)]}' { "log": [ { "commit": "e45d91ae6e931aec803c5cbbe36b53e64c3e3077", "tree": "307555a3258c9bb4a3164844cdb5f52807e9a4a2", "parents": [ "b9fbc5762da741f3fa89246193acdce428ce6816" ], "author": { "name": "Dan Williams", "email": "dan.j.williams@intel.com", "time": "Thu Apr 17 11:48:21 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:31 2014 +0200" }, "message": "libata/ahci: accommodate tag ordered controllers\n\ncommit 8a4aeec8d2d6a3edeffbdfae451cdf05cbf0fefd upstream.\n\nThe AHCI spec allows implementations to issue commands in tag order\nrather than FIFO order:\n\n\t5.3.2.12 P:SelectCmd\n\tHBA sets pSlotLoc \u003d (pSlotLoc + 1) mod (CAP.NCS + 1)\n\tor HBA selects the command to issue that has had the\n\tPxCI bit set to \u00271\u0027 longer than any other command\n\tpending to be issued.\n\nThe result is that commands posted sequentially (time-wise) may play out\nof sequence when issued by hardware.\n\nThis behavior has likely been hidden by drives that arrange for commands\nto complete in issue order. However, it appears recent drives (two from\ndifferent vendors that we have found so far) inflict out-of-order\ncompletions as a matter of course. So, we need to take care to maintain\nordered submission, otherwise we risk triggering a drive to fall out of\nsequential-io automation and back to random-io processing, which incurs\nlarge latency and degrades throughput.\n\nThis issue was found in simple benchmarks where QD\u003d2 seq-write\nperformance was 30-50% *greater* than QD\u003d32 seq-write performance.\n\nTagging for -stable and making the change globally since it has a low\nrisk-to-reward ratio. Also, word is that recent versions of an unnamed\nOS also does it this way now. So, drives in the field are already\nexperienced with this tag ordering scheme.\n\nCc: Dave Jiang \u003cdave.jiang@intel.com\u003e\nCc: Ed Ciechanowski \u003ced.ciechanowski@intel.com\u003e\nReviewed-by: Matthew Wilcox \u003cmatthew.r.wilcox@intel.com\u003e\nSigned-off-by: Dan Williams \u003cdan.j.williams@intel.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b9fbc5762da741f3fa89246193acdce428ce6816", "tree": "7adc92f2a706da48587ac7a3b85913afd15a28f8", "parents": [ "34dc182bf300e62e830c19ad174dfcb6ea973e6a" ], "author": { "name": "Rafał Miłecki", "email": "zajec5@gmail.com", "time": "Sat Apr 05 18:08:25 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:31 2014 +0200" }, "message": "b43: Fix machine check error due to improper access of B43_MMIO_PSM_PHY_HDR\n\ncommit 12cd43c6ed6da7bf7c5afbd74da6959cda6d056b upstream.\n\nRegister B43_MMIO_PSM_PHY_HDR is 16 bit one, so accessing it with 32b\nfunctions isn\u0027t safe. On my machine it causes delayed (!) CPU exception:\n\nDisabling lock debugging due to kernel taint\nmce: [Hardware Error]: CPU 0: Machine Check Exception: 4 Bank 4: b200000000070f0f\nmce: [Hardware Error]: TSC 164083803dc\nmce: [Hardware Error]: PROCESSOR 2:20fc2 TIME 1396650505 SOCKET 0 APIC 0 microcode 0\nmce: [Hardware Error]: Run the above through \u0027mcelog --ascii\u0027\nmce: [Hardware Error]: Machine check: Processor context corrupt\nKernel panic - not syncing: Fatal machine check on current CPU\nKernel Offset: 0x0 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffff9fffffff)\n\nSigned-off-by: Rafał Miłecki \u003czajec5@gmail.com\u003e\nAcked-by: Larry Finger \u003cLarry.Finger@lwfinger.net\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "34dc182bf300e62e830c19ad174dfcb6ea973e6a", "tree": "a8add999f603eef9148e83c6b76cce7ee24307da", "parents": [ "caf6f52449661bfcc4c5d3f79d65c1cda23f4a89" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Thu Jan 23 14:41:59 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:30 2014 +0200" }, "message": "mach64: fix cursor when character width is not a multiple of 8 pixels\n\ncommit 43751a1b8ee2e70ce392bf31ef3133da324e68b3 upstream.\n\nThis patch fixes the hardware cursor on mach64 when font width is not a\nmultiple of 8 pixels.\n\nIf you load such a font, the cursor is expanded to the next 8-byte\nboundary and a part of the next character after the cursor is not\nvisible.\nFor example, when you load a font with 12-pixel width, the cursor width\nis 16 pixels and when the cursor is displayed, 4 pixels of the next\ncharacter are not visible.\n\nThe reason is this: atyfb_cursor is called with proper parameters to\nload an image that is 12-pixel wide. However, the number is aligned on\nthe next 8-pixel boundary on the line\n\"unsigned int width \u003d (cursor-\u003eimage.width + 7) \u003e\u003e 3;\" and the whole\nfunction acts as it is was loading a 16-pixel image.\n\nThis patch fixes it so that the value written to the framebuffer is\npadded with 0xaaaa (the transparent pattern) when the image size it not\na multiple of 8 pixels. The transparent pattern causes that the cursor\nwill not interfere with the next character.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Tomi Valkeinen \u003ctomi.valkeinen@ti.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "caf6f52449661bfcc4c5d3f79d65c1cda23f4a89", "tree": "44b4e88613dc613a4234421f2f1aa9345c3ca192", "parents": [ "7ea30442913175c11e9e142c45c11bd88570bbad" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Thu Jan 23 14:41:09 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:30 2014 +0200" }, "message": "mach64: use unaligned access\n\ncommit c29dd8696dc5dbd50b3ac441b8a26751277ba520 upstream.\n\nThis patch fixes mach64 to use unaligned access to the font bitmap.\n\nThis fixes unaligned access warning on sparc64 when 14x8 font is loaded.\n\nOn x86(64), unaligned access is handled in hardware, so both functions\nle32_to_cpup and get_unaligned_le32 perform the same operation.\n\nOn RISC machines, unaligned access is not handled in hardware, so we\nbetter use get_unaligned_le32 to avoid the unaligned trap and warning.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Tomi Valkeinen \u003ctomi.valkeinen@ti.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7ea30442913175c11e9e142c45c11bd88570bbad", "tree": "e57f755c6df0da4e122ba98ad00dcf761e205931", "parents": [ "8b26a7a7b4abd06f3eca2772317bc7840f6e834a" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Thu Jan 23 14:39:04 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:30 2014 +0200" }, "message": "matroxfb: restore the registers M_ACCESS and M_PITCH\n\ncommit a772d4736641ec1b421ad965e13457c17379fc86 upstream.\n\nWhen X11 is running and the user switches back to console, the card\nmodifies the content of registers M_MACCESS and M_PITCH in periodic\nintervals.\n\nThis patch fixes it by restoring the content of these registers before\nissuing any accelerator command.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Tomi Valkeinen \u003ctomi.valkeinen@ti.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8b26a7a7b4abd06f3eca2772317bc7840f6e834a", "tree": "d8ab406166b5087f745900cdd15d028dc1cb8051", "parents": [ "89a3abc1fd0dd979929362a2a355d899f4574dab" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Thu Jan 23 14:39:29 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:30 2014 +0200" }, "message": "framebuffer: fix cfb_copyarea\n\ncommit 00a9d699bc85052d2d3ed56251cd928024ce06a3 upstream.\n\nThe function cfb_copyarea is buggy when the copy operation is not aligned on\nlong boundary (4 bytes on 32-bit machines, 8 bytes on 64-bit machines).\n\nHow to reproduce:\n- use x86-64 machine\n- use a framebuffer driver without acceleration (for example uvesafb)\n- set the framebuffer to 8-bit depth\n\t(for example fbset -a 1024x768-60 -depth 8)\n- load a font with character width that is not a multiple of 8 pixels\n\tnote: the console-tools package cannot load a font that has\n\twidth different from 8 pixels. You need to install the packages\n\t\"kbd\" and \"console-terminus\" and use the program \"setfont\" to\n\tset font width (for example: setfont Uni2-Terminus20x10)\n- move some text left and right on the bash command line and you get a\n\tscreen corruption\n\nTo expose more bugs, put this line to the end of uvesafb_init_info:\ninfo-\u003eflags |\u003d FBINFO_HWACCEL_COPYAREA | FBINFO_READS_FAST;\n- Now framebuffer console will use cfb_copyarea for console scrolling.\nYou get a screen corruption when console is scrolled.\n\nThis patch is a rewrite of cfb_copyarea. It fixes the bugs, with this\npatch, console scrolling in 8-bit depth with a font width that is not a\nmultiple of 8 pixels works fine.\n\nThe cfb_copyarea code was very buggy and it looks like it was written\nand never tried with non-8-pixel font.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Tomi Valkeinen \u003ctomi.valkeinen@ti.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "89a3abc1fd0dd979929362a2a355d899f4574dab", "tree": "a78ec88835316fda87b0c696a7e195b559ffd5ce", "parents": [ "a2295c4263fe35f674f0061fe0419c73238d5b5b" ], "author": { "name": "Ard Biesheuvel", "email": "ard.biesheuvel@linaro.org", "time": "Thu Mar 27 18:14:40 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:30 2014 +0200" }, "message": "crypto: ghash-clmulni-intel - use C implementation for setkey()\n\ncommit 8ceee72808d1ae3fb191284afc2257a2be964725 upstream.\n\nThe GHASH setkey() function uses SSE registers but fails to call\nkernel_fpu_begin()/kernel_fpu_end(). Instead of adding these calls, and\nthen having to deal with the restriction that they cannot be called from\ninterrupt context, move the setkey() implementation to the C domain.\n\nNote that setkey() does not use any particular SSE features and is not\nexpected to become a performance bottleneck.\n\nSigned-off-by: Ard Biesheuvel \u003card.biesheuvel@linaro.org\u003e\nAcked-by: H. Peter Anvin \u003chpa@linux.intel.com\u003e\nFixes: 0e1227d356e9b (crypto: ghash - Add PCLMULQDQ accelerated implementation)\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a2295c4263fe35f674f0061fe0419c73238d5b5b", "tree": "15b88f2cad71f1a4d95619176f6b245f48edf0c4", "parents": [ "983327a48a263bd65fa869a0aad76baaf75fff86" ], "author": { "name": "Tyler Stachecki", "email": "tstache1@binghamton.edu", "time": "Fri Apr 25 16:41:04 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:30 2014 +0200" }, "message": "mpt2sas: Don\u0027t disable device twice at suspend.\n\ncommit af61e27c3f77c7623b5335590ae24b6a5c323e22 upstream.\n\nOn suspend, _scsih_suspend calls mpt2sas_base_free_resources, which\nin turn calls pci_disable_device if the device is enabled prior to\nsuspending. However, _scsih_suspend also calls pci_disable_device\nitself.\n\nThus, in the event that the device is enabled prior to suspending,\npci_disable_device will be called twice. This patch removes the\nduplicate call to pci_disable_device in _scsi_suspend as it is both\nunnecessary and results in a kernel oops.\n\nSigned-off-by: Tyler Stachecki \u003ctstache1@binghamton.edu\u003e\nSigned-off-by: James Bottomley \u003cJBottomley@Parallels.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "983327a48a263bd65fa869a0aad76baaf75fff86", "tree": "1d8dfd2284c812187522b45bbbcdbedef614ee15", "parents": [ "ef9146785e023ef84cb777aac6deae53c53a2b84" ], "author": { "name": "Rusty Russell", "email": "rusty@rustcorp.com.au", "time": "Thu Mar 13 11:23:38 2014 +1030" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:30 2014 +0200" }, "message": "virtio_balloon: don\u0027t softlockup on huge balloon changes.\n\ncommit 1f74ef0f2d7d692fcd615621e0e734c3e7771413 upstream.\n\nWhen adding or removing 100G from a balloon:\n\n BUG: soft lockup - CPU#0 stuck for 22s! [vballoon:367]\n\nWe have a wait_event_interruptible(), but the condition is always true\n(more ballooning to do) so we don\u0027t ever sleep. We also have a\nwait_event() for the host to ack, but that is also always true as QEMU\nis synchronous for balloon operations.\n\nReported-by: Gopesh Kumar Chaudhary \u003cgopchaud@in.ibm.com\u003e\nSigned-off-by: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ef9146785e023ef84cb777aac6deae53c53a2b84", "tree": "b723a6e28700011923d4e5b66340f3485b3084e1", "parents": [ "bfa779779247e9421b23155747e1779ce87aa040" ], "author": { "name": "Huacai Chen", "email": "chenhc@lemote.com", "time": "Sat Mar 22 17:21:44 2014 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:29 2014 +0200" }, "message": "MIPS: Hibernate: Flush TLB entries in swsusp_arch_resume()\n\ncommit c14af233fbe279d0e561ecf84f1208b1bae087ef upstream.\n\nThe original MIPS hibernate code flushes cache and TLB entries in\nswsusp_arch_resume(). But they are removed in Commit 44eeab67416711\n(MIPS: Hibernation: Remove SMP TLB and cacheflushing code.). A cross-\nCPU flush is surely unnecessary because all but the local CPU have\nalready been disabled. But a local flush (at least the TLB flush) is\nneeded. When we do hibernation on Loongson-3 with an E1000E NIC, it is\nvery easy to produce a kernel panic (kernel page fault, or unaligned\naccess). The root cause is E1000E driver use vzalloc_node() to allocate\npages, the stale TLB entries of the booting kernel will be misused by\nthe resumed target kernel.\n\nSigned-off-by: Huacai Chen \u003cchenhc@lemote.com\u003e\nCc: John Crispin \u003cjohn@phrozen.org\u003e\nCc: Steven J. Hill \u003cSteven.Hill@imgtec.com\u003e\nCc: Aurelien Jarno \u003caurelien@aurel32.net\u003e\nCc: linux-mips@linux-mips.org\nCc: Fuxin Zhang \u003czhangfx@lemote.com\u003e\nCc: Zhangjin Wu \u003cwuzhangjin@gmail.com\u003e\nPatchwork: https://patchwork.linux-mips.org/patch/6643/\nSigned-off-by: Ralf Baechle \u003cralf@linux-mips.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "bfa779779247e9421b23155747e1779ce87aa040", "tree": "ba0e80345bca015d0381aaeb0cc447b1a5d5e452", "parents": [ "a04d8ef979b661ce9051d0f22b0b2c25fc94b955" ], "author": { "name": "Matthew Daley", "email": "mattd@bugfuzz.com", "time": "Mon Apr 28 19:05:21 2014 +1200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:29 2014 +0200" }, "message": "floppy: don\u0027t write kernel-only members to FDRAWCMD ioctl output\n\ncommit 2145e15e0557a01b9195d1c7199a1b92cb9be81f upstream.\n\nDo not leak kernel-only floppy_raw_cmd structure members to userspace.\nThis includes the linked-list pointer and the pointer to the allocated\nDMA space.\n\nSigned-off-by: Matthew Daley \u003cmattd@bugfuzz.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a04d8ef979b661ce9051d0f22b0b2c25fc94b955", "tree": "4affe04b7b7b698f317df00858f3d065caef521f", "parents": [ "5c5aeb0ca78c6b9cdca6462bf54f50ac28756cbb" ], "author": { "name": "Matthew Daley", "email": "mattd@bugfuzz.com", "time": "Mon Apr 28 19:05:20 2014 +1200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:29 2014 +0200" }, "message": "floppy: ignore kernel-only members in FDRAWCMD ioctl input\n\ncommit ef87dbe7614341c2e7bfe8d32fcb7028cc97442c upstream.\n\nAlways clear out these floppy_raw_cmd struct members after copying the\nentire structure from userspace so that the in-kernel version is always\nvalid and never left in an interdeterminate state.\n\nSigned-off-by: Matthew Daley \u003cmattd@bugfuzz.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5c5aeb0ca78c6b9cdca6462bf54f50ac28756cbb", "tree": "be6157846a37ab8393947daeb1f1eb2ca0231e84", "parents": [ "d89a13cf5f83e4f2b6fe98b52530bdab4b773c5c" ], "author": { "name": "Tomoki Sekiyama", "email": "tomoki.sekiyama@hds.com", "time": "Fri May 02 18:58:24 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:29 2014 +0200" }, "message": "drivers/tty/hvc: don\u0027t free hvc_console_setup after init\n\ncommit 501fed45b7e8836ee9373f4d31e2d85e3db6103a upstream.\n\nWhen \u0027console\u003dhvc0\u0027 is specified to the kernel parameter in x86 KVM guest,\nhvc console is setup within a kthread. However, that will cause SEGV\nand the boot will fail when the driver is builtin to the kernel,\nbecause currently hvc_console_setup() is annotated with \u0027__init\u0027. This\npatch removes \u0027__init\u0027 to boot the guest successfully with \u0027console\u003dhvc0\u0027.\n\nSigned-off-by: Tomoki Sekiyama \u003ctomoki.sekiyama@hds.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d89a13cf5f83e4f2b6fe98b52530bdab4b773c5c", "tree": "630316963499f1022761d4252ae19ba4e4fb9345", "parents": [ "1361b5386da290994fcbf5399d87e4417bec213d" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:52:14 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:52:14 2014 -0700" }, "message": "Linux 3.4.89\n" }, { "commit": "1361b5386da290994fcbf5399d87e4417bec213d", "tree": "ad025d3623914c7cfe8429fd82de31458c58e66f", "parents": [ "6b2b2314fe03f5dc66d4c9370dfa263e19fda392" ], "author": { "name": "Aaron Sanders", "email": "aaron.sanders@hp.com", "time": "Mon Mar 31 15:54:21 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:46 2014 -0700" }, "message": "USB: pl2303: add ids for Hewlett-Packard HP POS pole displays\n\ncommit b16c02fbfb963fa2941b7517ebf1f8a21946775e upstream.