dongle.\n\n[ 2212.355447] BUG: unable to handle kernel NULL pointer dereference at 0000000000000250\n[ 2212.355527] IP: [\u003cffffffffa02667f2\u003e] rt2x00usb_kick_tx_entry+0x12/0x160 [rt2x00usb]\n[ 2212.355599] PGD 0\n[ 2212.355626] Oops: 0000 [#1] SMP\n[ 2212.355664] Modules linked in: rt2800usb rt2x00usb rt2800lib crc_ccitt rt2x00lib mac80211 cfg80211 tun arc4 fuse rfcomm bnep snd_hda_codec_realtek snd_hda_intel snd_hda_codec btusb uvcvideo bluetooth snd_hwdep x86_pkg_temp_thermal snd_seq coretemp aesni_intel aes_x86_64 snd_seq_device glue_helper snd_pcm ablk_helper videobuf2_vmalloc sdhci_pci videobuf2_memops videobuf2_core sdhci videodev mmc_core serio_raw snd_page_alloc microcode i2c_i801 snd_timer hid_multitouch thinkpad_acpi lpc_ich mfd_core snd tpm_tis wmi tpm tpm_bios soundcore acpi_cpufreq i915 i2c_algo_bit drm_kms_helper drm i2c_core video [last unloaded: cfg80211]\n[ 2212.356224] CPU: 0 PID: 34 Comm: khubd Not tainted 3.12.0-rc3-wl+ #3\n[ 2212.356268] Hardware name: LENOVO 3444CUU/3444CUU, BIOS G6ET93WW (2.53 ) 02/04/2013\n[ 2212.356319] task: ffff880212f687c0 ti: ffff880212f66000 task.ti: ffff880212f66000\n[ 2212.356392] RIP: 0010:[\u003cffffffffa02667f2\u003e] [\u003cffffffffa02667f2\u003e] rt2x00usb_kick_tx_entry+0x12/0x160 [rt2x00usb]\n[ 2212.356481] RSP: 0018:ffff880212f67750 EFLAGS: 00010202\n[ 2212.356519] RAX: 000000000000000c RBX: 000000000000000c RCX: 0000000000000293\n[ 2212.356568] RDX: ffff8801f4dc219a RSI: 0000000000000000 RDI: 0000000000000240\n[ 2212.356617] RBP: ffff880212f67778 R08: ffffffffa02667e0 R09: 0000000000000002\n[ 2212.356665] R10: 0001f95254ab4b40 R11: ffff880212f675be R12: ffff8801f4dc2150\n[ 2212.356712] R13: 0000000000000000 R14: ffffffffa02667e0 R15: 000000000000000d\n[ 2212.356761] FS: 0000000000000000(0000) GS:ffff88021e200000(0000) knlGS:0000000000000000\n[ 2212.356813] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 2212.356852] CR2: 0000000000000250 CR3: 0000000001a0c000 CR4: 00000000001407f0\n[ 2212.356899] Stack:\n[ 2212.356917] 000000000000000c ffff8801f4dc2150 0000000000000000 ffffffffa02667e0\n[ 2212.356980] 000000000000000d ffff880212f677b8 ffffffffa03a31ad ffff8801f4dc219a\n[ 2212.357038] ffff8801f4dc2150 0000000000000000 ffff8800b93217a0 ffff8801f49bc800\n[ 2212.357099] Call Trace:\n[ 2212.357122] [\u003cffffffffa02667e0\u003e] ? rt2x00usb_interrupt_txdone+0x90/0x90 [rt2x00usb]\n[ 2212.357174] [\u003cffffffffa03a31ad\u003e] rt2x00queue_for_each_entry+0xed/0x170 [rt2x00lib]\n[ 2212.357244] [\u003cffffffffa026701c\u003e] rt2x00usb_kick_queue+0x5c/0x60 [rt2x00usb]\n[ 2212.357314] [\u003cffffffffa03a3682\u003e] rt2x00queue_flush_queue+0x62/0xa0 [rt2x00lib]\n[ 2212.357386] [\u003cffffffffa03a2930\u003e] rt2x00mac_flush+0x30/0x70 [rt2x00lib]\n[ 2212.357470] [\u003cffffffffa04edded\u003e] ieee80211_flush_queues+0xbd/0x140 [mac80211]\n[ 2212.357555] [\u003cffffffffa0502e52\u003e] ieee80211_set_disassoc+0x2d2/0x3d0 [mac80211]\n[ 2212.357645] [\u003cffffffffa0506da3\u003e] ieee80211_mgd_deauth+0x1d3/0x240 [mac80211]\n[ 2212.357718] [\u003cffffffff8108b17c\u003e] ? try_to_wake_up+0xec/0x290\n[ 2212.357788] [\u003cffffffffa04dbd18\u003e] ieee80211_deauth+0x18/0x20 [mac80211]\n[ 2212.357872] [\u003cffffffffa0418ddc\u003e] cfg80211_mlme_deauth+0x9c/0x140 [cfg80211]\n[ 2212.357913] [\u003cffffffffa041907c\u003e] cfg80211_mlme_down+0x5c/0x60 [cfg80211]\n[ 2212.357962] [\u003cffffffffa041cd18\u003e] cfg80211_disconnect+0x188/0x1a0 [cfg80211]\n[ 2212.358014] [\u003cffffffffa04013bc\u003e] ? __cfg80211_stop_sched_scan+0x1c/0x130 [cfg80211]\n[ 2212.358067] [\u003cffffffffa03f8954\u003e] cfg80211_leave+0xc4/0xe0 [cfg80211]\n[ 2212.358124] [\u003cffffffffa03f8d1b\u003e] cfg80211_netdev_notifier_call+0x3ab/0x5e0 [cfg80211]\n[ 2212.358177] [\u003cffffffff815140f8\u003e] ? inetdev_event+0x38/0x510\n[ 2212.358217] [\u003cffffffff81085a94\u003e] ? __wake_up+0x44/0x50\n[ 2212.358254] [\u003cffffffff8155995c\u003e] notifier_call_chain+0x4c/0x70\n[ 2212.358293] [\u003cffffffff81081156\u003e] raw_notifier_call_chain+0x16/0x20\n[ 2212.358361] [\u003cffffffff814b6dd5\u003e] call_netdevice_notifiers_info+0x35/0x60\n[ 2212.358429] [\u003cffffffff814b6ec9\u003e] __dev_close_many+0x49/0xd0\n[ 2212.358487] [\u003cffffffff814b7028\u003e] dev_close_many+0x88/0x100\n[ 2212.358546] [\u003cffffffff814b8150\u003e] rollback_registered_many+0xb0/0x220\n[ 2212.358612] [\u003cffffffff814b8319\u003e] unregister_netdevice_many+0x19/0x60\n[ 2212.358694] [\u003cffffffffa04d8eb2\u003e] ieee80211_remove_interfaces+0x112/0x190 [mac80211]\n[ 2212.358791] [\u003cffffffffa04c585f\u003e] ieee80211_unregister_hw+0x4f/0x100 [mac80211]\n[ 2212.361994] [\u003cffffffffa03a1221\u003e] rt2x00lib_remove_dev+0x161/0x1a0 [rt2x00lib]\n[ 2212.365240] [\u003cffffffffa0266e2e\u003e] rt2x00usb_disconnect+0x2e/0x70 [rt2x00usb]\n[ 2212.368470] [\u003cffffffff81419ce4\u003e] usb_unbind_interface+0x64/0x1c0\n[ 2212.371734] [\u003cffffffff813b446f\u003e] __device_release_driver+0x7f/0xf0\n[ 2212.374999] [\u003cffffffff813b4503\u003e] device_release_driver+0x23/0x30\n[ 2212.378131] [\u003cffffffff813b3c98\u003e] bus_remove_device+0x108/0x180\n[ 2212.381358] [\u003cffffffff813b0565\u003e] device_del+0x135/0x1d0\n[ 2212.384454] [\u003cffffffff81417760\u003e] usb_disable_device+0xb0/0x270\n[ 2212.387451] [\u003cffffffff8140d9cd\u003e] usb_disconnect+0xad/0x1d0\n[ 2212.390294] [\u003cffffffff8140f6cd\u003e] hub_thread+0x63d/0x1660\n[ 2212.393034] [\u003cffffffff8107c860\u003e] ? wake_up_atomic_t+0x30/0x30\n[ 2212.395728] [\u003cffffffff8140f090\u003e] ? hub_port_debounce+0x130/0x130\n[ 2212.398412] [\u003cffffffff8107baa0\u003e] kthread+0xc0/0xd0\n[ 2212.401058] [\u003cffffffff8107b9e0\u003e] ? insert_kthread_work+0x40/0x40\n[ 2212.403639] [\u003cffffffff8155de3c\u003e] ret_from_fork+0x7c/0xb0\n[ 2212.406193] [\u003cffffffff8107b9e0\u003e] ? insert_kthread_work+0x40/0x40\n[ 2212.408732] Code: 24 58 08 00 00 bf 80 00 00 00 e8 3a c3 e0 e0 5b 41 5c 5d c3 0f 1f 44 00 00 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 53 \u003c48\u003e 8b 47 10 48 89 fb 4c 8b 6f 28 4c 8b 20 49 8b 04 24 4c 8b 30\n[ 2212.414671] RIP [\u003cffffffffa02667f2\u003e] rt2x00usb_kick_tx_entry+0x12/0x160 [rt2x00usb]\n[ 2212.417646] RSP \u003cffff880212f67750\u003e\n[ 2212.420547] CR2: 0000000000000250\n[ 2212.441024] ---[ end trace 5442918f33832bce ]---\n\nSigned-off-by: Stanislaw Gruszka \u003cstf_xl@wp.pl\u003e\nAcked-by: Helmut Schaa \u003chelmut.schaa@googlemail.