1. 31 Oct, 2015 2 commits
  2. 27 Oct, 2015 1 commit
    • Werner Pawlitschko's avatar
      x86/ioapic: Prevent NULL pointer dereference in setup_ioapic_dest() · ababae44
      Werner Pawlitschko authored
      Commit 4857c91f changed the way how irq affinity is setup in
      setup_ioapic_dest() from using the core helper function to
      unconditionally calling the irq_set_affinity() callback of the
      underlying irq chip.
      
      That results in a NULL pointer dereference for the rare case where the
      underlying irq chip is lapic_chip which has no irq_set_affinity()
      callback. lapic_chip is occasionally used for the timer interrupt (irq
      0).
      
      The fix is simple: Check the availability of the callback instead of
      calling it unconditionally.
      
      Fixes: 4857c91f "x86/ioapic: Force affinity setting in setup_ioapic_dest()"
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: stable@vger.kernel.org
      ababae44
  3. 26 Oct, 2015 1 commit
  4. 25 Oct, 2015 1 commit
  5. 23 Oct, 2015 34 commits
    • Linus Torvalds's avatar
      Merge tag 'usb-4.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 01815536
      Linus Torvalds authored
      Pull USB fixes from Greg KH:
       "Here are three xhci driver fixes for reported issues for 4.3-rc7
      
        All have been in linux-next for a while with no problems"
      
      * tag 'usb-4.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
        xhci: Add spurious wakeup quirk for LynxPoint-LP controllers
        xhci: handle no ping response error properly
        xhci: don't finish a TD if we get a short transfer event mid TD
      01815536
    • Linus Torvalds's avatar
      Merge tag 'tty-4.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · dd5ae681
      Linus Torvalds authored
      Pull tty/serial fixes from Greg KH:
       "Here are two fixes that resolve reported issues, one with the 8250
        driver, and the other with the generic fbcon driver.
      
        Both have been in linux-next for a while"
      
      * tag 'tty-4.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        fbcon: initialize blink interval before calling fb_set_par
        Revert "serial: 8250_dma: don't bother DMA with small transfers"
      dd5ae681
    • Linus Torvalds's avatar
      Merge tag 'staging-4.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · 4ee8019d
      Linus Torvalds authored
      Pull staging driver fixes from Greg KH:
       "Here are four iio driver fixes for 4.3-rc7, fixing some reported
        issues.  All of these have been in linux-next for a while"
      
      * tag 'staging-4.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        iio: mxs-lradc: Fix temperature offset
        iio: accel: sca3000: memory corruption in sca3000_read_first_n_hw_rb()
        iio: st_accel: fix interrupt handling on LIS3LV02
        iio: adc: twl4030: Fix ADC[3:6] readings
      4ee8019d
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma · 410694e2
      Linus Torvalds authored
      Pull infiniband fixes from Doug Ledford:
       "It's late in the game, I know, but these fixes seemed important enough
        to warrant a late pull request.  They all involve oopses or use after
        frees or corruptions.
      
        Six serious fixes:
      
         - Hold the mutex around the find and corresponding update of our gid
      
         - The ifa list is rcu protected, copy its contents under rcu to avoid
           using a freed structure
      
         - On error, netdev might be null, so check it before trying to
           release it
      
         - On init, if workqueue alloc fails, fail init
      
         - The new demux patches exposed a bug in mlx5 and ipath drivers, we
           need to use the payload P_Key to determine the P_Key the packet
           arrived on because the hardware doesn't tell us the truth
      
         - Due to a couple convoluted error flows, it is possible for the CM
           to trigger a use_after_free and a double_free of rb nodes.  Add two
           checks to prevent that.  This code has worked for 10+ years.  It is
           likely that some of the recent changes have caused this issue to
           surface.  The current patch will protect us from nasty events for
           now while we track down why this is just now showing up"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma:
        IB/cm: Fix rb-tree duplicate free and use-after-free
        IB/cma: Use inner P_Key to determine netdev
        IB/ucma: check workqueue allocation before usage
        IB/cma: Potential NULL dereference in cma_id_from_event
        IB/core: Fix use after free of ifa
        IB/core: Fix memory corruption in ib_cache_gid_set_default_gid
      410694e2
    • Linus Torvalds's avatar
      Merge tag 'dm-4.3-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm · 35df017c
      Linus Torvalds authored
      Pull device mapper fixes from Mike Snitzer:
       "Three stable fixes (two in btree code used by DM thinp and one to
        properly store flags in DM cache metadata's superblock)"
      