\n\nAdd device ids to pl2303 for the Hewlett-Packard HP POS pole displays:\n\nLD960: 03f0:0B39\nLCM220: 03f0:3139\nLCM960: 03f0:3239\n\n[ Johan: fix indentation and sort PIDs numerically ]\n\nSigned-off-by: Aaron Sanders \u003caaron.sanders@hp.com\u003e\nSigned-off-by: Johan Hovold \u003cjhovold@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6b2b2314fe03f5dc66d4c9370dfa263e19fda392", "tree": "fcfbb967c872fc8391d2bc7fa870a0568f22f513", "parents": [ "982daeb44e46bd2c1d84106f90381184bf2c0ed2" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Sat Apr 12 12:45:25 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:46 2014 -0700" }, "message": "ext4: use i_size_read in ext4_unaligned_aio()\n\ncommit 6e6358fc3c3c862bfe9a5bc029d3f8ce43dc9765 upstream.\n\nWe haven\u0027t taken i_mutex yet, so we need to use i_size_read().\n\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "982daeb44e46bd2c1d84106f90381184bf2c0ed2", "tree": "ebdb45f53d165340ac471e9c8fccb656a427cc7f", "parents": [ "8917a40da468d4ffb7accf5eea6e381a123058b1" ], "author": { "name": "alex chen", "email": "alex.chen@huawei.com", "time": "Thu Apr 03 14:47:05 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:46 2014 -0700" }, "message": "ocfs2: do not put bh when buffer_uptodate failed\n\ncommit f7cf4f5bfe073ad792ab49c04f247626b3e38db6 upstream.\n\nDo not put bh when buffer_uptodate failed in ocfs2_write_block and\nocfs2_write_super_or_backup, because it will put bh in b_end_io.\nOtherwise it will hit a warning \"VFS: brelse: Trying to free free\nbuffer\".\n\nSigned-off-by: Alex Chen \u003calex.chen@huawei.com\u003e\nReviewed-by: Joseph Qi \u003cjoseph.qi@huawei.com\u003e\nReviewed-by: Srinivas Eeda \u003csrinivas.eeda@oracle.com\u003e\nCc: Mark Fasheh \u003cmfasheh@suse.com\u003e\nAcked-by: Joel Becker \u003cjlbec@evilplan.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8917a40da468d4ffb7accf5eea6e381a123058b1", "tree": "14a650166f3a03e46c3962fdc4d102a605279569", "parents": [ "09400fe4ff8794b823889c4634afa0c740d29b1c" ], "author": { "name": "Junxiao Bi", "email": "junxiao.bi@oracle.com", "time": "Thu Apr 03 14:46:51 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:46 2014 -0700" }, "message": "ocfs2: dlm: fix recovery hung\n\ncommit ded2cf71419b9353060e633b59e446c42a6a2a09 upstream.\n\nThere is a race window in dlm_do_recovery() between dlm_remaster_locks()\nand dlm_reset_recovery() when the recovery master nearly finish the\nrecovery process for a dead node. After the master sends FINALIZE_RECO\nmessage in dlm_remaster_locks(), another node may become the recovery\nmaster for another dead node, and then send the BEGIN_RECO message to\nall the nodes included the old master, in the handler of this message\ndlm_begin_reco_handler() of old master, dlm-\u003ereco.dead_node and\ndlm-\u003ereco.new_master will be set to the second dead node and the new\nmaster, then in dlm_reset_recovery(), these two variables will be reset\nto default value. This will cause new recovery master can not finish\nthe recovery process and hung, at last the whole cluster will hung for\nrecovery.\n\nold recovery master: new recovery master:\ndlm_remaster_locks()\n become recovery master for\n another dead node.\n dlm_send_begin_reco_message()\ndlm_begin_reco_handler()\n{\n if (dlm-\u003ereco.state \u0026 DLM_RECO_STATE_FINALIZE) {\n return -EAGAIN;\n }\n dlm_set_reco_master(dlm, br-\u003enode_idx);\n dlm_set_reco_dead_node(dlm, br-\u003edead_node);\n}\ndlm_reset_recovery()\n{\n dlm_set_reco_dead_node(dlm, O2NM_INVALID_NODE_NUM);\n dlm_set_reco_master(dlm, O2NM_INVALID_NODE_NUM);\n}\n will hang in dlm_remaster_locks() for\n request dlm locks info\n\nBefore send FINALIZE_RECO message, recovery master should set\nDLM_RECO_STATE_FINALIZE for itself and clear it after the recovery done,\nthis can break the race windows as the BEGIN_RECO messages will not be\nhandled before DLM_RECO_STATE_FINALIZE flag is cleared.\n\nA similar race may happen between new recovery master and normal node\nwhich is in dlm_finalize_reco_handler(), also fix it.\n\nSigned-off-by: Junxiao Bi \u003cjunxiao.bi@oracle.com\u003e\nReviewed-by: Srinivas Eeda \u003csrinivas.eeda@oracle.com\u003e\nReviewed-by: Wengang Wang \u003cwen.gang.wang@oracle.com\u003e\nCc: Joel Becker \u003cjlbec@evilplan.org\u003e\nCc: Mark Fasheh \u003cmfasheh@suse.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "09400fe4ff8794b823889c4634afa0c740d29b1c", "tree": "041f6c8351f4849df2eccc9787ddc628d8a5439e", "parents": [ "96f6aea2715b25edfc9b982f9e372bd87db6c04e" ], "author": { "name": "Junxiao Bi", "email": "junxiao.bi@oracle.com", "time": "Thu Apr 03 14:46:49 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:45 2014 -0700" }, "message": "ocfs2: dlm: fix lock migration crash\n\ncommit 34aa8dac482f1358d59110d5e3a12f4351f6acaa upstream.\n\nThis issue was introduced by commit 800deef3f6f8 (\"ocfs2: use\nlist_for_each_entry where benefical\") in 2007 where it replaced\nlist_for_each with list_for_each_entry. The variable \"lock\" will point\nto invalid data if \"tmpq\" list is empty and a panic will be triggered\ndue to this. Sunil advised reverting it back, but the old version was\nalso not right. At the end of the outer for loop, that\nlist_for_each_entry will also set \"lock\" to an invalid data, then in the\nnext loop, if the \"tmpq\" list is empty, \"lock\" will be an stale invalid\ndata and cause the panic. So reverting the list_for_each back and reset\n\"lock\" to NULL to fix this issue.\n\nAnother concern is that this seemes can not happen because the \"tmpq\"\nlist should not be empty. Let me describe how.\n\nold lock resource owner(node 1): migratation target(node 2):\nimage there\u0027s lockres with a EX lock from node 2 in\ngranted list, a NR lock from node x with convert_type\nEX in converting list.\ndlm_empty_lockres() {\n dlm_pick_migration_target() {\n pick node 2 as target as its lock is the first one\n in granted list.\n }\n dlm_migrate_lockres() {\n dlm_mark_lockres_migrating() {\n res-\u003estate |\u003d DLM_LOCK_RES_BLOCK_DIRTY;\n wait_event(dlm-\u003east_wq, !dlm_lockres_is_dirty(dlm, res));\n\t //after the above code, we can not dirty lockres any more,\n // so dlm_thread shuffle list will not run\n downconvert lock from EX to NR\n upconvert lock from NR to EX\n\u003c\u003c\u003c migration may schedule out here, then\n\u003c\u003c\u003c node 2 send down convert request to convert type from EX to\n\u003c\u003c\u003c NR, then send up convert request to convert type from NR to\n\u003c\u003c\u003c EX, at this time, lockres granted list is empty, and two locks\n\u003c\u003c\u003c in the converting list, node x up convert lock followed by\n\u003c\u003c\u003c node 2 up convert lock.\n\n\t // will set lockres RES_MIGRATING flag, the following\n\t // lock/unlock can not run\n dlm_lockres_release_ast(dlm, res);\n }\n\n dlm_send_one_lockres()\n dlm_process_recovery_data()\n for (i\u003d0; i\u003cmres-\u003enum_locks; i++)\n if (ml-\u003enode \u003d\u003d dlm-\u003enode_num)\n for (j \u003d DLM_GRANTED_LIST; j \u003c\u003d DLM_BLOCKED_LIST; j++) {\n list_for_each_entry(lock, tmpq, list)\n if (lock) break; \u003c\u003c\u003c lock is invalid as grant list is empty.\n }\n if (lock-\u003eml.node !\u003d ml-\u003enode)\n BUG() \u003e\u003e\u003e crash here\n }\n\nI see the above locks status from a vmcore of our internal bug.\n\nSigned-off-by: Junxiao Bi \u003cjunxiao.bi@oracle.com\u003e\nReviewed-by: Wengang Wang \u003cwen.gang.wang@oracle.com\u003e\nCc: Sunil Mushran \u003csunil.mushran@gmail.com\u003e\nReviewed-by: Srinivas Eeda \u003csrinivas.eeda@oracle.com\u003e\nCc: Joel Becker \u003cjlbec@evilplan.org\u003e\nCc: Mark Fasheh \u003cmfasheh@suse.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "96f6aea2715b25edfc9b982f9e372bd87db6c04e", "tree": "36c4f98e3e0c9e2a8ac02ccfbdd320577478abc5", "parents": [ "af4acfaf3ca2f1da6e48d67e50f27f5e22fa3308" ], "author": { "name": "Liu Hua", "email": "sdu.liu@huawei.com", "time": "Mon Apr 07 15:38:57 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:45 2014 -0700" }, "message": "hung_task: check the value of \"sysctl_hung_task_timeout_sec\"\n\ncommit 80df28476505ed4e6701c3448c63c9229a50c655 upstream.\n\nAs sysctl_hung_task_timeout_sec is unsigned long, when this value is\nlarger then LONG_MAX/HZ, the function schedule_timeout_interruptible in\nwatchdog will return immediately without sleep and with print :\n\n schedule_timeout: wrong timeout value ffffffffffffff83\n\nand then the funtion watchdog will call schedule_timeout_interruptible\nagain and again. The screen will be filled with\n\n\t\"schedule_timeout: wrong timeout value ffffffffffffff83\"\n\nThis patch does some check and correction in sysctl, to let the function\nschedule_timeout_interruptible allways get the valid parameter.\n\nSigned-off-by: Liu Hua \u003csdu.liu@huawei.com\u003e\nTested-by: Satoru Takeuchi \u003csatoru.takeuchi@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "af4acfaf3ca2f1da6e48d67e50f27f5e22fa3308", "tree": "e563577a2a106b1c4b45507a6a8d729e4f650061", "parents": [ "5650bff7fdf4f586d05dad9315d4786eba694149" ], "author": { "name": "Mizuma, Masayoshi", "email": "m.mizuma@jp.fujitsu.com", "time": "Mon Apr 07 15:37:54 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:45 2014 -0700" }, "message": "mm: hugetlb: fix softlockup when a large number of hugepages are freed.\n\ncommit 55f67141a8927b2be3e51840da37b8a2320143ed upstream.\n\nWhen I decrease the value of nr_hugepage in procfs a lot, softlockup\nhappens. It is because there is no chance of context switch during this\nprocess.\n\nOn the other hand, when I allocate a large number of hugepages, there is\nsome chance of context switch. Hence softlockup doesn\u0027t happen during\nthis process. So it\u0027s necessary to add the context switch in the\nfreeing process as same as allocating process to avoid softlockup.\n\nWhen I freed 12 TB hugapages with kernel-2.6.32-358.el6, the freeing\nprocess occupied a CPU over 150 seconds and following softlockup message\nappeared twice or more.\n\n$ echo 6000000 \u003e /proc/sys/vm/nr_hugepages\n$ cat /proc/sys/vm/nr_hugepages\n6000000\n$ grep ^Huge /proc/meminfo\nHugePages_Total: 6000000\nHugePages_Free: 6000000\nHugePages_Rsvd: 0\nHugePages_Surp: 0\nHugepagesize: 2048 kB\n$ echo 0 \u003e /proc/sys/vm/nr_hugepages\n\nBUG: soft lockup - CPU#16 stuck for 67s! [sh:12883] ...\nPid: 12883, comm: sh Not tainted 2.6.32-358.el6.x86_64 #1\nCall Trace:\n free_pool_huge_page+0xb8/0xd0\n set_max_huge_pages+0x128/0x190\n hugetlb_sysctl_handler_common+0x113/0x140\n hugetlb_sysctl_handler+0x1e/0x20\n proc_sys_call_handler+0x97/0xd0\n proc_sys_write+0x14/0x20\n vfs_write+0xb8/0x1a0\n sys_write+0x51/0x90\n __audit_syscall_exit+0x265/0x290\n system_call_fastpath+0x16/0x1b\n\nI have not confirmed this problem with upstream kernels because I am not\nable to prepare the machine equipped with 12TB memory now. However I\nconfirmed that the amount of decreasing hugepages was directly\nproportional to the amount of required time.\n\nI measured required times on a smaller machine. It showed 130-145\nhugepages decreased in a millisecond.\n\n Amount of decreasing Required time Decreasing rate\n hugepages (msec) (pages/msec)\n ------------------------------------------------------------\n 10,000 pages \u003d\u003d 20GB 70 - 74 135-142\n 30,000 pages \u003d\u003d 60GB 208 - 229 131-144\n\nIt means decrement of 6TB hugepages will trigger softlockup with the\ndefault threshold 20sec, in this decreasing rate.\n\nSigned-off-by: Masayoshi Mizuma \u003cm.mizuma@jp.fujitsu.com\u003e\nCc: Joonsoo Kim \u003ciamjoonsoo.kim@lge.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.cz\u003e\nCc: Wanpeng Li \u003cliwanp@linux.vnet.ibm.com\u003e\nCc: Aneesh Kumar \u003caneesh.kumar@linux.vnet.ibm.com\u003e\nCc: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nCc: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5650bff7fdf4f586d05dad9315d4786eba694149", "tree": "3286ec5f670affebf7ec13b081fc44b59903b4d7", "parents": [ "d6f6fc7a2bc99124058b7c4850a9997530589a33" ], "author": { "name": "Matt Fleming", "email": "matt.fleming@intel.com", "time": "Thu Apr 03 14:46:20 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:45 2014 -0700" }, "message": "sh: fix format string bug in stack tracer\n\ncommit a0c32761e73c9999cbf592b702f284221fea8040 upstream.\n\nKees reported the following error:\n\n arch/sh/kernel/dumpstack.c: In function \u0027print_trace_address\u0027:\n arch/sh/kernel/dumpstack.c:118:2: error: format not a string literal and no format arguments [-Werror\u003dformat-security]\n\nUse the \"%s\" format so that it\u0027s impossible to interpret \u0027data\u0027 as a\nformat string.\n\nSigned-off-by: Matt Fleming \u003cmatt.fleming@intel.com\u003e\nReported-by: Kees Cook \u003ckeescook@chromium.org\u003e\nAcked-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Paul Mundt \u003clethal@linux-sh.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d6f6fc7a2bc99124058b7c4850a9997530589a33", "tree": "9bc2384599e2b0be35cf36266c24c8f12dfb735c", "parents": [ "216583b5033215cd64468b865c0ee96d265cf546" ], "author": { "name": "Alan Stern", "email": "stern@rowland.harvard.edu", "time": "Wed Mar 12 11:30:38 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:45 2014 -0700" }, "message": "USB: unbind all interfaces before rebinding any\n\ncommit 6aec044cc2f5670cf3b143c151c8be846499bd15 upstream.\n\nWhen a driver doesn\u0027t have pre_reset, post_reset, or reset_resume\nmethods, the USB core unbinds that driver when its device undergoes a\nreset or a reset-resume, and then rebinds it afterward.\n\nThe existing straightforward implementation can lead to problems,\nbecause each interface gets unbound and rebound before the next\ninterface is handled. If a driver claims additional interfaces, the\nclaim may fail because the old binding instance may still own the\nadditional interface when the new instance tries to claim it.\n\nThis patch fixes the problem by first unbinding all the interfaces\nthat are marked (i.e., their needs_binding flag is set) and then\nrebinding all of them.\n\nThe patch also makes the helper functions in driver.c a little more\nuniform and adjusts some out-of-date comments.\n\nSigned-off-by: Alan Stern \u003cstern@rowland.harvard.edu\u003e\nReported-and-tested-by: \"Poulain, Loic\" \u003cloic.poulain@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "216583b5033215cd64468b865c0ee96d265cf546", "tree": "85bede3a9de8e178aac7b362fea9f672682b0a68", "parents": [ "f53fd451ade7c197376e9337c0ff4bbadf985dde" ], "author": { "name": "Paul Gortmaker", "email": "paul.gortmaker@windriver.com", "time": "Tue Jan 14 16:03:37 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:45 2014 -0700" }, "message": "hvc: ensure hvc_init is only ever called once in hvc_console.c\n\ncommit f76a1cbed18c86e2d192455f0daebb48458965f3 upstream.\n\nCommit 3e6c6f630a5282df8f3393a59f10eb9c56536d23 (\"Delay creation of\nkhcvd thread\") moved the call of hvc_init from being a device_initcall\ninto hvc_alloc, and used a non-null hvc_driver as indication of whether\nhvc_init had already been called.\n\nThe problem with this is that hvc_driver is only assigned a value\nat the bottom of hvc_init, and so there is a window where multiple\nhvc_alloc calls can be in progress at the same time and hence try\nand call hvc_init multiple times. Previously the use of device_init\nguaranteed that hvc_init was only called once.\n\nThis manifests itself as sporadic instances of two hvc_init calls\nracing each other, and with the loser of the race getting -EBUSY\nfrom tty_register_driver() and hence that virtual console fails:\n\n Couldn\u0027t register hvc console driver\n virtio-ports vport0p1: error -16 allocating hvc for port\n\nHere we add an atomic_t to guarantee we\u0027ll never run hvc_init twice.\n\nCc: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nCc: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nFixes: 3e6c6f630a52 (\"Delay creation of khcvd thread\")\nReported-by: Jim Somerville \u003cJim.Somerville@windriver.com\u003e\nTested-by: Jim Somerville \u003cJim.Somerville@windriver.com\u003e\nSigned-off-by: Paul Gortmaker \u003cpaul.gortmaker@windriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f53fd451ade7c197376e9337c0ff4bbadf985dde", "tree": "e5a614a9b242e0b0c5a13d9d13d45534819f240d", "parents": [ "f97f28f902804f7ccc209ff0e560c20dcb32c608" ], "author": { "name": "Huang Rui", "email": "ray.huang@amd.com", "time": "Tue Jan 07 17:45:50 2014 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:44 2014 -0700" }, "message": "usb: dwc3: fix wrong bit mask in dwc3_event_devt\n\ncommit 06f9b6e59661cee510b04513b13ea7927727d758 upstream.