From: Alexander Sverdlin <alexander.sverdlin(a)nokia.com>
irq_create_fwspec_mapping() can race with itself during IRQ trigger type
configuration. Possible scenarios include:
- Mapping exists, two irq_create_fwspec_mapping() running in parallel do
not detect type mismatch, IRQ remains configured with one of the
different trigger types randomly
- Second call to irq_create_fwspec_mapping() sees existing mapping just
created by first call, but earlier irqd_set_trigger_type() call races
with later irqd_set_trigger_type() => totally undetected, IRQ type
is being set randomly to either one or another type
Introduce helper function to detect parallel changes to IRQ type.
Cc: stable(a)vger.kernel.org
Signed-off-by: Alexander Sverdlin <alexander.sverdlin(a)nokia.com>
---
kernel/irq/irqdomain.c | 66 +++++++++++++++++++++++++++++---------------------
1 file changed, 38 insertions(+), 28 deletions(-)
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index 176f2cc..af4d30c 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -764,10 +764,45 @@ static void of_phandle_args_to_fwspec(struct device_node *np, const u32 *args,
fwspec->param[i] = args[i];
}
+/* Detect races during IRQ type setting */
+static int irq_set_trigger_type_locked(unsigned int virq, unsigned int type,
+ irq_hw_number_t hwirq,
+ const struct irq_fwspec *fwspec)
+{
+ struct irq_data *irq_data;
+ int ret = 0;
+
+ mutex_lock(&irq_domain_mutex);
+ /*
+ * If the trigger type is not specified or matches the current trigger
+ * type then we are done.
+ */
+ if (type == IRQ_TYPE_NONE || type == irq_get_trigger_type(virq))
+ goto unlock;
+
+ /* If the trigger type has not been set yet, then set it now */
+ if (irq_get_trigger_type(virq) != IRQ_TYPE_NONE) {
+ pr_warn("type mismatch, failed to map hwirq-%lu for %s!\n",
+ hwirq, of_node_full_name(to_of_node(fwspec->fwnode)));
+ ret = -EINVAL;
+ goto unlock;
+ }
+
+ irq_data = irq_get_irq_data(virq);
+ if (!irq_data) {
+ ret = -ENOENT;
+ goto unlock;
+ }
+ irqd_set_trigger_type(irq_data, type);
+
+unlock:
+ mutex_unlock(&irq_domain_mutex);
+ return ret;
+}
+
unsigned int irq_create_fwspec_mapping(struct irq_fwspec *fwspec)
{
struct irq_domain *domain;
- struct irq_data *irq_data;
irq_hw_number_t hwirq;
unsigned int type = IRQ_TYPE_NONE;
int virq;
@@ -802,29 +837,8 @@ unsigned int irq_create_fwspec_mapping(struct irq_fwspec *fwspec)
*/
virq = irq_find_mapping(domain, hwirq);
if (virq) {
- /*
- * If the trigger type is not specified or matches the
- * current trigger type then we are done so return the
- * interrupt number.
- */
- if (type == IRQ_TYPE_NONE || type == irq_get_trigger_type(virq))
- return virq;
-
- /*
- * If the trigger type has not been set yet, then set
- * it now and return the interrupt number.
- */
- if (irq_get_trigger_type(virq) == IRQ_TYPE_NONE) {
- irq_data = irq_get_irq_data(virq);
- if (!irq_data)
- return 0;
-
- irqd_set_trigger_type(irq_data, type);
+ if (!irq_set_trigger_type_locked(virq, type, hwirq, fwspec))
return virq;
- }
-
- pr_warn("type mismatch, failed to map hwirq-%lu for %s!\n",
- hwirq, of_node_full_name(to_of_node(fwspec->fwnode)));
return 0;
}
@@ -839,8 +853,7 @@ unsigned int irq_create_fwspec_mapping(struct irq_fwspec *fwspec)
return virq;
}
- irq_data = irq_get_irq_data(virq);
- if (!irq_data) {
+ if (irq_set_trigger_type_locked(virq, type, hwirq, fwspec)) {
if (irq_domain_is_hierarchy(domain))
irq_domain_free_irqs(virq, 1);
else
@@ -848,9 +861,6 @@ unsigned int irq_create_fwspec_mapping(struct irq_fwspec *fwspec)
return 0;
}
- /* Store trigger type */
- irqd_set_trigger_type(irq_data, type);
-
return virq;
}
EXPORT_SYMBOL_GPL(irq_create_fwspec_mapping);
--
2.4.6
commit 6953c57ab172 "gpio: of: Handle SPI chipselect legacy bindings"
did introduce logic to centrally handle the legacy spi-cs-high property
in combination with cs-gpios. This assumes that the polarity
of the CS has to be inverted if spi-cs-high is missing, even
and especially if non-legacy GPIO_ACTIVE_HIGH is specified.