      * tag 'dm-4.3-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
        dm cache: the CLEAN_SHUTDOWN flag was not being set
        dm btree: fix leak of bufio-backed block in btree_split_beneath error path
        dm btree remove: fix a bug when rebalancing nodes after removal
      35df017c
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.dk/linux-block · ea1ee5ff
      Linus Torvalds authored
      Pull block layer fixes from Jens Axboe:
       "A final set of fixes for 4.3.
      
        It is (again) bigger than I would have liked, but it's all been
        through the testing mill and has been carefully reviewed by multiple
        parties.  Each fix is either a regression fix for this cycle, or is
        marked stable.  You can scold me at KS.  The pull request contains:
      
         - Three simple fixes for NVMe, fixing regressions since 4.3.  From
           Arnd, Christoph, and Keith.
      
         - A single xen-blkfront fix from Cathy, fixing a NULL dereference if
           an error is returned through the staste change callback.
      
         - Fixup for some bad/sloppy code in nbd that got introduced earlier
           in this cycle.  From Markus Pargmann.
      
         - A blk-mq tagset use-after-free fix from Junichi.
      
         - A backing device lifetime fix from Tejun, fixing a crash.
      
         - And finally, a set of regression/stable fixes for cgroup writeback
           from Tejun"
      
      * 'for-linus' of git://git.kernel.dk/linux-block:
        writeback: remove broken rbtree_postorder_for_each_entry_safe() usage in cgwb_bdi_destroy()
        NVMe: Fix memory leak on retried commands
        block: don't release bdi while request_queue has live references
        nvme: use an integer value to Linux errno values
        blk-mq: fix use-after-free in blk_mq_free_tag_set()
        nvme: fix 32-bit build warning
        writeback: fix incorrect calculation of available memory for memcg domains
        writeback: memcg dirty_throttle_control should be initialized with wb->memcg_completions
        writeback: bdi_writeback iteration must not skip dying ones
        writeback: fix bdi_writeback iteration in wakeup_dirtytime_writeback()
        writeback: laptop_mode_timer_fn() needs rcu_read_lock() around bdi_writeback iteration
        nbd: Add locking for tasks
        xen-blkfront: check for null drvdata in blkback_changed (XenbusStateClosing)
      ea1ee5ff
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client · ef594c42
      Linus Torvalds authored
      Pull Ceph fixes from Sage Weil:
       "Two fixes.
      
        One is a stopgap to prevent a stack blowout when users have a deep
        chain of image clones.  (We'll rewrite this code to be non-recursive
        for the next window, but in the meantime this is a simple fix that
        avoids a crash.)
      
        The second fixes a refcount underflow"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:
        rbd: prevent kernel stack blow up on rbd map
        rbd: don't leak parent_spec in rbd_dev_probe_parent()
      ef594c42
    • Linus Torvalds's avatar
      Merge branch 'for-linus-4.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs · 37902bc1
      Linus Torvalds authored
      Pull btrfs fixes from Chris Mason:
       "I have two more small fixes this week:
      
        Qu's fix avoids unneeded COW during fallocate, and Christian found a
        memory leak in the error handling of an earlier fix"
      
      * 'for-linus-4.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
        btrfs: fix possible leak in btrfs_ioctl_balance()
        btrfs: Avoid truncate tailing page if fallocate range doesn't exceed inode size
      37902bc1
    • Joe Thornber's avatar
      dm cache: the CLEAN_SHUTDOWN flag was not being set · 3201ac45
      Joe Thornber authored
      If the CLEAN_SHUTDOWN flag is not set when a cache is loaded then all cache
      blocks are marked as dirty and a full writeback occurs.
      