\n\nAround DWC USB3 2.30a release another bit has been added to the\nDevice-Specific Event (DEVT) Event Information (EvtInfo) bitfield.\n\nBecause of that, what used to be 8 bits long, has become 9 bits long.\n\nPer dwc3 2.30a+ spec in the Device-Specific Event (DEVT), the field of\nEvent Information Bits(EvtInfo) uses [24:16] bits, and it has 9 bits\nnot 8 bits. And the following reserved field uses [31:25] bits not\n[31:24] bits, and it has 7 bits.\n\nSo in dwc3_event_devt, the bit mask should be:\nevent_info\t[24:16]\t\t9 bits\nreserved31_25\t[31:25]\t\t7 bits\n\nThis patch makes sure that newer core releases will work fine with\nLinux and that we will decode the event information properly on new\ncore releases.\n\n[ balbi@ti.com : improve commit log a bit ]\n\nSigned-off-by: Huang Rui \u003cray.huang@amd.com\u003e\nSigned-off-by: Felipe Balbi \u003cbalbi@ti.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f97f28f902804f7ccc209ff0e560c20dcb32c608", "tree": "a2f149322def325ffad3ec9c8ae28bc817c37b24", "parents": [ "8ccd1a5521d0e870ccc5fee1d4bf7ee7ddab66ff" ], "author": { "name": "David Cohen", "email": "david.a.cohen@linux.intel.com", "time": "Fri Apr 25 19:20:16 2014 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:44 2014 -0700" }, "message": "usb/xhci: fix compilation warning when !CONFIG_PCI \u0026\u0026 !CONFIG_PM\n\ncommit 01bb59ebffdec314da8da66266edf29529372f9b upstream.\n\nWhen CONFIG_PCI and CONFIG_PM are not selected, xhci.c gets this\nwarning:\ndrivers/usb/host/xhci.c:409:13: warning: ‘xhci_msix_sync_irqs’ defined\nbut not used [-Wunused-function]\n\nInstead of creating nested #ifdefs, this patch fixes it by defining the\nxHCI PCI stubs as inline.\n\nThis warning has been in since 3.2 kernel and was\ncaused by commit 421aa841a134f6a743111cf44d0c6d3b45e3cf8c\n\"usb/xhci: hide MSI code behind PCI bars\", but wasn\u0027t noticed\nuntil 3.13 when a configuration with these options was tried\n\nSigned-off-by: David Cohen \u003cdavid.a.cohen@linux.intel.com\u003e\nSigned-off-by: Mathias Nyman \u003cmathias.nyman@linux.intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8ccd1a5521d0e870ccc5fee1d4bf7ee7ddab66ff", "tree": "680e1732fcca6d43d535bb912d027041c185ed07", "parents": [ "41b4a7dfd391b5826492a89c702420b97dc02334" ], "author": { "name": "Igor Gnatenko", "email": "i.gnatenko.brain@gmail.com", "time": "Fri Apr 25 19:20:15 2014 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:44 2014 -0700" }, "message": "xhci: extend quirk for Renesas cards\n\ncommit 6db249ebefc6bf5c39f35dfaacc046d8ad3ffd70 upstream.\n\nAfter suspend another Renesas PCI-X USB 3.0 card doesn\u0027t work.\n[root@fedora-20 ~]# lspci -vmnnd 1912:\nDevice:\t03:00.0\nClass:\tUSB controller [0c03]\nVendor:\tRenesas Technology Corp. [1912]\nDevice:\tuPD720202 USB 3.0 Host Controller [0015]\nSVendor:\tRenesas Technology Corp. [1912]\nSDevice:\tuPD720202 USB 3.0 Host Controller [0015]\nRev:\t02\nProgIf:\t30\n\nThis patch should be applied to stable kernel 3.14 that contain\nthe commit 1aa9578c1a9450fb21501c4f549f5b1edb557e6d\n\"xhci: Fix resume issues on Renesas chips in Samsung laptops\"\n\nReported-and-tested-by: Anatoly Kharchenko \u003crfr-bugs@yandex.ru\u003e\nReference: http://redmine.russianfedora.pro/issues/1315\nSigned-off-by: Igor Gnatenko \u003ci.gnatenko.brain@gmail.com\u003e\nSigned-off-by: Mathias Nyman \u003cmathias.nyman@linux.intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "41b4a7dfd391b5826492a89c702420b97dc02334", "tree": "22b1c0dc0d1213b6a3e4712123b3546e5f82dafd", "parents": [ "15e5f90c0f1d3f597981ffe18112aae9421f57c0" ], "author": { "name": "supriya karanth", "email": "supriya.karanth@stericsson.com", "time": "Thu Dec 06 11:12:48 2012 +0530" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:44 2014 -0700" }, "message": "usb: musb: set TXMAXP and AUTOSET for full speed bulk in device mode\n\ncommit bb3a2ef2eb8cfaea335dcb3426350df7f3d48069 upstream.\n\nThe TXMAXP register is not set correctly for full speed bulk case\nwhen the can_bulk_split() is used. Without this PIO transfers will\nnot take place correctly\n\nThe \"mult\" factor needs to be updated correctly for the\ncan_bulk_split() case\n\nThe AUTOSET bit in the TXCSR is not being set if the \"mult\"\nfactor is greater than 0 for the High Bandwidth ISO case.\nBut the \"mult\" factor is also greater than 0 in case of Full speed\nbulk transfers with the packet splitting in TXMAXP register\n\nWithout the AUTOSET the DMA transfers will not progress in mode1\n\n[ balbi@ti.com : add braces to both branches ]\n\nSigned-off-by: supriya karanth \u003csupriya.karanth@stericsson.com\u003e\nSigned-off-by: Praveena NADAHALLY \u003cpraveen.nadahally@stericsson.com\u003e\nAcked-by: Linus Walleij \u003clinus.walleij@linaro.org\u003e\nSigned-off-by: Felipe Balbi \u003cbalbi@ti.com\u003e\nCc: ian coolidge \u003ciancoolidge@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "15e5f90c0f1d3f597981ffe18112aae9421f57c0", "tree": "7b23c1679b69ac6d3b79da9aec33ecfcfe828c48", "parents": [ "86455b800f7544e239b2fa5a16962ea780a1e9d8" ], "author": { "name": "Jeff Mahoney", "email": "jeffm@suse.com", "time": "Wed Apr 02 14:40:26 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:44 2014 -0700" }, "message": "reiserfs: fix race in readdir\n\ncommit 01d8885785a60ae8f4c37b0ed75bdc96d0fc6a44 upstream.\n\njdm-20004 reiserfs_delete_xattrs: Couldn\u0027t delete all xattrs (-2)\n\nThe -ENOENT is due to readdir calling dir_emit on the same entry twice.\n\nIf the dir_emit callback sleeps and the tree is changed underneath us,\nwe won\u0027t be able to trust deh_offset(deh) anymore. We need to save\nnext_pos before we might sleep so we can find the next entry.\n\nSigned-off-by: Jeff Mahoney \u003cjeffm@suse.com\u003e\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "86455b800f7544e239b2fa5a16962ea780a1e9d8", "tree": "7119f6a2a710aa78fc46eeb2d9d3cf06da12389c", "parents": [ "d72db3c871f7232448abab9e12fbbe9d80a6606c" ], "author": { "name": "Andy Grover", "email": "agrover@redhat.com", "time": "Fri Apr 04 16:44:37 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:44 2014 -0700" }, "message": "target/tcm_fc: Fix use-after-free of ft_tpg\n\ncommit 2c42be2dd4f6586728dba5c4e197afd5cfaded78 upstream.\n\nft_del_tpg checks tpg-\u003etport is set before unlinking the tpg from the\ntport when the tpg is being removed. Set this pointer in ft_tport_create,\nor the unlinking won\u0027t happen in ft_del_tpg and tport-\u003etpg will reference\na deleted object.\n\nThis patch sets tpg-\u003etport in ft_tport_create, because that\u0027s what\nft_del_tpg checks, and is the only way to get back to the tport to\nclear tport-\u003etpg.\n\nThe bug was occuring when:\n\n- lport created, tport (our per-lport, per-provider context) is\n allocated.\n tport-\u003etpg \u003d NULL\n- tpg created\n- a PRLI is received. ft_tport_create is called, tpg is found and\n tport-\u003etpg is set\n- tpg removed. ft_tpg is freed in ft_del_tpg. Since tpg-\u003etport was not\n set, tport-\u003etpg is not cleared and points at freed memory\n- Future calls to ft_tport_create return tport via first conditional,\n instead of searching for new tpg by calling ft_lport_find_tpg.\n tport-\u003etpg is still invalid, and will access freed memory.\n\nsee https://bugzilla.redhat.com/show_bug.cgi?id\u003d1071340\n\nSigned-off-by: Andy Grover \u003cagrover@redhat.com\u003e\nSigned-off-by: Nicholas Bellinger \u003cnab@linux-iscsi.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d72db3c871f7232448abab9e12fbbe9d80a6606c", "tree": "57332345d7f1a1de27f9eaae4eda3b9709fc4d82", "parents": [ "8ba4bc7680f75ac3294cb3222b21bc2912b24963" ], "author": { "name": "Nicholas Bellinger", "email": "nab@linux-iscsi.org", "time": "Wed Feb 19 23:32:14 2014 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:43 2014 -0700" }, "message": "iscsi-target: Fix ERL\u003d2 ASYNC_EVENT connection pointer bug\n\ncommit d444edc679e7713412f243b792b1f964e5cff1e1 upstream.\n\nThis patch fixes a long-standing bug in iscsit_build_conn_drop_async_message()\nwhere during ERL\u003d2 connection recovery, a bogus conn_p pointer could\nend up being used to send the ISCSI_OP_ASYNC_EVENT + DROPPING_CONNECTION\nnotifying the initiator that cmd-\u003elogout_cid has failed.\n\nThe bug was manifesting itself as an OOPs in iscsit_allocate_cmd() with\na bogus conn_p pointer in iscsit_build_conn_drop_async_message().\n\nReported-by: Arshad Hussain \u003carshad.hussain@calsoftinc.com\u003e\nReported-by: santosh kulkarni \u003csantosh.kulkarni@calsoftinc.com\u003e\nSigned-off-by: Nicholas Bellinger \u003cnab@linux-iscsi.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8ba4bc7680f75ac3294cb3222b21bc2912b24963", "tree": "6d2e583cf657638790e10dfbdab1e49a37f4fde6", "parents": [ "41d5d291583dedd9fde7dbdad524a604166266c4" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Tue Feb 11 19:06:33 2014 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:43 2014 -0700" }, "message": "SCSI: arcmsr: upper 32 of dma address lost\n\ncommit e2c70425f05219b142b3a8a9489a622c736db39d upstream.\n\nThe original code always set the upper 32 bits to zero because it was\ndoing a shift of the wrong variable.\n\nFixes: 1a4f550a09f8 (\u0027[SCSI] arcmsr: 1.20.00.15: add SATA RAID plus other fixes\u0027)\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: James Bottomley \u003cJBottomley@Parallels.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "41d5d291583dedd9fde7dbdad524a604166266c4", "tree": "2f0731e52957f8a901510fd84cd7ffe94f1b59ea", "parents": [ "794f9950ebd832b8712e32007e0359e5c6e60f55" ], "author": { "name": "Mike Marciniszyn", "email": "mike.marciniszyn@intel.com", "time": "Mon Apr 07 13:58:35 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:43 2014 -0700" }, "message": "ib_srpt: Use correct ib_sg_dma primitives\n\ncommit b076808051f2c80d38e03fb2f1294f525c7a446d upstream.\n\nThe code was incorrectly using sg_dma_address() and\nsg_dma_len() instead of ib_sg_dma_address() and\nib_sg_dma_len().\n\nThis prevents srpt from functioning with the\nIntel HCA and indeed will corrupt memory\nbadly.\n\nCc: Bart Van Assche \u003cbvanassche@acm.org\u003e\nReviewed-by: Dennis Dalessandro \u003cdennis.dalessandro@intel.com\u003e\nTested-by: Vinod Kumar \u003cvinod.kumar@intel.com\u003e\nSigned-off-by: Mike Marciniszyn \u003cmike.marciniszyn@intel.com\u003e\nSigned-off-by: Nicholas Bellinger \u003cnab@linux-iscsi.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "794f9950ebd832b8712e32007e0359e5c6e60f55", "tree": "0a07c710c6cf08308d96fd4b291981880c09b090", "parents": [ "53b5bc1e97df8c617d6a9e15d0ce33981ee086c9" ], "author": { "name": "Yann Droneaud", "email": "ydroneaud@opteya.com", "time": "Mon Mar 10 23:06:25 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:43 2014 -0700" }, "message": "IB/ehca: Returns an error on ib_copy_to_udata() failure\n\ncommit 5bdb0f02add5994b0bc17494f4726925ca5d6ba1 upstream.\n\nIn case of error when writing to userspace, function ehca_create_cq()\ndoes not set an error code before following its error path.\n\nThis patch sets the error code to -EFAULT when ib_copy_to_udata()\nfails.\n\nThis was caught when using spatch (aka. coccinelle)\nto rewrite call to ib_copy_{from,to}_udata().\n\nLink: https://www.gitorious.org/opteya/coccib/source/75ebf2c1033c64c1d81df13e4ae44ee99c989eba:ib_copy_udata.cocci\nLink: http://marc.info/?i\u003dcover.1394485254.git.ydroneaud@opteya.com\nSigned-off-by: Yann Droneaud \u003cydroneaud@opteya.com\u003e\nSigned-off-by: Roland Dreier \u003croland@purestorage.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "53b5bc1e97df8c617d6a9e15d0ce33981ee086c9", "tree": "9d0be6df99b030d8b9b6af4af3e0fc52d17e4cd4", "parents": [ "64900cd67cf96f8fc40d1db1f4058cbaa2dca7ff" ], "author": { "name": "Yann Droneaud", "email": "ydroneaud@opteya.com", "time": "Mon Mar 10 23:06:26 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:43 2014 -0700" }, "message": "IB/mthca: Return an error on ib_copy_to_udata() failure\n\ncommit 08e74c4b00c30c232d535ff368554959403d0432 upstream.\n\nIn case of error when writing to userspace, the function mthca_create_cq()\ndoes not set an error code before following its error path.\n\nThis patch sets the error code to -EFAULT when ib_copy_to_udata() fails.\n\nThis was caught when using spatch (aka. coccinelle)\nto rewrite call to ib_copy_{from,to}_udata().\n\nLink: https://www.gitorious.org/opteya/coccib/source/75ebf2c1033c64c1d81df13e4ae44ee99c989eba:ib_copy_udata.cocci\nLink: http://marc.info/?i\u003dcover.1394485254.git.ydroneaud@opteya.com\nSigned-off-by: Yann Droneaud \u003cydroneaud@opteya.com\u003e\nSigned-off-by: Roland Dreier \u003croland@purestorage.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "64900cd67cf96f8fc40d1db1f4058cbaa2dca7ff", "tree": "73cc9e6a5c00d76674790c77d579a37136b07a24", "parents": [ "066c269f39f667f486d3cb709429dc73ff2f172d" ], "author": { "name": "Yann Droneaud", "email": "ydroneaud@opteya.com", "time": "Mon Mar 10 23:06:27 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:43 2014 -0700" }, "message": "IB/nes: Return an error on ib_copy_from_udata() failure instead of NULL\n\ncommit 9d194d1025f463392feafa26ff8c2d8247f71be1 upstream.\n\nIn case of error while accessing to userspace memory, function\nnes_create_qp() returns NULL instead of an error code wrapped through\nERR_PTR(). But NULL is not expected by ib_uverbs_create_qp(), as it\ncheck for error with IS_ERR().\n\nAs page 0 is likely not mapped, it is going to trigger an Oops when\nthe kernel will try to dereference NULL pointer to access to struct\nib_qp\u0027s fields.\n\nIn some rare cases, page 0 could be mapped by userspace, which could\nturn this bug to a vulnerability that could be exploited: the function\npointers in struct ib_device will be under userspace total control.\n\nThis was caught when using spatch (aka. coccinelle)\nto rewrite calls to ib_copy_{from,to}_udata().\n\nLink: https://www.gitorious.org/opteya/ib-hw-nes-create-qp-null\nLink: https://www.gitorious.org/opteya/coccib/source/75ebf2c1033c64c1d81df13e4ae44ee99c989eba:ib_copy_udata.cocci\nLink: http://marc.info/?i\u003dcover.1394485254.git.ydroneaud@opteya.com\nSigned-off-by: Yann Droneaud \u003cydroneaud@opteya.com\u003e\nSigned-off-by: Roland Dreier \u003croland@purestorage.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "066c269f39f667f486d3cb709429dc73ff2f172d", "tree": "056b30092367c8618500d3ca9d980defd5920f1e", "parents": [ "d8992efff2b60c8b360ebef7daa03db6496cc131" ], "author": { "name": "Dennis Dalessandro", "email": "dennis.dalessandro@intel.com", "time": "Thu Feb 20 11:02:53 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:43 2014 -0700" }, "message": "IB/ipath: Fix potential buffer overrun in sending diag packet routine\n\ncommit a2cb0eb8a64adb29a99fd864013de957028f36ae upstream.\n\nGuard against a potential buffer overrun. The size to read from the\nuser is passed in, and due to the padding that needs to be taken into\naccount, as well as the place holder for the ICRC it is possible to\noverflow the 32bit value which would cause more data to be copied from\nuser space than is allocated in the buffer.\n\nReported-by: Nico Golde \u003cnico@ngolde.de\u003e\nReported-by: Fabian Yamaguchi \u003cfabs@goesec.de\u003e\nReviewed-by: Mike Marciniszyn \u003cmike.marciniszyn@intel.com\u003e\nSigned-off-by: Dennis Dalessandro \u003cdennis.dalessandro@intel.com\u003e\nSigned-off-by: Roland Dreier \u003croland@purestorage.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d8992efff2b60c8b360ebef7daa03db6496cc131", "tree": "8d9c6eec926034373edfbc387556f2743260a6be", "parents": [ "367bce496469f4a47c717c048116cdb73caefa62" ], "author": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Mon Mar 10 14:17:55 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:42 2014 -0700" }, "message": "nfsd4: fix setclientid encode size\n\ncommit 480efaee085235bb848f1063f959bf144103c342 upstream.\n\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "367bce496469f4a47c717c048116cdb73caefa62", "tree": "0470771399f03018f5ef348c6041bc3817ed758d", "parents": [ "c2189c7fedb781f3dd14b4df162661e36a85cc02" ], "author": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Mon Feb 24 14:59:47 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:42 2014 -0700" }, "message": "nfsd: notify_change needs elevated write count\n\ncommit 9f67f189939eccaa54f3d2c9cf10788abaf2d584 upstream.\n\nLooks like this bug has been here since these write counts were\nintroduced, not sure why it was just noticed now.