From: Nadav Amit <namit(a)vmware.com>
Subject: userfaultfd: fix a race between writeprotect and exit_mmap()
A race is possible when a process exits, its VMAs are removed by
exit_mmap() and at the same time userfaultfd_writeprotect() is called.
The race was detected by KASAN on a development kernel, but it appears to
be possible on vanilla kernels as well.
Use mmget_not_zero() to prevent the race as done in other userfaultfd
operations.
Link: https://lkml.kernel.org/r/20210921200247.25749-1-namit@vmware.com
Fixes: 63b2d4174c4ad ("userfaultfd: wp: add the writeprotect API to userfaultfd ioctl")
Signed-off-by: Nadav Amit <namit(a)vmware.com>
Tested-by: Li Wang <liwang(a)redhat.com>
Reviewed-by: Peter Xu <peterx(a)redhat.com>
Cc: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/userfaultfd.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/fs/userfaultfd.c~userfaultfd-fix-a-race-between-writeprotect-and-exit_mmap
+++ a/fs/userfaultfd.c
@@ -1827,9 +1827,15 @@ static int userfaultfd_writeprotect(stru
if (mode_wp && mode_dontwake)
return -EINVAL;
- ret = mwriteprotect_range(ctx->mm, uffdio_wp.range.start,
- uffdio_wp.range.len, mode_wp,
- &ctx->mmap_changing);
+ if (mmget_not_zero(ctx->mm)) {
+ ret = mwriteprotect_range(ctx->mm, uffdio_wp.range.start,
+ uffdio_wp.range.len, mode_wp,
+ &ctx->mmap_changing);
+ mmput(ctx->mm);
+ } else {
+ return -ESRCH;
+ }
+
if (ret)
return ret;
_
From: Peter Xu <peterx(a)redhat.com>
Subject: mm/userfaultfd: selftests: fix memory corruption with thp enabled
In RHEL's gating selftests we've encountered memory corruption in the uffd
event test even with upstream kernel:
# ./userfaultfd anon 128 4
nr_pages: 32768, nr_pages_per_cpu: 32768
bounces: 3, mode: rnd racing read, userfaults: 6240 missing (6240) 14729 wp (14729)
bounces: 2, mode: racing read, userfaults: 1444 missing (1444) 28877 wp (28877)
bounces: 1, mode: rnd read, userfaults: 6055 missing (6055) 14699 wp (14699)
bounces: 0, mode: read, userfaults: 82 missing (82) 25196 wp (25196)
testing uffd-wp with pagemap (pgsize=4096): done
testing uffd-wp with pagemap (pgsize=2097152): done
testing events (fork, remap, remove): ERROR: nr 32427 memory corruption 0 1 (errno=0, line=963)
ERROR: faulting process failed (errno=0, line=1117)
It can be easily reproduced when global thp enabled, which is the default for
RHEL.
It's also known as a side effect of commit 0db282ba2c12 ("selftest: use
mmap instead of posix_memalign to allocate memory", 2021-07-23), which is
imho right itself on using mmap() to make sure the addresses will be
untagged even on arm.
The problem is, for each test we allocate buffers using two
allocate_area() calls. We assumed these two buffers won't affect each
other, however they could, because mmap() could have found that the two
buffers are near each other and having the same VMA flags, so they got
merged into one VMA.
It won't be a big problem if thp is not enabled, but when thp is
agressively enabled it means when initializing the src buffer it could
accidentally setup part of the dest buffer too when there's a shared THP
that overlaps the two regions. Then some of the dest buffer won't be able
to be trapped by userfaultfd missing mode, then it'll cause memory
corruption as described.
To fix it, do release_pages() after initializing the src buffer.
Since the previous two release_pages() calls are after
uffd_test_ctx_clear() which will unmap all the buffers anyway (which is
stronger than release pages; as unmap() also tear town pgtables), drop
them as they shouldn't really be anything useful.