      __commit_transaction() is responsible for setting/clearing
      CLEAN_SHUTDOWN (based the flags_mutator that is passed in).
      
      Fix this issue, of the cache's on-disk flags being wrong, by making sure
      __commit_transaction() does not reset the flags after the mutator has
      altered the flags in preparation for them being serialized to disk.
      
      before:
      
      sb_flags = mutator(le32_to_cpu(disk_super->flags));
      disk_super->flags = cpu_to_le32(sb_flags);
      disk_super->flags = cpu_to_le32(cmd->flags);
      
      after:
      
      disk_super->flags = cpu_to_le32(cmd->flags);
      sb_flags = mutator(le32_to_cpu(disk_super->flags));
      disk_super->flags = cpu_to_le32(sb_flags);
      Reported-by: default avatarBogdan Vasiliev <bogdan.vasiliev@gmail.com>
      Signed-off-by: default avatarJoe Thornber <ejt@redhat.com>
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      Cc: stable@vger.kernel.org
      3201ac45
    • Mike Snitzer's avatar
      dm btree: fix leak of bufio-backed block in btree_split_beneath error path · 4dcb8b57
      Mike Snitzer authored
      btree_split_beneath()'s error path had an outstanding FIXME that speaks
      directly to the potential for _not_ cleaning up a previously allocated
      bufio-backed block.
      
      Fix this by releasing the previously allocated bufio block using
      unlock_block().
      Reported-by: default avatarMikulas Patocka <mpatocka@redhat.com>
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      Acked-by: default avatarJoe Thornber <thornber@redhat.com>
      Cc: stable@vger.kernel.org
      4dcb8b57
    • Joe Thornber's avatar
      dm btree remove: fix a bug when rebalancing nodes after removal · 2871c69e
      Joe Thornber authored
      Commit 4c7e3093 ("dm btree remove: fix bug in redistribute3") wasn't
      a complete fix for redistribute3().
      
      The redistribute3 function takes 3 btree nodes and shares out the entries
      evenly between them.  If the three nodes in total contained
      (MAX_ENTRIES * 3) - 1 entries between them then this was erroneously getting
      rebalanced as (MAX_ENTRIES - 1) on the left and right, and (MAX_ENTRIES + 1) in
      the center.
      
      Fix this issue by being more careful about calculating the target number
      of entries for the left and right nodes.
      
      Unit tested in userspace using this program:
      https://github.com/jthornber/redistribute3-test/blob/master/redistribute3_t.cSigned-off-by: default avatarJoe Thornber <ejt@redhat.com>
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      Cc: stable@vger.kernel.org
      2871c69e
    • Ilya Dryomov's avatar
      rbd: prevent kernel stack blow up on rbd map · 6d69bb53
      Ilya Dryomov authored
      Mapping an image with a long parent chain (e.g. image foo, whose parent
      is bar, whose parent is baz, etc) currently leads to a kernel stack
      overflow, due to the following recursion in the reply path:
      
        rbd_osd_req_callback()
          rbd_obj_request_complete()
            rbd_img_obj_callback()
              rbd_img_parent_read_callback()
                rbd_obj_request_complete()
                  ...
      
      Limit the parent chain to 16 images, which is ~5K worth of stack.  When
      the above recursion is eliminated, this limit can be lifted.
      
      Fixes: http://tracker.ceph.com/issues/12538
      
      Cc: stable@vger.kernel.org # 3.10+, needs backporting for < 4.2
      Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
      Reviewed-by: default avatarJosh Durgin <jdurgin@redhat.com>
      6d69bb53
    • Ilya Dryomov's avatar
      rbd: don't leak parent_spec in rbd_dev_probe_parent() · 1f2c6651
      Ilya Dryomov authored
      Currently we leak parent_spec and trigger a "parent reference
      underflow" warning if rbd_dev_create() in rbd_dev_probe_parent() fails.
      The problem is we take the !parent out_err branch and that only drops
      refcounts; parent_spec that would've been freed had we called
      rbd_dev_unparent() remains and triggers rbd_warn() in
      rbd_dev_parent_put() - at that point we have parent_spec != NULL and
      parent_ref == 0, so counter ends up being -1 after the decrement.
      
