April 2019 - Linux-stable-mirror

FAILED: patch "[PATCH] powerpc/mm/radix: Make Radix require HUGETLB_PAGE" failed to apply to 4.9-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 8adddf349fda0d3de2f6bb41ddf838cbf36a8ad2 Mon Sep 17 00:00:00 2001 From: Michael Ellerman <mpe(a)ellerman.id.au> Date: Tue, 16 Apr 2019 23:59:02 +1000 Subject: [PATCH] powerpc/mm/radix: Make Radix require HUGETLB_PAGE Joel reported weird crashes using skiroot_defconfig, in his case we jumped into an NX page: kernel tried to execute exec-protected page (c000000002bff4f0) - exploit attempt? (uid: 0) BUG: Unable to handle kernel instruction fetch Faulting instruction address: 0xc000000002bff4f0 Looking at the disassembly, we had simply branched to that address: c000000000c001bc 49fff335 bl c000000002bff4f0 But that didn't match the original kernel image: c000000000c001bc 4bfff335 bl c000000000bff4f0 <kobject_get+0x8> When STRICT_KERNEL_RWX is enabled, and we're using the radix MMU, we call radix__change_memory_range() late in boot to change page protections. We do that both to mark rodata read only and also to mark init text no-execute. That involves walking the kernel page tables, and clearing _PAGE_WRITE or _PAGE_EXEC respectively. With radix we may use hugepages for the linear mapping, so the code in radix__change_memory_range() uses eg. pmd_huge() to test if it has found a huge mapping, and if so it stops the page table walk and changes the PMD permissions. However if the kernel is built without HUGETLBFS support, pmd_huge() is just a #define that always returns 0. That causes the code in radix__change_memory_range() to incorrectly interpret the PMD value as a pointer to a PTE page rather than as a PTE at the PMD level. We can see this using `dv` in xmon which also uses pmd_huge(): 0:mon> dv c000000000000000 pgd @ 0xc000000001740000 pgdp @ 0xc000000001740000 = 0x80000000ffffb009 pudp @ 0xc0000000ffffb000 = 0x80000000ffffa009 pmdp @ 0xc0000000ffffa000 = 0xc00000000000018f <- this is a PTE ptep @ 0xc000000000000100 = 0xa64bb17da64ab07d <- kernel text The end result is we treat the value at 0xc000000000000100 as a PTE and clear _PAGE_WRITE or _PAGE_EXEC, potentially corrupting the code at that address. In Joel's specific case we cleared the sign bit in the offset of the branch, causing a backward branch to turn into a forward branch which caused us to branch into a non-executable page. However the exact nature of the crash depends on kernel version, compiler version, and other factors. We need to fix radix__change_memory_range() to not use accessors that depend on HUGETLBFS, but we also have radix memory hotplug code that uses pmd_huge() etc that will also need fixing. So for now just disallow the broken combination of Radix with HUGETLBFS disabled. The only defconfig we have that is affected is skiroot_defconfig, so turn on HUGETLBFS there so that it still gets Radix. Fixes: 566ca99af026 ("powerpc/mm/radix: Add dummy radix_enabled()") Cc: stable(a)vger.kernel.org # v4.7+ Reported-by: Joel Stanley <joel(a)jms.id.au> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> diff --git a/arch/powerpc/configs/skiroot_defconfig b/arch/powerpc/configs/skiroot_defconfig index 5ba131c30f6b..1bcd468ab422 100644 --- a/arch/powerpc/configs/skiroot_defconfig +++ b/arch/powerpc/configs/skiroot_defconfig @@ -266,6 +266,7 @@ CONFIG_UDF_FS=m CONFIG_MSDOS_FS=m CONFIG_VFAT_FS=m CONFIG_PROC_KCORE=y +CONFIG_HUGETLBFS=y # CONFIG_MISC_FILESYSTEMS is not set # CONFIG_NETWORK_FILESYSTEMS is not set CONFIG_NLS=y diff --git a/arch/powerpc/platforms/Kconfig.cputype b/arch/powerpc/platforms/Kconfig.cputype index 842b2c7e156a..50cd09b4e05d 100644 --- a/arch/powerpc/platforms/Kconfig.cputype +++ b/arch/powerpc/platforms/Kconfig.cputype @@ -324,7 +324,7 @@ config ARCH_ENABLE_SPLIT_PMD_PTLOCK config PPC_RADIX_MMU bool "Radix MMU Support" - depends on PPC_BOOK3S_64 + depends on PPC_BOOK3S_64 && HUGETLB_PAGE select ARCH_HAS_GIGANTIC_PAGE if (MEMORY_ISOLATION && COMPACTION) || CMA default y help

5 years, 5 months

1
0
0 0

Re: [PATCH-tip v6 01/20] locking/rwsem: Prevent decrement of reader count before increment

by Waiman Long

On 4/28/19 4:39 PM, Sasha Levin wrote: > Hi, > > [This is an automated email] > > This commit has been processed because it contains a "Fixes:" tag, > fixing commit: 70800c3c0cc5 locking/rwsem: Scan the wait_list for readers only once. > > The bot has tested the following trees: v5.0.10, v4.19.37, v4.14.114, v4.9.171. > > v5.0.10: Failed to apply! Possible dependencies: > 412f34a82ccf ("locking/qspinlock_stat: Track the no MCS node available case") > 46ad0840b158 ("locking/rwsem: Remove arch specific rwsem files") > 579afe866f52 ("xtensa: use generic spinlock/rwlock implementation") > a8654596f037 ("locking/rwsem: Enable lock event counting") > ad53fa10fa9e ("locking/qspinlock_stat: Introduce generic lockevent_*() counting APIs") > c7580c1e8443 ("locking/rwsem: Move owner setting code from rwsem.c to rwsem.h") > ce9084ba0d1d ("x86: Make ARCH_USE_MEMREMAP_PROT a generic Kconfig symbol") > d682b596d993 ("locking/qspinlock: Handle > 4 slowpath nesting levels") > eecec78f7777 ("locking/rwsem: Relocate rwsem_down_read_failed()") > fb346fd9fc08 ("locking/lock_events: Make lock_events available for all archs & other locks") > > v4.19.37: Failed to apply! Possible dependencies: > 0fa809ca7f81 ("locking/pvqspinlock: Extend node size when pvqspinlock is configured") > 1222109a5363 ("locking/qspinlock_stat: Count instances of nested lock slowpaths") > 412f34a82ccf ("locking/qspinlock_stat: Track the no MCS node available case") > 46ad0840b158 ("locking/rwsem: Remove arch specific rwsem files") > 4b486b535c33 ("locking/rwsem: Exit read lock slowpath if queue empty & no writer") > 925b9cd1b89a ("locking/rwsem: Make owner store task pointer of last owning reader") > a8654596f037 ("locking/rwsem: Enable lock event counting") > ad53fa10fa9e ("locking/qspinlock_stat: Introduce generic lockevent_*() counting APIs") > c7580c1e8443 ("locking/rwsem: Move owner setting code from rwsem.c to rwsem.h") > ce9084ba0d1d ("x86: Make ARCH_USE_MEMREMAP_PROT a generic Kconfig symbol") > d682b596d993 ("locking/qspinlock: Handle > 4 slowpath nesting levels") > eecec78f7777 ("locking/rwsem: Relocate rwsem_down_read_failed()") > fb346fd9fc08 ("locking/lock_events: Make lock_events available for all archs & other locks") > > v4.14.114: Failed to apply! Possible dependencies: > 0fa809ca7f81 ("locking/pvqspinlock: Extend node size when pvqspinlock is configured") > 11752adb68a3 ("locking/pvqspinlock: Implement hybrid PV queued/unfair locks") > 1222109a5363 ("locking/qspinlock_stat: Count instances of nested lock slowpaths") > 1958b5fc4010 ("x86/boot: Add early boot support when running with SEV active") > 1cd9c22fee3a ("x86/mm/encrypt: Move page table helpers into separate translation unit") > 271ca788774a ("arch: enable relative relocations for arm64, power and x86") > 412f34a82ccf ("locking/qspinlock_stat: Track the no MCS node available case") > 81d3dc9a349b ("locking/qspinlock: Add stat tracking for pending vs. slowpath") > 94d49eb30e85 ("x86/mm: Decouple dynamic __PHYSICAL_MASK from AMD SME") > a8654596f037 ("locking/rwsem: Enable lock event counting") > ad53fa10fa9e ("locking/qspinlock_stat: Introduce generic lockevent_*() counting APIs") > ce9084ba0d1d ("x86: Make ARCH_USE_MEMREMAP_PROT a generic Kconfig symbol") > d682b596d993 ("locking/qspinlock: Handle > 4 slowpath nesting levels") > d7b417fa08d1 ("x86/mm: Add DMA support for SEV memory encryption") > d8aa7eea78a1 ("x86/mm: Add Secure Encrypted Virtualization (SEV) support") > dfaaec9033b8 ("x86: Add support for changing memory encryption attribute in early boot") > fb346fd9fc08 ("locking/lock_events: Make lock_events available for all archs & other locks") > > v4.9.171: Failed to apply! Possible dependencies: > 1a8b6d76dc5b ("net:add one common config ARCH_WANT_RELAX_ORDER to support relax ordering") > 271ca788774a ("arch: enable relative relocations for arm64, power and x86") > 29dee3c03abc ("locking/refcounts: Out-of-line everything") > 40565b5aedd6 ("sched/cputime, powerpc, s390: Make scaled cputime arch specific") > 4ad8622dc548 ("powerpc/8xx: Implement hw_breakpoint") > 51c9c0843993 ("powerpc/kprobes: Implement Optprobes") > 5b9ff0278598 ("powerpc: Build-time sort the exception table") > 65c059bcaa73 ("powerpc: Enable support for GCC plugins") > 9fea59bd7ca5 ("powerpc/mm: Add support for runtime configuration of ASLR limits") > a7d2475af7ae ("powerpc: Sort the selects under CONFIG_PPC") > a8654596f037 ("locking/rwsem: Enable lock event counting") > bd174169c7a1 ("locking/refcount: Add refcount_t API kernel-doc comments") > ce9084ba0d1d ("x86: Make ARCH_USE_MEMREMAP_PROT a generic Kconfig symbol") > d557d1b58b35 ("refcount: change EXPORT_SYMBOL markings") > ebfa50df435e ("powerpc: Add helper to check if offset is within relative branch range") > f405df5de317 ("refcount_t: Introduce a special purpose refcount type") > fa769d3f58e6 ("powerpc/32: Enable HW_BREAKPOINT on BOOK3S") > fb346fd9fc08 ("locking/lock_events: Make lock_events available for all archs & other locks") > fd25d19f6b8d ("locking/refcount: Create unchecked atomic_t implementation") > > > How should we proceed with this patch? I will send out a version that will be easier to backport once this patch lands in the mainline. Cheers, Longman