We can mark the Fixes tag upon 0db282ba2c12 as it's reported to only
happen there, however the real "Fixes" IMHO should be 8ba6e8640844, as
before that commit we'll always do explicit release_pages() before
registration of uffd, and 8ba6e8640844 changed that logic by adding extra
unmap/map and we didn't release the pages at the right place. Meanwhile I
don't have a solid glue anyway on whether posix_memalign() could always
avoid triggering this bug, hence it's safer to attach this fix to commit
8ba6e8640844.
Link: https://lkml.kernel.org/r/20210923232512.210092-1-peterx@redhat.com
Fixes: 8ba6e8640844 ("userfaultfd/selftests: reinitialize test context in each test")
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1994931
Signed-off-by: Peter Xu <peterx(a)redhat.com>
Reported-by: Li Wang <liwan(a)redhat.com>
Tested-by: Li Wang <liwang(a)redhat.com>
Reviewed-by: Axel Rasmussen <axelrasmussen(a)google.com>
Cc: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: Nadav Amit <nadav.amit(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
tools/testing/selftests/vm/userfaultfd.c | 23 ++++++++++++++++++---
1 file changed, 20 insertions(+), 3 deletions(-)
--- a/tools/testing/selftests/vm/userfaultfd.c~mm-userfaultfd-selftests-fix-memory-corruption-with-thp-enabled
+++ a/tools/testing/selftests/vm/userfaultfd.c
@@ -414,9 +414,6 @@ static void uffd_test_ctx_init_ext(uint6
uffd_test_ops->allocate_area((void **)&area_src);
uffd_test_ops->allocate_area((void **)&area_dst);
- uffd_test_ops->release_pages(area_src);
- uffd_test_ops->release_pages(area_dst);
-
userfaultfd_open(features);
count_verify = malloc(nr_pages * sizeof(unsigned long long));
@@ -437,6 +434,26 @@ static void uffd_test_ctx_init_ext(uint6
*(area_count(area_src, nr) + 1) = 1;
}
+ /*
+ * After initialization of area_src, we must explicitly release pages
+ * for area_dst to make sure it's fully empty. Otherwise we could have
+ * some area_dst pages be errornously initialized with zero pages,
+ * hence we could hit memory corruption later in the test.
+ *
+ * One example is when THP is globally enabled, above allocate_area()
+ * calls could have the two areas merged into a single VMA (as they
+ * will have the same VMA flags so they're mergeable). When we
+ * initialize the area_src above, it's possible that some part of
+ * area_dst could have been faulted in via one huge THP that will be
+ * shared between area_src and area_dst. It could cause some of the
+ * area_dst won't be trapped by missing userfaults.
+ *
+ * This release_pages() will guarantee even if that happened, we'll
+ * proactively split the thp and drop any accidentally initialized
+ * pages within area_dst.
+ */
+ uffd_test_ops->release_pages(area_dst);
+
pipefd = malloc(sizeof(int) * nr_cpus * 2);
if (!pipefd)
err("pipefd");
_
Currently, Linux probes for X86_BUG_NULL_SEL unconditionally which
makes it unsafe to migrate in a virtualised environment as the
properties across the migration pool might differ.
To be specific, the case which goes wrong is:
1. Zen1 (or earlier) and Zen2 (or later) in a migration pool
2. Linux boots on Zen2, probes and finds the absence of X86_BUG_NULL_SEL
3. Linux is then migrated to Zen1
Linux is now running on a X86_BUG_NULL_SEL-impacted CPU while believing
that the bug is fixed.
The only way to address the problem is to fully trust the "no longer
affected" CPUID bit when virtualised, because in the above case it would
be clear deliberately to indicate the fact "you might migrate to
somewhere which has this behaviour".
Zen3 adds the NullSelectorClearsBase bit to indicate that loading
a NULL segment selector zeroes the base and limit fields, as well as
just attributes. Zen2 also has this behaviour but doesn't have the
NSCB bit.