      Redo rbd_dev_probe_parent() to fix this.
      
      Cc: stable@vger.kernel.org # 3.10+, needs backporting for < 4.2
      Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
      Reviewed-by: default avatarAlex Elder <elder@linaro.org>
      1f2c6651
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 03867292
      Linus Torvalds authored
      Pull x86 fixes from Ingo Molnar:
       "Misc fixes: two KASAN fixes, two EFI boot fixes, two boot-delay
        optimization fixes, and a fix for a IRQ handling hang observed on
        virtual platforms"
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/mm, kasan: Silence KASAN warnings in get_wchan()
        compiler, atomics, kasan: Provide READ_ONCE_NOCHECK()
        x86, kasan: Fix build failure on KASAN=y && KMEMCHECK=y kernels
        x86/smpboot: Fix CPU #1 boot timeout
        x86/smpboot: Fix cpu_init_udelay=10000 corner case boot parameter misbehavior
        x86/ioapic: Disable interrupts when re-routing legacy IRQs
        x86/setup: Extend low identity map to cover whole kernel range
        x86/efi: Fix multiple GOP device support
      03867292
    • Linus Torvalds's avatar
      Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · df557936
      Linus Torvalds authored
      Pull scheduler fixes from Ingo Molnar:
       "Misc fixes all around the map: an instrumentation fix, a nohz
        usability fix, a lockdep annotation fix and two task group scheduling
        fixes"
      
      * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        sched/core: Add missing lockdep_unpin() annotations
        sched/deadline: Fix migration of SCHED_DEADLINE tasks
        nohz: Revert "nohz: Set isolcpus when nohz_full is set"
        sched/fair: Update task group's load_avg after task migration
        sched/fair: Fix overly small weight for interactive group entities
        sched, tracing: Stop/start critical timings around the idle=poll idle loop
      df557936
    • Linus Torvalds's avatar
      Merge branch 'akpm' (patches from Andrew) · 9f30931a
      Linus Torvalds authored
      Merge fixes from Andrew Morton:
       "9 fixes"
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>:
        ocfs2/dlm: unlock lockres spinlock before dlm_lockres_put
        fault-inject: fix inverted interval/probability values in printk
        lib/Kconfig.debug: disable -Wframe-larger-than warnings with KASAN=y
        mm: make sendfile(2) killable
        thp: use is_zero_pfn() only after pte_present() check
        mailmap: update Javier Martinez Canillas' email
        MAINTAINERS: add Sergey as zsmalloc reviewer
        mm: cma: fix incorrect type conversion for size during dma allocation
        kmod: don't run async usermode helper as a child of kworker thread
      9f30931a
    • Peter Zijlstra's avatar
      sched/core: Add missing lockdep_unpin() annotations · 0aaafaab
      Peter Zijlstra authored
      Luca and Wanpeng reported two missing annotations that led to
      false lockdep complaints. Add the missing annotations.
      Reported-by: default avatarLuca Abeni <luca.abeni@unitn.it>
      Reported-by: default avatarWanpeng Li <wanpeng.li@hotmail.com>
      Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Cc: Juri Lelli <juri.lelli@arm.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Mike Galbraith <efault@gmx.de>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Fixes: cbce1a68 ("sched,lockdep: Employ lock pinning")
      Link: http://lkml.kernel.org/r/20151023095008.GY17308@twins.programming.kicks-ass.netSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      0aaafaab
    • Linus Torvalds's avatar
      Merge tag 'powerpc-4.3-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · a2c01ed5
      Linus Torvalds authored
      Pull powerpc fixes from Michael Ellerman:
      
       - Revert "Use the POWER8 Micro Partition Prefetch Engine in KVM HV on
         POWER8" from Paul
       - Handle irq_happened flag correctly in off-line loop from Paul
       - Validate rtas.entry before calling enter_rtas() from Vasant
      