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d134082b7a9bb0e09158a2cc2e551841a84ddfa7", "tree": "867255fbc644ae386cb93323401437f9167cce7e", "parents": [ "f22ff9d05def87a049c5c8c7b86539bd4f8e3172" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Tue Nov 05 12:51:11 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:33 2013 -0800" }, "message": "perf/ftrace: Fix paranoid level for enabling function tracer\n\ncommit 12ae030d54ef250706da5642fc7697cc60ad0df7 upstream.\n\nThe current default perf paranoid level is \"1\" which has\n\"perf_paranoid_kernel()\" return false, and giving any operations that\nuse it, access to normal users. Unfortunately, this includes function\ntracing and normal users should not be allowed to enable function\ntracing by default.\n\nThe proper level is defined at \"-1\" (full perf access), which\n\"perf_paranoid_tracepoint_raw()\" will only give access to. Use that\ncheck instead for enabling function tracing.\n\nReported-by: Dave Jones \u003cdavej@redhat.com\u003e\nReported-by: Vince Weaver \u003cvincent.weaver@maine.edu\u003e\nTested-by: Vince Weaver \u003cvincent.weaver@maine.edu\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Jiri Olsa \u003cjolsa@redhat.com\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCVE: CVE-2013-2930\nFixes: ced39002f5ea (\"ftrace, perf: Add support to use function tracepoint in perf\")\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f22ff9d05def87a049c5c8c7b86539bd4f8e3172", "tree": "ed805b8838b5cf2d7686345c8859eeb1f8d48901", "parents": [ "df4011e050b4e80165a317424e6b3367dfa7697c" ], "author": { "name": "Fan Du", "email": "fan.du@windriver.com", "time": "Tue Apr 30 15:27:27 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:33 2013 -0800" }, "message": "include/linux/fs.h: disable preempt when acquire i_size_seqcount write lock\n\ncommit 74e3d1e17b2e11d175970b85acd44f5927000ba2 upstream.\n\nTwo rt tasks bind to one CPU core.\n\nThe higher priority rt task A preempts a lower priority rt task B which\nhas already taken the write seq lock, and then the higher priority rt\ntask A try to acquire read seq lock, it\u0027s doomed to lockup.\n\nrt task A with lower priority: call write\ni_size_write rt task B with higher priority: call sync, and preempt task A\n write_seqcount_begin(\u0026inode-\u003ei_size_seqcount); i_size_read\n inode-\u003ei_size \u003d i_size; read_seqcount_begin \u003c-- lockup here...\n\nSo disable preempt when acquiring every i_size_seqcount *write* lock will\ncure the problem.\n\nSigned-off-by: Fan Du \u003cfan.du@windriver.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Zhao Hongjiang \u003czhaohongjiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "df4011e050b4e80165a317424e6b3367dfa7697c", "tree": "2aef78ae8ee675b60ec7798beda0b49e73545f51", "parents": [ "1a9a8c2c61437bc8ab745c96af936196f4684495" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Tue Apr 30 15:28:20 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:33 2013 -0800" }, "message": "exec: do not abuse -\u003ecred_guard_mutex in threadgroup_lock()\n\ncommit e56fb2874015370e3b7f8d85051f6dce26051df9 upstream.\n\nthreadgroup_lock() takes signal-\u003ecred_guard_mutex to ensure that\nthread_group_leader() is stable. This doesn\u0027t look nice, the scope of\nthis lock in do_execve() is huge.\n\nAnd as Dave pointed out this can lead to deadlock, we have the\nfollowing dependencies:\n\n\tdo_execve:\t\tcred_guard_mutex -\u003e i_mutex\n\tcgroup_mount:\t\ti_mutex -\u003e cgroup_mutex\n\tattach_task_by_pid:\tcgroup_mutex -\u003e cred_guard_mutex\n\nChange de_thread() to take threadgroup_change_begin() around the\nswitch-the-leader code and change threadgroup_lock() to avoid\n-\u003ecred_guard_mutex.\n\nNote that de_thread() can\u0027t sleep with -\u003egroup_rwsem held, this can\nobviously deadlock with the exiting leader if the writer is active, so it\ndoes threadgroup_change_end() before schedule().\n\nReported-by: Dave Jones \u003cdavej@redhat.com\u003e\nAcked-by: Tejun Heo \u003ctj@kernel.org\u003e\nAcked-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n[ zhj: adjust context ]\nSigned-off-by: Zhao Hongjiang \u003czhaohongjiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "1a9a8c2c61437bc8ab745c96af936196f4684495", "tree": "7146378ada66a0de24598f8eae031b911942a0dd", "parents": [ "acf9ebdebcb3f39a41cf5fead7c11c32372dbf6c" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Mar 26 18:25:57 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:33 2013 -0800" }, "message": "Nest rename_lock inside vfsmount_lock\n\ncommit 7ea600b5314529f9d1b9d6d3c41cb26fce6a7a4a upstream.\n\n... lest we get livelocks between path_is_under() and d_path() and friends.\n\nThe thing is, wrt fairness lglocks are more similar to rwsems than to rwlocks;\nit is possible to have thread B spin on attempt to take lock shared while thread\nA is already holding it shared, if B is on lower-numbered CPU than A and there\u0027s\na thread C spinning on attempt to take the same lock exclusive.\n\nAs the result, we need consistent ordering between vfsmount_lock (lglock) and\nrename_lock (seq_lock), even though everything that takes both is going to take\nvfsmount_lock only shared.