Signed-off-by: Jane Malalane <jane.malalane(a)citrix.com>
---
CC: <x86(a)kernel.org>
CC: Thomas Gleixner <tglx(a)linutronix.de>
CC: Ingo Molnar <mingo(a)redhat.com>
CC: Borislav Petkov <bp(a)alien8.de>
CC: "H. Peter Anvin" <hpa(a)zytor.com>
CC: Pu Wen <puwen(a)hygon.cn>
CC: Paolo Bonzini <pbonzini(a)redhat.com>
CC: Sean Christopherson <seanjc(a)google.com>
CC: Peter Zijlstra <peterz(a)infradead.org>
CC: Andrew Cooper <andrew.cooper3(a)citrix.com>
CC: Yazen Ghannam <Yazen.Ghannam(a)amd.com>
CC: Brijesh Singh <brijesh.singh(a)amd.com>
CC: Huang Rui <ray.huang(a)amd.com>
CC: Andy Lutomirski <luto(a)kernel.org>
CC: Kim Phillips <kim.phillips(a)amd.com>
CC: <stable(a)vger.kernel.org>
v2:
* Deliberately not __init. early_init_*() not __init functions
* Fixed whitespace error flagged by scripts/checkpatch.pl
---
arch/x86/kernel/cpu/amd.c | 22 ++++++++++++++++++++++
arch/x86/kernel/cpu/common.c | 8 +++-----
arch/x86/kernel/cpu/cpu.h | 1 +
arch/x86/kernel/cpu/hygon.c | 22 ++++++++++++++++++++++
4 files changed, 48 insertions(+), 5 deletions(-)
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 2131af9f2fa2..1abfb0ae1f74 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -625,6 +625,7 @@ static void early_init_amd(struct cpuinfo_x86 *c)
{
u64 value;
u32 dummy;
+ bool nscb = false;
early_init_amd_mc(c);
@@ -650,6 +651,27 @@ static void early_init_amd(struct cpuinfo_x86 *c)
if (c->x86_power & BIT(14))
set_cpu_cap(c, X86_FEATURE_RAPL);
+ /*
+ * Zen1 and earlier CPUs don't clear segment base/limits when
+ * loading a NULL selector. This has been designated
+ * X86_BUG_NULL_SEG.
+ *
+ * Zen3 CPUs advertise Null Selector Clears Base in CPUID.
+ * Zen2 CPUs also have this behaviour, but no CPUID bit.
+ *
+ * A hypervisor may sythesize the bit, but may also hide it
+ * for migration safety, so we must not probe for model
+ * specific behaviour when virtualised.
+ */
+ if (c->extended_cpuid_level >= 0x80000021 && cpuid_eax(0x80000021) & BIT(6))
+ nscb = true;
+
+ if (!cpu_has(c, X86_FEATURE_HYPERVISOR) && !nscb && c->x86 == 0x17)
+ nscb = check_null_seg_clears_base(c);
+
+ if (!nscb)
+ set_cpu_bug(c, X86_BUG_NULL_SEG);
+
#ifdef CONFIG_X86_64
set_cpu_cap(c, X86_FEATURE_SYSCALL32);
#else
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 0f8885949e8c..2ca4afb97247 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1395,7 +1395,7 @@ void __init early_cpu_init(void)
early_identify_cpu(&boot_cpu_data);
}
-static void detect_null_seg_behavior(struct cpuinfo_x86 *c)
+bool check_null_seg_clears_base(struct cpuinfo_x86 *c)
{
#ifdef CONFIG_X86_64
/*
@@ -1418,10 +1418,10 @@ static void detect_null_seg_behavior(struct cpuinfo_x86 *c)
wrmsrl(MSR_FS_BASE, 1);
loadsegment(fs, 0);
rdmsrl(MSR_FS_BASE, tmp);
- if (tmp != 0)
- set_cpu_bug(c, X86_BUG_NULL_SEG);