      * tag 'powerpc-4.3-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        powerpc/rtas: Validate rtas.entry before calling enter_rtas()
        powerpc/powernv: Handle irq_happened flag correctly in off-line loop
        powerpc: Revert "Use the POWER8 Micro Partition Prefetch Engine in KVM HV on POWER8"
      a2c01ed5
    • Linus Torvalds's avatar
      Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · d0ddf980
      Linus Torvalds authored
      Pull ARM SoC fixes from Arnd Bergmann:
       "Most of the changes this time are for incorrect device nodes in
        various ways, on on imx, berlin, exynos, ux500, uniphier, omap and
        meson.
      
        Chen-Yu Tsai now co-maintains mach-sunxi (Allwinner).
      
        Other bug fixes include
         - a partial revert of a broken tegra gpio patch
         - irq affinity for arm ccn
         - suspend on one Armada 385 machine
         - enable ZONE_DMA to avoid an OMAP crash for over 2GB RAM
         - turning on a regulator on beagleboard-x15 for HDMI
         - making the omap gpmc debug code visible
         - setup of orion network switch
         - a rare build regression for pxa"
      
      * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (22 commits)
        ARM: OMAP2+: Fix imprecise external abort caused by bogus SRAM init
        thermal: exynos: Fix register read in TMU
        ARM: OMAP2+: Fix oops with LPAE and more than 2GB of memory
        ARM: tegra: Comment out gpio-ranges properties
        ARM: dts: uniphier: fix IRQ number for devices on PH1-LD6b ref board
        drivers/perf: arm_pmu: avoid CPU device_node reference leak
        bus: arm-ccn: Fix irq affinity setting on CPU migration
        bus: arm-ccn: Handle correctly no-more-cpus case
        ARM: mvebu: correct a385-db-ap compatible string
        ARM: meson6: DTS: Fix wrong reg mapping and IRQ numbers
        MAINTAINERS: Update Allwinner entry and add new maintainer
        ARM: ux500: modify initial levelshifter status
        ARM: pxa: fix pxa3xx DFI lockup hack
        Documentation: ARM: List new omap MMC requirements
        memory: omap-gpmc: dump "before" state before first modification
        memory: omap-gpmc: Fix unselectable debug option for GPMC
        ARM: dts: am57xx-beagle-x15: set VDD_SD to always-on
        ARM: dts: Fix audio card detection on Peach boards
        ARM: EXYNOS: Fix double of_node_put() when parsing child power domains
        ARM: orion: Fix DSA platform device after mvmdio conversion
        ...
      d0ddf980
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 2c44f4f0
      Linus Torvalds authored
      Pull KVM bugfixes from Paolo Bonzini:
       "Bug fixes for ARM, mostly 4.3 regressions related to virtual interrupt
        controller changes"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        arm/arm64: KVM: Fix disabled distributor operation
        arm/arm64: KVM: Clear map->active on pend/active clear
        arm/arm64: KVM: Fix arch timer behavior for disabled interrupts
        KVM: arm: use GIC support unconditionally
        KVM: arm/arm64: Fix memory leak if timer initialization fails
        KVM: arm/arm64: Do not inject spurious interrupts
      2c44f4f0
    • Linus Torvalds's avatar
      Merge tag 'trace-fixes-v4.3-rc6' of... · 8a990fb4
      Linus Torvalds authored
      Merge tag 'trace-fixes-v4.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace
      
      Pull tracing fixes from Steven Rostedt:
       "Running tests on other changes, the system locked up due to lots of
        warnings.  It was caused by the stack tracer triggering a warning
        about using rcu_dereference() when RCU was not watching.  This can
        happen due to the fact that the stack tracer uses the function tracer
        to check each function, and there are functions that may be called and
        traced when RCU stopped watching.  Namely when a function is called
        just before going idle or to userspace and after RCU stopped watching
        that current CPU.
      