5 years, 5 months

1
0
0 0

[PATCH-tip v6 01/20] locking/rwsem: Prevent decrement of reader count before increment

by Waiman Long

During my rwsem testing, it was found that after a down_read(), the reader count may occasionally become 0 or even negative. Consequently, a writer may steal the lock at that time and execute with the reader in parallel thus breaking the mutual exclusion guarantee of the write lock. In other words, both readers and writer can become rwsem owners simultaneously. The current reader wakeup code does it in one pass to clear waiter->task and put them into wake_q before fully incrementing the reader count. Once waiter->task is cleared, the corresponding reader may see it, finish the critical section and do unlock to decrement the count before the count is incremented. This is not a problem if there is only one reader to wake up as the count has been pre-incremented by 1. It is a problem if there are more than one readers to be woken up and writer can steal the lock. The wakeup is actually done in 2 passes before the v4.9 commit 70800c3c0cc5 ("locking/rwsem: Scan the wait_list for readers only once"). To fix this problem, the wakeup is now done in two passes again. In the first pass, we collect the readers and count them. The reader count is then fully incremented. In the second pass, the waiter->task is then cleared and they are put into wake_q to be woken up later. Fixes: 70800c3c0cc5 ("locking/rwsem: Scan the wait_list for readers only once") Cc: <stable(a)vger.kernel.org> Signed-off-by: Waiman Long <longman(a)redhat.com> --- kernel/locking/rwsem-xadd.c | 45 +++++++++++++++++++++++++------------ 1 file changed, 31 insertions(+), 14 deletions(-) diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c index 6b3ee9948bf1..cab5b1f6b2de 100644 --- a/kernel/locking/rwsem-xadd.c +++ b/kernel/locking/rwsem-xadd.c @@ -130,6 +130,7 @@ static void __rwsem_mark_wake(struct rw_semaphore *sem, { struct rwsem_waiter *waiter, *tmp; long oldcount, woken = 0, adjustment = 0; + struct list_head wlist; /* * Take a peek at the queue head waiter such that we can determine @@ -188,18 +189,44 @@ static void __rwsem_mark_wake(struct rw_semaphore *sem, * of the queue. We know that woken will be at least 1 as we accounted * for above. Note we increment the 'active part' of the count by the * number of readers before waking any processes up. + * + * We have to do wakeup in 2 passes to prevent the possibility that + * the reader count may be decremented before it is incremented. It + * is because the to-be-woken waiter may not have slept yet. So it + * may see waiter->task got cleared, finish its critical section and + * do an unlock before the reader count increment. + * + * 1) Collect the read-waiters in a separate list, count them and + * fully increment the reader count in rwsem. + * 2) For each waiters in the new list, clear waiter->task and + * put them into wake_q to be woken up later. */ + INIT_LIST_HEAD(&wlist); list_for_each_entry_safe(waiter, tmp, &sem->wait_list, list) { - struct task_struct *tsk; - if (waiter->type == RWSEM_WAITING_FOR_WRITE) break; woken++; - tsk = waiter->task; + list_move_tail(&waiter->list, &wlist); + } + + adjustment = woken * RWSEM_ACTIVE_READ_BIAS - adjustment; + lockevent_cond_inc(rwsem_wake_reader, woken); + if (list_empty(&sem->wait_list)) { + /* hit end of list above */ + adjustment -= RWSEM_WAITING_BIAS; + } + + if (adjustment) + atomic_long_add(adjustment, &sem->count); + + /* 2nd pass */ + list_for_each_entry(waiter, &wlist, list) { + struct task_struct *tsk; + tsk = waiter->task; get_task_struct(tsk); - list_del(&waiter->list); + /* * Ensure calling get_task_struct() before setting the reader * waiter to nil such that rwsem_down_read_failed() cannot @@ -213,16 +240,6 @@ static void __rwsem_mark_wake(struct rw_semaphore *sem, */ wake_q_add_safe(wake_q, tsk); } - - adjustment = woken * RWSEM_ACTIVE_READ_BIAS - adjustment; - lockevent_cond_inc(rwsem_wake_reader, woken); - if (list_empty(&sem->wait_list)) { - /* hit end of list above */ - adjustment -= RWSEM_WAITING_BIAS; - } - - if (adjustment) - atomic_long_add(adjustment, &sem->count); } /* -- 2.18.1

5 years, 5 months

2
4
0 0

Experienced Remote Web Application Developer

by AnjanPatra

Do you want web development and design? We work full time working online. We do not ask for advance payment. Try for 7 days, If you like our work then only pay and continue long term. Web Design , Development , PHP , Graphic Design , Rate @ 125 USD / Week General Office Work (BPO) - Rate @ 90 US / Week ( Mon - Sat 40 Hrs per week ). Our Expertise ( PHP | MySQL | HTML | CSS, Dreamweaver, Photoshop etc..) We are always online on Skype(id-anjanindi) and email. Please visit codelogics . com to see our previous work samples If you are not interested we will never send you email again ever. Thanks Anjan Patra