wrmsrl(MSR_FS_BASE, old_base);
+ return tmp == 0;
#endif
+ return true;
}
static void generic_identify(struct cpuinfo_x86 *c)
@@ -1457,8 +1457,6 @@ static void generic_identify(struct cpuinfo_x86 *c)
get_model_name(c); /* Default name */
- detect_null_seg_behavior(c);
-
/*
* ESPFIX is a strange bug. All real CPUs have it. Paravirt
* systems that run Linux at CPL > 0 may or may not have the
diff --git a/arch/x86/kernel/cpu/cpu.h b/arch/x86/kernel/cpu/cpu.h
index 95521302630d..ad88bce508fa 100644
--- a/arch/x86/kernel/cpu/cpu.h
+++ b/arch/x86/kernel/cpu/cpu.h
@@ -75,6 +75,7 @@ extern int detect_extended_topology_early(struct cpuinfo_x86 *c);
extern int detect_extended_topology(struct cpuinfo_x86 *c);
extern int detect_ht_early(struct cpuinfo_x86 *c);
extern void detect_ht(struct cpuinfo_x86 *c);
+extern bool check_null_seg_clears_base(struct cpuinfo_x86 *c);
unsigned int aperfmperf_get_khz(int cpu);
diff --git a/arch/x86/kernel/cpu/hygon.c b/arch/x86/kernel/cpu/hygon.c
index 6d50136f7ab9..49bdb55efe52 100644
--- a/arch/x86/kernel/cpu/hygon.c
+++ b/arch/x86/kernel/cpu/hygon.c
@@ -240,6 +240,7 @@ static void bsp_init_hygon(struct cpuinfo_x86 *c)
static void early_init_hygon(struct cpuinfo_x86 *c)
{
u32 dummy;
+ bool nscb = false;
early_init_hygon_mc(c);
@@ -264,6 +265,27 @@ static void early_init_hygon(struct cpuinfo_x86 *c)
if (c->x86_power & BIT(14))
set_cpu_cap(c, X86_FEATURE_RAPL);
+ /*
+ * Zen1 and earlier CPUs don't clear segment base/limits when
+ * loading a NULL selector. This has been designated
+ * X86_BUG_NULL_SEG.
+ *
+ * Zen3 CPUs advertise Null Selector Clears Base in CPUID.
+ * Zen2 CPUs also have this behaviour, but no CPUID bit.
+ *
+ * A hypervisor may sythesize the bit, but may also hide it
+ * for migration safety, so we must not probe for model
+ * specific behaviour when virtualised.
+ */
+ if (c->extended_cpuid_level >= 0x80000021 && cpuid_eax(0x80000021) & BIT(6))
+ nscb = true;
+
+ if (!cpu_has(c, X86_FEATURE_HYPERVISOR) && !nscb && c->x86 == 0x18)
+ nscb = check_null_seg_clears_base(c);
+
+ if (!nscb)
+ set_cpu_bug(c, X86_BUG_NULL_SEG);
+
#ifdef CONFIG_X86_64
set_cpu_cap(c, X86_FEATURE_SYSCALL32);
#endif
--
2.11.0
This is the start of the stable review cycle for the 4.19.213 release.
There are 50 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 20 Oct 2021 13:23:15 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.213-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.213-rc1
Vegard Nossum <vegard.nossum(a)oracle.com>
r8152: select CRC32 and CRYPTO/CRYPTO_HASH/CRYPTO_SHA256
chongjiapeng <jiapeng.chong(a)linux.alibaba.com>
qed: Fix missing error code in qed_slowpath_start()
Sebastian Andrzej Siewior <bigeasy(a)linutronix.de>
mqprio: Correct stats in mqprio_dump_class_stats().