        The first patch makes sure that RCU is watching when the stack tracer
        uses RCU.  The second patch is to make sure that the stack tracer does
        not get called by functions in NMI, as it's not NMI safe"
      
      * tag 'trace-fixes-v4.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        tracing: Do not allow stack_tracer to record stack in NMI
        tracing: Have stack tracer force RCU to be watching
      8a990fb4
    • Linus Torvalds's avatar
      Merge tag 'sound-4.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 0122835a
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "There is nothing to worry you much, only a few small & stable patches
        are found for usual stuff, HD-audio (a Lenovo laptop quirk, a fix for
        minor error handling) and ASoC (trivial fixes for RT298 and WM
        codecs).
      
        The only remaining major change is the fix for ASoC SX_TLV control
        that was overseen during refactoring, but the fix itself is trivial
        and safe"
      
      * tag 'sound-4.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ASoC: wm8962: mark cache_dirty flag after software reset in pm_resume
        ASoC: rt298: fix wrong setting of gpio2_en
        ASoC: wm8904: Correct number of EQ registers
        ALSA: hda - Fix deadlock at error in building PCM
        ASoC: Add info callback for SX_TLV controls
        ASoC: rt298: correct index default value
        ALSA: hda - Fix inverted internal mic on Lenovo G50-80
        ALSA: hdac: Explicitly add io.h
      0122835a
    • Linus Torvalds's avatar
      Merge tag 'media/v4.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media · 45d80f16
      Linus Torvalds authored
      Pull media fixes from Mauro Carvalho Chehab:
       "Some regression fixes and potential security issues:
      
         - netup_unidvb: fix potential crash when spi is NULL
         - rtl28xxu: fix control message flaws
         - m88ds3103: fix a regression on Kernel 4.2
         - c8sectpfe: fix some issues on this new driver
         - v4l2-flash-led-class: fix a Kbuild dependency
         - si2157 and si2158: check for array boundary when uploading firmware
           files
         - horus3a and lnbh25: fix some building troubles when some options
           aren't selected
         - ir-hix5hd2: drop the use of IRQF_NO_SUSPEND"
      
      * tag 'media/v4.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
        [media] m88ds3103: use own reg update_bits() implementation
        [media] rtl28xxu: fix control message flaws
        [media] v4l2-flash-led-class: Add missing VIDEO_V4L2 Kconfig dependency
        [media] netup_unidvb: fix potential crash when spi is NULL
        [media] si2168: Bounds check firmware
        [media] si2157: Bounds check firmware
        [media] ir-hix5hd2: drop the use of IRQF_NO_SUSPEND
        [media] c8sectpfe: fix return of garbage
        [media] c8sectpfe: fix ininitialized error return on firmware load failure
        [media] lnbh25: Fix lnbh25_attach() function return type
        [media] horus3a: Fix horus3a_attach() function parameters
      45d80f16
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · a67b20d2
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "I've been a bit slow gathering these:
      
         - drm/mst: one mutex leak in a fail path
      
         - radeon: two oops fixes, one dpm fix
      
         - i915: one messy set of fixes, where we revert the original fix, and
                 pull back the proper set of fixes from -next on top.
      
         - nouveau: one fix for an illegal buffer placement.
      
        Doesn't look too bad, hopefully shouldn't be too much more"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        drm/nouveau/gem: return only valid domain when there's only one
        drm: fix mutex leak in drm_dp_get_mst_branch_device
        drm/amdgpu: add missing dpm check for KV dpm late init
        drm/amdgpu/dpm: don't add pwm attributes if DPM is disabled
        drm/radeon/dpm: don't add pwm attributes if DPM is disabled
        drm/i915: Add primary plane to mask if it's visible
        drm/i915: Move sprite/cursor plane disable to intel_sanitize_crtc()
        drm/i915: Assign hwmode after encoder state readout
        Revert "drm/i915: Add primary plane to mask if it's visible"
        drm/i915: Deny wrapping an userptr into a framebuffer
        drm/i915: Enable DPLL VGA mode before P1/P2 divider write
        drm/i915: Restore lost DPLL register write on gen2-4
        drm/i915: Flush pipecontrol post-sync writes
        drm/i915: Fix kerneldoc for i915_gem_shrink_all
      a67b20d2
    • Joseph Qi's avatar
      ocfs2/dlm: unlock lockres spinlock before dlm_lockres_put · b67de018
      Joseph Qi authored
      dlm_lockres_put will call dlm_lockres_release if it is the last
      reference, and then it may call dlm_print_one_lock_resource and
      take lockres spinlock.
      