5 years, 5 months

1
0
0 0

[PATCH 3.16 000/202] 3.16.66-rc1 review

by Ben Hutchings

This is the start of the stable review cycle for the 3.16.66 release. There are 202 patches in this series, which will be posted as responses to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed May 01 18:00:00 UTC 2019. Anything received after that time might be too late. All the patches have also been committed to the linux-3.16.y-rc branch of https://git.kernel.org/pub/scm/linux/kernel/git/bwh/linux-stable-rc.git . A shortlog and diffstat can be found below. Ben. ------------- Aaro Koskinen (1): MIPS: OCTEON: don't set octeon_dma_bar_type if PCI is disabled [dcf300a69ac307053dfb35c2e33972e754a98bce] Alex Williamson (1): vfio/type1: Limit DMA mappings per container [492855939bdb59c6f947b0b5b44af9ad82b7e38c] Alexander Popov (1): KVM: x86: Fix single-step debugging [5cc244a20b86090c087073c124284381cdf47234] Alexandru Ardelean (1): dmaengine: dmatest: unmap data on a single code-path when xfer done [0255200bd29afc320c6ea4c1adf8bdc13a9b3c15] Andrea Arcangeli (1): coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping [04f5866e41fb70690e28397487d8bd8eea7d712a] Andy Lutomirski (1): x86/uaccess: Don't leak the AC flag into __put_user() value evaluation [2a418cf3f5f1caf911af288e978d61c9844b0695] Andy Shevchenko (1): dmaengine: dmatest: Abort test in case of mapping error [6454368a804c4955ccd116236037536f81e5b1f1] Arend van Spriel (5): brcmfmac: add subtype check for event handling in data path [a4176ec356c73a46c07c181c6d04039fafa34a9f] brcmfmac: assure SSID length from firmware is limited [1b5e2423164b3670e8bc9174e4762d297990deff] brcmfmac: consolidate ifp lookup in driver core [75effb03ee8e4c9d4bbc909118ce5444b047dfde] brcmfmac: make brcmf_proto_hdrpull() return struct brcmf_if instance [796cfb65e3ed01a9b08e3a0b93e34120c54bbbd2] brcmfmac: revise handling events in receive path [9c349892ccc90c6de2baaa69cc78449f58082273] Aya Levin (1): net/mlx4_core: Add masking for a few queries on HCA caps [a40ded6043658444ee4dd6ee374119e4e98b33fc] B-Ak (1): ASoC: tlv320aic32x4: Kernel OOPS while entering DAPM standby mode [667e9334fa64da2273e36ce131b05ac9e47c5769] Ben Hutchings (1): binfmt_elf: Fix missing SIGKILL for empty PIE [not upstream; fixes bad backport] Bin Liu (1): usb: phy: am335x: fix race condition in _probe [a53469a68eb886e84dd8b69a1458a623d3591793] Borislav Petkov (1): x86/a.out: Clear the dump structure initially [10970e1b4be9c74fce8ab6e3c34a7d718f063f2c] Charles Keepax (1): ALSA: compress: Fix stop handling on compressed capture streams [4f2ab5e1d13d6aa77c55f4914659784efd776eb4] Charles Yeh (1): USB: serial: pl2303: add new PID to support PL2303TB [4dcf9ddc9ad5ab649abafa98c5a4d54b1a33dabb] Christian Borntraeger (1): s390/early: improve machine detection [03aa047ef2db4985e444af6ee1c1dd084ad9fb4c] Christoph Paasch (1): net/packet: Set __GFP_NOWARN upon allocation in alloc_pg_vec [398f0132c14754fcd03c1c4f8e7176d001ce8ea1] Cong Wang (1): team: avoid complex list operations in team_nl_cmd_options_set() [2fdeee2549231b1f989f011bb18191f5660d3745] Dan Carpenter (4): ALSA: cs46xx: Potential NULL dereference in probe [1524f4e47f90b27a3ac84efbdd94c63172246a6f] mfd: ab8500-core: Return zero in get_register_interruptible() [10628e3ecf544fa2e4e24f8e112d95c37884dc98] scsi: bnx2fc: Fix error handling in probe() [b2d3492fc591b1fb46b81d79ca1fc44cac6ae0ae] skge: potential memory corruption in skge_get_regs() [294c149a209c6196c2de85f512b52ef50f519949] Daniel Drake (1): x86/kaslr: Fix incorrect i8254 outb() parameters [7e6fc2f50a3197d0e82d1c0e86282976c9e6c8a4] Daniele Palmas (1): usb: cdc-acm: send ZLP for Telit 3G Intel based modems [34aabf918717dd14e05051896aaecd3b16b53d95] Darrick J. Wong (2): tmpfs: fix link accounting when a tmpfile is linked in [1062af920c07f5b54cf5060fde3339da6df0cf6b] tmpfs: fix uninitialized return value in shmem_link [29b00e609960ae0fcff382f4c7079dd0874a5311] David Hildenbrand (1): mm: migrate: don't rely on __PageMovable() of newpage after unlocking it [e0a352fabce61f730341d119fbedf71ffdb8663f] David Howells (1): assoc_array: Fix shortcut creation [bb2ba2d75a2d673e76ddaf13a9bd30d6a8b1bb08] Davidlohr Bueso (1): arc: do not export symbols in troubleshoot.c [be2a7fce397d82b7dc3fdbc61fb0bdab118e65ca] Dexuan Cui (1): Drivers: hv: vmbus: Check for ring when getting debug info [ba50bf1ce9a51fc97db58b96d01306aa70bc3979] Eric Biggers (5): KEYS: allow reaching the keys quotas exactly [a08bf91ce28ed3ae7b6fef35d843fef8dc8c2cd9] KEYS: always initialize keyring_index_key::desc_len [ede0fa98a900e657d1fcd80b50920efc896c1a4c] KEYS: restrict /proc/keys by credentials at open time [4aa68e07d845562561f5e73c04aa521376e95252] KEYS: user: Align the payload buffer [cc1780fc42c76c705dd07ea123f1143dc5057630] crypto: authenc - fix parsing key with misaligned rta_len [8f9c469348487844328e162db57112f7d347c49f] Eric Dumazet (3): batman-adv: fix uninit-value in batadv_interface_tx() [4ffcbfac60642f63ae3d80891f573ba7e94a265c] net/x25: fix a race in x25_bind() [797a22bd5298c2674d927893f46cadf619dad11d] vxlan: test dev->flags & IFF_UP before calling netif_rx() [4179cb5a4c924cd233eaadd081882425bc98f44e] Eric W. Biederman (4): ipc/shm: Fix pid freeing. [2236d4d39035b9839944603ec4b65ce71180a9ea] signal: Always notice exiting tasks [35634ffa1751b6efd8cf75010b509dcb0263e29b] signal: Better detection of synchronous signals [7146db3317c67b517258cb5e1b08af387da0618b] signal: Restore the stop PTRACE_EVENT_EXIT [cf43a757fd49442bc38f76088b70c2299eed2c2f] Eugene Loh (1): kallsyms: Handle too long symbols in kallsyms.c [6db2983cd8064808141ccefd75218f5b4345ffae] Eugeniy Paltsev (1): ARC: U-boot: check arguments paranoidly [a66f2e57bd566240d8b3884eedf503928fbbe557] Felix Fietkau (1): mac80211: ensure that mgmt tx skbs have tailroom for encryption [9d0f50b80222dc273e67e4e14410fcfa4130a90c] Feras Daoud (1): IB/ipoib: Fix for use-after-free in ipoib_cm_tx_start [6ab4aba00f811a5265acc4d3eb1863bb3ca60562] Florian Westphal (1): netfilter: nf_tables: nft_compat: fix refcount leak on xt module [b8e9dc1c75714ceb53615743e1036f76e00f5a17] Franky Lin (1): brcmfmac: screening firmware event packet [c56caa9db8abbbfb9e31325e0897705aa897db37] Gabriel Krisman Bertazi (1): sd: Clear PS bit before Mode Select. [2c5d16d6a9e7218e57b716e4fd9d77c776d21471] Gavin Li (1): brcmfmac: fix incorrect event channel deduction [8e290cecdd0178f3d4cf7d463c51dc7e462843b4] Gerald Schaefer (1): s390/smp: fix CPU hotplug deadlock with CPU rescan [b7cb707c373094ce4008d4a6ac9b6b366ec52da5] Greg Kroah-Hartman (3): debugfs: fix debugfs_rename parameter checking [d88c93f090f708c18195553b352b9f205e65418f] tty: Handle problem if line discipline does not have receive_buf [27cfb3a53be46a54ec5e0bd04e51995b74c90343] tty: mark Siemens R3964 line discipline as BROKEN [c7084edc3f6d67750f50d4183134c4fb5712a5c8] Grygorii Strashko (1): net: phy: micrel: ksz9031: reconfigure autoneg after phy autoneg workaround [c1a8d0a3accf64a014d605e6806ce05d1c17adf1] Guenter Roeck (1): unicore32: Fix build error [ca98565a6182a960cd857d7546267a0775154eb8] Gustavo A. R. Silva (4): char/mwave: fix potential Spectre v1 vulnerability [701956d4018e5d5438570e39e8bda47edd32c489] ipmi: msghandler: Fix potential Spectre v1 vulnerabilities [a7102c7461794a5bb31af24b08e9e0f50038897a] perf tests evsel-tp-sched: Fix bitwise operator [489338a717a0dfbbd5a3fabccf172b78f0ac9015] usb: gadget: udc: net2272: Fix bitwise and boolean operations [07c69f1148da7de3978686d3af9263325d9d60bd] Hangbin Liu (1): sit: check if IPv6 enabled before calling ip6_err_gen_icmpv6_unreach() [173656accaf583698bac3f9e269884ba60d51ef4] Hans de Goede (2): ACPI: power: Skip duplicate power resource references in _PRx [7d7b467cb95bf29597b417d4990160d4ea6d69b9] libata: Add NOLPM quirk for SAMSUNG MZ7TE512HMHP-000L1 SSD [dd957493baa586f1431490f97f9c7c45eaf8ab10] Heiner Kallweit (1): net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ9031 [1d16073a326891c2a964e4cb95bc18fbcafb5f74] Hui Peng (1): ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks [cbb2ebf70daf7f7d97d3811a2ff8e39655b8c184] Icenowy Zheng (2): USB: storage: add quirk for SMI SM3350 [0a99cc4b8ee83885ab9f097a3737d1ab28455ac0] USB: storage: don't insert sane sense for SPC3+ when bad sense specified [c5603d2fdb424849360fe7e3f8c1befc97571b8c] Ilya Dryomov (1): rbd: don't return 0 on unmap if RBD_DEV_FLAG_REMOVING is set [85f5a4d666fd9be73856ed16bb36c5af5b406b29] Ingo Molnar (1): perf/core: Fix impossible ring-buffer sizes warning [528871b456026e6127d95b1b2bd8e3a003dc1614] Ivan Mironov (3): drm/fb-helper: Ignore the value of fb_var_screeninfo.pixclock [66a8d5bfb518f9f12d47e1d2dce1732279f9451e] drm/fb-helper: Partially bring back workaround for bugs of SDL 1.2 [62d85b3bf9d978ed4b6b2aeef5cf0ccf1423906e] scsi: sd: Fix cache_type_store() [44759979a49bfd2d20d789add7fa81a21eb1a4ab] Jack Stocker (1): USB: Add USB_QUIRK_DELAY_CTRL_MSG quirk for Corsair K70 RGB [3483254b89438e60f719937376c5e0ce2bc46761] Jacob Wen (1): l2tp: copy 4 more bytes to linear part if necessary [91c524708de6207f59dd3512518d8a1c7b434ee3] Jann Horn (2): fuse: call pipe_buf_release() under pipe lock [9509941e9c534920ccc4771ae70bd6cbbe79df1c] mm: enforce min addr even if capable() in expand_downwards() [0a1d52994d440e21def1c2174932410b4f2a98a1] Jason Gunthorpe (1): packet: Do not leak dev refcounts on error exit [d972f3dce8d161e2142da0ab1ef25df00e2f21a9] Jiri Olsa (1): perf/x86: Add check_period PMU callback [81ec3f3c4c4d78f2d3b6689c9816bfbdf7417dbb] John Garry (1): scsi: libsas: Fix rphy phy_identifier for PHYs with end devices attached [ffeafdd2bf0b280d67ec1a47ea6287910d271f3f] John Johansen (1): apparmor: provide userspace flag indicating binfmt_elf_mmap change [34c426acb75cc21bdf84685e106db0c1a3565057] Jonathan Bakker (1): Input: bma150 - register input device after setting private data [90cc55f067f6ca0e64e5e52883ece47d8af7b67b] Jonathan Hunter (1): mfd: tps6586x: Handle interrupts on suspend [ac4ca4b9f4623ba5e1ea7a582f286567c611e027] Jonathan Neuschäfer (1): mmc: spi: Fix card detection during probe [c9bd505dbd9d3dc80c496f88eafe70affdcf1ba6] Jose