The DTS for the GTA04 was orginally introduced under the assumption
that there is no need for spi-cs-high if the gpio is defined with
proper polarity GPIO_ACTIVE_HIGH.
This was not a problem until gpiolib changed the interpretation of
GPIO_ACTIVE_HIGH and missing spi-cs-high.
The effect is that the missing spi-cs-high is now interpreted as CS being
low (despite GPIO_ACTIVE_HIGH) which turns off the SPI interface when the
panel is to be programmed by the panel driver.
Therefore, we have to add the redundant and legacy spi-cs-high property
to properly pass through the legacy handler.
Since this is nowhere documented in the bindings, we add some words of
WARNING.
Cc: stable(a)vger.kernel.org
Signed-off-by: H. Nikolaus Schaller <hns(a)goldelico.com>
---
Documentation/devicetree/bindings/spi/spi-bus.txt | 6 ++++++
arch/arm/boot/dts/omap3-gta04.dtsi | 1 +
2 files changed, 7 insertions(+)
diff --git a/Documentation/devicetree/bindings/spi/spi-bus.txt b/Documentation/devicetree/bindings/spi/spi-bus.txt
index 1f6e86f787ef..982aa590058b 100644
--- a/Documentation/devicetree/bindings/spi/spi-bus.txt
+++ b/Documentation/devicetree/bindings/spi/spi-bus.txt
@@ -47,6 +47,10 @@ cs1 : native
cs2 : &gpio1 1 0
cs3 : &gpio1 2 0
+WARNING: the polarity of cs-gpios may be inverted in some cases compared
+to what is specified in the third parameter. In that case the spi-cs-high
+property must be defined for slave nodes.
+
SPI slave nodes must be children of the SPI controller node.
@@ -69,6 +73,8 @@ All slave nodes can contain the following optional properties:
phase (CPHA) mode.
- spi-cs-high - Empty property indicating device requires chip select
active high.
+ WARNING: this is especially required even if the cs-gpios
+ define the gpio as GPIO_ACTIVE_HIGH
- spi-3wire - Empty property indicating device requires 3-wire mode.
- spi-lsb-first - Empty property indicating device requires LSB first mode.
- spi-tx-bus-width - The bus width (number of data wires) that is used for MOSI.
diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
index 9a9a29fe88ec..47bab8e1040e 100644
--- a/arch/arm/boot/dts/omap3-gta04.dtsi
+++ b/arch/arm/boot/dts/omap3-gta04.dtsi
@@ -124,6 +124,7 @@
spi-max-frequency = <100000>;
spi-cpol;
spi-cpha;
+ spi-cs-high;
backlight= <&backlight>;
label = "lcd";
--
2.19.1
From: Alexander Sverdlin <alexander.sverdlin(a)nokia.com>
irq_domain_associate() is the only place where irq_find_mapping() can be
used reliably (under irq_domain_mutex) to make a decision if the mapping
shall be created or not. Other calls to irq_find_mapping() (not under
any lock) cannot be used for this purpose and lead to race conditions in
particular inside irq_create_mapping().
Give the callers of irq_domain_associate() an ability to detect existing
domain reliably by examining the return value.
Cc: stable(a)vger.kernel.org
Signed-off-by: Alexander Sverdlin <alexander.sverdlin(a)nokia.com>
---
kernel/irq/irqdomain.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index 3078d0e..7bc07b6 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -532,6 +532,7 @@ int irq_domain_associate(struct irq_domain *domain, unsigned int virq,
irq_hw_number_t hwirq)
{
struct irq_data *irq_data = irq_get_irq_data(virq);
+ unsigned int eirq;
int ret;
if (WARN(hwirq >= domain->hwirq_max,
@@ -543,6 +544,16 @@ int irq_domain_associate(struct irq_domain *domain, unsigned int virq,
return -EINVAL;
mutex_lock(&irq_domain_mutex);
+
+ /* Check if mapping already exists */
+ eirq = irq_find_mapping(domain, hwirq);
+ if (eirq) {
+ mutex_unlock(&irq_domain_mutex);
+ pr_debug("%s: conflicting mapping for hwirq 0x%x\n",
+ domain->name, (int)hwirq);
+ return -EBUSY;
+ }
+
irq_data->hwirq = hwirq;
irq_data->domain = domain;
if (domain->ops->map) {
--
2.4.6
From: Srikar Dronamraju <srikar(a)linux.vnet.ibm.com>
Observe a segmentation fault when 'perf stat' is asked to repeat forever
with the interval option.