\n\nThanks also to Jan Kara for pointing out the problem.\n\nReported-by: Matthew Rahtz \u003cmrahtz@rapitasystems.com\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c2189c7fedb781f3dd14b4df162661e36a85cc02", "tree": "f913a63c0c1d04c74cd8af30ff5c4b72439768fa", "parents": [ "9acc531f6038cccb95a7bf4d26469196764e6d53" ], "author": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Mon Feb 03 16:31:42 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:42 2014 -0700" }, "message": "nfsd4: fix test_stateid error reply encoding\n\ncommit a11fcce1544df08c723d950ff0edef3adac40405 upstream.\n\nIf the entire operation fails then there\u0027s nothing to encode.\n\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9acc531f6038cccb95a7bf4d26469196764e6d53", "tree": "7d3b9e2f1b064e527954ca5f321d1148f6054fd8", "parents": [ "fc111bf8f73b9223fd4f8e420b7b76f4e0fed427" ], "author": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Tue Jan 28 16:05:15 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:42 2014 -0700" }, "message": "nfsd4: buffer-length check for SUPPATTR_EXCLCREAT\n\ncommit de3997a7eeb9ea286b15879fdf8a95aae065b4f7 upstream.\n\nThis was an omission from 8c18f2052e756e7d5dea712fc6e7ed70c00e8a39\n\"nfsd41: SUPPATTR_EXCLCREAT attribute\".\n\nCc: Benny Halevy \u003cbhalevy@primarydata.com\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "fc111bf8f73b9223fd4f8e420b7b76f4e0fed427", "tree": "c320303c76a4252d965345ca05baf791b336100f", "parents": [ "5d052fbbd7b0069df1fdeaa7dd5eb16e1345a458" ], "author": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Tue Jan 28 16:01:04 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:42 2014 -0700" }, "message": "nfsd4: session needs room for following op to error out\n\ncommit 4c69d5855a16f7378648c5733632628fa10431db upstream.\n\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5d052fbbd7b0069df1fdeaa7dd5eb16e1345a458", "tree": "85d38d4c39d69a896dbbddc578485305c9e2d81f", "parents": [ "632d996e9911371a3b48cec1e8451c7c2761fd69" ], "author": { "name": "Alan Stern", "email": "stern@rowland.harvard.edu", "time": "Mon Apr 14 13:48:47 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:42 2014 -0700" }, "message": "USB: fix crash during hotplug of PCI USB controller card\n\ncommit a2ff864b53eac9a0e9b05bfe9d1781ccd6c2af71 upstream.\n\nThe code in hcd-pci.c that matches up EHCI controllers with their\ncompanion UHCI or OHCI controllers assumes that the private drvdata\nfields don\u0027t get set too early. However, it turns out that this field\ngets set by usb_create_hcd(), before hcd-pci expects it, and this can\nresult in a crash when two controllers are probed in parallel (as can\nhappen when a new controller card is hotplugged).\n\nThe companions_rwsem lock was supposed to prevent this sort of thing,\nbut usb_create_hcd() is called outside the scope of the rwsem.\n\nA simple solution is to check that the root-hub pointer has been\ninitialized as well as the drvdata field. This doesn\u0027t happen until\nusb_add_hcd() is called; that call and the check are both protected by\nthe rwsem.\n\nThis patch should be applied to stable kernels from 3.10 onward.\n\nSigned-off-by: Alan Stern \u003cstern@rowland.harvard.edu\u003e\nReported-by: Stefani Seibold \u003cstefani@seibold.net\u003e\nTested-by: Stefani Seibold \u003cstefani@seibold.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "632d996e9911371a3b48cec1e8451c7c2761fd69", "tree": "fad9c784dd595583703c53555f28d1ca06c2a32d", "parents": [ "9d1a5959bc3be5b9aa5886e8736534b96098b215" ], "author": { "name": "H. Peter Anvin", "email": "hpa@linux.intel.com", "time": "Sun Mar 16 15:31:54 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:42 2014 -0700" }, "message": "x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels\n\ncommit b3b42ac2cbae1f3cecbb6229964a4d48af31d382 upstream.\n\nThe IRET instruction, when returning to a 16-bit segment, only\nrestores the bottom 16 bits of the user space stack pointer. We have\na software workaround for that (\"espfix\") for the 32-bit kernel, but\nit relies on a nonzero stack segment base which is not available in\n32-bit mode.\n\nSince 16-bit support is somewhat crippled anyway on a 64-bit kernel\n(no V86 mode), and most (if not quite all) 64-bit processors support\nvirtualization for the users who really need it, simply reject\nattempts at creating a 16-bit segment when running on top of a 64-bit\nkernel.\n\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: H. Peter Anvin \u003chpa@linux.intel.com\u003e\nLink: http://lkml.kernel.org/n/tip-kicdm89kzw9lldryb1br9od0@git.kernel.org\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9d1a5959bc3be5b9aa5886e8736534b96098b215", "tree": "08279717977dcbeb73901895ae4992042e219c8c", "parents": [ "725f2ba0cbb94c7e8f3499ef57dbd47d85521ef7" ], "author": { "name": "Larry Finger", "email": "Larry.Finger@lwfinger.net", "time": "Wed Apr 16 14:49:33 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:41 2014 -0700" }, "message": "staging: r8712u: Fix case where ethtype was never obtained and always be checked against 0\n\ncommit f764cd68d9036498f08fe8834deb6a367b5c2542 upstream.\n\nZero-initializing ether_type masked that the ether type would never be\nobtained for 8021x packets and the comparison against eapol_type\nwould always fail.\n\nReported-by: Jes Sorensen \u003cJes.Sorensen@redhat.com\u003e\nSigned-off-by: Larry Finger \u003cLarry.Finger@lwfinger.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "725f2ba0cbb94c7e8f3499ef57dbd47d85521ef7", "tree": "b8b6b089bdf8f2e5cf1e883b038b1eb52efe5b7e", "parents": [ "6733ac581418cfd8d7bef57c22fc2e0d673c4272" ], "author": { "name": "Himangi Saraogi", "email": "himangi774@gmail.com", "time": "Wed Mar 05 04:59:57 2014 +0530" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:41 2014 -0700" }, "message": "staging:serqt_usb2: Fix sparse warning restricted __le16 degrades to integer\n\ncommit abe5d64d1a74195a44cd14624f8178b9f48b7cc7 upstream.\n\nThis patch fixes the following sparse warning :\ndrivers/staging/serqt_usb2/serqt_usb2.c:727:40: warning: restricted __le16 degrades to integer\n\nSigned-off-by: Himangi Saraogi \u003chimangi774@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6733ac581418cfd8d7bef57c22fc2e0d673c4272", "tree": "901d07fe2fe2e1af5f69ca18259fa1b0d78d967b", "parents": [ "3b015ff0243274791bb5d9357f517e43babcf705" ], "author": { "name": "David Fries", "email": "David@Fries.net", "time": "Wed Jan 15 22:29:12 2014 -0600" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:41 2014 -0700" }, "message": "w1: fix w1_send_slave dropping a slave id\n\ncommit 6b355b33a64fd6d8ead2b838ec16fb9b551f71e8 upstream.\n\nPrevious logic,\nif (avail \u003e 8) {\n\tstore slave;\n\treturn;\n}\nsend data; clear;\n\nThe logic error is, if there isn\u0027t space send the buffer and clear,\nbut the slave wasn\u0027t added to the now empty buffer loosing that slave\nid. It also should have been \"if (avail \u003e\u003d 8)\" because when it is 8,\nthere is space.\n\nInstead, if there isn\u0027t space send and clear the buffer, then there is\nalways space for the slave id.\n\nSigned-off-by: David Fries \u003cDavid@Fries.net\u003e\nAcked-by: Evgeniy Polyakov \u003czbr@ioremap.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "3b015ff0243274791bb5d9357f517e43babcf705", "tree": "db0da7b5f71a821a514016a3fa61395dbc094d4c", "parents": [ "4efaf4210b1a995cf39f29425259fbbd87194661" ], "author": { "name": "Krzysztof Kozlowski", "email": "k.kozlowski@samsung.com", "time": "Tue Feb 11 11:03:34 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:41 2014 -0700" }, "message": "mfd: max8997: Fix possible NULL pointer dereference on i2c_new_dummy error\n\ncommit 97dc4ed3fa377ec91bb60ba98b70d645c2099384 upstream.\n\nDuring probe the driver allocates dummy I2C devices for RTC, haptic and\nMUIC with i2c_new_dummy() but it does not check the return value of this\ncalls.\n\nIn case of error (i2c_new_device(): memory allocation failure or I2C\naddress cannot be used) this function returns NULL which is later used\nby i2c_unregister_device().\n\nIf i2c_new_dummy() fails for RTC, haptic or MUIC devices, fail also the\nprobe for main MFD driver.\n\nSigned-off-by: Krzysztof Kozlowski \u003ck.kozlowski@samsung.com\u003e\nSigned-off-by: Lee Jones \u003clee.jones@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "4efaf4210b1a995cf39f29425259fbbd87194661", "tree": "5d90e9031603ac8e7dd01455b886ce9edbd65f35", "parents": [ "b9546b807f1a47ba98760246df1c3f1cb6d05306" ], "author": { "name": "Krzysztof Kozlowski", "email": "k.kozlowski@samsung.com", "time": "Tue Feb 11 11:03:35 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:41 2014 -0700" }, "message": "mfd: max8998: Fix possible NULL pointer dereference on i2c_new_dummy error\n\ncommit ed26f87b9f71693a1d1ee85f5e6209601505080f upstream.\n\nDuring probe the driver allocates dummy I2C device for RTC with i2c_new_dummy() but it does not check the return value of this call.\n\nIn case of error (i2c_new_device(): memory allocation failure or I2C\naddress cannot be used) this function returns NULL which is later used\nby i2c_unregister_device().\n\nIf i2c_new_dummy() fails for RTC device, fail also the probe for\nmain MFD driver.\n\nSigned-off-by: Krzysztof Kozlowski \u003ck.kozlowski@samsung.com\u003e\nSigned-off-by: Lee Jones \u003clee.jones@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b9546b807f1a47ba98760246df1c3f1cb6d05306", "tree": "06b05546ece80f06566574242eaa9d399e8950db", "parents": [ "f4a8f6c0d3970daa2634475ce43d04310127272d" ], "author": { "name": "Krzysztof Kozlowski", "email": "k.kozlowski@samsung.com", "time": "Tue Feb 11 11:03:33 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:41 2014 -0700" }, "message": "mfd: max8925: Fix possible NULL pointer dereference on i2c_new_dummy error\n\ncommit 96cf3dedc491d2f1f66cc26217f2b06b0c7b6797 upstream.\n\nDuring probe the driver allocates dummy I2C devices for RTC and ADC\nwith i2c_new_dummy() but it does not check the return value of this\ncalls.\n\nIn case of error (i2c_new_device(): memory allocation failure or I2C\naddress cannot be used) this function returns NULL which is later used\nby i2c_unregister_device().\n\nIf i2c_new_dummy() fails for RTC or ADC devices, fail also the probe\nfor main MFD driver.\n\nSigned-off-by: Krzysztof Kozlowski \u003ck.kozlowski@samsung.com\u003e\nSigned-off-by: Lee Jones \u003clee.jones@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f4a8f6c0d3970daa2634475ce43d04310127272d", "tree": "c9b3a2d85f4a9ab169786fe62615a96eae532125", "parents": [ "b7b38eb3f20b2cd88c41f6b05aa2e3f2f1b3b878" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Tue Apr 08 16:58:34 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:40 2014 -0700" }, "message": "ALSA: ice1712: Fix boundary checks in PCM pointer ops\n\ncommit 4f8e940095536bc002a81666a4107a581c84e9b9 upstream.\n\nPCM pointer callbacks in ice1712 driver check the buffer size boundary\nwrongly between bytes and frames. This leads to PCM core warnings\nlike:\n snd_pcm_update_hw_ptr0: 105 callbacks suppressed\n ALSA pcm_lib.c:352 BUG: pcmC3D0c:0, pos \u003d 5461, buffer size \u003d 5461, period size \u003d 2730\n\nThis patch fixes these checks to be placed after the proper unit\nconversions.\n\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b7b38eb3f20b2cd88c41f6b05aa2e3f2f1b3b878", "tree": "e4ce05d0b6c3eeeb923e7ca2c34e1ca65b166d82", "parents": [ "61d0294719523889c7ce32d33a2ab7cc73fbb814" ], "author": { "name": "W. Trevor King", "email": "wking@tremily.us", "time": "Sat Mar 29 17:47:24 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:40 2014 -0700" }, "message": "ALSA: hda - Enable beep for ASUS 1015E\n\ncommit a4b7f21d7b42b33609df3f86992a8deff80abfaf upstream.\n\nThe `lspci -nnvv` output contains (wrapped for line length):\n\n 00:1b.0 Audio device [0403]:\n Intel Corporation 7 Series/C210 Series Chipset Family\n High Definition Audio Controller [8086:1e20] (rev 04)\n Subsystem: ASUSTeK Computer Inc. Device [1043:115d]\n\nSigned-off-by: W. Trevor King \u003cwking@tremily.us\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "61d0294719523889c7ce32d33a2ab7cc73fbb814", "tree": "074514bf280ad6d9428731086aebd49bde0e980b", "parents": [ "76ff67ac5a2585634709abc41a0a9f3f3b28c90f" ], "author": { "name": "Liu Hua", "email": "sdu.liu@huawei.com", "time": "Fri Apr 18 07:45:36 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:40 2014 -0700" }, "message": "ARM: 8030/1: ARM : kdump : add arch_crash_save_vmcoreinfo\n\ncommit 56b700fd6f1e49149880fb1b6ffee0dca5be45fb upstream.\n\nFor vmcore generated by LPAE enabled kernel, user space\nutility such as crash needs additional infomation to\nparse.\n\nSo this patch add arch_crash_save_vmcoreinfo as what PAE enabled\ni386 linux does.\n\nReviewed-by: Will Deacon \u003cwill.deacon@arm.com\u003e\nSigned-off-by: Liu Hua \u003csdu.liu@huawei.com\u003e\nSigned-off-by: Russell King \u003crmk+kernel@arm.linux.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "76ff67ac5a2585634709abc41a0a9f3f3b28c90f", "tree": "51364e09deb33ef92ca5801a8615c74b3dda6c8e", "parents": [ "375f0dfa0c993b38ca4cd6f5859cc2a35ee10157" ], "author": { "name": "Xiangyu Lu", "email": "luxiangyu@huawei.com", "time": "Tue Apr 15 09:38:17 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:40 2014 -0700" }, "message": "ARM: 8027/1: fix do_div() bug in big-endian systems\n\ncommit 80bb3ef109ff40a7593d9481c17de9bbc4d7c0e2 upstream.\n\nIn big-endian systems, \"%1\" get the most significant part of the value, cause the instruction to get the wrong result.\n\nWhen viewing ftrace record in big-endian ARM systems, we found that\nthe timestamp errors:\n\nswapper-0 [001] 1325.970000: 0:120:R \u003d\u003d\u003e [001] 16:120:R events/1\nevents/1-16 [001] 1325.970000: 16:120:S \u003d\u003d\u003e [001] 0:120:R swapper\nswapper-0 [000] 1325.1000000: 0:120:R + [000] 15:120:R events/0\nswapper-0 [000] 1325.1000000: 0:120:R \u003d\u003d\u003e [000] 15:120:R events/0\nswapper-0 [000] 1326.030000: 0:120:R + [000] 1150:120:R sshd\nswapper-0 [000] 1326.030000: 0:120:R \u003d\u003d\u003e [000] 1150:120:R sshd\n\nWhen viewed ftrace records, it will call the do_div(n, base) function, which achieved arch/arm/include/asm/div64.h in. When n \u003d 10000000, base \u003d 1000000, in do_div(n, base) will execute \"umull %Q0, %R0, %1, %Q2\".\n\nReviewed-by: Dave Martin \u003cDave.Martin@arm.com\u003e\nReviewed-by: Nicolas Pitre \u003cnico@linaro.org\u003e\nSigned-off-by: Alex Wu \u003cwuquanming@huawei.com\u003e\nSigned-off-by: Xiangyu Lu \u003cluxiangyu@huawei.com\u003e\nSigned-off-by: Russell King \u003crmk+kernel@arm.linux.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "375f0dfa0c993b38ca4cd6f5859cc2a35ee10157", "tree": "9864a2c9553594492ff399321cd46c9199b43d81", "parents": [ "05b81311eb29058600b458393cf577b4d40a0b14" ], "author": { "name": "Roger Quadros", "email": "rogerq@ti.com", "time": "Thu Apr 10 10:18:17 2014 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:40 2014 -0700" }, "message": "ARM: OMAP3: hwmod data: Correct clock domains for USB modules\n\ncommit c6c56697ae4bf1226263c19e8353343d7083f40e upstream.\n\nOMAP3 doesn\u0027t contain \"l3_init_clkdm\" clock domain. Use the\nproper clock domains for USB Host and USB TLL modules.\n\nGets rid of the following warnings during boot\n omap_hwmod: usb_host_hs: could not associate to clkdm l3_init_clkdm\n omap_hwmod: usb_tll_hs: could not associate to clkdm l3_init_clkdm\n\nReported-by: Nishanth Menon \u003cnm@ti.com\u003e\nCc: Paul Walmsley \u003cpaul@pwsan.com\u003e\nSigned-off-by: Roger Quadros \u003crogerq@ti.com\u003e\nFixes: de231388cb80a8ef3e779bbfa0564ba0157b7377 (\"ARM: OMAP: USB: EHCI and OHCI hwmod structures for OMAP3\")\nCc: Keshava Munegowda \u003ckeshava_mgowda@ti.com\u003e\nCc: Partha Basak \u003cparthab@india.ti.com\u003e\nSigned-off-by: Paul Walmsley \u003cpaul@pwsan.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "05b81311eb29058600b458393cf577b4d40a0b14", "tree": "4d84fa66a4644abe5421b6314d59d816437d41fa", "parents": [ "62f29567f2e87357413ec534d7ecde5763e83239" ], "author": { "name": "Stefan Sørensen", "email": "stefan.sorensen@spectralink.com", "time": "Thu Mar 06 16:27:15 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:40 2014 -0700" }, "message": "ARM: OMAP2+: INTC: Acknowledge stuck active interrupts\n\ncommit 698b48532539484b012fb7c4176b959d32a17d00 upstream.\n\nWhen an interrupt has become active on the INTC it will stay active\nuntil it is acked, even if masked or de-asserted. The\nINTC_PENDING_IRQn registers are however updated and since these are\nused by omap_intc_handle_irq to determine which interrupt to handle,\nit will never see the active interrupt. This will result in a storm of\nuseless interrupts that is only stopped when another higher priority\ninterrupt is asserted.