\n\nSpotted-by: Brad Spengler \u003cspender@grsecurity.net\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n[ zhj: backport to 3.4:\n - Adjust context\n - s/\u0026vfsmount_lock/vfsmount_lock/]\nSigned-off-by: Zhao Hongjiang \u003czhaohongjiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "acf9ebdebcb3f39a41cf5fead7c11c32372dbf6c", "tree": "808c768d781d78c9f25592aa7f5ecc406530e4ea", "parents": [ "14384c7346f4d6480503b825a474006a654d50e2" ], "author": { "name": "Andy Adamson", "email": "andros@netapp.com", "time": "Wed Aug 14 11:59:13 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:33 2013 -0800" }, "message": "SUNRPC: don\u0027t map EKEYEXPIRED to EACCES in call_refreshresult\n\ncommit f1ff0c27fd9987c59d707cd1a6b6c1fc3ae0a250 upstream.\n\nThe NFS layer needs to know when a key has expired.\nThis change also returns -EKEYEXPIRED to the application, and the informative\n\"Key has expired\" error message is displayed. The user then knows that\ncredential renewal is required.\n\nSigned-off-by: Andy Adamson \u003candros@netapp.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "14384c7346f4d6480503b825a474006a654d50e2", "tree": "102f7a97b454cfe3a2a555f4d25a6a6593921b5a", "parents": [ "fa7b5d69efb4db4ee60adcefa86bac1efd8e8b45" ], "author": { "name": "Andy Adamson", "email": "andros@netapp.com", "time": "Tue Nov 27 10:34:19 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:32 2013 -0800" }, "message": "SUNRPC handle EKEYEXPIRED in call_refreshresult\n\ncommit eb96d5c97b0825d542e9c4ba5e0a22b519355166 upstream.\n\nCurrently, when an RPCSEC_GSS context has expired or is non-existent\nand the users (Kerberos) credentials have also expired or are non-existent,\nthe client receives the -EKEYEXPIRED error and tries to refresh the context\nforever. If an application is performing I/O, or other work against the share,\nthe application hangs, and the user is not prompted to refresh/establish their\ncredentials. This can result in a denial of service for other users.\n\nUsers are expected to manage their Kerberos credential lifetimes to mitigate\nthis issue.\n\nMove the -EKEYEXPIRED handling into the RPC layer. Try tk_cred_retry number\nof times to refresh the gss_context, and then return -EACCES to the application.\n\nSigned-off-by: Andy Adamson \u003candros@netapp.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\n[bwh: Backported to 3.2:\n - Adjust context\n - Drop change to nfs4_handle_reclaim_lease_error()]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "fa7b5d69efb4db4ee60adcefa86bac1efd8e8b45", "tree": "95bf54a9a7a18bb510ea2715d9150da53b510472", "parents": [ "d05ee9e14f71acbc101358ac0659b67794ca644f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 29 10:21:34 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:32 2013 -0800" }, "message": "Fix a few incorrectly checked [io_]remap_pfn_range() calls\n\ncommit 7314e613d5ff9f0934f7a0f74ed7973b903315d1 upstream.\n\nNico Golde reports a few straggling uses of [io_]remap_pfn_range() that\nreally should use the vm_iomap_memory() helper. This trivially converts\ntwo of them to the helper, and comments about why the third one really\nneeds to continue to use remap_pfn_range(), and adds the missing size\ncheck.\n\nReported-by: Nico Golde \u003cnico@ngolde.de\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org.\n[lizf: backported to 3.4:\n - adjust context\n - no uio_physical_vm_ops]\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d05ee9e14f71acbc101358ac0659b67794ca644f", "tree": "9f27cdff0820e77cdad92836d1eefc8c800e48ba", "parents": [ "06d5a745ee1257f4dbf49385bf63e2b7554cc9b7" ], "author": { "name": "David Woodhouse", "email": "dwmw2@infradead.org", "time": "Sat Nov 24 12:11:21 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:32 2013 -0800" }, "message": "8139cp: re-enable interrupts after tx timeout\n\ncommit 01ffc0a7f1c1801a2354719dedbc32aff45b987d upstream.\n\nRecovery doesn\u0027t work too well if we leave interrupts disabled...\n\nSigned-off-by: David Woodhouse \u003cDavid.Woodhouse@intel.com\u003e\nAcked-by: Francois Romieu \u003cromieu@fr.zoreil.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nCc: Luis Henriques \u003cluis.henriques@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "06d5a745ee1257f4dbf49385bf63e2b7554cc9b7", "tree": "ba43167f8bf06716383807ddff40db5ae131e76f", "parents": [ "4a4c6cd28ac9322f1a69e15eeb314566dfefe23d" ], "author": { "name": "Markus Pargmann", "email": "mpa@pengutronix.de", "time": "Mon Oct 28 09:54:40 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:32 2013 -0800" }, "message": "can: c_can: Fix RX message handling, handle lost message before EOB\n\ncommit 5d0f801a2ccec3b1fdabc3392c8d99ed0413d216 upstream.\n\nIf we handle end of block messages with higher priority than a lost message,\nwe can run into an endless interrupt loop.\n\nThis is reproducable with a am335x processor and \"cansequence -r\" at 1Mbit.\nAs soon as we loose a packet we can\u0027t escape from an interrupt loop.\n\nThis patch fixes the problem by handling lost packets before EOB packets.\n\nSigned-off-by: Markus Pargmann \u003cmpa@pengutronix.de\u003e\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "4a4c6cd28ac9322f1a69e15eeb314566dfefe23d", "tree": "e561c89a89f46a0ebbc22a9ac941df32f5159d2a", "parents": [ "a4f4086ae811ac85d536dadc5ef8387cb404d042" ], "author": { "name": "Neil Horman", "email": "nhorman@tuxdriver.com", "time": "Tue Sep 17 08:33:11 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:32 2013 -0800" }, "message": "crypto: ansi_cprng - Fix off by one error in non-block size request\n\ncommit 714b33d15130cbb5ab426456d4e3de842d6c5b8a upstream.\n\nStephan Mueller reported to me recently a error in random number generation in\nthe ansi cprng. If several small requests are made that are less than the\ninstances block size, the remainder for loop code doesn\u0027t increment\nrand_data_valid in the last iteration, meaning that the last bytes in the\nrand_data buffer gets reused on the subsequent smaller-than-a-block request for\nrandom data.