      So unlock lockres spinlock before dlm_lockres_put to avoid deadlock.
      Signed-off-by: default avatarJoseph Qi <joseph.qi@huawei.com>
      Cc: Mark Fasheh <mfasheh@suse.de>
      Cc: Joel Becker <jlbec@evilplan.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b67de018
    • Florian Westphal's avatar
      fault-inject: fix inverted interval/probability values in printk · bb387002
      Florian Westphal authored
      interval displays the probability and vice versa.
      
      Fixes: 6adc4a22 ("fault-inject: add ratelimit option")
      Acked-by: default avatarAkinobu Mita <akinobu.mita@gmail.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      bb387002
    • Andrey Ryabinin's avatar
      lib/Kconfig.debug: disable -Wframe-larger-than warnings with KASAN=y · 3f181b4d
      Andrey Ryabinin authored
      When the kernel compiled with KASAN=y, GCC adds redzones for each
      variable on stack.  This enlarges function's stack frame and causes:
      
      	'warning: the frame size of X bytes is larger than Y bytes'
      
      The worst case I've seen for now is following:
      
         ../net/wireless/nl80211.c: In function `nl80211_send_wiphy':
         ../net/wireless/nl80211.c:1731:1: warning: the frame size of 5448 bytes is larger than 2048 bytes [-Wframe-larger-than=]
      
      That kind of warning becomes useless with KASAN=y.  It doesn't
      necessarily indicate that there is some problem in the code, thus we
      should turn it off.
      
      (The KASAN=y stack size in increased from 16k to 32k for this reason)
      Signed-off-by: default avatarAndrey Ryabinin <aryabinin@virtuozzo.com>
      Reported-by: default avatarFengguang Wu <fengguang.wu@intel.com>
      Acked-by: default avatarAbylay Ospan <aospan@netup.ru>
      Cc: Andi Kleen <andi@firstfloor.org>
      Cc: Ingo Molnar <mingo@kernel.org>
      Cc: Mauro Carvalho Chehab <m.chehab@samsung.com>
      Cc: Kozlov Sergey <serjk@netup.ru>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      3f181b4d
    • Jan Kara's avatar
      mm: make sendfile(2) killable · 296291cd
      Jan Kara authored
      Currently a simple program below issues a sendfile(2) system call which
      takes about 62 days to complete in my test KVM instance.
      
              int fd;
              off_t off = 0;
      
              fd = open("file", O_RDWR | O_TRUNC | O_SYNC | O_CREAT, 0644);
              ftruncate(fd, 2);
              lseek(fd, 0, SEEK_END);
              sendfile(fd, fd, &off, 0xfffffff);
      
      Now you should not ask kernel to do a stupid stuff like copying 256MB in
      2-byte chunks and call fsync(2) after each chunk but if you do, sysadmin
      should have a way to stop you.
      
      We actually do have a check for fatal_signal_pending() in
      generic_perform_write() which triggers in this path however because we
      always succeed in writing something before the check is done, we return
      value > 0 from generic_perform_write() and thus the information about
      signal gets lost.
      
      Fix the problem by doing the signal check before writing anything.  That
      way generic_perform_write() returns -EINTR, the error gets propagated up
      and the sendfile loop terminates early.
      Signed-off-by: default avatarJan Kara <jack@suse.com>
      Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
      Cc: Al Viro <viro@ZenIV.linux.org.uk>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      296291cd
    • Minchan Kim's avatar
      thp: use is_zero_pfn() only after pte_present() check · 47aee4d8
      Minchan Kim authored
      Use is_zero_pfn() on pteval only after pte_present() check on pteval
      (It might be better idea to introduce is_zero_pte() which checks
      pte_present() first).
      