\n\nFix by sending the INTC an acknowledge if we find no interrupts to\nhandle.\n\nSigned-off-by: Stefan Sørensen \u003cstefan.sorensen@spectralink.com\u003e\nSigned-off-by: Tony Lindgren \u003ctony@atomide.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "62f29567f2e87357413ec534d7ecde5763e83239", "tree": "016eb7c91de213d4424827098a4d088a9c96afad", "parents": [ "5c5994f5a166379c5b8e719f17d466e9276ee581" ], "author": { "name": "Brian Austin", "email": "brian.austin@cirrus.com", "time": "Tue Mar 18 13:56:21 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 06 07:51:39 2014 -0700" }, "message": "ASoC: cs42l73: Fix mask bits for SOC_VALUE_ENUM_SINGLE\n\ncommit 1555b652970e541fa1cb80c61ffc696bbfb92bb7 upstream.\n\nThe mask bits values were wrong for the SOC_VALUE_ENUM_SINGLE for the mono mix controls.\n\nReported-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Brian Austin \u003cbrian.austin@cirrus.com\u003e\nSigned-off-by: Mark Brown \u003cbroonie@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5c5994f5a166379c5b8e719f17d466e9276ee581", "tree": "77fbf01fb2b2e263ec61ea916b1037c1e1518c20", "parents": [ "d66d2078181ddf2d26585c6737ea43ea8a6f52e6" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:46 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:46 2014 -0700" }, "message": "Linux 3.4.88\n" }, { "commit": "d66d2078181ddf2d26585c6737ea43ea8a6f52e6", "tree": "6ef8e1786836c5e8872d6ecd9b9625a13bfe807a", "parents": [ "371d9bb7dab6293e79aafb5481b842629a60aa5e" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Mon Apr 07 15:38:41 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:20 2014 -0700" }, "message": "wait: fix reparent_leader() vs EXIT_DEAD-\u003eEXIT_ZOMBIE race\n\ncommit dfccbb5e49a621c1b21a62527d61fc4305617aca upstream.\n\nwait_task_zombie() first does EXIT_ZOMBIE-\u003eEXIT_DEAD transition and\ndrops tasklist_lock. If this task is not the natural child and it is\ntraced, we change its state back to EXIT_ZOMBIE for -\u003ereal_parent.\n\nThe last transition is racy, this is even documented in 50b8d257486a\n\"ptrace: partially fix the do_wait(WEXITED) vs EXIT_DEAD-\u003eEXIT_ZOMBIE\nrace\". wait_consider_task() tries to detect this transition and clear\n-\u003enotask_error but we can\u0027t rely on ptrace_reparented(), debugger can\nexit and do ptrace_unlink() before its sub-thread sets EXIT_ZOMBIE.\n\nAnd there is another problem which were missed before: this transition\ncan also race with reparent_leader() which doesn\u0027t reset \u003eexit_signal if\nEXIT_DEAD, assuming that this task must be reaped by someone else. So\nthe tracee can be re-parented with -\u003eexit_signal !\u003d SIGCHLD, and if\n/sbin/init doesn\u0027t use __WALL it becomes unreapable.\n\nChange reparent_leader() to update -\u003eexit_signal even if EXIT_DEAD.\nNote: this is the simple temporary hack for -stable, it doesn\u0027t try to\nsolve all problems, it will be reverted by the next changes.\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nReported-by: Jan Kratochvil \u003cjan.kratochvil@redhat.com\u003e\nReported-by: Michal Schmidt \u003cmschmidt@redhat.com\u003e\nTested-by: Michal Schmidt \u003cmschmidt@redhat.com\u003e\nCc: Al Viro \u003cviro@ZenIV.linux.org.uk\u003e\nCc: Lennart Poettering \u003clpoetter@redhat.com\u003e\nCc: Roland McGrath \u003croland@hack.frob.com\u003e\nCc: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "371d9bb7dab6293e79aafb5481b842629a60aa5e", "tree": "4aecba22fcca3750180832a4e03c8ed79100c447", "parents": [ "5c8e8e1378bb5be5600f8ed23d8bc61cc466b6eb" ], "author": { "name": "Li Zefan", "email": "lizefan@huawei.com", "time": "Wed Feb 12 12:44:57 2014 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:20 2014 -0700" }, "message": "jffs2: remove from wait queue after schedule()\n\ncommit 3ead9578443b66ddb3d50ed4f53af8a0c0298ec5 upstream.\n\n@wait is a local variable, so if we don\u0027t remove it from the wait queue\nlist, later wake_up() may end up accessing invalid memory.\n\nThis was spotted by eyes.\n\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nCc: David Woodhouse \u003cdwmw2@infradead.org\u003e\nCc: Artem Bityutskiy \u003cartem.bityutskiy@linux.intel.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Brian Norris \u003ccomputersforpeace@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5c8e8e1378bb5be5600f8ed23d8bc61cc466b6eb", "tree": "b4201e5362ad14591b4486ec88aa2c98d35e756e", "parents": [ "b49c0b860779db3f81d88a1ba4edc9b2f2d27b96" ], "author": { "name": "Li Zefan", "email": "lizefan@huawei.com", "time": "Wed Feb 12 12:44:56 2014 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:20 2014 -0700" }, "message": "jffs2: avoid soft-lockup in jffs2_reserve_space_gc()\n\ncommit 13b546d96207c131eeae15dc7b26c6e7d0f1cad7 upstream.\n\nWe triggered soft-lockup under stress test on 2.6.34 kernel.\n\nBUG: soft lockup - CPU#1 stuck for 60009ms! [lockf2.test:14488]\n...\n[\u003cbf09a4d4\u003e] (jffs2_do_reserve_space+0x420/0x440 [jffs2])\n[\u003cbf09a528\u003e] (jffs2_reserve_space_gc+0x34/0x78 [jffs2])\n[\u003cbf0a1350\u003e] (jffs2_garbage_collect_dnode.isra.3+0x264/0x478 [jffs2])\n[\u003cbf0a2078\u003e] (jffs2_garbage_collect_pass+0x9c0/0xe4c [jffs2])\n[\u003cbf09a670\u003e] (jffs2_reserve_space+0x104/0x2a8 [jffs2])\n[\u003cbf09dc48\u003e] (jffs2_write_inode_range+0x5c/0x4d4 [jffs2])\n[\u003cbf097d8c\u003e] (jffs2_write_end+0x198/0x2c0 [jffs2])\n[\u003cc00e00a4\u003e] (generic_file_buffered_write+0x158/0x200)\n[\u003cc00e14f4\u003e] (__generic_file_aio_write+0x3a4/0x414)\n[\u003cc00e15c0\u003e] (generic_file_aio_write+0x5c/0xbc)\n[\u003cc012334c\u003e] (do_sync_write+0x98/0xd4)\n[\u003cc0123a84\u003e] (vfs_write+0xa8/0x150)\n[\u003cc0123d74\u003e] (sys_write+0x3c/0xc0)]\n\nFix this by adding a cond_resched() in the while loop.\n\n[akpm@linux-foundation.org: don\u0027t initialize `ret\u0027]\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nCc: David Woodhouse \u003cdwmw2@infradead.org\u003e\nCc: Artem Bityutskiy \u003cartem.bityutskiy@linux.intel.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Brian Norris \u003ccomputersforpeace@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b49c0b860779db3f81d88a1ba4edc9b2f2d27b96", "tree": "88b58d135041265fce23728ccd81c950e97036ac", "parents": [ "3dba9e3a42493e2c6453f3863a999778ad3dd3b0" ], "author": { "name": "Ajesh Kunhipurayil Vijayan", "email": "ajesh@broadcom.com", "time": "Mon Jan 06 19:06:55 2014 +0530" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:20 2014 -0700" }, "message": "jffs2: Fix crash due to truncation of csize\n\ncommit 41bf1a24c1001f4d0d41a78e1ac575d2f14789d7 upstream.\n\nmounting JFFS2 partition sometimes crashes with this call trace:\n\n[ 1322.240000] Kernel bug detected[#1]:\n[ 1322.244000] Cpu 2\n[ 1322.244000] $ 0 : 0000000000000000 0000000000000018 000000003ff00070 0000000000000001\n[ 1322.252000] $ 4 : 0000000000000000 c0000000f3980150 0000000000000000 0000000000010000\n[ 1322.260000] $ 8 : ffffffffc09cd5f8 0000000000000001 0000000000000088 c0000000ed300de8\n[ 1322.268000] $12 : e5e19d9c5f613a45 ffffffffc046d464 0000000000000000 66227ba5ea67b74e\n[ 1322.276000] $16 : c0000000f1769c00 c0000000ed1e0200 c0000000f3980150 0000000000000000\n[ 1322.284000] $20 : c0000000f3a80000 00000000fffffffc c0000000ed2cfbd8 c0000000f39818f0\n[ 1322.292000] $24 : 0000000000000004 0000000000000000\n[ 1322.300000] $28 : c0000000ed2c0000 c0000000ed2cfab8 0000000000010000 ffffffffc039c0b0\n[ 1322.308000] Hi : 000000000000023c\n[ 1322.312000] Lo : 000000000003f802\n[ 1322.316000] epc : ffffffffc039a9f8 check_tn_node+0x88/0x3b0\n[ 1322.320000] Not tainted\n[ 1322.324000] ra : ffffffffc039c0b0 jffs2_do_read_inode_internal+0x1250/0x1e48\n[ 1322.332000] Status: 5400f8e3 KX SX UX KERNEL EXL IE\n[ 1322.336000] Cause : 00800034\n[ 1322.340000] PrId : 000c1004 (Netlogic XLP)\n[ 1322.344000] Modules linked in:\n[ 1322.348000] Process jffs2_gcd_mtd7 (pid: 264, threadinfo\u003dc0000000ed2c0000, task\u003dc0000000f0e68dd8, tls\u003d0000000000000000)\n[ 1322.356000] Stack : c0000000f1769e30 c0000000ed010780 c0000000ed010780 c0000000ed300000\n c0000000f1769c00 c0000000f3980150 c0000000f3a80000 00000000fffffffc\n c0000000ed2cfbd8 ffffffffc039c0b0 ffffffffc09c6340 0000000000001000\n 0000000000000dec ffffffffc016c9d8 c0000000f39805a0 c0000000f3980180\n 0000008600000000 0000000000000000 0000000000000000 0000000000000000\n 0001000000000dec c0000000f1769d98 c0000000ed2cfb18 0000000000010000\n 0000000000010000 0000000000000044 c0000000f3a80000 c0000000f1769c00\n c0000000f3d207a8 c0000000f1769d98 c0000000f1769de0 ffffffffc076f9c0\n 0000000000000009 0000000000000000 0000000000000000 ffffffffc039cf90\n 0000000000000017 ffffffffc013fbdc 0000000000000001 000000010003e61c\n ...\n[ 1322.424000] Call Trace:\n[ 1322.428000] [\u003cffffffffc039a9f8\u003e] check_tn_node+0x88/0x3b0\n[ 1322.432000] [\u003cffffffffc039c0b0\u003e] jffs2_do_read_inode_internal+0x1250/0x1e48\n[ 1322.440000] [\u003cffffffffc039cf90\u003e] jffs2_do_crccheck_inode+0x70/0xd0\n[ 1322.448000] [\u003cffffffffc03a1b80\u003e] jffs2_garbage_collect_pass+0x160/0x870\n[ 1322.452000] [\u003cffffffffc03a392c\u003e] jffs2_garbage_collect_thread+0xdc/0x1f0\n[ 1322.460000] [\u003cffffffffc01541c8\u003e] kthread+0xb8/0xc0\n[ 1322.464000] [\u003cffffffffc0106d18\u003e] kernel_thread_helper+0x10/0x18\n[ 1322.472000]\n[ 1322.472000]\nCode: 67bd0050 94a4002c 2c830001 \u003c00038036\u003e de050218 2403fffc 0080a82d 00431824 24630044\n[ 1322.480000] ---[ end trace b052bb90e97dfbf5 ]---\n\nThe variable csize in structure jffs2_tmp_dnode_info is of type uint16_t, but it\nis used to hold the compressed data length(csize) which is declared as uint32_t.\nSo, when the value of csize exceeds 16bits, it gets truncated when assigned to\ntn-\u003ecsize. This is causing a kernel BUG.\nChanging the definition of csize in jffs2_tmp_dnode_info to uint32_t fixes the issue.\n\nSigned-off-by: Ajesh Kunhipurayil Vijayan \u003cajesh@broadcom.com\u003e\nSigned-off-by: Kamlakant Patel \u003ckamlakant.patel@broadcom.com\u003e\nSigned-off-by: Brian Norris \u003ccomputersforpeace@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "3dba9e3a42493e2c6453f3863a999778ad3dd3b0", "tree": "65f473e40cadf3a474817367fb4a64a97274fb45", "parents": [ "dfb81e8ae6f25dcca2c93d1f6cdaaf89ef5dd047" ], "author": { "name": "Kamlakant Patel", "email": "kamlakant.patel@broadcom.com", "time": "Mon Jan 06 19:06:54 2014 +0530" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:19 2014 -0700" }, "message": "jffs2: Fix segmentation fault found in stress test\n\ncommit 3367da5610c50e6b83f86d366d72b41b350b06a2 upstream.\n\nCreating a large file on a JFFS2 partition sometimes crashes with this call\ntrace:\n\n[ 306.476000] CPU 13 Unable to handle kernel paging request at virtual address c0000000dfff8002, epc \u003d\u003d ffffffffc03a80a8, ra \u003d\u003d ffffffffc03a8044\n[ 306.488000] Oops[#1]:\n[ 306.488000] Cpu 13\n[ 306.492000] $ 0 : 0000000000000000 0000000000000000 0000000000008008 0000000000008007\n[ 306.500000] $ 4 : c0000000dfff8002 000000000000009f c0000000e0007cde c0000000ee95fa58\n[ 306.508000] $ 8 : 0000000000000001 0000000000008008 0000000000010000 ffffffffffff8002\n[ 306.516000] $12 : 0000000000007fa9 000000000000ff0e 000000000000ff0f 80e55930aebb92bb\n[ 306.524000] $16 : c0000000e0000000 c0000000ee95fa5c c0000000efc80000 ffffffffc09edd70\n[ 306.532000] $20 : ffffffffc2b60000 c0000000ee95fa58 0000000000000000 c0000000efc80000\n[ 306.540000] $24 : 0000000000000000 0000000000000004\n[ 306.548000] $28 : c0000000ee950000 c0000000ee95f738 0000000000000000 ffffffffc03a8044\n[ 306.556000] Hi : 00000000000574a5\n[ 306.560000] Lo : 6193b7a7e903d8c9\n[ 306.564000] epc : ffffffffc03a80a8 jffs2_rtime_compress+0x98/0x198\n[ 306.568000] Tainted: G W\n[ 306.572000] ra : ffffffffc03a8044 jffs2_rtime_compress+0x34/0x198\n[ 306.580000] Status: 5000f8e3 KX SX UX KERNEL EXL IE\n[ 306.584000] Cause : 00800008\n[ 306.588000] BadVA : c0000000dfff8002\n[ 306.592000] PrId : 000c1100 (Netlogic XLP)\n[ 306.596000] Modules linked in:\n[ 306.596000] Process dd (pid: 170, threadinfo\u003dc0000000ee950000, task\u003dc0000000ee6e0858, tls\u003d0000000000c47490)\n[ 306.608000] Stack : 7c547f377ddc7ee4 7ffc7f967f5d7fae 7f617f507fc37ff4 7e7d7f817f487f5f\n 7d8e7fec7ee87eb3 7e977ff27eec7f9e 7d677ec67f917f67 7f3d7e457f017ed7\n 7fd37f517f867eb2 7fed7fd17ca57e1d 7e5f7fe87f257f77 7fd77f0d7ede7fdb\n 7fba7fef7e197f99 7fde7fe07ee37eb5 7f5c7f8c7fc67f65 7f457fb87f847e93\n 7f737f3e7d137cd9 7f8e7e9c7fc47d25 7dbb7fac7fb67e52 7ff17f627da97f64\n 7f6b7df77ffa7ec5 80057ef17f357fb3 7f767fa27dfc7fd5 7fe37e8e7fd07e53\n 7e227fcf7efb7fa1 7f547e787fa87fcc 7fcb7fc57f5a7ffb 7fc07f6c7ea97e80\n 7e2d7ed17e587ee0 7fb17f9d7feb7f31 7f607e797e887faa 7f757fdd7c607ff3\n 7e877e657ef37fbd 7ec17fd67fe67ff7 7ff67f797ff87dc4 7eef7f3a7c337fa6\n 7fe57fc97ed87f4b 7ebe7f097f0b8003 7fe97e2a7d997cba 7f587f987f3c7fa9\n ...\n[ 306.676000] Call Trace:\n[ 306.680000] [\u003cffffffffc03a80a8\u003e] jffs2_rtime_compress+0x98/0x198\n[ 306.684000] [\u003cffffffffc0394f10\u003e] jffs2_selected_compress+0x110/0x230\n[ 306.692000] [\u003cffffffffc039508c\u003e] jffs2_compress+0x5c/0x388\n[ 306.696000] [\u003cffffffffc039dc58\u003e] jffs2_write_inode_range+0xd8/0x388\n[ 306.704000] [\u003cffffffffc03971bc\u003e] jffs2_write_end+0x16c/0x2d0\n[ 306.708000] [\u003cffffffffc01d3d90\u003e] generic_file_buffered_write+0xf8/0x2b8\n[ 306.716000] [\u003cffffffffc01d4e7c\u003e] __generic_file_aio_write+0x1ac/0x350\n[ 306.720000] [\u003cffffffffc01d50a0\u003e] generic_file_aio_write+0x80/0x168\n[ 306.728000] [\u003cffffffffc021f7dc\u003e] do_sync_write+0x94/0xf8\n[ 306.732000] [\u003cffffffffc021ff6c\u003e] vfs_write+0xa4/0x1a0\n[ 306.736000] [\u003cffffffffc02202e8\u003e] SyS_write+0x50/0x90\n[ 306.744000] [\u003cffffffffc0116cc0\u003e] handle_sys+0x180/0x1a0\n[ 306.748000]\n[ 306.748000]\nCode: 020b202d 0205282d 90a50000 \u003c90840000\u003e 14a40038 00000000 0060602d 0000282d 016c5823\n[ 306.760000] ---[ end trace 79dd088435be02d0 ]---\nSegmentation fault\n\nThis crash is caused because the \u0027positions\u0027 is declared as an array of signed\nshort. The value of position is in the range 0..65535, and will be converted\nto a negative number when the position is greater than 32767 and causes a\ncorruption and crash. Changing the definition to \u0027unsigned short\u0027 fixes this\nissue\n\nSigned-off-by: Jayachandran C \u003cjchandra@broadcom.com\u003e\nSigned-off-by: Kamlakant Patel \u003ckamlakant.patel@broadcom.com\u003e\nSigned-off-by: Brian Norris \u003ccomputersforpeace@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "dfb81e8ae6f25dcca2c93d1f6cdaaf89ef5dd047", "tree": "05cc784faa63d69ab3a4ea6c706a3a7a0aba30da", "parents": [ "eea7ead860ea8622d2d4b1cfbd63649beed91a9b" ], "author": { "name": "Claudio Takahasi", "email": "claudio.takahasi@openbossa.org", "time": "Thu Jul 25 16:34:24 2013 -0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:19 2014 -0700" }, "message": "Bluetooth: Fix removing Long Term Key\n\ncommit 5981a8821b774ada0be512fd9bad7c241e17657e upstream.\n\nThis patch fixes authentication failure on LE link re-connection when\nBlueZ acts as slave (peripheral). LTK is removed from the internal list\nafter its first use causing PIN or Key missing reply when re-connecting\nthe link. The LE Long Term Key Request event indicates that the master\nis attempting to encrypt or re-encrypt the link.\n\nPre-condition: BlueZ host paired and running as slave.\nHow to reproduce(master):\n\n 1) Establish an ACL LE encrypted link\n 2) Disconnect the link\n 3) Try to re-establish the ACL LE encrypted link (fails)\n\n\u003e HCI Event: LE Meta Event (0x3e) plen 19\n LE Connection Complete (0x01)\n Status: Success (0x00)\n Handle: 64\n Role: Slave (0x01)\n...\n@ Device Connected: 00:02:72:DC:29:C9 (1) flags 0x0000\n\u003e HCI Event: LE Meta Event (0x3e) plen 13\n LE Long Term Key Request (0x05)\n Handle: 64\n Random number: 875be18439d9aa37\n Encryption diversifier: 0x76ed\n\u003c HCI Command: LE Long Term Key Request Reply (0x08|0x001a) plen 18\n Handle: 64\n Long term key: 2aa531db2fce9f00a0569c7d23d17409\n\u003e HCI Event: Command Complete (0x0e) plen 6\n LE Long Term Key Request Reply (0x08|0x001a) ncmd 1\n Status: Success (0x00)\n Handle: 64\n\u003e HCI Event: Encryption Change (0x08) plen 4\n Status: Success (0x00)\n Handle: 64\n Encryption: Enabled with AES-CCM (0x01)\n...