\n\nThe fix is pretty easy, just re-code the for loop to make sure that\nrand_data_valid gets incremented appropriately\n\nSigned-off-by: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nReported-by: Stephan Mueller \u003cstephan.mueller@atsec.com\u003e\nCC: Stephan Mueller \u003cstephan.mueller@atsec.com\u003e\nCC: Petr Matousek \u003cpmatouse@redhat.com\u003e\nCC: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nCC: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nCc: Luis Henriques \u003cluis.henriques@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a4f4086ae811ac85d536dadc5ef8387cb404d042", "tree": "18f0c22fdc8eef38a3b37d33bd6f016bffad02ac", "parents": [ "8e5931c319674b15847999e79f90e763f32af663" ], "author": { "name": "Johan Hovold", "email": "jhovold@gmail.com", "time": "Wed Oct 09 17:01:09 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:32 2013 -0800" }, "message": "USB: mos7840: fix tiocmget error handling\n\ncommit a91ccd26e75235d86248d018fe3779732bcafd8d upstream.\n\nMake sure to return errors from tiocmget rather than rely on\nuninitialised stack data.\n\nSigned-off-by: Johan Hovold \u003cjhovold@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8e5931c319674b15847999e79f90e763f32af663", "tree": "6c84d6dfec6dbc3226daec696f66f16584bd8ce6", "parents": [ "f9a3a293af3ca3cec5240f0c479f0bed84f195cc" ], "author": { "name": "Bob Moore", "email": "robert.moore@intel.com", "time": "Fri Sep 06 14:27:15 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:31 2013 -0800" }, "message": "ACPICA: Fix for a Store-\u003eArgX when ArgX contains a reference to a field.\n\ncommit 4be4be8fee2ee99a52f94f90d03d2f287ee1db86 upstream.\n\nThis change fixes a problem where a Store operation to an ArgX object\nthat contained a reference to a field object did not complete the\nautomatic dereference and then write to the actual field object.\nInstead, the object type of the field object was inadvertently changed\nto match the type of the source operand. The new behavior will actually\nwrite to the field object (buffer field or field unit), thus matching\nthe correct ACPI-defined behavior.\n\nSigned-off-by: Bob Moore \u003crobert.moore@intel.com\u003e\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nSigned-off-by: Lv Zheng \u003clv.zheng@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f9a3a293af3ca3cec5240f0c479f0bed84f195cc", "tree": "8d5b7e676f5386c9b7206a3d6591b264e868c938", "parents": [ "71a28e49b6566e92f157c871ce50a9613c682caa" ], "author": { "name": "Bob Moore", "email": "robert.moore@intel.com", "time": "Thu Aug 08 15:29:58 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:31 2013 -0800" }, "message": "ACPICA: Return error if DerefOf resolves to a null package element.\n\ncommit a50abf4842dd7d603a2ad6dcc7f1467fd2a66f03 upstream.\n\nDisallow the dereference of a reference (via index) to an uninitialized\npackage element. Provides compatibility with other ACPI\nimplementations. ACPICA BZ 1003.\n\nReferences: https://bugs.acpica.org/show_bug.cgi?id\u003d431\nSigned-off-by: Bob Moore \u003crobert.moore@intel.com\u003e\nSigned-off-by: Lv Zheng \u003clv.zheng@intel.com\u003e\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "71a28e49b6566e92f157c871ce50a9613c682caa", "tree": "0eb4056515f1eb008212efacfb3709e361f8414b", "parents": [ "b6af75b221f4a998dbbf9297fa3ac591974e70ab" ], "author": { "name": "Bob Moore", "email": "robert.moore@intel.com", "time": "Thu Aug 08 15:29:32 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:31 2013 -0800" }, "message": "ACPICA: DeRefOf operator: Update to fully resolve FieldUnit and BufferField refs.\n\ncommit 63660e05ec719613b518547b40a1c501c10f0bc4 upstream.\n\nPreviously, references to these objects were resolved only to the actual\nFieldUnit or BufferField object. The correct behavior is to resolve these\nreferences to an actual value.\nThe problem is that DerefOf did not resolve these objects to actual\nvalues. An \"Integer\" object is simple, return the value. But a field in\nan operation region will require a read operation. For a BufferField, the\nappropriate data must be extracted from the parent buffer.\n\nNOTE: It appears that this issues is present in Windows7 but not\nWindows8.\n\nSigned-off-by: Bob Moore \u003crobert.moore@intel.com\u003e\nSigned-off-by: Lv Zheng \u003clv.zheng@intel.com\u003e\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b6af75b221f4a998dbbf9297fa3ac591974e70ab", "tree": "88ede841b193de19b80fbcd190de9a9c313c1a6f", "parents": [ "3a7ed06c1e3a1ec493d97dc5a708bae17dd9e7b0" ], "author": { "name": "Bob Moore", "email": "robert.moore@intel.com", "time": "Mon Dec 31 00:11:45 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:31 2013 -0800" }, "message": "ACPICA: Interpreter: Fix Store() when implicit conversion is not possible.\n\ncommit 3f654bad3257427bea7ba1c4d43a23d99a03622b upstream.\n\nFor the cases such as a store of a string to an existing package\nobject, implement the store as a CopyObject().\nThis is a small departure from the ACPI specification which states\nthat the control method should be aborted in this case. However,\nASLTS suite depends on this behavior.\n\nSigned-off-by: Bob Moore \u003crobert.moore@intel.com\u003e\nSigned-off-by: Lv Zheng \u003clv.zheng@intel.com\u003e\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "3a7ed06c1e3a1ec493d97dc5a708bae17dd9e7b0", "tree": "359d107b79558d26a39bb674a1c2f79815cfc5c6", "parents": [ "e181e37563a1ef5dcc25565c12b03f6a816b0f36" ], "author": { "name": "Mahesh Rajashekhara", "email": "Mahesh.Rajashekhara@pmcs.com", "time": "Thu Oct 31 14:01:02 2013 +0530" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:30 2013 -0800" }, "message": "aacraid: prevent invalid pointer dereference\n\ncommit b4789b8e6be3151a955ade74872822f30e8cd914 upstream.\n\nIt appears that driver runs into a problem here if fibsize is too small\nbecause we allocate user_srbcmd with fibsize size only but later we\naccess it until user_srbcmd-\u003esg.count to copy it over to srbcmd.\n\nIt is not correct to test (fibsize \u003c sizeof(*user_srbcmd)) because this\nstructure already includes one sg element and this is not needed for\ncommands without data. So, we would recommend to add the following\n(instead of test for fibsize \u003d\u003d 0).