      Otherwise when working on a swap or migration entry and if pte_pfn's
      result is equal to zero_pfn by chance, we lose user's data in
      __collapse_huge_page_copy().  So if you're unlucky, the application
      segfaults and finally you could see below message on exit:
      
      BUG: Bad rss-counter state mm:ffff88007f099300 idx:2 val:3
      
      Fixes: ca0984ca ("mm: incorporate zero pages into transparent huge pages")
      Signed-off-by: default avatarMinchan Kim <minchan@kernel.org>
      Reviewed-by: default avatarAndrea Arcangeli <aarcange@redhat.com>
      Acked-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
      Cc: Mel Gorman <mgorman@suse.de>
      Acked-by: default avatarVlastimil Babka <vbabka@suse.cz>
      Cc: Hugh Dickins <hughd@google.com>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: <stable@vger.kernel.org>	[4.1+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      47aee4d8
    • Javier Martinez Canillas's avatar
      mailmap: update Javier Martinez Canillas' email · b8fa0efa
      Javier Martinez Canillas authored
      The get_maintainer script still reports my old Collabora email based on
      old commits but that address no longer exist so update mailmap to report
      my current email and avoid people sending to the old address.
      Signed-off-by: default avatarJavier Martinez Canillas <javier@osg.samsung.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b8fa0efa
    • Sergey Senozhatsky's avatar
      MAINTAINERS: add Sergey as zsmalloc reviewer · 41192a2d
      Sergey Senozhatsky authored
      Nominate myself as a zsmalloc reviewer.
      Signed-off-by: default avatarSergey Senozhatsky <sergey.senozhatsky@gmail.com>
      Cc: Minchan Kim <minchan@kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      41192a2d
    • Rohit Vaswani's avatar
      mm: cma: fix incorrect type conversion for size during dma allocation · 67a2e213
      Rohit Vaswani authored
      This was found during userspace fuzzing test when a large size dma cma
      allocation is made by driver(like ion) through userspace.
      
        show_stack+0x10/0x1c
        dump_stack+0x74/0xc8
        kasan_report_error+0x2b0/0x408
        kasan_report+0x34/0x40
        __asan_storeN+0x15c/0x168
        memset+0x20/0x44
        __dma_alloc_coherent+0x114/0x18c
      Signed-off-by: default avatarRohit Vaswani <rvaswani@codeaurora.org>
      Acked-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: Marek Szyprowski <m.szyprowski@samsung.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      67a2e213
    • Oleg Nesterov's avatar
      kmod: don't run async usermode helper as a child of kworker thread · 52116139
      Oleg Nesterov authored
      call_usermodehelper_exec_sync() does fork() + wait() with "unignored"
      SIGCHLD.  What we have missed is that this worker thread can have other
      children previously forked by call_usermodehelper_exec_work() without
      UMH_WAIT_PROC.  If such a child exits in between it becomes a zombie
      because auto-reaping only works if SIGCHLD is ignored, and nobody can
      reap it (unless/until this worker thread exits too).
      
      Change the !UMH_WAIT_PROC case to use CLONE_PARENT.
      
      Note: this is only first step.  All PF_KTHREAD tasks, even created by
      kernel_thread() should have ->parent == kthreadd by default.
      
      Fixes: bb304a5c ("kmod: handle UMH_WAIT_PROC from system unbound workqueue")
      Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
      Acked-by: default avatarFrederic Weisbecker <fweisbec@gmail.com>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Christoph Lameter <cl@linux.com>
      Cc: Tejun Heo <tj@kernel.org>
      Cc: Rusty Russell <rusty@rustcorp.com.au>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      52116139
    • Takashi Iwai's avatar
      Merge tag 'asoc-fix-v4.3-rc6' of... · b9b6e4ac
      Takashi Iwai authored
      Merge tag 'asoc-fix-v4.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
      
      ASoC: Fixes for v4.3
      
      A bunch of driver fixes plus one core fix which fixes problems with
      misreporting values from _SX controls following a recent refactoring.
      This had gone unnoticed as such controls are quite rare.
      b9b6e4ac
  6. 22 Oct, 2015 1 commit