\n@ Device Disconnected: 00:02:72:DC:29:C9 (1) reason 3\n\u003c HCI Command: LE Set Advertise Enable (0x08|0x000a) plen 1\n Advertising: Enabled (0x01)\n\u003e HCI Event: Command Complete (0x0e) plen 4\n LE Set Advertise Enable (0x08|0x000a) ncmd 1\n Status: Success (0x00)\n\u003e HCI Event: LE Meta Event (0x3e) plen 19\n LE Connection Complete (0x01)\n Status: Success (0x00)\n Handle: 64\n Role: Slave (0x01)\n...\n@ Device Connected: 00:02:72:DC:29:C9 (1) flags 0x0000\n\u003e HCI Event: LE Meta Event (0x3e) plen 13\n LE Long Term Key Request (0x05)\n Handle: 64\n Random number: 875be18439d9aa37\n Encryption diversifier: 0x76ed\n\u003c HCI Command: LE Long Term Key Request Neg Reply (0x08|0x001b) plen 2\n Handle: 64\n\u003e HCI Event: Command Complete (0x0e) plen 6\n LE Long Term Key Request Neg Reply (0x08|0x001b) ncmd 1\n Status: Success (0x00)\n Handle: 64\n\u003e HCI Event: Disconnect Complete (0x05) plen 4\n Status: Success (0x00)\n Handle: 64\n Reason: Authentication Failure (0x05)\n@ Device Disconnected: 00:02:72:DC:29:C9 (1) reason 0\n\nSigned-off-by: Claudio Takahasi \u003cclaudio.takahasi@openbossa.org\u003e\nSigned-off-by: Johan Hedberg \u003cjohan.hedberg@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "eea7ead860ea8622d2d4b1cfbd63649beed91a9b", "tree": "ddaf413fc4f011d4535e1583d3588b48d817230e", "parents": [ "036132b3be6073ecdeec7f1f3ad3606269ebf9c9" ], "author": { "name": "Jiri Slaby", "email": "jslaby@suse.cz", "time": "Mon Apr 14 09:46:50 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:19 2014 -0700" }, "message": "Char: ipmi_bt_sm, fix infinite loop\n\ncommit a94cdd1f4d30f12904ab528152731fb13a812a16 upstream.\n\nIn read_all_bytes, we do\n\n unsigned char i;\n ...\n bt-\u003eread_data[0] \u003d BMC2HOST;\n bt-\u003eread_count \u003d bt-\u003eread_data[0];\n ...\n for (i \u003d 1; i \u003c\u003d bt-\u003eread_count; i++)\n bt-\u003eread_data[i] \u003d BMC2HOST;\n\nIf bt-\u003eread_data[0] \u003d\u003d bt-\u003eread_count \u003d\u003d 255, we loop infinitely in the\n\u0027for\u0027 loop. Make \u0027i\u0027 an \u0027int\u0027 instead of \u0027char\u0027 to get rid of the\noverflow and finish the loop after 255 iterations every time.\n\nSigned-off-by: Jiri Slaby \u003cjslaby@suse.cz\u003e\nReported-and-debugged-by: Rui Hui Dian \u003crhdian@novell.com\u003e\nCc: Tomas Cech \u003ctcech@suse.cz\u003e\nCc: Corey Minyard \u003cminyard@acm.org\u003e\nCc: \u003copenipmi-developer@lists.sourceforge.net\u003e\nSigned-off-by: Corey Minyard \u003ccminyard@mvista.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "036132b3be6073ecdeec7f1f3ad3606269ebf9c9", "tree": "0373ea971c670b00f464098751cf7a5b830894a5", "parents": [ "e5097041dde828e4dec67f1f9df7034dd42aafdc" ], "author": { "name": "Dave Kleikamp", "email": "dave.kleikamp@oracle.com", "time": "Fri Mar 14 10:42:01 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:19 2014 -0700" }, "message": "sparc64: don\u0027t treat 64-bit syscall return codes as 32-bit\n\n[ Upstream commit 1535bd8adbdedd60a0ee62e28fd5225d66434371 ]\n\nWhen checking a system call return code for an error,\nlinux_sparc_syscall was sign-extending the lower 32-bit value and\ncomparing it to -ERESTART_RESTARTBLOCK. lseek can return valid return\ncodes whose lower 32-bits alone would indicate a failure (such as 4G-1).\nUse the whole 64-bit value to check for errors. Only the 32-bit path\nshould sign extend the lower 32-bit value.\n\nSigned-off-by: Dave Kleikamp \u003cdave.kleikamp@oracle.com\u003e\nAcked-by: Bob Picco \u003cbob.picco@oracle.com\u003e\nAcked-by: Allen Pais \u003callen.pais@oracle.com\u003e\nCc: David S. Miller \u003cdavem@davemloft.net\u003e\nCc: sparclinux@vger.kernel.org\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "e5097041dde828e4dec67f1f9df7034dd42aafdc", "tree": "a35ebf8f8417d4be5c5dbaaeb90745e621bda5f7", "parents": [ "53c93feee59ac7884329013b243dcb218a4ad47b" ], "author": { "name": "Paul Gortmaker", "email": "paul.gortmaker@windriver.com", "time": "Thu Feb 13 13:57:44 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:19 2014 -0700" }, "message": "sparc32: fix build failure for arch_jump_label_transform\n\n[ Upstream commit 4f6500fff5f7644a03c46728fd7ef0f62fa6940b ]\n\nIn arch/sparc/Kernel/Makefile, we see:\n\n obj-$(CONFIG_SPARC64) +\u003d jump_label.o\n\nHowever, the Kconfig selects HAVE_ARCH_JUMP_LABEL unconditionally\nfor all SPARC. This in turn leads to the following failure when\ndoing allmodconfig coverage builds:\n\nkernel/built-in.o: In function `__jump_label_update\u0027:\njump_label.c:(.text+0x8560c): undefined reference to `arch_jump_label_transform\u0027\nkernel/built-in.o: In function `arch_jump_label_transform_static\u0027:\n(.text+0x85cf4): undefined reference to `arch_jump_label_transform\u0027\nmake: *** [vmlinux] Error 1\n\nChange HAVE_ARCH_JUMP_LABEL to be conditional on SPARC64 so that it\nmatches the Makefile.\n\nSigned-off-by: Paul Gortmaker \u003cpaul.gortmaker@windriver.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "53c93feee59ac7884329013b243dcb218a4ad47b", "tree": "ef7a2332163757c430ce2563f12a0851c4f89859", "parents": [ "10d52681f0d0d0b93aaf8efdaadac468e1bd872f" ], "author": { "name": "Dave Kleikamp", "email": "dave.kleikamp@oracle.com", "time": "Mon Dec 16 15:01:00 2013 -0600" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:19 2014 -0700" }, "message": "Revert \"sparc64: Fix __copy_{to,from}_user_inatomic defines.\"\n\n[ Upstream commit 16932237f2978a2265662f8de4af743b1f55a209 ]\n\nThis reverts commit 145e1c0023585e0e8f6df22316308ec61c5066b2.\n\nThis commit broke the behavior of __copy_from_user_inatomic when\nit is only partially successful. Instead of returning the number\nof bytes not copied, it now returns 1. This translates to the\nwrong value being returned by iov_iter_copy_from_user_atomic.\n\nxfstests generic/246 and LTP writev01 both fail on btrfs and nfs\nbecause of this.\n\nSigned-off-by: Dave Kleikamp \u003cdave.kleikamp@oracle.com\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: David S. Miller \u003cdavem@davemloft.net\u003e\nCc: sparclinux@vger.kernel.org\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "10d52681f0d0d0b93aaf8efdaadac468e1bd872f", "tree": "df0e065a11dcd49dc8a8b58ae2288a7484ee0137", "parents": [ "04477075793234a9cd5411b3fe359f8506b0734e" ], "author": { "name": "oftedal", "email": "oftedal@gmail.com", "time": "Fri Oct 18 22:28:29 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:18 2014 -0700" }, "message": "sparc: PCI: Fix incorrect address calculation of PCI Bridge windows on Simba-bridges\n\n[ Upstream commit 557fc5873ef178c4b3e1e36a42db547ecdc43f9b ]\n\nThe SIMBA APB Bridges lacks the \u0027ranges\u0027 of-property describing the\nPCI I/O and memory areas located beneath the bridge. Faking this\ninformation has been performed by reading range registers in the\nAPB bridge, and calculating the corresponding areas.\n\nIn commit 01f94c4a6ced476ce69b895426fc29bfc48c69bd\n(\"Fix sabre pci controllers with new probing scheme.\") a bug was\nintroduced into this calculation, causing the PCI memory areas\nto be calculated incorrectly: The shift size was set to be\nidentical for I/O and MEM ranges, which is incorrect.\n\nThis patch set the shift size of the MEM range back to the\nvalue used before 01f94c4a6ced476ce69b895426fc29bfc48c69bd.\n\nSigned-off-by: Kjetil Oftedal \u003coftedal@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "04477075793234a9cd5411b3fe359f8506b0734e", "tree": "424bfd18cc397afe8a4c64bc8bb95b6f39397372", "parents": [ "8c3911a71ede8ec4c29329c7a5a80c37b3aeb83e" ], "author": { "name": "Sasha Levin", "email": "sasha.levin@oracle.com", "time": "Sat Mar 29 20:39:35 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:18 2014 -0700" }, "message": "rds: prevent dereference of a NULL device in rds_iw_laddr_check\n\n[ Upstream commit bf39b4247b8799935ea91d90db250ab608a58e50 ]\n\nBinding might result in a NULL device which is later dereferenced\nwithout checking.\n\nSigned-off-by: Sasha Levin \u003csasha.levin@oracle.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "8c3911a71ede8ec4c29329c7a5a80c37b3aeb83e", "tree": "bb341accabb7096331464364986bd105f0cbec14", "parents": [ "495d659f2c1057de1529d98733c6f1e7de275107" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Tue Apr 08 12:23:09 2014 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:18 2014 -0700" }, "message": "isdnloop: several buffer overflows\n\n[ Upstream commit 7563487cbf865284dcd35e9ef5a95380da046737 ]\n\nThere are three buffer overflows addressed in this patch.\n\n1) In isdnloop_fake_err() we add an \u0027E\u0027 to a 60 character string and\nthen copy it into a 60 character buffer. I have made the destination\nbuffer 64 characters and I\u0027m changed the sprintf() to a snprintf().\n\n2) In isdnloop_parse_cmd(), p points to a 6 characters into a 60\ncharacter buffer so we have 54 characters. The -\u003eeazlist[] is 11\ncharacters long. I have modified the code to return if the source\nbuffer is too long.\n\n3) In isdnloop_command() the cbuf[] array was 60 characters long but the\nmax length of the string then can be up to 79 characters. I made the\ncbuf array 80 characters long and changed the sprintf() to snprintf().\nI also removed the temporary \"dial\" buffer and changed it to use \"p\"\ndirectly.\n\nUnfortunately, we pass the \"cbuf\" string from isdnloop_command() to\nisdnloop_writecmd() which truncates anything over 60 characters to make\nit fit in card-\u003eomsg[]. (It can accept values up to 255 characters so\nlong as there is a \u0027\\n\u0027 character every 60 characters). For now I have\njust fixed the memory corruption bug and left the other problems in this\ndriver alone.\n\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "495d659f2c1057de1529d98733c6f1e7de275107", "tree": "810aba67b55e3f2e0013f1676a1c0ae045bc5137", "parents": [ "99df85bdef3515827e40fa019e0ecdda74f817ab" ], "author": { "name": "YOSHIFUJI Hideaki", "email": "yoshfuji@linux-ipv6.org", "time": "Wed Apr 02 12:48:42 2014 +0900" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:18 2014 -0700" }, "message": "isdnloop: Validate NUL-terminated strings from user.\n\n[ Upstream commit 77bc6bed7121936bb2e019a8c336075f4c8eef62 ]\n\nReturn -EINVAL unless all of user-given strings are correctly\nNUL-terminated.\n\nSigned-off-by: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "99df85bdef3515827e40fa019e0ecdda74f817ab", "tree": "45f96b8eab92a31e969d0d67516314a5d9c52fbc", "parents": [ "4230a2aaaa1b7df2f8127cf5e697dc4e2772ce1b" ], "author": { "name": "Pablo Neira", "email": "pablo@netfilter.org", "time": "Tue Apr 01 19:38:44 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:18 2014 -0700" }, "message": "netlink: don\u0027t compare the nul-termination in nla_strcmp\n\n[ Upstream commit 8b7b932434f5eee495b91a2804f5b64ebb2bc835 ]\n\nnla_strcmp compares the string length plus one, so it\u0027s implicitly\nincluding the nul-termination in the comparison.\n\n int nla_strcmp(const struct nlattr *nla, const char *str)\n {\n int len \u003d strlen(str) + 1;\n ...\n d \u003d memcmp(nla_data(nla), str, len);\n\nHowever, if NLA_STRING is used, userspace can send us a string without\nthe nul-termination. This is a problem since the string\ncomparison will not match as the last byte may be not the\nnul-termination.\n\nFix this by skipping the comparison of the nul-termination if the\nattribute data is nul-terminated. Suggested by Thomas Graf.\n\nCc: Florian Westphal \u003cfw@strlen.de\u003e\nCc: Thomas Graf \u003ctgraf@suug.ch\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4230a2aaaa1b7df2f8127cf5e697dc4e2772ce1b", "tree": "e1f30105d1590f3c166991fc658e08a1f76f3a35", "parents": [ "fec7e11a8fe3a3bd13429916872b08cc58f215da" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Mon Mar 31 20:14:10 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:18 2014 -0700" }, "message": "ipv6: some ipv6 statistic counters failed to disable bh\n\n[ Upstream commit 43a43b6040165f7b40b5b489fe61a4cb7f8c4980 ]\n\nAfter commit c15b1ccadb323ea (\"ipv6: move DAD and addrconf_verify\nprocessing to workqueue\") some counters are now updated in process context\nand thus need to disable bh before doing so, otherwise deadlocks can\nhappen on 32-bit archs. Fabio Estevam noticed this while while mounting\na NFS volume on an ARM board.\n\nAs a compensation for missing this I looked after the other *_STATS_BH\nand found three other calls which need updating:\n\n1) icmp6_send: ip6_fragment -\u003e icmpv6_send -\u003e icmp6_send (error handling)\n2) ip6_push_pending_frames: rawv6_sendmsg -\u003e rawv6_push_pending_frames -\u003e ...\n (only in case of icmp protocol with raw sockets in error handling)\n3) ping6_v6_sendmsg (error handling)\n\nFixes: c15b1ccadb323ea (\"ipv6: move DAD and addrconf_verify processing to workqueue\")\nReported-by: Fabio Estevam \u003cfestevam@gmail.com\u003e\nTested-by: Fabio Estevam \u003cfabio.estevam@freescale.com\u003e\nCc: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "fec7e11a8fe3a3bd13429916872b08cc58f215da", "tree": "540e83678277f908fb804a6627950fb22a13b77e", "parents": [ "1bc0f3b76f86de85baa45a5e64cf5970095d2925" ], "author": { "name": "Paul Durrant", "email": "Paul.Durrant@citrix.com", "time": "Fri Mar 28 11:39:05 2014 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:17 2014 -0700" }, "message": "xen-netback: remove pointless clause from if statement\n\n[ Upstream commit 0576eddf24df716d8570ef8ca11452a9f98eaab2 ]\n\nThis patch removes a test in start_new_rx_buffer() that checks whether\na copy operation is less than MAX_BUFFER_OFFSET in length, since\nMAX_BUFFER_OFFSET is defined to be PAGE_SIZE and the only caller of\nstart_new_rx_buffer() already limits copy operations to PAGE_SIZE or less.\n\nSigned-off-by: Paul Durrant \u003cpaul.durrant@citrix.com\u003e\nCc: Ian Campbell \u003cian.campbell@citrix.com\u003e\nCc: Wei Liu \u003cwei.liu2@citrix.com\u003e\nCc: Sander Eikelenboom \u003clinux@eikelenboom.it\u003e\nReported-By: Sander Eikelenboom \u003clinux@eikelenboom.it\u003e\nTested-By: Sander Eikelenboom \u003clinux@eikelenboom.it\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "1bc0f3b76f86de85baa45a5e64cf5970095d2925", "tree": "aef0c4a5e425631bbd9db01439e5d11714a1577b", "parents": [ "20a51abb07a34a3af96b4fffac08022763f74c93" ], "author": { "name": "Michael S. Tsirkin", "email": "mst@redhat.com", "time": "Thu Mar 27 12:53:37 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:17 2014 -0700" }, "message": "vhost: validate vhost_get_vq_desc return value\n\n[ Upstream commit a39ee449f96a2cd44ce056d8a0a112211a9b1a1f ]\n\nvhost fails to validate negative error code\nfrom vhost_get_vq_desc causing\na crash: we are using -EFAULT which is 0xfffffff2\nas vector size, which exceeds the allocated size.\n\nThe code in question was introduced in commit\n8dd014adfea6f173c1ef6378f7e5e7924866c923\n vhost-net: mergeable buffers support\n\nCVE-2014-0055\n\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "20a51abb07a34a3af96b4fffac08022763f74c93", "tree": "b860b9cd77e981e3420e207d60f9f64ef862f93c", "parents": [ "4b6da9193692acfe4889cb0a6050239cc613f756" ], "author": { "name": "Michael S. Tsirkin", "email": "mst@redhat.com", "time": "Thu Mar 27 12:00:26 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:17 2014 -0700" }, "message": "vhost: fix total length when packets are too short\n\n[ Upstream commit d8316f3991d207fe32881a9ac20241be8fa2bad0 ]\n\nWhen mergeable buffers are disabled, and the\nincoming packet is too large for the rx buffer,\nget_rx_bufs returns success.\n\nThis was intentional in order for make recvmsg\ntruncate the packet and then handle_rx would\ndetect err !\u003d sock_len and drop it.\n\nUnfortunately we pass the original sock_len to\nrecvmsg - which means we use parts of iov not fully\nvalidated.\n\nFix this up by detecting this overrun and doing packet drop\nimmediately.\n\nCVE-2014-0077\n\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4b6da9193692acfe4889cb0a6050239cc613f756", "tree": "048104abd34208c4b7bf6e57b198aa48beb5e4f3", "parents": [ "4800c471ea65fba8d6fc105b51f8b1f43afbd91a" ], "author": { "name": "lucien", "email": "lucien.xin@gmail.com", "time": "Mon Mar 17 12:51:01 2014 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:17 2014 -0700" }, "message": "ipv6: ip6_append_data_mtu do not handle the mtu of the second fragment properly\n\n[ Upstream commit e367c2d03dba4c9bcafad24688fadb79dd95b218 ]\n\nIn ip6_append_data_mtu(), when the xfrm mode is not tunnel(such as\ntransport),the ipsec header need to be added in the first fragment, so the mtu\nwill decrease to reserve space for it, then the second fragment come, the mtu\nshould be turn back, as the commit 0c1833797a5a6ec23ea9261d979aa18078720b74\nsaid. however, in the commit a493e60ac4bbe2e977e7129d6d8cbb0dd236be, it use\n*mtu \u003d min(*mtu, ...) to change the mtu, which lead to the new mtu is alway\nequal with the first fragment\u0027s. and cannot turn back.