Jackie Liu <liuyun01(a)kylinos.cn>
acpi/arm64: fix next_platform_timer() section mismatch error
Dan Carpenter <dan.carpenter(a)oracle.com>
drm/msm/dsi: fix off by one in dsi_bus_clk_enable error handling
Dan Carpenter <dan.carpenter(a)oracle.com>
drm/msm/dsi: Fix an error code in msm_dsi_modeset_init()
Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org>
drm/msm/mdp5: fix cursor-related warnings
Colin Ian King <colin.king(a)canonical.com>
drm/msm: Fix null pointer dereference on pointer edp
Vadim Pasternak <vadimp(a)nvidia.com>
platform/mellanox: mlxreg-io: Fix argument base in kstrtou32() call
Dan Carpenter <dan.carpenter(a)oracle.com>
pata_legacy: fix a couple uninitialized variable bugs
Ziyang Xuan <william.xuanziyang(a)huawei.com>
NFC: digital: fix possible memory leak in digital_in_send_sdd_req()
Ziyang Xuan <william.xuanziyang(a)huawei.com>
NFC: digital: fix possible memory leak in digital_tg_listen_mdaa()
Ziyang Xuan <william.xuanziyang(a)huawei.com>
nfc: fix error handling of nfc_proto_register()
Arnd Bergmann <arnd(a)arndb.de>
ethernet: s2io: fix setting mac address during resume
Nanyong Sun <sunnanyong(a)huawei.com>
net: encx24j600: check error in devm_regmap_init_encx24j600
Vegard Nossum <vegard.nossum(a)oracle.com>
net: korina: select CRC32
Vegard Nossum <vegard.nossum(a)oracle.com>
net: arc: select CRC32
Eiichi Tsukata <eiichi.tsukata(a)nutanix.com>
sctp: account stream padding length for reconf chunk
Dan Carpenter <dan.carpenter(a)oracle.com>
iio: dac: ti-dac5571: fix an error code in probe()
Dan Carpenter <dan.carpenter(a)oracle.com>
iio: ssp_sensors: fix error code in ssp_print_mcu_debug()
Dan Carpenter <dan.carpenter(a)oracle.com>
iio: ssp_sensors: add more range checking in ssp_parse_dataframe()
Jiri Valek - 2N <valek(a)2n.cz>
iio: light: opt3001: Fixed timeout error when 0 lux
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
iio: adc128s052: Fix the error handling path of 'adc128_probe()'
Billy Tsai <billy_tsai(a)aspeedtech.com>
iio: adc: aspeed: set driver data when adc probe.
Borislav Petkov <bp(a)suse.de>
x86/Kconfig: Do not enable AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT automatically
Stephen Boyd <swboyd(a)chromium.org>
nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
Halil Pasic <pasic(a)linux.ibm.com>
virtio: write back F_VERSION_1 before validate
Tomaz Solc <tomaz.solc(a)tablix.org>
USB: serial: option: add prod. id for Quectel EG91
Daniele Palmas <dnlplm(a)gmail.com>
USB: serial: option: add Telit LE910Cx composition 0x1204
Yu-Tung Chang <mtwget(a)gmail.com>
USB: serial: option: add Quectel EC200S-CN module support
Aleksander Morgado <aleksander(a)aleksander.es>
USB: serial: qcserial: add EM9191 QDL support
Michael Cullen <michael(a)michaelcullen.name>
Input: xpad - add support for another USB ID of Nacon GC-100
Miquel Raynal <miquel.raynal(a)bootlin.com>
usb: musb: dsps: Fix the probe error path
Zhang Jianhua <chris.zjh(a)huawei.com>
efi: Change down_interruptible() in virt_efi_reset_system() to down_trylock()
Ard Biesheuvel <ardb(a)kernel.org>
efi/cper: use stack buffer for error record decoding
Arnd Bergmann <arnd(a)arndb.de>
cb710: avoid NULL pointer subtraction
Nikolay Martynov <mar.kolya(a)gmail.com>
xhci: Enable trust tx length quirk for Fresco FL11 USB controller
Pavankumar Kondeti <pkondeti(a)codeaurora.org>
xhci: Fix command ring pointer corruption while aborting a command
Jonathan Bell <jonathan(a)raspberrypi.com>
xhci: guard accesses to ep_state in xhci_endpoint_reset()
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
mei: me: add Ice Lake-N device id.