Abreu (1): net: stmmac: Fix a race in EEE enable callback [8a7493e58ad688eb23b81e45461c5d314f4402f1] Julian Wiedmann (3): s390/qeth: cancel close_dev work before removing a card [c2780c1a3fb724560b1d44f7976e0de17bf153c7] s390/qeth: conclude all event processing before offlining a card [c0a2e4d10d9366ada133a8ae4ff2f32397f8b15b] s390/qeth: fix use-after-free in error path [afa0c5904ba16d59b0454f7ee4c807dae350f432] Jun-Ru Chang (1): MIPS: Remove function size check in get_frame_info() [2b424cfc69728224fcb5fad138ea7260728e0901] Kal Conley (1): net/packet: fix 4gb buffer limit due to overflow check [fc62814d690cf62189854464f4bd07457d5e9e50] Kan Liang (1): perf/x86/intel/uncore: Add Node ID mask [9e63a7894fd302082cf3627fe90844421a6cbe7f] Kangjie Lu (1): ASoC: atom: fix a missing check of snd_pcm_lib_malloc_pages [44fabd8cdaaa3acb80ad2bb3b5c61ae2136af661] Kees Cook (1): Yama: Check for pid death before checking ancestry [9474f4e7cd71a633fa1ef93b7daefd44bbdfd482] Leonid Iziumtsev (1): dmaengine: imx-dma: fix wrong callback invoke [341198eda723c8c1cddbb006a89ad9e362502ea2] Linus Torvalds (1): binfmt_elf: switch to new creds when switching to new mm [9f834ec18defc369d73ccf9e87a2790bfa05bf46] Linus Walleij (1): ARM: dts: kirkwood: Fix polarity of GPIO fan lines [b5f034845e70916fd33e172fad5ad530a29c10ab] Liping Zhang (1): netfilter: nft_compat: fix crash when related match/target module is removed [4b512e1c1f8de6b9ceb796ecef8658e0a083cab7] Logan Gunthorpe (1): scsi: isci: initialize shost fully before calling scsi_add_host() [cc29a1b0a3f2597ce887d339222fa85b9307706d] Lukas Wunner (2): dmaengine: bcm2835: Fix abort of transactions [9e528c799d17a4ac37d788c81440b50377dd592d] dmaengine: bcm2835: Fix interrupt race on RT [f7da7782aba92593f7b82f03d2409a1c5f4db91b] Manfred Schlaegl (1): can: dev: __can_get_echo_skb(): fix bogous check for non-existing skb by removing it [7b12c8189a3dc50638e7d53714c88007268d47ef] Manuel Reinhardt (1): ALSA: usb-audio: Fix implicit fb endpoint setup by quirk [2bc16b9f3223d049b57202ee702fcb5b9b507019] Marcel Holtmann (2): Bluetooth: Check L2CAP option sizes returned from l2cap_get_conf_opt [af3d5d1c87664a4f150fcf3534c6567cb19909b0] Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer [7c9cbd0b5e38a1672fcd137894ace3b042dfbf69] Mark Rutland (1): perf/core: Don't WARN() for impossible ring-buffer sizes [9dff0aa95a324e262ffb03f425d00e4751f3294e] Martin Kepplinger (1): mtd: rawnand: gpmi: fix MX28 bus master lockup problem [d5d27fd9826b59979b184ec288e4812abac0e988] Martin Schwidefsky (1): s390/mm: always force a load of the primary ASCE on context switch [a38662084c8bdb829ff486468c7ea801c13fcc34] Martin Sperl (1): dmaengine: bcm2835: add additional defines for DMA-registers [e42685d7a7d5afa6278561ffd85c475eae246be3] Matthias Schwarzott (1): media: em28xx: Fix use-after-free when disconnecting [910b0797fa9e8af09c44a3fa36cb310ba7a7218d] Matti Kurkela (2): Input: elantech - enable 3rd button support on Fujitsu CELSIUS H780 [e8b22d0a329f0fb5c7ef95406872d268f01ee3b1] Input: elantech - force needed quirks on Fujitsu H760 [f9a703a54d16ba2470391c4b12236ee56591d50c] Max Schulze (1): USB: serial: simple: add Motorola Tetra TPG2200 device id [b81c2c33eab79dfd3650293b2227ee5c6036585c] Michael Straube (1): staging: rtl8188eu: Add device code for D-Link DWA-121 rev B1 [5f74a8cbb38d10615ed46bc3e37d9a4c9af8045a] Miklos Szeredi (2): fuse: decrement NR_WRITEBACK_TEMP on the right page [a2ebba824106dabe79937a9f29a875f837e1b6d4] fuse: handle zero sized retrieve correctly [97e1532ef81acb31c30f9e75bf00306c33a77812] Naoya Horiguchi (1): mm: hwpoison: use do_send_sig_info() instead of force_sig() [6376360ecbe525a9c17b3d081dfd88ba3e4ed65b] Nathan Sullivan (1): net/phy: micrel: Add workaround for bad autoneg [d2fd719bcb0e83cb39cfee22ee800f98a56eceb3] Naveen N. Rao (1): powerpc/signal: Properly handle return value from uprobe_deny_signal() [46725b17f1c6c815a41429259b3f070c01e71bc1] Nicolas Pitre (2): vt: always call notifier with the console lock held [7e1d226345f89ad5d0216a9092c81386c89b4983] vt: invoke notifier on screen size change [0c9b1965faddad7534b6974b5b36c4ad37998f8e] Nikos Tsironis (1): dm thin: fix bug where bio that overwrites thin block ignores FUA [4ae280b4ee3463fa57bbe6eede26b97daff8a0f1] Oleg Nesterov (1): mm/mmap.c: expand_downwards: don't require the gap if !vm_prev [32e4e6d5cbb0c0e427391635991fe65e17797af8] Oliver Hartkopp (1): can: bcm: check timer values before ktime conversion [93171ba6f1deffd82f381d36cb13177872d023f6] Pablo Neira Ayuso (2): netfilter: nf_tables: fix flush after rule deletion in the same batch [23b7ca4f745f21c2b9cfcb67fdd33733b3ae7e66] netfilter: nft_compat: use-after-free when deleting targets [753c111f655e38bbd52fc01321266633f022ebe2] Paolo Abeni (1): vsock: cope with memory allocation failure at socket creation time [225d9464268599a5b4d094d02ec17808e44c7553] Paul Elder (1): usb: gadget: musb: fix short isoc packets with inventra dma [c418fd6c01fbc5516a2cd1eaf1df1ec86869028a] Paul Fulghum (1): tty/n_hdlc: fix __might_sleep warning [fc01d8c61ce02c034e67378cd3e645734bc18c8c] Paul Moore (1): netlabel: fix out-of-bounds memory accesses [5578de4834fe0f2a34fedc7374be691443396d1f] Pavel Shilovsky (3): CIFS: Do not consider -ENODATA as stat failure for reads [082aaa8700415f6471ec9c5ef0c8307ca214989a] CIFS: Do not count -ENODATA as failure for query directory [8e6e72aeceaaed5aeeb1cb43d3085de7ceb14f79] CIFS: Do not hide EINTR after sending network packets [ee13919c2e8d1f904e035ad4b4239029a8994131] Peng Hao (1): ARM: pxa: ssp: unneeded to free devm_ allocated data [ba16adeb346387eb2d1ada69003588be96f098fa] Peter Zijlstra (1): perf/core: Fix perf_event_open() vs. execve() race [79c9ce57eb2d5f1497546a3946b4ae21b6fdc438] Rajasingh Thavamani (1): net: phy: Micrel KSZ8061: link failure after cable connect [232ba3a51cc224b339c7114888ed7f0d4d95695e] Richard Weinberger (28): Clean up signal_delivered() [10b1c7ac8bfed429cf3dcb0225482c8dc1485d8e] Rip out get_signal_to_deliver() [828b1f65d23cf8a68795739f6dd08fc8abd9ee64] arc: Use get_signal() signal_setup_done() [f6dd2a3f1f8d8df640cfa2d60f85c0b818af1593] arm64: Use get_signal() signal_setup_done() [00554fa4f80279db92f82c4f52c8ae72711f173e] avr32: Use get_signal() signal_setup_done() [d809709a8845954a95c2ac86c13bd0dfd549c1ae] blackfin: Use get_signal() signal_setup_done() [1270cff147a39f7da5b25225dca6ca3132ca6130] c6x: Use get_signal() signal_setup_done() [e19c025bc9a184ed9c5daf06ffb89abc81d1696a] cris: Use get_signal() signal_setup_done() [fa0197722eb7559a6a9733881bbb8d9e76364f33] frv: Use get_signal() signal_setup_done() [720f36b983224ac52b6acdd8b646ce30f6b38763] hexagon: Use get_signal() signal_setup_done() [ac443624490f7033aefd06713e7761aee5977de3] ia64: Use get_signal() signal_setup_done() [98c20309b97fc30001adf643cf876125f334fd8a] m32r: Use get_signal() signal_setup_done() [0f5bef660a7c3b030eb60ceb29e3b2d89f894f56] m68k: Use get_signal() signal_setup_done() [0d97500d393012690f3579056629bea0369e6554] microblaze: Use get_signal() signal_setup_done() [9c53c7ec14a5738ae3117d7d71b7abf630526c9f] mips: Use get_signal() signal_setup_done() [81d103bf80678669c56658185e758fc3f9845d71] mips: Use sigsp() [7c4f563507c33ca97dcfbd62dba1e9232575d499] mn10300: Use get_signal() signal_setup_done() [8b166553a9aaf39774bc22f5e93c965584303929] parisc: Use get_signal() signal_setup_done() [e4dc894b61776733629b24507031dd46f5ba5efc] powerpc: Use get_signal() signal_setup_done() [129b69df9c9074750245fca8aa92df5cc1a86ef4] powerpc: Use sigsp() [059ade650ae57cfd371af690fdba887af04aded8] s390: Use get_signal() signal_setup_done() [067bf2d4d3a7aedc5982f6a58716054e5004b801] score: Use get_signal() signal_setup_done() [2bb12b773feb3e792145961e57ab356e6134d4a5] sh: Use get_signal() signal_setup_done() [b46e848768acc458ba94feef162b8901592dbb9c] tile: Use get_signal() signal_setup_done() [b3707c7ed013d36752272ca2f9ed20dc8aed92e4] tracehook_signal_handler: Remove sig, info, ka and regs [df5601f9c3d831b4c478b004a1ed90a18643adbe] um: Use get_signal() signal_setup_done() [307627eebbb0bc41b21e74d78b932362a6c1b38d] unicore32: Use get_signal() signal_setup_done() [649671c90eaf3cbbd0cd03460b6a92c0b674a32e] xtensa: Use get_signal() signal_setup_done() [5bdb7611eb7987102f3c0fef1220dd64b6fbd9fd] Ross Lagerwall (1): cifs: Fix potential OOB access of lock element array [b9a74cde94957d82003fb9f7ab4777938ca851cd] Rundong Ge (1): net: dsa: slave: Don't propagate flag changes on down slave interfaces [17ab4f61b8cd6f9c38e9d0b935d86d73b5d0d2b5] Russell King (1): ARM: iop32x/n2100: fix PCI IRQ mapping [db4090920ba2d61a5827a23e441447926a02ffee] Sakari Ailus (1): media: v4l: ioctl: Validate num_planes for debug messages [7fe9f01c04c2673bd6662c35b664f0f91888b96f] Samir Virmani (1): uart: Fix crash in uart_write and uart_put_char [aff9cf5955185d1f183227e46c5f8673fa483813] Sergei Shtylyov (1): mmc: tmio_mmc_core: don't claim spurious interrupts [5c27ff5db1491a947264d6d4e4cbe43ae6535bae] Sergei Trofimovich (1): alpha: fix page fault handling for r16-r18 targets [491af60ffb848b59e82f7c9145833222e0bf27a5] Shakeel Butt (1): mm, oom: fix use-after-free in oom_kill_process [cefc7ef3c87d02fc9307835868ff721ea12cc597] Sheng Lan (1): net: netem: fix skb length BUG_ON in __skb_to_sgvec [5845f706388a4cde0f6b80f9e5d33527e942b7d9] Shuah Khan (1): [media] media: em28xx-dvb - fix em28xx_dvb_resume() to not unregister i2c and dvb [6eb5e3399e8f45aa191ad21c0556bece8ea559f2] Shubhrajyoti Datta (1): i2c: cadence: Fix the hold bit setting [d358def706880defa4c9e87381c5bf086a97d5f9] Stefan Haberland (1): s390/dasd: fix using offset into zero size array error [4a8ef6999bce998fa5813023a9a6b56eea329dba] Suravee Suthikulpanit (1): iommu/amd: Fix IOMMU page flush when detach device from a domain [9825bd94e3a2baae1f4874767ae3a7d4c049720e] Sven Eckelmann (2): batman-adv: Avoid WARN on net_device without parent in netns [955d3411a17f590364238bd0d3329b61f20c1cd2] batman-adv: Force mac header to start of data on xmit [9114daa825fc3f335f9bea3313ce667090187280] Takashi Iwai (2): ALSA: usb-audio: Always check descriptor sizes in parser code [3e96d7280f16e2f787307f695a31296b9e4a1cd7] ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit() [f4351a199cc120ff9d59e06d02e8657d08e6cc46] Thomas Hellstrom (2): drm/vmwgfx: Fix setting of dma masks [4cbfa1e6c09e98450aab3240e5119b0ab2c9795b] drm/vmwgfx: Return error code from vmw_execbuf_copy_fence_user [728354c005c36eaf44b6e5552372b67e60d17f56] Thomas Richter (1): perf test: Fix failure of 'evsel-tp-sched' test on s390 [03d309711d687460d1345de8a0363f45b1c8cd11] Tina Zhang (1): drm/modes: Prevent division by zero htotal [a2fcd5c84f7a7825e028381b10182439067aa90d] Vineet Gupta (2): ARC: mm: do_page_fault fixes #1: relinquish mmap_sem if signal arrives while handle_mm_fault [4d447455e73b47c43dd35fcc38ed823d3182a474] ARC: show_regs: lockdep: avoid page allocator... [ab6c03676cb190156603cf4c5ecf97aa406c9c53] Vitaly Kuznetsov (1): x86/kvm/nVMX: read from MSR_IA32_VMX_PROCBASED_CTLS2 only when it is available [6b1971c694975e49af302229202c0043568b1791] Vlad Tsyrklevich (1): omap2fb: Fix stack memory disclosure [a01421e4484327fe44f8e126793ed5a48a221e24] Waiman Long (1): fs/dcache: Fix incorrect nr_dentry_unused accounting in shrink_dcache_sb() [1dbd449c9943e3145148cc893c2461b72ba6fef0] Willem de Bruijn (2): packet: validate address length [99137b7888f4058087895d035d81c6b2d31015c5] packet: validate address length if non-zero [6b8d95f1795c42161dc0984b6863e95d6acf24ed] Yi Zeng (1): i2c: dev: prevent adapter retries and timeout being set as minus value [6ebec961d59bccf65d08b13fc1ad4e6272a89338] YueHaibing (2): mdio_bus: Fix use-after-free on device_register fails [6ff7b060535e87c2ae14dd8548512abfdda528fb] net: nfc: Fix NULL dereference on nfc_llcp_build_tlv fails [58bdd544e2933a21a51eecf17c3f5f94038261b5] YunQiang Su (1): Disable MSI also when pcie-octeon.pcie_disable on [a214720cbf50cd8c3f76bbb9c3f5c283910e9d33] Yunjian Wang (1): net: bridge: Fix ethernet header pointer before check skb forwardable [28c1382fa28f2e2d9d0d6f25ae879b5af2ecbd03] Zach Brown (1): net/phy: micrel: configure intterupts after autoneg workaround [b866203d872d5deeafcecd25ea429d6748b5bd56] Zheng Yan (1): ceph: avoid repeatedly adding inode to mdsc->snap_flush_list [04242ff3ac0abbaa4362f97781dac268e6c3541a] Zhiqiang Liu (1): net: fix IPv6 prefix route residue [e75913c93f7cd5f338ab373c34c93a655bd309cb] Makefile | 4 +- arch/alpha/mm/fault.c | 2 +- arch/arc/kernel/head.S | 4 +- arch/arc/kernel/setup.c | 88 ++++++++++---- arch/arc/kernel/signal.c | 39 +++--- arch/arc/kernel/troubleshoot.c | 27 ++--- arch/arc/mm/fault.c | 13 +- arch/arm/boot/dts/kirkwood-dnskw.dtsi | 4 +- arch/arm/mach-iop32x/n2100.c | 3 +- arch/arm/plat-pxa/ssp.c | 3 - arch/arm64/include/asm/signal32.h | 11 +- arch/arm64/kernel/signal.c | 48 ++++---- arch/arm64/kernel/signal32.c | 14 +-- arch/avr32/kernel/signal.c | 43 +++---- arch/blackfin/kernel/signal.c | 39 +++--- arch/c6x/kernel/signal.c | 43 +++---- arch/cris/arch-v10/kernel/signal.c | 79 +++++------- arch/cris/arch-v32/kernel/signal.c | 77 +++++------- arch/frv/kernel/signal.c | 99 +++++++-------- arch/hexagon/kernel/signal.c | 45 +++---- arch/ia64/kernel/signal.c | 46 ++++--- arch/m32r/kernel/signal.c | 47 ++++---- arch/m68k/kernel/signal.c | 63 ++++------ arch/microblaze/kernel/signal.c | 48 +++----- arch/mips/include/asm/abi.h | 10 +- arch/mips/kernel/process.c | 7 +- arch/mips/kernel/signal-common.h | 2 +- arch/mips/kernel/signal.c | 72 +++++------ arch/mips/kernel/signal32.c | 39 +++--- arch/mips/kernel/signal_n32.c | 20 ++-- arch/mips/pci/msi-octeon.c | 4 +- arch/mips/pci/pci-octeon.c | 10 +- arch/mn10300/kernel/signal.c | 89 ++++++-------- arch/parisc/kernel/signal.c | 58 ++++----- arch/powerpc/kernel/signal.c | 41 ++----- arch/powerpc/kernel/signal.h | 14 +-- arch/powerpc/kernel/signal_32.c | 36 +++--- arch/powerpc/kernel/signal_64.c | 28 ++--- arch/s390/include/asm/mmu_context.h | 12 +- arch/s390/kernel/compat_signal.c | 79 ++++++------ arch/s390/kernel/early.c | 4 +- arch/s390/kernel/entry.h | 4 +- arch/s390/kernel/setup.c | 2 + arch/s390/kernel/signal.c | 78 +++++------- arch/s390/kernel/smp.c | 4 + arch/score/kernel/signal.c | 43 +++---- arch/sh/kernel/signal_32.c | 79 +++++------- arch/sh/kernel/signal_64.c | 82 +++++-------- arch/tile/include/asm/compat.h | 3 +- arch/tile/kernel/compat_signal.c | 29 ++--- arch/tile/kernel/signal.c | 54 ++++----- arch/um/include/shared/frame_kern.h | 12 +- arch/um/kernel/signal.c | 27 ++--- arch/unicore32/kernel/signal.c | 51 ++++---- arch/x86/boot/compressed/aslr.c | 4 +- arch/x86/ia32/ia32_aout.c | 6 +- arch/x86/include/asm/uaccess.h | 7 +- arch/x86/kernel/cpu/perf_event.c | 9 ++ arch/x86/kernel/cpu/perf_event.h | 21 ++++ arch/x86/kernel/cpu/perf_event_intel.c | 9 ++ arch/x86/kernel/cpu/perf_event_intel_uncore.c | 4 +- arch/x86/kvm/vmx.c | 7 +- arch/x86/kvm/x86.c | 3 +- arch/x86/um/signal.c | 45 ++++--- arch/xtensa/kernel/signal.c | 43 +++---- crypto/authenc.c | 14 ++- drivers/acpi/power.c | 22 ++++ drivers/ata/libata-core.c | 1 + drivers/block/rbd.c | 9 +- drivers/char/Kconfig | 2 +- drivers/char/ipmi/ipmi_msghandler.c | 6 + drivers/char/mwave/mwavedd.c | 7 ++ drivers/dma/bcm2835-dma.c | 124 +++++++++++-------- drivers/dma/dmatest.c | 30 ++--- drivers/dma/imx-dma.c | 8 +- drivers/gpu/drm/drm_fb_helper.c | 133 ++++++++++++--------- drivers/gpu/drm/drm_modes.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 9 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +- drivers/hv/hyperv_vmbus.h | 5 +- drivers/hv/ring_buffer.c | 31 +++-- drivers/hv/vmbus_drv.c | 91 +++++++++----- drivers/i2c/busses/i2c-cadence.c | 9 +- drivers/i2c/i2c-dev.c | 6 + drivers/infiniband/ulp/ipoib/ipoib.h | 1 - drivers/infiniband/ulp/ipoib/ipoib_cm.c | 3 +- drivers/input/misc/bma150.c | 9 +- drivers/input/mouse/elantech.c | 23 ++++ drivers/iommu/amd_iommu.c | 15 ++- drivers/md/dm-thin.c | 55 ++++++++- drivers/media/usb/em28xx/em28xx-dvb.c | 20 +--- drivers/media/v4l2-core/v4l2-ioctl.c | 4 +- drivers/mfd/ab8500-core.c | 2 +- drivers/mfd/tps6586x.c | 24 ++++ drivers/mmc/host/mmc_spi.c | 1 + drivers/mmc/host/tmio_mmc_pio.c | 8 +- drivers/mtd/nand/gpmi-nand/gpmi-lib.c | 13 +- drivers/net/can/dev.c | 27 ++--- drivers/net/ethernet/marvell/skge.c | 6 +- drivers/net/ethernet/mellanox/mlx4/fw.c | 68 +++++++---- .../net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 22 ++-- drivers/net/phy/mdio_bus.c | 1 - drivers/net/phy/micrel.c | 41 ++++++- drivers/net/team/team.c | 27 +---- drivers/net/vxlan.c | 13 +- drivers/net/wireless/brcm80211/brcmfmac/bcdc.c | 29 ++--- drivers/net/wireless/brcm80211/brcmfmac/dhd.h | 2 +- drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h | 4 +- .../net/wireless/brcm80211/brcmfmac/dhd_linux.c | 76 +++++++++--- drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c | 32 +++-- drivers/net/wireless/brcm80211/brcmfmac/fweh.h | 16 ++- drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c | 11 +- drivers/net/wireless/brcm80211/brcmfmac/proto.h | 18 ++- drivers/net/wireless/brcm80211/brcmfmac/usb.c | 2 +- .../net/wireless/brcm80211/brcmfmac/wl_cfg80211.c | 2 + drivers/s390/block/dasd_eckd.c | 8 ++ drivers/s390/char/sclp_config.c | 2 + drivers/s390/net/qeth_core.h | 3 +- drivers/s390/net/qeth_core_main.c | 35 ++++-- drivers/s390/net/qeth_l2_main.c | 7 +- drivers/s390/net/qeth_l3_main.c | 3 + drivers/scsi/bnx2fc/bnx2fc_io.c | 4 +- drivers/scsi/isci/init.c | 14 +-- drivers/scsi/libsas/sas_expander.c | 2 + drivers/scsi/sd.c | 7 ++ drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 + drivers/tty/n_hdlc.c | 1 + drivers/tty/serial/serial_core.c | 12 +- drivers/tty/tty_io.c | 3 +- drivers/tty/vt/vt.c | 3 +- drivers/usb/class/cdc-acm.c | 7 ++ drivers/usb/core/quirks.c | 3 +- drivers/usb/gadget/net2272.c | 2 +- drivers/usb/musb/musb_gadget.c | 13 +- drivers/usb/musb/musbhsdma.c | 21 ++-- drivers/usb/phy/phy-am335x.c | 5 +- drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 2 + drivers/usb/serial/usb-serial-simple.c | 3 +- drivers/usb/storage/scsiglue.c | 8 +- drivers/usb/storage/unusual_devs.h | 12 ++ drivers/vfio/vfio_iommu_type1.c | 15 +++ drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c | 2 + fs/binfmt_elf.c | 3 +- fs/ceph/snap.c | 3 +- fs/cifs/file.c | 8 +- fs/cifs/smb2file.c | 4 +- fs/cifs/smb2pdu.c | 6 +- fs/cifs/transport.c | 2 +- fs/dcache.c | 6 +- fs/debugfs/inode.c | 7 ++ fs/fuse/dev.c | 4 +- fs/fuse/file.c | 2 +- fs/proc/task_mmu.c | 22 +++- include/keys/user-type.h | 2 +- include/linux/perf_event.h | 5 + include/linux/sched.h | 21 ++++ include/linux/signal.h | 15 +-- include/linux/tracehook.h | 8 +- include/sound/compress_driver.h | 6 +- ipc/shm.c | 4 +- kernel/events/core.c | 70 ++++++++--- kernel/events/ring_buffer.c | 3 + kernel/signal.c | 105 ++++++++++++---- lib/assoc_array.c | 8 +- mm/memory-failure.c | 3 +- mm/migrate.c | 8 +- mm/mmap.c | 24 ++-- mm/oom_kill.c | 8 ++ mm/shmem.c | 12 +- net/batman-adv/hard-interface.c | 4 +- net/batman-adv/soft-interface.c | 4 + net/bluetooth/l2cap_core.c | 83 ++++++++----- net/bridge/br_forward.c | 26 ++-- net/can/bcm.c | 27 +++++ net/dsa/slave.c | 13 +- net/ipv4/cipso_ipv4.c | 6 +- net/ipv6/addrconf.c | 3 +- net/ipv6/sit.c | 3 +- net/l2tp/l2tp_core.c | 5 +- net/mac80211/tx.c | 9 +- net/netfilter/nf_tables_api.c | 3 + net/netfilter/nft_compat.c | 120 +++++++++++-------- net/nfc/llcp_commands.c | 20 ++++ net/nfc/llcp_core.c | 24 +++- net/packet/af_packet.c | 12 +- net/sched/sch_netem.c | 10 +- net/vmw_vsock/vmci_transport.c | 4 + net/x25/af_x25.c | 13 +- scripts/kallsyms.c | 4 +- security/apparmor/apparmorfs.c | 1 + security/keys/key.c | 4 +- security/keys/keyring.c | 4 +- security/keys/proc.c | 11 +- security/keys/request_key.c | 1 + security/keys/request_key_auth.c | 2 +- security/yama/yama_lsm.c | 4 +- sound/pci/cs46xx/dsp_spos.c | 3 + sound/soc/codecs/tlv320aic32x4.c | 4 + sound/soc/intel/sst-mfld-platform-pcm.c | 8 +- sound/usb/card.c | 5 + sound/usb/mixer.c | 10 +- sound/usb/pcm.c | 9 +- sound/usb/quirks-table.h | 6 + sound/usb/stream.c | 31 +++-- tools/perf/tests/evsel-tp-sched.c | 8 +- 206 files changed, 2364 insertions(+), 1834 deletions(-) -- Ben Hutchings Teamwork is essential - it allows you to blame someone else.