\n\nSigned-off-by: Mahesh Rajashekhara \u003cMahesh.Rajashekhara@pmcs.com\u003e\nReported-by: Nico Golde \u003cnico@ngolde.de\u003e\nReported-by: Fabian Yamaguchi \u003cfabs@goesec.de\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e181e37563a1ef5dcc25565c12b03f6a816b0f36", "tree": "56a2a81c71936937f7ca46261c6cdd5e7ceebf38", "parents": [ "d92fa5be781c08695c9cb47124a5ac4746964e6d" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Wed Oct 30 20:12:51 2013 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:30 2013 -0800" }, "message": "libertas: potential oops in debugfs\n\ncommit a497e47d4aec37aaf8f13509f3ef3d1f6a717d88 upstream.\n\nIf we do a zero size allocation then it will oops. Also we can\u0027t be\nsure the user passes us a NUL terminated string so I\u0027ve added a\nterminator.\n\nThis code can only be triggered by root.\n\nReported-by: Nico Golde \u003cnico@ngolde.de\u003e\nReported-by: Fabian Yamaguchi \u003cfabs@goesec.de\u003e\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nAcked-by: Dan Williams \u003cdcbw@redhat.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nCc: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d92fa5be781c08695c9cb47124a5ac4746964e6d", "tree": "f1acd8aa2ef24471c0f2631d06a81b136dce7c9f", "parents": [ "a3b4c0bacef529359f30d85107b6b8af8684ccd0" ], "author": { "name": "Jeff Layton", "email": "jlayton@redhat.com", "time": "Wed Feb 27 20:10:34 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:30 2013 -0800" }, "message": "nfs: don\u0027t allow nfs_find_actor to match inodes of the wrong type\n\ncommit f6488c9ba51d65410e2dbc4345413c0d9120971e upstream.\n\nBenny Halevy reported the following oops when testing RHEL6:\n\n\u003c7\u003enfs_update_inode: inode 892950 mode changed, 0040755 to 0100644\n\u003c1\u003eBUG: unable to handle kernel NULL pointer dereference at (null)\n\u003c1\u003eIP: [\u003cffffffffa02a52c5\u003e] nfs_closedir+0x15/0x30 [nfs]\n\u003c4\u003ePGD 81448a067 PUD 831632067 PMD 0\n\u003c4\u003eOops: 0000 [#1] SMP\n\u003c4\u003elast sysfs file: /sys/kernel/mm/redhat_transparent_hugepage/enabled\n\u003c4\u003eCPU 6\n\u003c4\u003eModules linked in: fuse bonding 8021q garp ebtable_nat ebtables be2iscsi iscsi_boot_sysfs bnx2i cnic uio cxgb4i cxgb4 cxgb3i libcxgbi cxgb3 mdio ib_iser rdma_cm ib_cm iw_cm ib_sa ib_mad ib_core ib_addr iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi softdog bridge stp llc xt_physdev ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4 xt_multiport iptable_filter ip_tables ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables ipv6 dm_round_robin dm_multipath objlayoutdriver2(U) nfs(U) lockd fscache auth_rpcgss nfs_acl sunrpc vhost_net macvtap macvlan tun kvm_intel kvm be2net igb dca ptp pps_core microcode serio_raw sg iTCO_wdt iTCO_vendor_support i7core_edac edac_core shpchp ext4 mbcache jbd2 sd_mod crc_t10dif ahci dm_mirror dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan]\n\u003c4\u003e\n\u003c4\u003ePid: 6332, comm: dd Not tainted 2.6.32-358.el6.x86_64 #1 HP ProLiant DL170e G6 /ProLiant DL170e G6\n\u003c4\u003eRIP: 0010:[\u003cffffffffa02a52c5\u003e] [\u003cffffffffa02a52c5\u003e] nfs_closedir+0x15/0x30 [nfs]\n\u003c4\u003eRSP: 0018:ffff88081458bb98 EFLAGS: 00010292\n\u003c4\u003eRAX: ffffffffa02a52b0 RBX: 0000000000000000 RCX: 0000000000000003\n\u003c4\u003eRDX: ffffffffa02e45a0 RSI: ffff88081440b300 RDI: ffff88082d5f5760\n\u003c4\u003eRBP: ffff88081458bba8 R08: 0000000000000000 R09: 0000000000000000\n\u003c4\u003eR10: 0000000000000772 R11: 0000000000400004 R12: 0000000040000008\n\u003c4\u003eR13: ffff88082d5f5760 R14: ffff88082d6e8800 R15: ffff88082f12d780\n\u003c4\u003eFS: 00007f728f37e700(0000) GS:ffff8800456c0000(0000) knlGS:0000000000000000\n\u003c4\u003eCS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n\u003c4\u003eCR2: 0000000000000000 CR3: 0000000831279000 CR4: 00000000000007e0\n\u003c4\u003eDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n\u003c4\u003eDR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n\u003c4\u003eProcess dd (pid: 6332, threadinfo ffff88081458a000, task ffff88082fa0e040)\n\u003c4\u003eStack:\n\u003c4\u003e 0000000040000008 ffff88081440b300 ffff88081458bbf8 ffffffff81182745\n\u003c4\u003e\u003cd\u003e ffff88082d5f5760 ffff88082d6e8800 ffff88081458bbf8 ffffffffffffffea\n\u003c4\u003e\u003cd\u003e ffff88082f12d780 ffff88082d6e8800 ffffffffa02a50a0 ffff88082d5f5760\n\u003c4\u003eCall Trace:\n\u003c4\u003e [\u003cffffffff81182745\u003e] __fput+0xf5/0x210\n\u003c4\u003e [\u003cffffffffa02a50a0\u003e] ? do_open+0x0/0x20 [nfs]\n\u003c4\u003e [\u003cffffffff81182885\u003e] fput+0x25/0x30\n\u003c4\u003e [\u003cffffffff8117e23e\u003e] __dentry_open+0x27e/0x360\n\u003c4\u003e [\u003cffffffff811c397a\u003e] ? inotify_d_instantiate+0x2a/0x60\n\u003c4\u003e [\u003cffffffff8117e4b9\u003e] lookup_instantiate_filp+0x69/0x90\n\u003c4\u003e [\u003cffffffffa02a6679\u003e] nfs_intent_set_file+0x59/0x90 [nfs]\n\u003c4\u003e [\u003cffffffffa02a686b\u003e] nfs_atomic_lookup+0x1bb/0x310 [nfs]\n\u003c4\u003e [\u003cffffffff8118e0c2\u003e] __lookup_hash+0x102/0x160\n\u003c4\u003e [\u003cffffffff81225052\u003e] ? selinux_inode_permission+0x72/0xb0\n\u003c4\u003e [\u003cffffffff8118e76a\u003e] lookup_hash+0x3a/0x50\n\u003c4\u003e [\u003cffffffff81192a4b\u003e] do_filp_open+0x2eb/0xdd0\n\u003c4\u003e [\u003cffffffff8104757c\u003e] ? __do_page_fault+0x1ec/0x480\n\u003c4\u003e [\u003cffffffff8119f562\u003e] ? alloc_fd+0x92/0x160\n\u003c4\u003e [\u003cffffffff8117de79\u003e] do_sys_open+0x69/0x140\n\u003c4\u003e [\u003cffffffff811811f6\u003e] ? sys_lseek+0x66/0x80\n\u003c4\u003e [\u003cffffffff8117df90\u003e] sys_open+0x20/0x30\n\u003c4\u003e [\u003cffffffff8100b072\u003e] system_call_fastpath+0x16/0x1b\n\u003c4\u003eCode: 65 48 8b 04 25 c8 cb 00 00 83 a8 44 e0 ff ff 01 5b 41 5c c9 c3 90 55 48 89 e5 53 48 83 ec 08 0f 1f 44 00 00 48 8b 9e a0 00 00 00 \u003c48\u003e 8b 3b e8 13 0c f7 ff 48 89 df e8 ab 3d ec e0 48 83 c4 08 31\n\u003c1\u003eRIP [\u003cffffffffa02a52c5\u003e] nfs_closedir+0x15/0x30 [nfs]\n\u003c4\u003e RSP \u003cffff88081458bb98\u003e\n\u003c4\u003eCR2: 0000000000000000\n\nI think this is ultimately due to a bug on the server. The client had\npreviously found a directory dentry. It then later tried to do an atomic\nopen on a new (regular file) dentry. The attributes it got back had the\nsame filehandle as the previously found directory inode. It then tried\nto put the filp because it failed the aops tests for O_DIRECT opens, and\noopsed here because the ctx was still NULL.