\n\nwhen I test through ping6 -c1 -s5000 $ip (mtu\u003d1280):\n...frag (0|1232) ESP(spi\u003d0x00002000,seq\u003d0xb), length 1232\n...frag (1232|1216)\n...frag (2448|1216)\n...frag (3664|1216)\n...frag (4880|164)\n\nwhich should be:\n...frag (0|1232) ESP(spi\u003d0x00001000,seq\u003d0x1), length 1232\n...frag (1232|1232)\n...frag (2464|1232)\n...frag (3696|1232)\n...frag (4928|116)\n\nso delete the min() when change back the mtu.\n\nSigned-off-by: Xin Long \u003clucien.xin@gmail.com\u003e\nFixes: 75a493e60ac4bb (\"ipv6: ip6_append_data_mtu did not care about pmtudisc and frag_size\")\nAcked-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4800c471ea65fba8d6fc105b51f8b1f43afbd91a", "tree": "51ef805146bd1fc56d002c389ff55832627c9c6f", "parents": [ "d82c152b565849a5290abc8e7e0c181257457c05" ], "author": { "name": "Heiner Kallweit", "email": "heiner.kallweit@web.de", "time": "Wed Mar 12 22:13:19 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:17 2014 -0700" }, "message": "ipv6: Avoid unnecessary temporary addresses being generated\n\n[ Upstream commit ecab67015ef6e3f3635551dcc9971cf363cc1cd5 ]\n\ntmp_prefered_lft is an offset to ifp-\u003etstamp, not now. Therefore\nage needs to be added to the condition.\n\nAge calculation in ipv6_create_tempaddr is different from the one\nin addrconf_verify and doesn\u0027t consider ADDRCONF_TIMER_FUZZ_MINUS.\nThis can cause age in ipv6_create_tempaddr to be less than the one\nin addrconf_verify and therefore unnecessary temporary address to\nbe generated.\nUse age calculation as in addrconf_modify to avoid this.\n\nSigned-off-by: Heiner Kallweit \u003cheiner.kallweit@web.de\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d82c152b565849a5290abc8e7e0c181257457c05", "tree": "1199583de433a6ad2d9b8fc0925e1310a07f9531", "parents": [ "711d9170450f00ac8e5c3467948900d124993fe0" ], "author": { "name": "Matthew Leach", "email": "matthew.leach@arm.com", "time": "Tue Mar 11 11:58:27 2014 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:17 2014 -0700" }, "message": "net: socket: error on a negative msg_namelen\n\n[ Upstream commit dbb490b96584d4e958533fb637f08b557f505657 ]\n\nWhen copying in a struct msghdr from the user, if the user has set the\nmsg_namelen parameter to a negative value it gets clamped to a valid\nsize due to a comparison between signed and unsigned values.\n\nEnsure the syscall errors when the user passes in a negative value.\n\nSigned-off-by: Matthew Leach \u003cmatthew.leach@arm.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "711d9170450f00ac8e5c3467948900d124993fe0", "tree": "b4dde7d8772b69ef33a8a206e3959b73ef2f7048", "parents": [ "c3363b2d9eb62338b918426a080fa554c5323c7f" ], "author": { "name": "Peter Boström", "email": "peter.bostrom@netrounds.com", "time": "Mon Mar 10 16:17:15 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:16 2014 -0700" }, "message": "vlan: Set correct source MAC address with TX VLAN offload enabled\n\n[ Upstream commit dd38743b4cc2f86be250eaf156cf113ba3dd531a ]\n\nWith TX VLAN offload enabled the source MAC address for frames sent using the\nVLAN interface is currently set to the address of the real interface. This is\nwrong since the VLAN interface may be configured with a different address.\n\nThe bug was introduced in commit 2205369a314e12fcec4781cc73ac9c08fc2b47de\n(\"vlan: Fix header ops passthru when doing TX VLAN offload.\").\n\nThis patch sets the source address before calling the create function of the\nreal interface.\n\nSigned-off-by: Peter Boström \u003cpeter.bostrom@netrounds.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "c3363b2d9eb62338b918426a080fa554c5323c7f", "tree": "007ad9c230a579b55d3446f3fdfa60c6ab21ae76", "parents": [ "d7fc329bf09d772a91a774fdedb039a0f8cf583d" ], "author": { "name": "Sabrina Dubroca", "email": "sd@queasysnail.net", "time": "Thu Mar 06 17:51:57 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:16 2014 -0700" }, "message": "ipv6: don\u0027t set DST_NOCOUNT for remotely added routes\n\n[ Upstream commit c88507fbad8055297c1d1e21e599f46960cbee39 ]\n\nDST_NOCOUNT should only be used if an authorized user adds routes\nlocally. In case of routes which are added on behalf of router\nadvertisments this flag must not get used as it allows an unlimited\nnumber of routes getting added remotely.\n\nSigned-off-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nAcked-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d7fc329bf09d772a91a774fdedb039a0f8cf583d", "tree": "d2f7ac560f7a10da1de099d916c17776b4eb7e5f", "parents": [ "098c9960de5f0c682f1cdddfe51648d4232a952d" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Mar 25 18:42:27 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:16 2014 -0700" }, "message": "net: unix: non blocking recvmsg() should not return -EINTR\n\n[ Upstream commit de1443916791d75fdd26becb116898277bb0273f ]\n\nSome applications didn\u0027t expect recvmsg() on a non blocking socket\ncould return -EINTR. This possibility was added as a side effect\nof commit b3ca9b02b00704 (\"net: fix multithreaded signal handling in\nunix recv routines\").\n\nTo hit this bug, you need to be a bit unlucky, as the u-\u003ereadlock\nmutex is usually held for very small periods.\n\nFixes: b3ca9b02b00704 (\"net: fix multithreaded signal handling in unix recv routines\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Rainer Weikusat \u003crweikusat@mobileactivedefense.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "098c9960de5f0c682f1cdddfe51648d4232a952d", "tree": "b5a0438bbaf4ab381f5ba41ffb288e22b9ab9abf", "parents": [ "978a9b75b98d918e757eac01d0008fd30252e3bf" ], "author": { "name": "Linus Lüssing", "email": "linus.luessing@web.de", "time": "Tue Mar 04 03:57:35 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:16 2014 -0700" }, "message": "bridge: multicast: add sanity check for query source addresses\n\n[ Upstream commit 6565b9eeef194afbb3beec80d6dd2447f4091f8c ]\n\nMLD queries are supposed to have an IPv6 link-local source address\naccording to RFC2710, section 4 and RFC3810, section 5.1.14. This patch\nadds a sanity check to ignore such broken MLD queries.\n\nWithout this check, such malformed MLD queries can result in a\ndenial of service: The queries are ignored by any MLD listener\ntherefore they will not respond with an MLD report. However,\nwithout this patch these malformed MLD queries would enable the\nsnooping part in the bridge code, potentially shutting down the\naccording ports towards these hosts for multicast traffic as the\nbridge did not learn about these listeners.\n\nReported-by: Jan Stancek \u003cjstancek@redhat.com\u003e\nSigned-off-by: Linus Lüssing \u003clinus.luessing@web.de\u003e\nReviewed-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "978a9b75b98d918e757eac01d0008fd30252e3bf", "tree": "4697d59fdf3a89ba394b63b896379d9db56068af", "parents": [ "9660cc51f80ab16b415b311f5f0ee8cdea496a7c" ], "author": { "name": "Daniel Borkmann", "email": "dborkman@redhat.com", "time": "Tue Mar 04 16:35:51 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 26 17:13:16 2014 -0700" }, "message": "net: sctp: fix skb leakage in COOKIE ECHO path of chunk-\u003eauth_chunk\n\n[ Upstream commit c485658bae87faccd7aed540fd2ca3ab37992310 ]\n\nWhile working on ec0223ec48a9 (\"net: sctp: fix sctp_sf_do_5_1D_ce to\nverify if we/peer is AUTH capable\"), we noticed that there\u0027s a skb\nmemory leakage in the error path.\n\nRunning the same reproducer as in ec0223ec48a9 and by unconditionally\njumping to the error label (to simulate an error condition) in\nsctp_sf_do_5_1D_ce() receive path lets kmemleak detector bark about\nthe unfreed chunk-\u003eauth_chunk skb clone:\n\nUnreferenced object 0xffff8800b8f3a000 (size 256):\n comm \"softirq\", pid 0, jiffies 4294769856 (age 110.757s)\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 89 ab 75 5e d4 01 58 13 00 00 00 00 00 00 00 00 ..u^..X.........\n backtrace:\n [\u003cffffffff816660be\u003e] kmemleak_alloc+0x4e/0xb0\n [\u003cffffffff8119f328\u003e] kmem_cache_alloc+0xc8/0x210\n [\u003cffffffff81566929\u003e] skb_clone+0x49/0xb0\n [\u003cffffffffa0467459\u003e] sctp_endpoint_bh_rcv+0x1d9/0x230 [sctp]\n [\u003cffffffffa046fdbc\u003e] sctp_inq_push+0x4c/0x70 [sctp]\n [\u003cffffffffa047e8de\u003e] sctp_rcv+0x82e/0x9a0 [sctp]\n [\u003cffffffff815abd38\u003e] ip_local_deliver_finish+0xa8/0x210\n [\u003cffffffff815a64af\u003e] nf_reinject+0xbf/0x180\n [\u003cffffffffa04b4762\u003e] nfqnl_recv_verdict+0x1d2/0x2b0 [nfnetlink_queue]\n [\u003cffffffffa04aa40b\u003e] nfnetlink_rcv_msg+0x14b/0x250 [nfnetlink]\n [\u003cffffffff815a3269\u003e] netlink_rcv_skb+0xa9/0xc0\n [\u003cffffffffa04aa7cf\u003e] nfnetlink_rcv+0x23f/0x408 [nfnetlink]\n [\u003cffffffff815a2bd8\u003e] netlink_unicast+0x168/0x250\n [\u003cffffffff815a2fa1\u003e] netlink_sendmsg+0x2e1/0x3f0\n [\u003cffffffff8155cc6b\u003e] sock_sendmsg+0x8b/0xc0\n [\u003cffffffff8155d449\u003e] ___sys_sendmsg+0x369/0x380\n\nWhat happens is that commit bbd0d59809f9 clones the skb containing\nthe AUTH chunk in sctp_endpoint_bh_rcv() when having the edge case\nthat an endpoint requires COOKIE-ECHO chunks to be authenticated:\n\n ---------- INIT[RANDOM; CHUNKS; HMAC-ALGO] ----------\u003e\n \u003c------- INIT-ACK[RANDOM; CHUNKS; HMAC-ALGO] ---------\n ------------------ AUTH; COOKIE-ECHO ----------------\u003e\n \u003c-------------------- COOKIE-ACK ---------------------\n\nWhen we enter sctp_sf_do_5_1D_ce() and before we actually get to\nthe point where we process (and subsequently free) a non-NULL\nchunk-\u003eauth_chunk, we could hit the \"goto nomem_init\" path from\nan error condition and thus leave the cloned skb around w/o\nfreeing it.\n\nThe fix is to centrally free such clones in sctp_chunk_destroy()\nhandler that is invoked from sctp_chunk_free() after all refs have\ndropped; and also move both kfree_skb(chunk-\u003eauth_chunk) there,\nso that chunk-\u003eauth_chunk is either NULL (since sctp_chunkify()\nallocs new chunks through kmem_cache_zalloc()) or non-NULL with\na valid skb pointer. chunk-\u003eskb and chunk-\u003eauth_chunk are the\nonly skbs in the sctp_chunk structure that need to be handeled.\n\nWhile at it, we should use consume_skb() for both. It is the same\nas dev_kfree_skb() but more appropriately named as we are not\na device but a protocol. Also, this effectively replaces the\nkfree_skb() from both invocations into consume_skb(). Functions\nare the same only that kfree_skb() assumes that the frame was\nbeing dropped after a failure (e.g. for tools like drop monitor),\nusage of consume_skb() seems more appropriate in function\nsctp_chunk_destroy() though.\n\nFixes: bbd0d59809f9 (\"[SCTP]: Implement the receive and verification of AUTH chunk\")\nSigned-off-by: Daniel Borkmann \u003cdborkman@redhat.com\u003e\nCc: Vlad Yasevich \u003cyasevich@gmail.com\u003e\nCc: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nAcked-by: Vlad Yasevich \u003cvyasevich@gmail.com\u003e\nAcked-by: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "9660cc51f80ab16b415b311f5f0ee8cdea496a7c", "tree": "82062a5e05345a144c0bb348acec6f9ff3dfaf32", "parents": [ "1436b3314b5582b5d370d276afacdfed9b8fbe99" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Apr 14 06:45:17 2014 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Apr 14 06:45:17 2014 -0700" }, "message": "Linux 3.4.87\n" }, { "commit": "1436b3314b5582b5d370d276afacdfed9b8fbe99", "tree": "a1dd5caf836d469b7f45678e0f769d9ca49e37d2", "parents": [ "1acb634a8af5443c41141a02d710baa91d8ec82d" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Wed Dec 11 19:39:19 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Apr 14 06:44:34 2014 -0700" }, "message": "powernow-k6: reorder frequencies\n\ncommit 22c73795b101597051924556dce019385a1e2fa0 upstream.\n\nThis patch reorders reported frequencies from the highest to the lowest,\njust like in other frequency drivers.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nAcked-by: Viresh Kumar \u003cviresh.kumar@linaro.org\u003e\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n\n" }, { "commit": "1acb634a8af5443c41141a02d710baa91d8ec82d", "tree": "a57e8caa63ec80b07f279bf3c3ba6988c4548f01", "parents": [ "cccd0fd759fa4e1306173f5740cc4ba8566e1d65" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Wed Dec 11 19:38:53 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Apr 14 06:44:34 2014 -0700" }, "message": "powernow-k6: correctly initialize default parameters\n\ncommit d82b922a4acc1781d368aceac2f9da43b038cab2 upstream.\n\nThe powernow-k6 driver used to read the initial multiplier from the\npowernow register. However, there is a problem with this:\n\n* If there was a frequency transition before, the multiplier read from the\n register corresponds to the current multiplier.\n* If there was no frequency transition since reset, the field in the\n register always reads as zero, regardless of the current multiplier that\n is set using switches on the mainboard and that the CPU is running at.\n\nThe zero value corresponds to multiplier 4.5, so as a consequence, the\npowernow-k6 driver always assumes multiplier 4.5.\n\nFor example, if we have 550MHz CPU with bus frequency 100MHz and\nmultiplier 5.5, the powernow-k6 driver thinks that the multiplier is 4.5\nand bus frequency is 122MHz. The powernow-k6 driver then sets the\nmultiplier to 4.5, underclocking the CPU to 450MHz, but reports the\ncurrent frequency as 550MHz.\n\nThere is no reliable way how to read the initial multiplier. I modified\nthe driver so that it contains a table of known frequencies (based on\nparameters of existing CPUs and some common overclocking schemes) and sets\nthe multiplier according to the frequency. If the frequency is unknown\n(because of unusual overclocking or underclocking), the user must supply\nthe bus speed and maximum multiplier as module parameters.\n\nThis patch should be backported to all stable kernels. If it doesn\u0027t\napply cleanly, change it, or ask me to change it.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n\n" }, { "commit": "cccd0fd759fa4e1306173f5740cc4ba8566e1d65", "tree": "4457e3795500054b2666dc529099b2bd63b8eb78", "parents": [ "c34cad873ff38096f8710ab318b486d4e40d4293" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Wed Dec 11 19:38:32 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Apr 14 06:44:34 2014 -0700" }, "message": "powernow-k6: disable cache when changing frequency\n\ncommit e20e1d0ac02308e2211306fc67abcd0b2668fb8b upstream.\n\nI found out that a system with k6-3+ processor is unstable during network\nserver load. The system locks up or the network card stops receiving. The\nreason for the instability is the CPU frequency scaling.\n\nDuring frequency transition the processor is in \"EPM Stop Grant\" state.\nThe documentation says that the processor doesn\u0027t respond to inquiry\nrequests in this state. Consequently, coherency of processor caches and\nbus master devices is not maintained, causing the system instability.\n\nThis patch flushes the cache during frequency transition. It fixes the\ninstability.\n\nOther minor changes:\n* u64 invalue changed to unsigned long because the variable is 32-bit\n* move the logic to set the multiplier to a separate function\n powernow_k6_set_cpu_multiplier\n* preserve lower 5 bits of the powernow port instead of 4 (the voltage\n field has 5 bits)\n* mask interrupts when reading the multiplier, so that the port is not\n open during other activity (running other kernel code with the port open\n shouldn\u0027t cause any misbehavior, but we should better be safe and keep\n the port closed)\n\nThis patch should be backported to all stable kernels. If it doesn\u0027t\napply cleanly, change it, or ask me to change it.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c34cad873ff38096f8710ab318b486d4e40d4293", "tree": "163ec08bcc8587d55dcc7d7f74f745ec40644c4a", "parents": [ "96ca9726343c0166dbdbe85c0d80a95c44a0c90a" ], "author": { "name": "Wei Yongjun", "email": "yongjun_wei@trendmicro.com.cn", "time": "Fri Oct 25 06:34:03 2013 -0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Apr 14 06:44:33 2014 -0700" }, "message": "media: saa7164: fix return value check in saa7164_initdev()\n\ncommit 89f4d45b2752df5d222b5f63919ce59e2d8afaf4 upstream.\n\nIn case of error, the function kthread_run() returns ERR_PTR()\nand never returns NULL. The NULL test in the return value check\nshould be replaced with IS_ERR().