Without fix:
# perf stat -r 0 -I 5000 -e cycles -a sleep 10
# time counts unit events
5.000211692 3,13,89,82,34,157 cycles
10.000380119 1,53,98,52,22,294 cycles
10.040467280 17,16,79,265 cycles
Segmentation fault
This problem was only observed when we use forever option aka -r 0 and
works with limited repeats. Calling print_counter with ts being set to
NULL, is not a correct option when interval is set. Hence avoid
print_counter(NULL,..) if interval is set.
With fix:
# perf stat -r 0 -I 5000 -e cycles -a sleep 10
# time counts unit events
5.019866622 3,15,14,43,08,697 cycles
10.039865756 3,15,16,31,95,261 cycles
10.059950628 1,26,05,47,158 cycles
5.009902655 3,14,52,62,33,932 cycles
10.019880228 3,14,52,22,89,154 cycles
10.030543876 66,90,18,333 cycles
5.009848281 3,14,51,98,25,437 cycles
10.029854402 3,15,14,93,04,918 cycles
5.009834177 3,14,51,95,92,316 cycles
Committer notes:
Did the 'git bisect' to find the cset introducing the problem to add the
Fixes tag below, and at that time the problem reproduced as:
(gdb) run stat -r0 -I500 sleep 1
<SNIP>
Program received signal SIGSEGV, Segmentation fault.
print_interval (prefix=prefix@entry=0x7fffffffc8d0 "", ts=ts@entry=0x0) at builtin-stat.c:866
866 sprintf(prefix, "%6lu.%09lu%s", ts->tv_sec, ts->tv_nsec, csv_sep);
(gdb) bt
#0 print_interval (prefix=prefix@entry=0x7fffffffc8d0 "", ts=ts@entry=0x0) at builtin-stat.c:866
#1 0x000000000041860a in print_counters (ts=ts@entry=0x0, argc=argc@entry=2, argv=argv@entry=0x7fffffffd640) at builtin-stat.c:938
#2 0x0000000000419a7f in cmd_stat (argc=2, argv=0x7fffffffd640, prefix=<optimized out>) at builtin-stat.c:1411
#3 0x000000000045c65a in run_builtin (p=p@entry=0x6291b8 <commands+216>, argc=argc@entry=5, argv=argv@entry=0x7fffffffd640) at perf.c:370
#4 0x000000000045c893 in handle_internal_command (argc=5, argv=0x7fffffffd640) at perf.c:429
#5 0x000000000045c8f1 in run_argv (argcp=argcp@entry=0x7fffffffd4ac, argv=argv@entry=0x7fffffffd4a0) at perf.c:473
#6 0x000000000045cac9 in main (argc=<optimized out>, argv=<optimized out>) at perf.c:588
(gdb)
Mostly the same as just before this patch:
Program received signal SIGSEGV, Segmentation fault.