5 years, 5 months

2
204
0 0

[PATCH V8 3/7] blk-mq: free hw queue's resource in hctx's release handler

by Ming Lei

Once blk_cleanup_queue() returns, tags shouldn't be used any more, because blk_mq_free_tag_set() may be called. Commit 45a9c9d909b2 ("blk-mq: Fix a use-after-free") fixes this issue exactly. However, that commit introduces another issue. Before 45a9c9d909b2, we are allowed to run queue during cleaning up queue if the queue's kobj refcount is held. After that commit, queue can't be run during queue cleaning up, otherwise oops can be triggered easily because some fields of hctx are freed by blk_mq_free_queue() in blk_cleanup_queue(). We have invented ways for addressing this kind of issue before, such as: 8dc765d438f1 ("SCSI: fix queue cleanup race before queue initialization is done") c2856ae2f315 ("blk-mq: quiesce queue before freeing queue") But still can't cover all cases, recently James reports another such kind of issue: https://marc.info/?l=linux-scsi&m=155389088124782&w=2 This issue can be quite hard to address by previous way, given scsi_run_queue() may run requeues for other LUNs. Fixes the above issue by freeing hctx's resources in its release handler, and this way is safe becasue tags isn't needed for freeing such hctx resource. This approach follows typical design pattern wrt. kobject's release handler. Cc: Dongli Zhang <dongli.zhang(a)oracle.com> Cc: James Smart <james.smart(a)broadcom.com> Cc: Bart Van Assche <bart.vanassche(a)wdc.com> Cc: linux-scsi(a)vger.kernel.org, Cc: Martin K . Petersen <martin.petersen(a)oracle.com>, Cc: Christoph Hellwig <hch(a)lst.de>, Cc: James E . J . Bottomley <jejb(a)linux.vnet.ibm.com>, Reported-by: James Smart <james.smart(a)broadcom.com> Fixes: 45a9c9d909b2 ("blk-mq: Fix a use-after-free") Cc: stable(a)vger.kernel.org Reviewed-by: Hannes Reinecke <hare(a)suse.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Tested-by: James Smart <james.smart(a)broadcom.com> Signed-off-by: Ming Lei <ming.lei(a)redhat.com> --- block/blk-core.c | 2 +- block/blk-mq-sysfs.c | 6 ++++++ block/blk-mq.c | 8 ++------ block/blk-mq.h | 2 +- 4 files changed, 10 insertions(+), 8 deletions(-) diff --git a/block/blk-core.c b/block/blk-core.c index 93dc588fabe2..2dd94b3e9ece 100644 --- a/block/blk-core.c +++ b/block/blk-core.c @@ -374,7 +374,7 @@ void blk_cleanup_queue(struct request_queue *q) blk_exit_queue(q); if (queue_is_mq(q)) - blk_mq_free_queue(q); + blk_mq_exit_queue(q); percpu_ref_exit(&q->q_usage_counter); diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c index 3f9c3f4ac44c..4040e62c3737 100644 --- a/block/blk-mq-sysfs.c +++ b/block/blk-mq-sysfs.c @@ -10,6 +10,7 @@ #include <linux/smp.h> #include <linux/blk-mq.h> +#include "blk.h" #include "blk-mq.h" #include "blk-mq-tag.h" @@ -33,6 +34,11 @@ static void blk_mq_hw_sysfs_release(struct kobject *kobj) { struct blk_mq_hw_ctx *hctx = container_of(kobj, struct blk_mq_hw_ctx, kobj); + + if (hctx->flags & BLK_MQ_F_BLOCKING) + cleanup_srcu_struct(hctx->srcu); + blk_free_flush_queue(hctx->fq); + sbitmap_free(&hctx->ctx_map); free_cpumask_var(hctx->cpumask); kfree(hctx->ctxs); kfree(hctx); diff --git a/block/blk-mq.c b/block/blk-mq.c index 89781309a108..d98cb9614dfa 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -2267,12 +2267,7 @@ static void blk_mq_exit_hctx(struct request_queue *q, if (set->ops->exit_hctx) set->ops->exit_hctx(hctx, hctx_idx); - if (hctx->flags & BLK_MQ_F_BLOCKING) - cleanup_srcu_struct(hctx->srcu); - blk_mq_remove_cpuhp(hctx); - blk_free_flush_queue(hctx->fq); - sbitmap_free(&hctx->ctx_map); } static void blk_mq_exit_hw_queues(struct request_queue *q, @@ -2907,7 +2902,8 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set, } EXPORT_SYMBOL(blk_mq_init_allocated_queue); -void blk_mq_free_queue(struct request_queue *q) +/* tags can _not_ be used after returning from blk_mq_exit_queue */ +void blk_mq_exit_queue(struct request_queue *q) { struct blk_mq_tag_set *set = q->tag_set; diff --git a/block/blk-mq.h b/block/blk-mq.h index 423ea88ab6fb..633a5a77ee8b 100644 --- a/block/blk-mq.h +++ b/block/blk-mq.h @@ -37,7 +37,7 @@ struct blk_mq_ctx { struct kobject kobj; } ____cacheline_aligned_in_smp; -void blk_mq_free_queue(struct request_queue *q); +void blk_mq_exit_queue(struct request_queue *q); int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr); void blk_mq_wake_waiters(struct request_queue *q); bool blk_mq_dispatch_rq_list(struct request_queue *, struct list_head *, bool); -- 2.9.5