\n\nObviously the root cause here is a server issue, but we can take steps\nto mitigate this on the client. When nfs_fhget is called, we always know\nwhat type of inode it is. In the event that there\u0027s a broken or\nmalicious server on the other end of the wire, the client can end up\ncrashing because the wrong ops are set on it.\n\nHave nfs_find_actor check that the inode type is correct after checking\nthe fileid. The fileid check should rarely ever match, so it should only\nrarely ever get to this check. In the case where we have a broken\nserver, we may see two different inodes with the same i_ino, but the\nclient should be able to cope with them without crashing.\n\nThis should fix the oops reported here:\n\n https://bugzilla.redhat.com/show_bug.cgi?id\u003d913660\n\nReported-by: Benny Halevy \u003cbhalevy@tonian.com\u003e\nSigned-off-by: Jeff Layton \u003cjlayton@redhat.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nCc: Rui Xiang \u003crui.xiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a3b4c0bacef529359f30d85107b6b8af8684ccd0", "tree": "8304c38a674b9d5a474787b4e8daa90064007626", "parents": [ "234d96ee0f3b8e49501d068a2a3165aa4db60903" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 22 11:44:04 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:30 2013 -0800" }, "message": "vfs,proc: guarantee unique inodes in /proc\n\ncommit 51f0885e5415b4cc6535e9cdcc5145bfbc134353 upstream.\n\nDave Jones found another /proc issue with his Trinity tool: thanks to\nthe namespace model, we can have multiple /proc dentries that point to\nthe same inode, aliasing directories in /proc/\u003cpid\u003e/net/ for example.\n\nThis ends up being a total disaster, because it acts like hardlinked\ndirectories, and causes locking problems. We rely on the topological\nsort of the inodes pointed to by dentries, and if we have aliased\ndirectories, that odering becomes unreliable.\n\nIn short: don\u0027t do this. Multiple dentries with the same (directory)\ninode is just a bad idea, and the namespace code should never have\nexposed things this way. But we\u0027re kind of stuck with it.\n\nThis solves things by just always allocating a new inode during /proc\ndentry lookup, instead of using \"iget_locked()\" to look up existing\ninodes by superblock and number. That actually simplies the code a bit,\nat the cost of potentially doing more inode [de]allocations.\n\nThat said, the inode lookup wasn\u0027t free either (and did a lot of locking\nof inodes), so it is probably not that noticeable. We could easily keep\nthe old lookup model for non-directory entries, but rather than try to\nbe excessively clever this just implements the minimal and simplest\nworkaround for the problem.\n\nReported-and-tested-by: Dave Jones \u003cdavej@redhat.com\u003e\nAnalyzed-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n[bwh: Backported to 3.2:\n - Adjust context\n - Never drop the pde reference in proc_get_inode(), as callers only\n expect this when we return an existing inode, and we never do that now]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Rui Xiang \u003crui.xiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "234d96ee0f3b8e49501d068a2a3165aa4db60903", "tree": "6cb7d819de6509756f78942c2d5d97c14640ee0c", "parents": [ "a73ff6145f62f0e744aeb095bf7119edfcb8a2e7" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 20 10:43:41 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 20 10:43:41 2013 -0800" }, "message": "Linux 3.4.70\n" }, { "commit": "a73ff6145f62f0e744aeb095bf7119edfcb8a2e7", "tree": "1778402544bb1cd769bef14291b4955df465ecfc", "parents": [ "17447567e81dd2e9614ec4837128daebc0c4abb1" ], "author": { "name": "Krzysztof Mazur", "email": "krzysiek@podlesie.net", "time": "Thu Aug 22 14:49:38 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 20 10:43:19 2013 -0800" }, "message": "usb: fix cleanup after failure in hub_configure()\n\ncommit d0308d4b6b02597f39fc31a9bddf7bb3faad5622 upstream.\n\nIf the hub_configure() fails after setting the hdev-\u003emaxchild\nthe hub-\u003eports might be NULL or point to uninitialized kzallocated\nmemory causing NULL pointer dereference in hub_quiesce() during cleanup.\n\nNow after such error the hdev-\u003emaxchild is set to 0 to avoid cleanup\nof uninitialized ports.\n\nSigned-off-by: Krzysztof Mazur \u003ckrzysiek@podlesie.net\u003e\nAcked-by: Alan Stern \u003cstern@rowland.harvard.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "17447567e81dd2e9614ec4837128daebc0c4abb1", "tree": "9ae54a78fc78b3b698ee03d5aab8cbd6abc62c56", "parents": [ "d1814ea12da067fda7bac933e06ef205163617f6" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Mon Feb 04 15:56:05 2013 +0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 20 10:43:19 2013 -0800" }, "message": "PCI/PM: Clear state_saved during suspend\n\ncommit 82fee4d67ab86d6fe5eb0f9a9e988ca9d654d765 upstream.\n\nThis patch clears pci_dev-\u003estate_saved at the beginning of suspending.\nPCI config state may be saved long before that. Some drivers call\npci_save_state() from the -\u003eprobe() callback to get snapshot of sane\nconfiguration space to use in the -\u003eslot_reset() callback.