0x00000000005874a7 in print_interval (config=0xa1f2a0 <stat_config>, evlist=0xbc9b90, prefix=0x7fffffffd1c0 "`", ts=0x0) at util/stat-display.c:964
964 sprintf(prefix, "%6lu.%09lu%s", ts->tv_sec, ts->tv_nsec, config->csv_sep);
(gdb) bt
#0 0x00000000005874a7 in print_interval (config=0xa1f2a0 <stat_config>, evlist=0xbc9b90, prefix=0x7fffffffd1c0 "`", ts=0x0) at util/stat-display.c:964
#1 0x0000000000588047 in perf_evlist__print_counters (evlist=0xbc9b90, config=0xa1f2a0 <stat_config>, _target=0xa1f0c0 <target>, ts=0x0, argc=2, argv=0x7fffffffd670)
at util/stat-display.c:1172
#2 0x000000000045390f in print_counters (ts=0x0, argc=2, argv=0x7fffffffd670) at builtin-stat.c:656
#3 0x0000000000456bb5 in cmd_stat (argc=2, argv=0x7fffffffd670) at builtin-stat.c:1960
#4 0x00000000004dd2e0 in run_builtin (p=0xa30e00 <commands+288>, argc=5, argv=0x7fffffffd670) at perf.c:310
#5 0x00000000004dd54d in handle_internal_command (argc=5, argv=0x7fffffffd670) at perf.c:362
#6 0x00000000004dd694 in run_argv (argcp=0x7fffffffd4cc, argv=0x7fffffffd4c0) at perf.c:406
#7 0x00000000004dda11 in main (argc=5, argv=0x7fffffffd670) at perf.c:531
(gdb)
Fixes: d4f63a4741a8 ("perf stat: Introduce print_counters function")
Signed-off-by: Srikar Dronamraju <srikar(a)linux.vnet.ibm.com>
Acked-by: Jiri Olsa <jolsa(a)kernel.org>
Tested-by: Arnaldo Carvalho de Melo <acme(a)redhat.com>
Tested-by: Ravi Bangoria <ravi.bangoria(a)linux.ibm.com>
Cc: Namhyung Kim <namhyung(a)kernel.org>
Cc: Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com>
Cc: stable(a)vger.kernel.org # v4.2+
Link: http://lore.kernel.org/lkml/20190904094738.9558-3-srikar@linux.vnet.ibm.com
Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com>
---
tools/perf/builtin-stat.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index fa4b148ecfca..60cdd383af81 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -1956,7 +1956,7 @@ int cmd_stat(int argc, const char **argv)
perf_evlist__reset_prev_raw_counts(evsel_list);
status = run_perf_stat(argc, argv, run_idx);
- if (forever && status != -1) {
+ if (forever && status != -1 && !interval) {
print_counters(NULL, argc, argv);
perf_stat__reset_stats();
}
--
2.21.0
From: Srikar Dronamraju <srikar(a)linux.vnet.ibm.com>
When using 'perf stat' with repeat and interval option, it shows wrong
values for events.
The wrong values will be shown for the first interval on the second and
subsequent repetitions.
Without the fix:
# perf stat -r 3 -I 2000 -e faults -e sched:sched_switch -a sleep 5
2.000282489 53 faults
2.000282489 513 sched:sched_switch
4.005478208 3,721 faults
4.005478208 2,666 sched:sched_switch
5.025470933 395 faults
5.025470933 1,307 sched:sched_switch
2.009602825 1,84,46,74,40,73,70,95,47,520 faults <------
2.009602825 1,84,46,74,40,73,70,95,49,568 sched:sched_switch <------
4.019612206 4,730 faults
4.019612206 2,746 sched:sched_switch
5.039615484 3,953 faults
5.039615484 1,496 sched:sched_switch
2.000274620 1,84,46,74,40,73,70,95,47,520 faults <------
2.000274620 1,84,46,74,40,73,70,95,47,520 sched:sched_switch <------
4.000480342 4,282 faults
4.000480342 2,303 sched:sched_switch
5.000916811 1,322 faults
5.000916811 1,064 sched:sched_switch
#
prev_raw_counts is allocated when using intervals. This is used when
calculating the difference in the counts of events when using interval.
The current counts are stored in prev_raw_counts to calculate the
differences in the next iteration.
On the first interval of the second and subsequent repetitions,
prev_raw_counts would be the values stored in the last interval of the
previous repetitions, while the current counts will only be for the
first interval of the current repetition.
Hence there is a possibility of events showing up as big number.
Fix this by resetting prev_raw_counts whenever perf stat repeats the
command.
With the fix:
# perf stat -r 3 -I 2000 -e faults -e sched:sched_switch -a sleep 5
2.019349347 2,597 faults
2.019349347 2,753 sched:sched_switch
4.019577372 3,098 faults
4.019577372 2,532 sched:sched_switch
5.019415481 1,879 faults
5.019415481 1,356 sched:sched_switch
2.000178813 8,468 faults
2.000178813 2,254 sched:sched_switch
4.000404621 7,440 faults
4.000404621 1,266 sched:sched_switch
5.040196079 2,458 faults
5.040196079 556 sched:sched_switch
2.000191939 6,870 faults
2.000191939 1,170 sched:sched_switch
4.000414103 541 faults
4.000414103 902 sched:sched_switch
5.000809863 450 faults
5.000809863 364 sched:sched_switch
#
Committer notes:
This was broken since the cset introducing the --interval feature, i.e.