5 years, 5 months

1
0
0 0

[PATCH AUTOSEL 5.0 01/79] ASoC: tlv320aic3x: fix reset gpio reference counting

by Sasha Levin

From: Philipp Puschmann <philipp.puschmann(a)emlix.com> [ Upstream commit 82ad759143ed77673db0d93d53c1cde7b99917ee ] This patch fixes a bug that prevents freeing the reset gpio on unloading the module. aic3x_i2c_probe is called when loading the module and it calls list_add with a probably uninitialized list entry aic3x->list (next = prev = NULL)). So even if list_del is called it does nothing and in the end the gpio_reset is not freed. Then a repeated module probing fails silently because gpio_request fails. When moving INIT_LIST_HEAD to aic3x_i2c_probe we also have to move list_del to aic3x_i2c_remove because aic3x_remove may be called multiple times without aic3x_i2c_remove being called which leads to a NULL pointer dereference. Signed-off-by: Philipp Puschmann <philipp.puschmann(a)emlix.com> Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- sound/soc/codecs/tlv320aic3x.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c index 6aa0edf8c5ef..cea3ebecdb12 100644 --- a/sound/soc/codecs/tlv320aic3x.c +++ b/sound/soc/codecs/tlv320aic3x.c @@ -1609,7 +1609,6 @@ static int aic3x_probe(struct snd_soc_component *component) struct aic3x_priv *aic3x = snd_soc_component_get_drvdata(component); int ret, i; - INIT_LIST_HEAD(&aic3x->list); aic3x->component = component; for (i = 0; i < ARRAY_SIZE(aic3x->supplies); i++) { @@ -1692,7 +1691,6 @@ static void aic3x_remove(struct snd_soc_component *component) struct aic3x_priv *aic3x = snd_soc_component_get_drvdata(component); int i; - list_del(&aic3x->list); for (i = 0; i < ARRAY_SIZE(aic3x->supplies); i++) regulator_unregister_notifier(aic3x->supplies[i].consumer, &aic3x->disable_nb[i].nb); @@ -1890,6 +1888,7 @@ static int aic3x_i2c_probe(struct i2c_client *i2c, if (ret != 0) goto err_gpio; + INIT_LIST_HEAD(&aic3x->list); list_add(&aic3x->list, &reset_list); return 0; @@ -1906,6 +1905,8 @@ static int aic3x_i2c_remove(struct i2c_client *client) { struct aic3x_priv *aic3x = i2c_get_clientdata(client); + list_del(&aic3x->list); + if (gpio_is_valid(aic3x->gpio_reset) && !aic3x_is_shared_reset(aic3x)) { gpio_set_value(aic3x->gpio_reset, 0); -- 2.19.1

5 years, 5 months

3
82
0 0

[PATCH 4.14 stable 0/5] net: ip6 defrag: backport fixes

by Peter Oskolkov

This is a backport of a 5.1rc patchset: https://patchwork.ozlabs.org/cover/1029418/ Which was backported into 4.19: https://patchwork.ozlabs.org/cover/1081619/ I had to backport two additional patches into 4.14 to make it work. John Masinter (captwiggum), could you, please, confirm that this patchset fixes TAHI tests? (I'm reasonably certain that it does, as I ran ip_defrag selftest, but given the amount of changes here, another set of completed tests would be nice to have). Eric Dumazet (1): ipv6: frags: fix a lockdep false positive Florian Westphal (1): ipv6: remove dependency of nf_defrag_ipv6 on ipv6 module Peter Oskolkov (3): net: IP defrag: encapsulate rbtree defrag code into callable functions net: IP6 defrag: use rbtrees for IPv6 defrag net: IP6 defrag: use rbtrees in nf_conntrack_reasm.c include/net/inet_frag.h | 16 +- include/net/ipv6.h | 29 -- include/net/ipv6_frag.h | 111 +++++++ net/ieee802154/6lowpan/reassembly.c | 2 +- net/ipv4/inet_fragment.c | 293 ++++++++++++++++++ net/ipv4/ip_fragment.c | 290 ++---------------- net/ipv6/netfilter/nf_conntrack_reasm.c | 279 +++++------------ net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 3 +- net/ipv6/reassembly.c | 357 +++++----------------- net/openvswitch/conntrack.c | 1 + 10 files changed, 616 insertions(+), 765 deletions(-) create mode 100644 include/net/ipv6_frag.h -- 2.21.0.593.g511ec345e18-goog