\n\n[wangyj: adjust context]\nSigned-off-by: Konstantin Khlebnikov \u003ckhlebnikov@openvz.org\u003e # add comment\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nSigned-off-by: Yijing Wang \u003cwangyijing@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d1814ea12da067fda7bac933e06ef205163617f6", "tree": "0ac58de8ac0d91dda338fdbcdbf24ec47f99d645", "parents": [ "e6fffec6636ffa3062891bae69a3895bbb73b148" ], "author": { "name": "Nicolas Pitre", "email": "nicolas.pitre@linaro.org", "time": "Tue Mar 12 13:00:42 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 20 10:43:19 2013 -0800" }, "message": "ARM: 7670/1: fix the memset fix\n\ncommit 418df63adac56841ef6b0f1fcf435bc64d4ed177 upstream.\n\nCommit 455bd4c430b0 (\"ARM: 7668/1: fix memset-related crashes caused by\nrecent GCC (4.7.2) optimizations\") attempted to fix a compliance issue\nwith the memset return value. However the memset itself became broken\nby that patch for misaligned pointers.\n\nThis fixes the above by branching over the entry code from the\nmisaligned fixup code to avoid reloading the original pointer.\n\nAlso, because the function entry alignment is wrong in the Thumb mode\ncompilation, that fixup code is moved to the end.\n\nWhile at it, the entry instructions are slightly reworked to help dual\nissue pipelines.\n\nSigned-off-by: Nicolas Pitre \u003cnico@linaro.org\u003e\nTested-by: Alexander Holler \u003choller@ahsoftware.de\u003e\nSigned-off-by: Russell King \u003crmk+kernel@arm.linux.org.uk\u003e\nCc: Eric Bénard \u003ceric@eukrea.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e6fffec6636ffa3062891bae69a3895bbb73b148", "tree": "7190a3af67fd6ceb7f353b19c0bffd7d957d353b", "parents": [ "af15b7691766d99f0f84bae9b3444ab06e9beb29" ], "author": { "name": "Ivan Djelic", "email": "ivan.djelic@parrot.com", "time": "Wed Mar 06 20:09:27 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 20 10:43:19 2013 -0800" }, "message": "ARM: 7668/1: fix memset-related crashes caused by recent GCC (4.7.2) optimizations\n\ncommit 455bd4c430b0c0a361f38e8658a0d6cb469942b5 upstream.\n\nRecent GCC versions (e.g. GCC-4.7.2) perform optimizations based on\nassumptions about the implementation of memset and similar functions.\nThe current ARM optimized memset code does not return the value of\nits first argument, as is usually expected from standard implementations.\n\nFor instance in the following function:\n\nvoid debug_mutex_lock_common(struct mutex *lock, struct mutex_waiter *waiter)\n{\n\tmemset(waiter, MUTEX_DEBUG_INIT, sizeof(*waiter));\n\twaiter-\u003emagic \u003d waiter;\n\tINIT_LIST_HEAD(\u0026waiter-\u003elist);\n}\n\ncompiled as:\n\n800554d0 \u003cdebug_mutex_lock_common\u003e:\n800554d0: e92d4008 push {r3, lr}\n800554d4: e1a00001 mov r0, r1\n800554d8: e3a02010 mov r2, #16 ; 0x10\n800554dc: e3a01011 mov r1, #17 ; 0x11\n800554e0: eb04426e bl 80165ea0 \u003cmemset\u003e\n800554e4: e1a03000 mov r3, r0\n800554e8: e583000c str r0, [r3, #12]\n800554ec: e5830000 str r0, [r3]\n800554f0: e5830004 str r0, [r3, #4]\n800554f4: e8bd8008 pop {r3, pc}\n\nGCC assumes memset returns the value of pointer \u0027waiter\u0027 in register r0; causing\nregister/memory corruptions.\n\nThis patch fixes the return value of the assembly version of memset.\nIt adds a \u0027mov\u0027 instruction and merges an additional load+store into\nexisting load/store instructions.\nFor ease of review, here is a breakdown of the patch into 4 simple steps:\n\nStep 1\n\u003d\u003d\u003d\u003d\u003d\u003d\nPerform the following substitutions:\nip -\u003e r8, then\nr0 -\u003e ip,\nand insert \u0027mov ip, r0\u0027 as the first statement of the function.\nAt this point, we have a memset() implementation returning the proper result,\nbut corrupting r8 on some paths (the ones that were using ip).\n\nStep 2\n\u003d\u003d\u003d\u003d\u003d\u003d\nMake sure r8 is saved and restored when (! CALGN(1)+0) \u003d\u003d 1:\n\nsave r8:\n- str lr, [sp, #-4]!\n+ stmfd sp!, {r8, lr}\n\nand restore r8 on both exit paths:\n- ldmeqfd sp!, {pc} @ Now \u003c64 bytes to go.\n+ ldmeqfd sp!, {r8, pc} @ Now \u003c64 bytes to go.\n(...)\n tst r2, #16\n stmneia ip!, {r1, r3, r8, lr}\n- ldr lr, [sp], #4\n+ ldmfd sp!, {r8, lr}\n\nStep 3\n\u003d\u003d\u003d\u003d\u003d\u003d\nMake sure r8 is saved and restored when (! CALGN(1)+0) \u003d\u003d 0:\n\nsave r8:\n- stmfd sp!, {r4-r7, lr}\n+ stmfd sp!, {r4-r8, lr}\n\nand restore r8 on both exit paths:\n bgt 3b\n- ldmeqfd sp!, {r4-r7, pc}\n+ ldmeqfd sp!, {r4-r8, pc}\n(...)\n tst r2, #16\n stmneia ip!, {r4-r7}\n- ldmfd sp!, {r4-r7, lr}\n+ ldmfd sp!, {r4-r8, lr}\n\nStep 4\n\u003d\u003d\u003d\u003d\u003d\u003d\nRewrite register list \"r4-r7, r8\" as \"r4-r8\".\n\nSigned-off-by: Ivan Djelic \u003civan.djelic@parrot.com\u003e\nReviewed-by: Nicolas Pitre \u003cnico@linaro.org\u003e\nSigned-off-by: Dirk Behme \u003cdirk.behme@gmail.com\u003e\nSigned-off-by: Russell King \u003crmk+kernel@arm.linux.org.uk\u003e\nCc: Eric Bénard \u003ceric@eukrea.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "af15b7691766d99f0f84bae9b3444ab06e9beb29", "tree": "5d22a78374519c3feeabeaddad7e4f0fb58360a6", "parents": [ "9736cb3f9aa9c620965d937f4ff0261f6ac32ee1" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Wed Oct 09 22:23:23 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 20 10:43:19 2013 -0800" }, "message": "tracing: Fix potential out-of-bounds in trace_get_user()\n\ncommit 057db8488b53d5e4faa0cedb2f39d4ae75dfbdbb upstream.