--repeat + --interval wasn't tested at that point, add the Fixes tag so
that automatic scripts can pick this up.
Fixes: 13370a9b5bb8 ("perf stat: Add interval printing")
Signed-off-by: Srikar Dronamraju <srikar(a)linux.vnet.ibm.com>
Acked-by: Jiri Olsa <jolsa(a)kernel.org>
Tested-by: Arnaldo Carvalho de Melo <acme(a)redhat.com>
Tested-by: Ravi Bangoria <ravi.bangoria(a)linux.ibm.com>
Cc: Namhyung Kim <namhyung(a)kernel.org>
Cc: Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com>
Cc: Stephane Eranian <eranian(a)google.com>
Cc: stable(a)vger.kernel.org # v3.9+
Link: http://lore.kernel.org/lkml/20190904094738.9558-2-srikar@linux.vnet.ibm.com
[ Fixed up conflicts with libperf, i.e. some perf_{evsel,evlist} lost the 'perf' prefix ]
Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com>
---
tools/perf/builtin-stat.c | 3 +++
tools/perf/util/stat.c | 17 +++++++++++++++++
tools/perf/util/stat.h | 1 +
3 files changed, 21 insertions(+)
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index eece3d1e429a..fa4b148ecfca 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -1952,6 +1952,9 @@ int cmd_stat(int argc, const char **argv)
fprintf(output, "[ perf stat: executing run #%d ... ]\n",
run_idx + 1);
+ if (run_idx != 0)
+ perf_evlist__reset_prev_raw_counts(evsel_list);
+
status = run_perf_stat(argc, argv, run_idx);
if (forever && status != -1) {
print_counters(NULL, argc, argv);
diff --git a/tools/perf/util/stat.c b/tools/perf/util/stat.c
index 06571209cb0b..fcd54342c04c 100644
--- a/tools/perf/util/stat.c
+++ b/tools/perf/util/stat.c
@@ -162,6 +162,15 @@ static void perf_evsel__free_prev_raw_counts(struct evsel *evsel)
evsel->prev_raw_counts = NULL;
}
+static void perf_evsel__reset_prev_raw_counts(struct evsel *evsel)
+{
+ if (evsel->prev_raw_counts) {
+ evsel->prev_raw_counts->aggr.val = 0;
+ evsel->prev_raw_counts->aggr.ena = 0;
+ evsel->prev_raw_counts->aggr.run = 0;
+ }
+}
+
static int perf_evsel__alloc_stats(struct evsel *evsel, bool alloc_raw)
{
int ncpus = perf_evsel__nr_cpus(evsel);
@@ -212,6 +221,14 @@ void perf_evlist__reset_stats(struct evlist *evlist)
}
}
+void perf_evlist__reset_prev_raw_counts(struct evlist *evlist)
+{
+ struct evsel *evsel;
+
+ evlist__for_each_entry(evlist, evsel)
+ perf_evsel__reset_prev_raw_counts(evsel);
+}
+
static void zero_per_pkg(struct evsel *counter)
{
if (counter->per_pkg_mask)
diff --git a/tools/perf/util/stat.h b/tools/perf/util/stat.h
index 0f9c9f6e2041..edbeb2f63e8d 100644
--- a/tools/perf/util/stat.h
+++ b/tools/perf/util/stat.h
@@ -193,6 +193,7 @@ void perf_stat__collect_metric_expr(struct evlist *);
int perf_evlist__alloc_stats(struct evlist *evlist, bool alloc_raw);
void perf_evlist__free_stats(struct evlist *evlist);
void perf_evlist__reset_stats(struct evlist *evlist);
+void perf_evlist__reset_prev_raw_counts(struct evlist *evlist);
int perf_stat_process_counter(struct perf_stat_config *config,
struct evsel *counter);
--
2.21.0
This is the start of the stable review cycle for the 4.19.74 release.