\n\nSigned-off-by: Wei Yongjun \u003cyongjun_wei@trendmicro.com.cn\u003e\nSigned-off-by: Hans Verkuil \u003chans.verkuil@cisco.com\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cm.chehab@samsung.com\u003e\n[bwh: Backported to 3.2: adjust filename]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "96ca9726343c0166dbdbe85c0d80a95c44a0c90a", "tree": "47702801499ae014b4b750ca9c6ab097599d7533", "parents": [ "092bc21ef043d7fb4515f54ccbd17d98a20e76fb" ], "author": { "name": "Alexey Khoroshilov", "email": "khoroshilov@ispras.ru", "time": "Wed Jul 03 16:17:34 2013 -0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Apr 14 06:44:33 2014 -0700" }, "message": "media: hdpvr: fix iteration over uninitialized lists in hdpvr_probe()\n\ncommit 2e923a0527ac439e135b9961e58d3acd876bba10 upstream.\n\nfree_buff_list and rec_buff_list are initialized in the middle of hdpvr_probe(),\nbut if something bad happens before that, error handling code calls hdpvr_delete(),\nwhich contains iteration over the lists (via hdpvr_free_buffers()).\nThe patch moves the lists initialization to the beginning and by the way fixes\ngoto label in error handling of registering videodev.\nFound by Linux Driver Verification project (linuxtesting.org).\n\nSigned-off-by: Alexey Khoroshilov \u003ckhoroshilov@ispras.ru\u003e\nSigned-off-by: Hans Verkuil \u003chans.verkuil@cisco.com\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cm.chehab@samsung.com\u003e\n[bwh: Backported to 3.2: adjust filename]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "092bc21ef043d7fb4515f54ccbd17d98a20e76fb", "tree": "5e2745675082df259785a5e78e9b83997bc958ce", "parents": [ "9ef2f22482a5a89c8ddac55c79d81b26292e59bf" ], "author": { "name": "Hans Verkuil", "email": "hans.verkuil@cisco.com", "time": "Tue Mar 19 09:34:58 2013 -0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Apr 14 06:44:33 2014 -0700" }, "message": "media: hdpvr: register the video node at the end of probe\n\ncommit 280847b532433ffe7a22795f926327805a127162 upstream.\n\nVideo nodes can be used at once after registration, so make sure the full\ninitialization is done before registering them.\n\nSigned-off-by: Hans Verkuil \u003chans.verkuil@cisco.com\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cmchehab@redhat.com\u003e\n[bwh: Backported to 3.2: adjust filename, context]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9ef2f22482a5a89c8ddac55c79d81b26292e59bf", "tree": "57be5cb5ee9a077ff0ac59c5ce9e23232a90187b", "parents": [ "915b4b0510b5f483fd46db9154c8dc1ee9e38ddf" ], "author": { "name": "Soeren Moch", "email": "smoch@web.de", "time": "Wed Jun 05 21:26:23 2013 -0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Apr 14 06:44:33 2014 -0700" }, "message": "media: dmxdev: remove dvb_ringbuffer_flush() on writer side\n\ncommit 414abbd2cd4c2618895f02ed3a76ec6647281436 upstream.\n\nIn dvb_ringbuffer lock-less synchronizationof reader and writer threads is done\nwith separateread and write pointers. Sincedvb_ringbuffer_flush() modifies the\nread pointer, this function must not be called from the writer thread.\nThis patch removes the dvb_ringbuffer_flush() calls in the dmxdev ringbuffer\nwrite functions, this fixes Oopses \"Unable to handle kernel paging request\"\nI could observe for the call chaindvb_demux_read -\u003edvb_dmxdev_buffer_read -\u003e\ndvb_ringbuffer_read_user -\u003e __copy_to_user (the reader side of the ringbuffer).\nThe flush calls at the write side are not necessary anyway since ringbuffer_flush\nis also called in dvb_dmxdev_buffer_read() when an error condition is set in the\nringbuffer.\nThis patch should also be applied to stable kernels.\n\nSigned-off-by: Soeren Moch \u003csmoch@web.de\u003e\nReviewed-by: Sakari Ailus \u003csakari.ailus@iki.fi\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cmchehab@redhat.com\u003e\n[bwh: Backported to 3.2: adjust filename]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "915b4b0510b5f483fd46db9154c8dc1ee9e38ddf", "tree": "ab25a83b7b491eb0809ec02762f3f7a503862af6", "parents": [ "ac871a8a93556bb96e6d11931c4568f60546c50f" ], "author": { "name": "Al Viro", "email": "viro@ZenIV.linux.org.uk", "time": "Sun Dec 16 16:04:46 2012 -0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Apr 14 06:44:33 2014 -0700" }, "message": "media: omap_vout: find_vma() needs -\u003emmap_sem held\n\ncommit 55ee64b30a38d688232e5eb2860467dddc493573 upstream.\n\nWalking rbtree while it\u0027s modified is a Bad Idea(tm); besides,\nthe result of find_vma() can be freed just as it\u0027s getting returned\nto caller. Fortunately, it\u0027s easy to fix - just take -\u003emmap_sem a bit\nearlier (and don\u0027t bother with find_vma() at all if virtp \u003e\u003d PAGE_OFFSET -\nin that case we don\u0027t even look at its result).\n\nWhile we are at it, what prevents VIDIOC_PREPARE_BUF calling\nv4l_prepare_buf() -\u003e (e.g) vb2_ioctl_prepare_buf() -\u003e vb2_prepare_buf() -\u003e\n__buf_prepare() -\u003e __qbuf_userptr() -\u003e vb2_vmalloc_get_userptr() -\u003e find_vma(),\nAFAICS without having taken -\u003emmap_sem anywhere in process? The code flow\nis bloody convoluted and depends on a bunch of things done by initialization,\nso I certainly might\u0027ve missed something...\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Sakari Ailus \u003csakari.ailus@iki.fi\u003e\nCc: Laurent Pinchart \u003claurent.pinchart@ideasonboard.com\u003e\nCc: Archit Taneja \u003carchit@ti.com\u003e\nCc: Prabhakar Lad \u003cprabhakar.lad@ti.com\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cmchehab@redhat.com\u003e\n[bwh: Backported to 3.2: adjust filename]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ac871a8a93556bb96e6d11931c4568f60546c50f", "tree": "4c8d912bf7a2160be692577f749d20a7b4fdb9ad", "parents": [ "1b8904da5aa472afbc86ba1a1c297c9bad21eb47" ], "author": { "name": "Laurent Pinchart", "email": "laurent.pinchart@ideasonboard.com", "time": "Sat Nov 24 21:35:48 2012 -0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Apr 14 06:44:33 2014 -0700" }, "message": "media: v4l: Reset subdev v4l2_dev field to NULL if registration fails\n\ncommit 317efce991620adc589b3005b9baed433dcb2a56 upstream.\n\nWhen subdev registration fails the subdev v4l2_dev field is left to a\nnon-NULL value. Later calls to v4l2_device_unregister_subdev() will\nconsider the subdev as registered and will module_put() the subdev\nmodule without any matching module_get().\nFix this by setting the subdev v4l2_dev field to NULL in\nv4l2_device_register_subdev() when the function fails.\n\nSigned-off-by: Laurent Pinchart \u003claurent.pinchart@ideasonboard.com\u003e\nAcked-by: Sylwester Nawrocki \u003cs.nawrocki@samsung.com\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cmchehab@redhat.com\u003e\n[bwh: Backported to 3.2: adjust context, filename]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1b8904da5aa472afbc86ba1a1c297c9bad21eb47", "tree": "29925e9739c04bf19f61bfa20cf75642fb1c3a26", "parents": [ "8d4787e99c05d0084a3a7644d8e5c04711f28970" ], "author": { "name": "Jacob Schloss", "email": "jacob.schloss@unlimitedautomata.com", "time": "Sun Dec 09 20:18:25 2012 -0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Apr 14 06:44:33 2014 -0700" }, "message": "media: gspca_kinect: add Kinect for Windows USB id\n\ncommit 98fd485795db064d0885150e2c0c7f296d8fe06e upstream.\n\nAdd the USB ID for the Kinect for Windows RGB camera so it can be used\nwith the gspca_kinect driver.\n\nSigned-off-by: Jacob Schloss \u003cjacob.schloss@unlimitedautomata.com\u003e\nSigned-off-by: Antonio Ospite \u003cospite@studenti.unina.it\u003e\nSigned-off-by: Hans de Goede \u003chdegoede@redhat.com\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cmchehab@redhat.com\u003e\n[bwh: Backported to 3.2: adjust filename]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8d4787e99c05d0084a3a7644d8e5c04711f28970", "tree": "06a73ee899a113c85dc9451a4a2316f5795406c4", "parents": [ "9e6f42f742cb5973960a89c4e94197c6f95a238b" ], "author": { "name": "Nithin Sujir", "email": "nsujir@broadcom.com", "time": "Mon Jun 03 09:19:34 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Apr 14 06:44:32 2014 -0700" }, "message": "tg3: Add read dma workaround for 5720\n\ncommit 9bc297ea0622bb2a6b3abfa2fa84f0a3b86ef8c8 upstream.\n\nCommit 091f0ea30074bc43f9250961b3247af713024bc6 \"tg3: Add New 5719 Read\nDMA workaround\" added a workaround for TX DMA stall on the 5719. This\nworkaround needs to be applied to the 5720 as well.\n\nReported-by: Roland Dreier \u003croland@purestorage.com\u003e\nTested-by: Roland Dreier \u003croland@purestorage.com\u003e\nSigned-off-by: Nithin Nayak Sujir \u003cnsujir@broadcom.com\u003e\nSigned-off-by: Michael Chan \u003cmchan@broadcom.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n[bwh: Backported to 3.2: use GET_ASIC_REV() instead of tg3_asic_rev()]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\n[hq: Backproted to 3.4: Adjust context]\nSigned-off-by: Qiang Huang \u003ch.huangqiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "9e6f42f742cb5973960a89c4e94197c6f95a238b", "tree": "a7bec5a8cb1fc2a4e7a75f35ab9fdf8f16ed1534", "parents": [ "14a7213e5390cd3f2c0cc00bf4d8caf663479b8b" ], "author": { "name": "Nithin Sujir", "email": "nsujir@broadcom.com", "time": "Mon May 13 11:04:15 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Apr 14 06:44:32 2014 -0700" }, "message": "tg3: Skip powering down function 0 on certain serdes devices\n\ncommit 44f3b503c16425c8e9db4bbaa2fc9cd0c9d0ba91 upstream.\n\nOn the 5718, 5719 and 5720 serdes devices, powering down function 0\nresults in all the other ports being powered down. Add code to skip\nfunction 0 power down.\n\nv2:\n - Modify tg3_phy_power_bug() function to use a switch instead of a\n complicated if statement. Suggested by Joe Perches.\n\nSigned-off-by: Michael Chan \u003cmchan@broadcom.com\u003e\nSigned-off-by: Nithin Nayak Sujir \u003cnsujir@broadcom.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n[bwh: Backported to 3.2:\n s/tg3_asic_rev\\(tp\\)/GET_ASIC_REV(tp-\u003epci_chip_rev_id)/]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\n[hq: Backported to 3.4: Adjust context]\nSigned-off-by: Qiang Huang \u003ch.huangqiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "14a7213e5390cd3f2c0cc00bf4d8caf663479b8b", "tree": "9ba01afe04693f19cd771d29a75c009f5d82b192", "parents": [ "82d16b39266179ca80f6b81b4084631ade240219" ], "author": { "name": "Mauro Carvalho Chehab", "email": "mchehab@redhat.com", "time": "Thu Sep 20 12:09:30 2012 -0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Apr 14 06:44:32 2014 -0700" }, "message": "sb_edac: Avoid overflow errors at memory size calculation\n\ncommit deb09ddaff1435f72dd598d38f9b58354c68a5ec upstream.\n\nSandy bridge EDAC is calculating the memory size with overflow.\nBasically, the size field and the integer calculation is using 32 bits.\nMore bits are needed, when the DIMM memories have high density.\n\nThe net result is that memories are improperly reported there, when\nhigh-density DIMMs are used:\n\nEDAC DEBUG: in drivers/edac/sb_edac.c, line at 591: mc#0: channel 0, dimm 0, -16384 Mb (-4194304 pages) bank: 8, rank: 2, row: 0x10000, col: 0x800\nEDAC DEBUG: in drivers/edac/sb_edac.c, line at 591: mc#0: channel 1, dimm 0, -16384 Mb (-4194304 pages) bank: 8, rank: 2, row: 0x10000, col: 0x800\n\nAs the number of pages value is handled at the EDAC core as unsigned\nints, the driver shows the 16 GB memories at sysfs interface as 16760832\nMB! The fix is simple: calculate the number of pages as unsigned 64-bits\ninteger.\n\nAfter the patch, the memory size (16 GB) is properly detected:\n\nEDAC DEBUG: in drivers/edac/sb_edac.c, line at 592: mc#0: channel 0, dimm 0, 16384 Mb (4194304 pages) bank: 8, rank: 2, row: 0x10000, col: 0x800\nEDAC DEBUG: in drivers/edac/sb_edac.c, line at 592: mc#0: channel 1, dimm 0, 16384 Mb (4194304 pages) bank: 8, rank: 2, row: 0x10000, col: 0x800\n\nSigned-off-by: Mauro Carvalho Chehab \u003cmchehab@redhat.com\u003e\n[bwh: Backported to 3.2:\n - Adjust context\n - Debug log function is debugf0(), not edac_dbg()]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Qiang Huang \u003ch.huangqiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "82d16b39266179ca80f6b81b4084631ade240219", "tree": "6440323afd6857eb0565acaacf5b963d2b48af30", "parents": [ "faf100389a5479de77294b8ebe98ec4e775d6927" ], "author": { "name": "Lauri Hintsala", "email": "lauri.hintsala@bluegiga.com", "time": "Tue Jul 17 17:16:10 2012 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Apr 14 06:44:32 2014 -0700" }, "message": "mmc: mxs-mmc: fix deadlock caused by recursion loop\n\ncommit fc108d24d3a6da63576a460e122fa1df0cbdea20 upstream.\n\nRelease the lock before mmc_signal_sdio_irq is called by\nmxs_mmc_enable_sdio_irq.\n\nBacktrace:\n[ 65.470000] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[ 65.470000] [ INFO: possible recursive locking detected ]\n[ 65.470000] 3.5.0-rc5 #2 Not tainted\n[ 65.470000] ---------------------------------------------\n[ 65.470000] ksdioirqd/mmc0/73 is trying to acquire lock:\n[ 65.470000] (\u0026(\u0026host-\u003elock)-\u003erlock#2){-.-...}, at: [\u003cbf054120\u003e] mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]\n[ 65.470000]\n[ 65.470000] but task is already holding lock:\n[ 65.470000] (\u0026(\u0026host-\u003elock)-\u003erlock#2){-.-...}, at: [\u003cbf054120\u003e] mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]\n[ 65.470000]\n[ 65.470000] other info that might help us debug this:\n[ 65.470000] Possible unsafe locking scenario:\n[ 65.470000]\n[ 65.470000] CPU0\n[ 65.470000] ----\n[ 65.470000] lock(\u0026(\u0026host-\u003elock)-\u003erlock#2);\n[ 65.470000] lock(\u0026(\u0026host-\u003elock)-\u003erlock#2);\n[ 65.470000]\n[ 65.470000] *** DEADLOCK ***\n[ 65.470000]\n[ 65.470000] May be due to missing lock nesting notation\n[ 65.470000]\n[ 65.470000] 1 lock held by ksdioirqd/mmc0/73:\n[ 65.470000] #0: (\u0026(\u0026host-\u003elock)-\u003erlock#2){-.-...}, at: [\u003cbf054120\u003e] mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]\n[ 65.470000]\n[ 65.470000] stack backtrace:\n[ 65.470000] [\u003cc0014990\u003e] (unwind_backtrace+0x0/0xf4) from [\u003cc005ccb8\u003e] (__lock_acquire+0x14f8/0x1b98)\n[ 65.470000] [\u003cc005ccb8\u003e] (__lock_acquire+0x14f8/0x1b98) from [\u003cc005d3f8\u003e] (lock_acquire+0xa0/0x108)\n[ 65.470000] [\u003cc005d3f8\u003e] (lock_acquire+0xa0/0x108) from [\u003cc02f671c\u003e] (_raw_spin_lock_irqsave+0x48/0x5c)\n[ 65.470000] [\u003cc02f671c\u003e] (_raw_spin_lock_irqsave+0x48/0x5c) from [\u003cbf054120\u003e] (mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc])\n[ 65.470000] [\u003cbf054120\u003e] (mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]) from [\u003cbf0541d0\u003e] (mxs_mmc_enable_sdio_irq+0xc8/0xdc [mxs_mmc])\n[ 65.470000] [\u003cbf0541d0\u003e] (mxs_mmc_enable_sdio_irq+0xc8/0xdc [mxs_mmc]) from [\u003cc0219b38\u003e] (sdio_irq_thread+0x1bc/0x274)\n[ 65.470000] [\u003cc0219b38\u003e] (sdio_irq_thread+0x1bc/0x274) from [\u003cc003c324\u003e] (kthread+0x8c/0x98)\n[ 65.470000] [\u003cc003c324\u003e] (kthread+0x8c/0x98) from [\u003cc00101ac\u003e] (kernel_thread_exit+0x0/0x8)\n[ 65.470000] BUG: spinlock lockup suspected on CPU#0, ksdioirqd/mmc0/73\n[ 65.470000] lock: 0xc3358724, .magic: dead4ead, .owner: ksdioirqd/mmc0/73, .owner_cpu: 0\n[ 65.470000] [\u003cc0014990\u003e] (unwind_backtrace+0x0/0xf4) from [\u003cc01b46b0\u003e] (do_raw_spin_lock+0x100/0x144)\n[ 65.470000] [\u003cc01b46b0\u003e] (do_raw_spin_lock+0x100/0x144) from [\u003cc02f6724\u003e] (_raw_spin_lock_irqsave+0x50/0x5c)\n[ 65.470000] [\u003cc02f6724\u003e] (_raw_spin_lock_irqsave+0x50/0x5c) from [\u003cbf054120\u003e] (mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc])\n[ 65.470000] [\u003cbf054120\u003e] (mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]) from [\u003cbf0541d0\u003e] (mxs_mmc_enable_sdio_irq+0xc8/0xdc [mxs_mmc])\n[ 65.470000] [\u003cbf0541d0\u003e] (mxs_mmc_enable_sdio_irq+0xc8/0xdc [mxs_mmc]) from [\u003cc0219b38\u003e] (sdio_irq_thread+0x1bc/0x274)\n[ 65.470000] [\u003cc0219b38\u003e] (sdio_irq_thread+0x1bc/0x274) from [\u003cc003c324\u003e] (kthread+0x8c/0x98)\n[ 65.470000] [\u003cc003c324\u003e] (kthread+0x8c/0x98) from [\u003cc00101ac\u003e] (kernel_thread_exit+0x0/0x8)\n\nReported-by: Attila Kinali \u003cattila@kinali.ch\u003e\nSigned-off-by: Lauri Hintsala \u003clauri.hintsala@bluegiga.com\u003e\nAcked-by: Shawn Guo \u003cshawn.guo@linaro.org\u003e\nSigned-off-by: Chris Ball \u003ccjb@laptop.org\u003e\n[bwh: Backported to 3.2:\n - Adjust context\n - HW_SSP_STATUS is a simple rather than function-like macro]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Qiang Huang \u003ch.huangqiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" } ], "next": "faf100389a5479de77294b8ebe98ec4e775d6927" }