\n\nAndrey reported the following report:\n\nERROR: AddressSanitizer: heap-buffer-overflow on address ffff8800359c99f3\nffff8800359c99f3 is located 0 bytes to the right of 243-byte region [ffff8800359c9900, ffff8800359c99f3)\nAccessed by thread T13003:\n #0 ffffffff810dd2da (asan_report_error+0x32a/0x440)\n #1 ffffffff810dc6b0 (asan_check_region+0x30/0x40)\n #2 ffffffff810dd4d3 (__tsan_write1+0x13/0x20)\n #3 ffffffff811cd19e (ftrace_regex_release+0x1be/0x260)\n #4 ffffffff812a1065 (__fput+0x155/0x360)\n #5 ffffffff812a12de (____fput+0x1e/0x30)\n #6 ffffffff8111708d (task_work_run+0x10d/0x140)\n #7 ffffffff810ea043 (do_exit+0x433/0x11f0)\n #8 ffffffff810eaee4 (do_group_exit+0x84/0x130)\n #9 ffffffff810eafb1 (SyS_exit_group+0x21/0x30)\n #10 ffffffff81928782 (system_call_fastpath+0x16/0x1b)\n\nAllocated by thread T5167:\n #0 ffffffff810dc778 (asan_slab_alloc+0x48/0xc0)\n #1 ffffffff8128337c (__kmalloc+0xbc/0x500)\n #2 ffffffff811d9d54 (trace_parser_get_init+0x34/0x90)\n #3 ffffffff811cd7b3 (ftrace_regex_open+0x83/0x2e0)\n #4 ffffffff811cda7d (ftrace_filter_open+0x2d/0x40)\n #5 ffffffff8129b4ff (do_dentry_open+0x32f/0x430)\n #6 ffffffff8129b668 (finish_open+0x68/0xa0)\n #7 ffffffff812b66ac (do_last+0xb8c/0x1710)\n #8 ffffffff812b7350 (path_openat+0x120/0xb50)\n #9 ffffffff812b8884 (do_filp_open+0x54/0xb0)\n #10 ffffffff8129d36c (do_sys_open+0x1ac/0x2c0)\n #11 ffffffff8129d4b7 (SyS_open+0x37/0x50)\n #12 ffffffff81928782 (system_call_fastpath+0x16/0x1b)\n\nShadow bytes around the buggy address:\n ffff8800359c9700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n ffff8800359c9780: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa\n ffff8800359c9800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n ffff8800359c9880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n ffff8800359c9900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n\u003d\u003effff8800359c9980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[03]fb\n ffff8800359c9a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n ffff8800359c9a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n ffff8800359c9b00: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00\n ffff8800359c9b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff8800359c9c00: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07\n Heap redzone: fa\n Heap kmalloc redzone: fb\n Freed heap region: fd\n Shadow gap: fe\n\nThe out-of-bounds access happens on \u0027parser-\u003ebuffer[parser-\u003eidx] \u003d 0;\u0027\n\nAlthough the crash happened in ftrace_regex_open() the real bug\noccurred in trace_get_user() where there\u0027s an incrementation to\nparser-\u003eidx without a check against the size. The way it is triggered\nis if userspace sends in 128 characters (EVENT_BUF_SIZE + 1), the loop\nthat reads the last character stores it and then breaks out because\nthere is no more characters. Then the last character is read to determine\nwhat to do next, and the index is incremented without checking size.\n\nThen the caller of trace_get_user() usually nulls out the last character\nwith a zero, but since the index is equal to the size, it writes a nul\ncharacter after the allocated space, which can corrupt memory.\n\nLuckily, only root user has write access to this file.\n\nLink: http://lkml.kernel.org/r/20131009222323.04fd1a0d@gandalf.local.home\n\nReported-by: Andrey Konovalov \u003candreyknvl@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9736cb3f9aa9c620965d937f4ff0261f6ac32ee1", "tree": "e92ab89b0f3a3849238dab6f985355dd273e9b6c", "parents": [ "1ddb811a5471028b2c85c4d8515ce4ff65d867a1" ], "author": { "name": "Patrick McHardy", "email": "kaber@trash.net", "time": "Fri Apr 05 08:13:30 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 20 10:43:18 2013 -0800" }, "message": "netfilter: nf_ct_sip: don\u0027t drop packets with offsets pointing outside the packet\n\ncommit 3a7b21eaf4fb3c971bdb47a98f570550ddfe4471 upstream.\n\nSome Cisco phones create huge messages that are spread over multiple packets.\nAfter calculating the offset of the SIP body, it is validated to be within\nthe packet and the packet is dropped otherwise. This breaks operation of\nthese phones. Since connection tracking is supposed to be passive, just let\nthose packets pass unmodified and untracked.\n\nSigned-off-by: Patrick McHardy \u003ckaber@trash.net\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nCc: William Roberts \u003cbill.c.roberts@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1ddb811a5471028b2c85c4d8515ce4ff65d867a1", "tree": "f4f88dfadc22ee9a15ba17d73a82eaf9a69da817", "parents": [ "a275776838715e6d7400b03414a23e99d6d85b8a" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Jun 20 16:32:22 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 20 10:43:18 2013 -0800" }, "message": "ALSA: hda - Move one-time init codes from generic_hdmi_init()\n\ncommit 8b8d654b55648561287bd8baca0f75f964a17038 upstream.\n\nThe codes to initialize work struct or create a proc interface should\nbe called only once and never although it\u0027s called many times through\nthe init callback. Move that stuff into patch_generic_hdmi() so that\nit\u0027s called only once.\n\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nBugLink: https://bugs.launchpad.net/bugs/1212160\nSigned-off-by: David Henningsson \u003cdavid.henningsson@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a275776838715e6d7400b03414a23e99d6d85b8a", "tree": "36e43d8dae2a93a10ee4d804542f7410d5767b66", "parents": [ "c10141099c1ea42afa3ded64530cf285d8ffc96a" ], "author": { "name": "Rui li", "email": "li.rui27@zte.com.cn", "time": "Fri Oct 25 10:57:21 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 20 10:43:18 2013 -0800" }, "message": "USB: add new zte 3g-dongle\u0027s pid to option.c\n\ncommit 0636fc507a976cdc40f21bdbcce6f0b98ff1dfe9 upstream.\n\nSigned-off-by: Rui li \u003cli.rui27@zte.com.cn\u003e\nCc: stable \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c10141099c1ea42afa3ded64530cf285d8ffc96a", "tree": "3ecf78bc947f72c19ea04e13e696aa424a37ddcf", "parents": [ "161f4a458cd88dc6ab33078d64aa28315129fade" ], "author": { "name": "Nikhil P Rao", "email": "nikhil.rao@intel.com", "time": "Wed Jun 20 12:56:00 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 20 10:43:18 2013 -0800" }, "message": "PCI: fix truncation of resource size to 32 bits\n\ncommit d6776e6d5c2f8db0252f447b09736075e1bbe387 upstream.\n\n_pci_assign_resource() took an int \"size\" argument, which meant that\nsizes larger than 4GB were truncated. Change type to resource_size_t.\n\n[bhelgaas: changelog]\nSigned-off-by: Nikhil P Rao \u003cnikhil.rao@intel.com\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nCc: Jiri Slaby \u003cjslaby@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" } ], "next": "161f4a458cd88dc6ab33078d64aa28315129fade" }