There are 50 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri 20 Sep 2019 06:09:47 AM UTC.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.74-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.74-rc1
Linus Torvalds <torvalds(a)linux-foundation.org>
x86/build: Add -Wnoaddress-of-packed-member to REALMODE_CFLAGS, to silence GCC9 build warning
Jean Delvare <jdelvare(a)suse.de>
nvmem: Use the same permissions for eeprom as for nvmem
Hui Peng <benquike(a)gmail.com>
rsi: fix a double free bug in rsi_91x_deinit()
Steffen Dirkwinkel <s.dirkwinkel(a)beckhoff.com>
platform/x86: pmc_atom: Add CB4063 Beckhoff Automation board to critclk_systems DMI table
Yang Yingliang <yangyingliang(a)huawei.com>
modules: fix compile error if don't have strict module rwx
Yang Yingliang <yangyingliang(a)huawei.com>
modules: fix BUG when load module with rodata=n
Olivier Moysan <olivier.moysan(a)st.com>
iio: adc: stm32-dfsdm: fix data type
Mario Limonciello <mario.limonciello(a)dell.com>
Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature"
Nishka Dasgupta <nishkadg.linux(a)gmail.com>
drm/mediatek: mtk_drm_drv.c: Add of_node_put() before goto
Hans de Goede <hdegoede(a)redhat.com>
drm: panel-orientation-quirks: Add extra quirk table entry for GPD MicroPC
Andrew F. Davis <afd(a)ti.com>
firmware: ti_sci: Always request response from firmware
Christophe Leroy <christophe.leroy(a)c-s.fr>
crypto: talitos - HMAC SNOOP NO AFEU mode requires SW icv checking.
Christophe Leroy <christophe.leroy(a)c-s.fr>
crypto: talitos - Do not modify req->cryptlen on decryption.
Christophe Leroy <christophe.leroy(a)c-s.fr>
crypto: talitos - fix ECB algs ivsize
Christophe Leroy <christophe.leroy(a)c-s.fr>
crypto: talitos - check data blocksize in ablkcipher.
Christophe Leroy <christophe.leroy(a)c-s.fr>
crypto: talitos - fix CTR alg blocksize
Christophe Leroy <christophe.leroy(a)c-s.fr>
crypto: talitos - check AES key size
Muchun Song <smuchun(a)gmail.com>
driver core: Fix use-after-free and double free on glue directory
Richard Weinberger <richard(a)nod.at>
ubifs: Correctly use tnc_next() in search_dh_cookie()
Kent Gibson <warthog618(a)gmail.com>
gpio: fix line flag validation in lineevent_create
Alex Williamson <alex.williamson(a)redhat.com>
PCI: Always allow probing with driver_override
Xiaolei Li <xiaolei.li(a)mediatek.com>
mtd: rawnand: mtk: Fix wrongly assigned OOB buffer pointer issue
Douglas Anderson <dianders(a)chromium.org>
clk: rockchip: Don't yell about bad mmc phases when getting
Neil Armstrong <narmstrong(a)baylibre.com>
drm/meson: Add support for XBGR8888 & ABGR8888 formats
Suraj Jitindar Singh <sjitindarsingh(a)gmail.com>
powerpc: Add barrier_nospec to raw_copy_in_user()
Steve Wahl <steve.wahl(a)hpe.com>
x86/purgatory: Change compiler flags from -mcmodel=kernel to -mcmodel=large to fix kexec relocation errors
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: nVMX: handle page fault in vmread
Fuqian Huang <huangfq.daxian(a)gmail.com>
KVM: x86: work around leak of uninitialized stack contents
Thomas Huth <thuth(a)redhat.com>
KVM: s390: Do not leak kernel stack data in the KVM_S390_INTERRUPT ioctl
Igor Mammedov <imammedo(a)redhat.com>
KVM: s390: kvm_s390_vm_start_migration: check dirty_bitmap before using it as target for memset()
Yunfeng Ye <yeyunfeng(a)huawei.com>
genirq: Prevent NULL pointer dereference in resend_irqs()
Alexander Duyck <alexander.h.duyck(a)linux.intel.com>