5 years, 5 months

4
8
0 0

Linux 5.0.10

by Greg KH

I'm announcing the release of the 5.0.10 kernel. All users of the 5.0 kernel series must upgrade. The updated 5.0.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.0.y and can be browsed at the normal kernel.org git web browser: http://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 5 arch/arm64/include/asm/futex.h | 2 arch/s390/boot/mem_detect.c | 2 arch/x86/crypto/poly1305-avx2-x86_64.S | 14 + arch/x86/crypto/poly1305-sse2-x86_64.S | 22 +- arch/x86/events/amd/core.c | 35 +++- arch/x86/events/intel/core.c | 2 arch/x86/events/perf_event.h | 38 ++-- arch/x86/kernel/cpu/bugs.c | 6 arch/x86/kernel/kprobes/core.c | 48 ++++++ arch/x86/kernel/process.c | 8 - arch/x86/kvm/emulate.c | 21 +- arch/x86/kvm/svm.c | 24 ++- arch/x86/kvm/vmx/vmx.c | 4 arch/x86/kvm/x86.c | 10 - arch/x86/kvm/x86.h | 2 crypto/testmgr.h | 44 +++++ drivers/acpi/nfit/core.c | 63 +++++--- drivers/acpi/nfit/nfit.h | 11 + drivers/base/memory.c | 2 drivers/char/ipmi/ipmi_msghandler.c | 19 ++ drivers/char/tpm/eventlog/tpm2.c | 4 drivers/char/tpm/tpm-dev-common.c | 9 + drivers/char/tpm/tpm_i2c_atmel.c | 4 drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c | 1 drivers/gpu/drm/ttm/ttm_page_alloc.c | 5 drivers/i3c/master.c | 5 drivers/i3c/master/dw-i3c-master.c | 2 drivers/iio/accel/kxcjk-1013.c | 2 drivers/iio/adc/ad_sigma_delta.c | 1 drivers/iio/adc/at91_adc.c | 28 ++- drivers/iio/chemical/bme680.h | 6 drivers/iio/chemical/bme680_core.c | 54 +++++-- drivers/iio/chemical/bme680_i2c.c | 21 -- drivers/iio/chemical/bme680_spi.c | 115 ++++++++++----- drivers/iio/common/cros_ec_sensors/cros_ec_sensors.c | 7 drivers/iio/dac/mcp4725.c | 1 drivers/iio/gyro/bmg160_core.c | 6 drivers/iio/gyro/mpu3050-core.c | 8 - drivers/iio/industrialio-buffer.c | 5 drivers/iio/industrialio-core.c | 4 drivers/infiniband/core/uverbs_main.c | 3 drivers/input/mouse/elan_i2c_core.c | 25 +++ drivers/net/bonding/bond_main.c | 6 drivers/net/ethernet/cavium/thunder/nicvf_main.c | 22 ++ drivers/net/ethernet/freescale/fec_main.c | 30 ++- drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 4 drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 3 drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 8 - drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 94 +++++++++--- drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 6 drivers/net/ethernet/mellanox/mlx5/core/en_stats.h | 4 drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c | 61 +++---- drivers/net/ethernet/mellanox/mlxsw/core.c | 6 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 2 drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 2 drivers/net/ethernet/netronome/nfp/flower/action.c | 3 drivers/net/ethernet/netronome/nfp/flower/cmsg.h | 3 drivers/net/ethernet/netronome/nfp/flower/match.c | 14 - drivers/net/team/team.c | 26 +++ drivers/net/wireless/mediatek/mt76/mt76x02_mac.c | 14 + drivers/net/wireless/ralink/rt2x00/rt2x00.h | 1 drivers/net/wireless/ralink/rt2x00/rt2x00mac.c | 10 - drivers/net/wireless/ralink/rt2x00/rt2x00queue.c | 15 + drivers/scsi/libfc/fc_rport.c | 1 drivers/scsi/scsi_lib.c | 6 drivers/staging/comedi/drivers/ni_usb6501.c | 10 - drivers/staging/comedi/drivers/vmk80xx.c | 8 - drivers/staging/iio/adc/ad7192.c | 8 - drivers/staging/iio/meter/ade7854.c | 2 drivers/staging/most/core.c | 2 drivers/tty/serial/sh-sci.c | 6 drivers/tty/vt/vt.c | 3 drivers/vhost/vhost.c | 6 fs/cifs/cifsglob.h | 2 fs/cifs/file.c | 30 +++ fs/cifs/misc.c | 25 +++ fs/cifs/smb2misc.c | 6 fs/cifs/smb2ops.c | 2 fs/cifs/smb2pdu.c | 11 - fs/dax.c | 15 + fs/proc/task_mmu.c | 18 ++ fs/userfaultfd.c | 9 + include/linux/kprobes.h | 1 include/linux/netdevice.h | 3 include/linux/sched/mm.h | 21 ++ include/net/nfc/nci_core.h | 2 include/net/tls.h | 4 kernel/events/ring_buffer.c | 33 +--- kernel/kprobes.c | 6 kernel/sched/fair.c | 25 +++ kernel/sysctl.c | 3 kernel/time/sched_clock.c | 4 kernel/time/tick-common.c | 2 kernel/time/timekeeping.h | 7 kernel/trace/ftrace.c | 6 mm/mmap.c | 7 mm/percpu.c | 8 - mm/vmstat.c | 5 net/atm/lec.c | 6 net/bridge/br_input.c | 23 +-- net/bridge/br_multicast.c | 4 net/bridge/br_netlink.c | 2 net/core/dev.c | 16 +- net/core/failover.c | 6 net/core/skbuff.c | 10 + net/ipv4/fou.c | 4 net/ipv4/route.c | 16 +- net/ipv4/tcp_input.c | 10 - net/ipv6/route.c | 4 net/mac80211/driver-ops.h | 3 net/nfc/nci/hci.c | 8 + net/sched/sch_cake.c | 57 +++---- net/strparser/strparser.c | 12 - net/tipc/name_table.c | 3 net/tls/tls_device.c | 12 + net/tls/tls_main.c | 24 +++ net/tls/tls_sw.c | 15 - security/device_cgroup.c | 2 sound/core/info.c | 12 + sound/core/init.c | 18 +- sound/pci/hda/patch_realtek.c | 6 122 files changed, 1135 insertions(+), 477 deletions(-) Alex Deucher (1): drm/amdgpu/gmc9: fix VM_L2_CNTL3 programming Alexander Shishkin (1): perf/ring_buffer: Fix AUX record suppression Andi Kleen (1): x86/cpu/bugs: Use __initconst for 'const' init data Andrea Arcangeli (1): coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping Andy Duan (1): net: fec: manage ahb clock in runtime pm Aneesh Kumar K.V (1): fs/dax: Deposit pagetable even when installing zero page Aurelien Aptel (1): CIFS: keep FileInfo handle live during oplock break Chang-An Chen (1): timers/sched_clock: Prevent generic sched_clock wrap caused by tick_freeze() Christian Gromm (1): staging: most: core: use device description as name Christian König (1): drm/ttm: fix out-of-bounds read in ttm_put_pages() v2 Corey Minyard (1): ipmi: fix sleep-in-atomic in free_user at cleanup SRCU user->release_barrier Dan Carpenter (2): NFC: nci: Add some bounds checking in nci_hci_cmd_received() nfc: nci: Potential off by one in ->pipes[] array Dan Williams (4): nfit/ars: Remove ars_start_flags nfit/ars: Introduce scrub_flags nfit/ars: Allow root to busy-poll the ARS state machine nfit/ars: Avoid stale ARS results Dmytro Linkin (1): net/mlx5e: Protect against non-uplink representor for encap Dragos Bogdan (1): iio: ad_sigma_delta: select channel when reading register Eric Biggers (1): crypto: x86/poly1305 - fix overflow during partial reduction Eric Dumazet (2): tcp: tcp_grow_window() needs to respect tcp_space() ipv4: ensure rcu_read_lock() in ipv4_link_failure() Fabrice Gasnier (1): iio: core: fix a possible circular locking dependency Felix Fietkau (1): mac80211: do not call driver wake_tx_queue op during reconfig Geert Uytterhoeven (2): serial: sh-sci: Fix HSCIF RX sampling point adjustment serial: sh-sci: Fix HSCIF RX sampling point calculation Georg Ottinger (1): iio: adc: at91: disable adc channel interrupt in timeout case Greg Kroah-Hartman (1): Linux 5.0.10 Gustavo A. R. Silva (1): net: atm: Fix potential Spectre v1 vulnerabilities Gwendal Grignou (1): iio: cros_ec: Fix the maths for gyro scale calculation Hangbin Liu (1): team: set slave to promisc if team is already in promisc mode Hoang Le (1): tipc: missing entries in name table of publications Hui Wang (1): ALSA: hda/realtek - add two more pin configuration sets to quirk table Ian Abbott (4): staging: comedi: vmk80xx: Fix use of uninitialized semaphore staging: comedi: vmk80xx: Fix possible double-free of ->usb_rx_buf staging: comedi: ni_usb6501: Fix use of uninitialized mutex staging: comedi: ni_usb6501: Fix possible double-free of ->usb_rx_buf Ido Schimmel (5): mlxsw: spectrum_switchdev: Add MDB entries in prepare phase mlxsw: core: Do not use WQ_MEM_RECLAIM for EMAD workqueue mlxsw: core: Do not use WQ_MEM_RECLAIM for mlxsw ordered workqueue mlxsw: core: Do not use WQ_MEM_RECLAIM for mlxsw workqueue mlxsw: spectrum_router: Do not check VRF MAC address Jaesoo Lee (1): scsi: core: set result when the command cannot be dispatched Jakub Kicinski (5): net/tls: fix the IV leaks net/tls: don't leak partially sent record in device mode net: strparser: partially revert "strparser: Call skb_unclone conditionally" net/tls: fix build without CONFIG_TLS_DEVICE net/tls: prevent bad memory access in tls_is_sk_tx_device_offloaded() Jann Horn (1): device_cgroup: fix RCU imbalance in error case Jarkko Sakkinen (1): tpm/tpm_i2c_atmel: Return -E2BIG when the transfer is incomplete Jason Wang (1): vhost: reject zero size iova range Jean-Francois Dagenais (1): iio: dac: mcp4725: add missing powerdown bits in store eeprom Joe Perches (1): s390/mem_detect: Use IS_ENABLED(CONFIG_BLK_DEV_INITRD) Jonathan Lemon (1): route: Avoid crash from dereferencing NULL rt->from KT Liao (1): Input: elan_i2c - add hardware ID for multiple Lenovo laptops Kan Liang (1): perf/x86: Fix incorrect PEBS_REGS Kim Phillips (1): perf/x86/amd: Add event map for AMD Family 17h Konstantin Khlebnikov (2): net/mlx5e: Switch to Toeplitz RSS hash by default mm/vmstat.c: fix /proc/vmstat format for CONFIG_DEBUG_TLBFLUSH=y CONFIG_SMP=n Lars-Peter Clausen (1): iio: Fix scan mask selection Leonard Pollak (1): Staging: iio: meter: fixed typo Lorenzo Bianconi (1): net: fou: do not use guehdr after iptunnel_pull_offloads in gue_udp_recv Masami Hiramatsu (4): x86/kprobes: Verify stack frame on kretprobe kprobes: Mark ftrace mcount handler functions nokprobe x86/kprobes: Avoid kretprobe recursion bug kprobes: Fix error check when reusing optimized probes Matteo Croce (3): net: thunderx: raise XDP MTU to 1508 net: thunderx: don't allow jumbo frames with XDP percpu: stop printing kernel addresses Matthias Kaehlcke (1): Revert "kbuild: use -Oz instead of -Os when using clang" Mike Looijmans (3): iio/gyro/bmg160: Use millidegrees for temperature scale iio:chemical:bme680: Fix, report temperature in millidegrees iio:chemical:bme680: Fix SPI read interface Mikulas Patocka (1): vt: fix cursor when clearing the screen Mircea Caprioru (1): staging: iio: ad7192: Fix ad7193 channel address Nathan Chancellor (1): arm64: futex: Restore oldval initialization to work around buggy compilers Nikolay Aleksandrov (3): net: bridge: fix per-port af_packet sockets net: bridge: multicast: use rcu to access port list from br_multicast_start_querier net: bridge: fix netlink export of vlan_stats_per_port option Or Gerlitz (1): Revert "net/mlx5e: Enable reporting checksum unnecessary also for L3 packets" Phil Auld (1): sched/fair: Limit sched_cfs_period_timer() loop to avoid hard lockup Pieter Jansen van Vuuren (2): nfp: flower: replace CFI with vlan present nfp: flower: remove vlan CFI bit from push vlan action Ronnie Sahlberg (1): cifs: fix handle leak in smb2_query_symlink() Sabrina Dubroca (1): bonding: fix event handling for stacked bonds Saeed Mahameed (5): net/mlx5e: XDP, Avoid checksum complete when XDP prog is loaded net/mlx5e: Rx, Fixup skb checksum for packets with tail padding net/mlx5e: Rx, Check ip headers sanity net/mlx5: FPGA, tls, hold rcu read lock a bit longer net/mlx5: FPGA, tls, idr remove on flow delete Saurav Kashyap (1): Revert "scsi: fcoe: clear FC_RP_STARTED flags when receiving a LOGO" Sean Christopherson (1): KVM: x86: Don't clear EFER during SMM transitions for 32-bit vCPU Sergey Larin (1): iio: gyro: mpu3050: fix chip ID reading Si-Wei Liu (1): failover: allow name change on IFF_UP slave interfaces Stanislaw Gruszka (1): mt76x02: avoid status_list.lock and sta->rate_ctrl_lock dependency Stephen Suryaputra (1): ipv4: recompile ip options in ipv4_link_failure Suthikulpanit, Suravee (1): Revert "svm: Fix AVIC incomplete IPI emulation" Tadeusz Struk (1): tpm: fix an invalid condition in tpm_common_poll Takashi Iwai (2): ALSA: core: Fix card races between register and disconnect ALSA: info: Fix racy addition/deletion of nodes Thomas Gleixner (1): x86/speculation: Prevent deadlock on ssb_state::lock Toke Høiland-Jørgensen (3): sch_cake: Use tc_skb_protocol() helper for getting packet protocol sch_cake: Make sure we can write the IP header before changing DSCP bits sch_cake: Simplify logic in cake_select_tin() Vijayakumar Durai (1): rt2x00: do not increment sequence number while re-transmitting Vitaly Kuznetsov (1): KVM: x86: svm: make sure NMI is injected after nmi_singlestep Vitor Soares (2): i3c: dw: Fix dw_i3c_master_disable controller by using correct mask i3c: Fix the verification of random PID WANG Chao (1): x86/kvm: move kvm_load/put_guest_xcr0 into atomic context Will Deacon (1): kernel/sysctl.c: fix out-of-bounds access when setting file-max Yue Haibing (1): tpm: Fix the type of the return value in calc_tpm2_event_size() Yuya Kusakabe (1): net: Fix missing meta data in skb with vlan packet ZhangXiaoxu (3): cifs: Fix lease buffer length error cifs: Fix use-after-free in SMB2_write cifs: Fix use-after-free in SMB2_read he, bo (1): io: accel: kxcjk1013: restore the range after resume. zhong jiang (1): mm/memory_hotplug: do not unlock after failing to take the device_hotplug_lock

5 years, 5 months

2
2
0 0

Re: [PATCH] power: supply: axp288_fuel_gauge: Add ACEPC T8 and T11 mini PCs to the blacklist

by Hans de Goede

Hi, On 23-04-19 00:29, Sasha Levin wrote: > Hi, > > [This is an automated email] > > This commit has been processed because it contains a -stable tag. > The stable tag indicates that it's relevant for the following trees: all > > The bot has tested the following trees: v5.0.9, v4.19.36, v4.14.113, v4.9.170, v4.4.178, v3.18.138. > > v5.0.9: Build OK! > v4.19.36: Build OK! > v4.14.113: Failed to apply! Possible dependencies: > b60c75b6a502 ("power: supply: axp288_fuel_gauge: Do not register our psy on (some) HDMI sticks") > > v4.9.170: Failed to apply! Possible dependencies: > b60c75b6a502 ("power: supply: axp288_fuel_gauge: Do not register our psy on (some) HDMI sticks") > > v4.4.178: Failed to apply! Possible dependencies: > b60c75b6a502 ("power: supply: axp288_fuel_gauge: Do not register our psy on (some) HDMI sticks") > > v3.18.138: Failed to apply! Possible dependencies: > 5a5bf49088f4 ("X-Power AXP288 PMIC Fuel Gauge Driver") > b60c75b6a502 ("power: supply: axp288_fuel_gauge: Do not register our psy on (some) HDMI sticks") > c1a281e34dae ("power: Add support for DA9150 Charger") > > > How should we proceed with this patch? Just applying it to 4.19.x and 5.0.x is fine. Regards, Hans

5 years, 5 months

1
0
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror April 2019