James Morse <james.morse(a)arm.com>
x86/resctrl: Free the ctrlval arrays when domain_setup_mon_state() fails
Filipe Manana <fdmanana(a)suse.com>
btrfs: check for error when looking up inode during dir entry replay
Filipe Manana <fdmanana(a)suse.com>
btrfs: deal with errors when adding inode reference during log replay
Filipe Manana <fdmanana(a)suse.com>
btrfs: deal with errors when replaying dir entry during log replay
Roberto Sassu <roberto.sassu(a)huawei.com>
s390: fix strrchr() implementation
Steven Rostedt <rostedt(a)goodmis.org>
nds32/ftrace: Fix Error: invalid operands (*UND* and *UND* sections) for `^'
Kailang Yang <kailang(a)realtek.com>
ALSA: hda/realtek - ALC236 headset MIC recording issue
Werner Sembach <wse(a)tuxedocomputers.com>
ALSA: hda/realtek: Add quirk for Clevo X170KM-G
Werner Sembach <wse(a)tuxedocomputers.com>
ALSA: hda/realtek: Complete partial device name to avoid ambiguity
Takashi Iwai <tiwai(a)suse.de>
ALSA: seq: Fix a potential UAF by wrong private_free call order
-------------
Diffstat:
Makefile | 4 +--
arch/s390/lib/string.c | 15 +++++-----
arch/x86/Kconfig | 1 -
arch/x86/kernel/cpu/intel_rdt.c | 2 ++
drivers/acpi/arm64/gtdt.c | 2 +-
drivers/ata/pata_legacy.c | 6 ++--
drivers/firmware/efi/cper.c | 4 +--
drivers/firmware/efi/runtime-wrappers.c | 2 +-
drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 16 +++++++++++
drivers/gpu/drm/msm/dsi/dsi.c | 4 ++-
drivers/gpu/drm/msm/dsi/dsi_host.c | 2 +-
drivers/gpu/drm/msm/edp/edp_ctrl.c | 3 +-
drivers/iio/adc/aspeed_adc.c | 1 +
drivers/iio/adc/ti-adc128s052.c | 6 ++++
drivers/iio/common/ssp_sensors/ssp_spi.c | 11 ++++++--
drivers/iio/dac/ti-dac5571.c | 1 +
drivers/iio/light/opt3001.c | 6 ++--
drivers/input/joystick/xpad.c | 2 ++
drivers/misc/cb710/sgbuf2.c | 2 +-
drivers/misc/mei/hw-me-regs.h | 1 +
drivers/misc/mei/pci-me.c | 1 +
drivers/net/ethernet/Kconfig | 1 +
drivers/net/ethernet/arc/Kconfig | 1 +
drivers/net/ethernet/microchip/encx24j600-regmap.c | 10 +++++--
drivers/net/ethernet/microchip/encx24j600.c | 5 +++-
drivers/net/ethernet/microchip/encx24j600_hw.h | 4 +--
drivers/net/ethernet/neterion/s2io.c | 2 +-
drivers/net/ethernet/qlogic/qed/qed_main.c | 1 +
drivers/net/usb/Kconfig | 4 +++
drivers/nvmem/core.c | 3 +-
drivers/platform/mellanox/mlxreg-io.c | 2 +-
drivers/usb/host/xhci-pci.c | 2 ++
drivers/usb/host/xhci-ring.c | 14 +++++++---
drivers/usb/host/xhci.c | 5 ++++
drivers/usb/musb/musb_dsps.c | 4 ++-
drivers/usb/serial/option.c | 8 ++++++
drivers/usb/serial/qcserial.c | 1 +
drivers/virtio/virtio.c | 11 ++++++++
fs/btrfs/tree-log.c | 32 +++++++++++++++-------
net/nfc/af_nfc.c | 3 ++
net/nfc/digital_core.c | 9 ++++--
net/nfc/digital_technology.c | 8 ++++--
net/sched/sch_mqprio.c | 30 ++++++++++++--------
net/sctp/sm_make_chunk.c | 2 +-
scripts/recordmcount.pl | 2 +-
sound/core/seq_device.c | 8 ++----
sound/pci/hda/patch_realtek.c | 8 ++++--
47 files changed, 198 insertions(+), 74 deletions(-)