ixgbe: Prevent u8 wrapping of ITR value to something less than 10us
Filipe Manana <fdmanana(a)suse.com>
Btrfs: fix assertion failure during fsync and use of stale transaction
Kent Gibson <warthog618(a)gmail.com>
gpio: fix line flag validation in linehandle_create
Hans de Goede <hdegoede(a)redhat.com>
gpiolib: acpi: Add gpiolib_acpi_run_edge_events_on_boot option and blacklist
Yang Yingliang <yangyingliang(a)huawei.com>
tun: fix use-after-free when register netdev failed
Xin Long <lucien.xin(a)gmail.com>
tipc: add NULL pointer check before calling kfree_rcu
Neal Cardwell <ncardwell(a)google.com>
tcp: fix tcp_ecn_withdraw_cwr() to clear TCP_ECN_QUEUE_CWR
Xin Long <lucien.xin(a)gmail.com>
sctp: use transport pf_retrans in sctp_do_8_2_transport_strike
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
sctp: Fix the link time qualifier of 'sctp_ctrlsock_exit()'
Cong Wang <xiyou.wangcong(a)gmail.com>
sch_hhf: ensure quantum and hhf_non_hh_weight are non-zero
Eric Dumazet <edumazet(a)google.com>
net: sched: fix reordering issues
Stefan Chulski <stefanc(a)marvell.com>
net: phylink: Fix flow control resolution
Shmulik Ladkani <shmulik(a)metanetworks.com>
net: gso: Fix skb_segment splat when splitting gso_size mangled skb having linear-headed frag_list
Subash Abhinov Kasiviswanathan <subashab(a)codeaurora.org>
net: Fix null de-reference of device refcount
Steffen Klassert <steffen.klassert(a)secunet.com>
ixgbe: Fix secpath usage for IPsec TX offload.
Eric Biggers <ebiggers(a)google.com>
isdn/capi: check message length in capi_write()
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()'
Bjørn Mork <bjorn(a)mork.no>
cdc_ether: fix rndis support for Mediatek based smartphones
Nicolas Dichtel <nicolas.dichtel(a)6wind.com>
bridge/mdb: remove wrong use of NLM_F_MULTI
-------------
Diffstat:
Makefile | 4 +-
arch/powerpc/include/asm/uaccess.h | 1 +
arch/s390/kvm/interrupt.c | 10 ++++
arch/s390/kvm/kvm-s390.c | 4 +-
arch/x86/Makefile | 1 +
arch/x86/kvm/vmx.c | 7 ++-
arch/x86/kvm/x86.c | 7 +++
arch/x86/purgatory/Makefile | 35 ++++++++------
drivers/base/core.c | 53 +++++++++++++++++++-
drivers/bluetooth/btusb.c | 5 --
drivers/clk/rockchip/clk-mmc-phase.c | 4 +-
drivers/crypto/talitos.c | 67 +++++++++++++++++++-------
drivers/firmware/ti_sci.c | 8 +--
drivers/gpio/gpiolib-acpi.c | 42 ++++++++++++++--
drivers/gpio/gpiolib.c | 16 ++++--
drivers/gpu/drm/drm_panel_orientation_quirks.c | 12 +++++
drivers/gpu/drm/mediatek/mtk_drm_drv.c | 5 +-
drivers/gpu/drm/meson/meson_plane.c | 16 ++++++
drivers/iio/adc/stm32-dfsdm-adc.c | 4 +-
drivers/isdn/capi/capi.c | 10 +++-
drivers/mtd/nand/raw/mtk_nand.c | 21 ++++----
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 8 ++-
drivers/net/phy/phylink.c | 6 +--
drivers/net/tun.c | 16 ++++--
drivers/net/usb/cdc_ether.c | 13 +++--
drivers/net/wireless/rsi/rsi_91x_usb.c | 1 -
drivers/nvmem/core.c | 15 ++++--
drivers/pci/pci-driver.c | 3 +-
drivers/platform/x86/pmc_atom.c | 8 +++
fs/btrfs/tree-log.c | 8 +--
fs/ubifs/tnc.c | 16 ++++--
include/uapi/linux/isdn/capicmd.h | 1 +
kernel/irq/resend.c | 2 +
kernel/module.c | 22 ++++++---
net/bridge/br_mdb.c | 2 +-
net/core/dev.c | 2 +
net/core/skbuff.c | 19 ++++++++
net/ipv4/tcp_input.c | 2 +-
net/ipv6/ping.c | 2 +-
net/sched/sch_generic.c | 9 +++-
net/sched/sch_hhf.c | 2 +-
net/sctp/protocol.c | 2 +-
net/sctp/sm_sideeffect.c | 2 +-
net/tipc/name_distr.c | 3 +-
44 files changed, 377 insertions(+), 119 deletions(-)