Re: [PATCH 1/3] Documentation: arm: update homepage URLs for Marvell Berlin SoCs

On Fri, 20 Nov 2015 21:22:54 -0500 Tom Hebb wrote: > If we can't find updated links, though, > perhaps we should remove them altogether. I can send another patch to do > that, provided no one has new links to the missing documents. An add-on patch to fix things up would be welcome if you get a c

Re: gigaset: freeing an active object

Hi Tilman, On 11/29/2015 10:30 AM, Tilman Schmidt wrote: > Hi Sasha, > > thanks for the report. As the original author of the code in question, I > am somewhat at a loss what to make of it. > > Am 27.11.2015 um 16:19 schrieb Sasha Levin: >> Fuzzing with syzkaller on the latest -next kernel produ

Re: user-controllable kmalloc size in bpf syscall

On Sun, Nov 29, 2015 at 02:18:29PM +0100, Dmitry Vyukov wrote: > ca.key_size = 1; > ca.value_size = 0xfff9; > ca.max_entries = 10; > int fd = syscall(SYS_bpf, BPF_MAP_CREATE, &ca, sizeof(ca)); ... > [ cut here ] > WARNING: CPU: 2 PID: 1112

Re: gigaset: freeing an active object

Am 29.11.2015 um 19:22 schrieb Peter Hurley: > On 11/29/2015 10:30 AM, Tilman Schmidt wrote: >> >> Judging from the backtrace below this must be the call >> >> kfree(cs->hw.ser); >> >> in drivers/isdn/gigaset/ser-gigaset.c line 375. >> cs->hw.ser is of type struct ser_cardstate *. >> struct

Re: gigaset: freeing an active object

Am 29.11.2015 um 19:22 schrieb Peter Hurley: >>> [ 413.536749] WARNING: CPU: 6 PID: 25400 at lib/debugobjects.c:263 >>> debug_print_object+0x1c4/0x1e0() >>> [ 413.538111] ODEBUG: free active (active state 0) object type: timer_list >>> hint: delayed_work_timer_fn+0x0/0x90 >> >> This message se

NEW ARRIVALS, CISCO, LAPTOP AND AVAYA

Hello, We have the below lists in stock and looking for offers. CPUs and QTYs in stock. 75 X X5650 55 X E5410 65 X X5660 45 X E5530 75 X E5645 70 X X5680 65 X X5690 IP phones and QTYs in stock. 15 x CP-7937G 57 x CP-7942G 45 x CP-7945G 55 x CP-7962G Here is the qty in

Re: [PATCH] drm/radeon: constify radeon_asic_ring structures

On 29.11.2015 17:12, Julia Lawall wrote: The radeon_asic_ring structures are never modified, so declare them as const. Done with the help of Coccinelle. Signed-off-by: Julia Lawall Nice clean, patch is Reviewed-by: Christian König --- drivers/gpu/drm/radeon/radeon.h |2 - dri

[PATCH v6 2/9] watchdog: Introduce WDOG_HW_RUNNING flag

The WDOG_HW_RUNNING flag is expected to be set by watchdog drivers if the hardware watchdog is running. If the flag is set, the watchdog subsystem will ping the watchdog even if the watchdog device is closed. The watchdog driver stop function is now optional and may be omitted if the watchdog can

[PATCH v6 5/9] watchdog: Simplify update_worker

Drop 'cancel' parameter; simply cancel worker unconditionally if not needed. Signed-off-by: Guenter Roeck --- v6: Rebased to v4.4-rc2 v5: Introduced patch --- drivers/watchdog/watchdog_dev.c | 15 +++ 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/drivers/watchdog/wat

[RFT PATCH v6 6/9] watchdog: imx2: Convert to use infrastructure triggered keepalives

The watchdog infrastructure now supports handling watchdog keepalive if the watchdog is running while the watchdog device is closed. Convert the driver to use this infrastructure. Signed-off-by: Guenter Roeck --- v6: Rename WDOG_RUNNING to WDOG_HW_RUNNING Rebased to v4.4-rc2 v5: Rebased to v4

[RFT PATCH v6 9/9] watchdog: dw_wdt: Convert to use watchdog infrastructure

Convert driver to use watchdog infrastructure. This includes infrastructure support to handle watchdog keepalive if the watchdog is running while the watchdog device is closed. Signed-off-by: Guenter Roeck --- v6: Added patch --- drivers/watchdog/Kconfig | 1 + drivers/watchdog/dw_wdt.c | 32

[RFT PATCH v6 7/9] watchdog: retu: Convert to use infrastructure triggered keepalives

The watchdog infrastructure now supports handling watchdog keepalive if the watchdog is running while the watchdog device is closed. Convert the driver to use this infrastructure. Signed-off-by: Guenter Roeck --- v6: Rename WDOG_RUNNING to WDOG_HW_RUNNING Rebased to v4.4-rc2 v5: Rebased to v4

[PATCH v6 1/9] watchdog: Introduce hardware maximum timeout in watchdog core

Introduce an optional hardware maximum timeout in the watchdog core. The hardware maximum timeout can be lower than the maximum timeout. Drivers can set the maximum hardware timeout value in the watchdog data structure. If the configured timeout exceeds the maximum hardware timeout, the watchdog c

[RFT PATCH v6 8/9] watchdog: at91sam9: Convert to use infrastructure triggered keepalives

The watchdog infrastructure now supports handling watchdog keepalive if the watchdog is running while the watchdog device is closed. The infrastructure now also supports generating additional heartbeats if the maximum hardware timeout is smaller than or close to the configured timeout. Convert the

[PATCH v6 0/9] watchdog: Add support for keepalives triggered by infrastructure

The watchdog infrastructure is currently purely passive, meaning it only passes information from user space to drivers and vice versa. Since watchdog hardware tends to have its own quirks, this can result in quite complex watchdog drivers. A number of scanarios are especially common. - A watchdog

[PATCH v6 3/9] watchdog: Make set_timeout function optional

For some watchdogs, the hardware timeout is fixed, and the watchdog driver depends on the watchdog core to handle the actual timeout. In this situation, the watchdog driver might only set the 'timeout' variable but do nothing else. This can as well be handled by the infrastructure, so make the set_

[PATCH v6 4/9] watchdog: Add support for minimum time between heartbeats

Some watchdogs require a minimum time between heartbeats. Examples are the watchdogs in DA9062 and AT91SAM9x. Signed-off-by: Guenter Roeck --- v6: Rebased to v4.4-rc2 v5: Rebased to v4.4-rc1 Fixed typo in documentation. v4: Added patch --- Documentation/watchdog/watchdog-kernel-api.txt | 4

Random VMs stuck in [drm] fb: depth 24,pitch 4096

Running centos 6.7 and trying to PXE boot centos 6.5 vms but some of them are stuck with this in boot message: [drm] fb: depth 24,pitch 4096 screenshot of vm console: http://snag.gy/7Bhyc.jpg tried restarting vms but its still stuck there rpm -qa |grep kvm qemu-kvm-rhev-tools-0.12.1.2-2.479.el6

Re: [PATCH] dell-wmi: add module param to control Dell Instant Launch hotkey processing

On Thursday 26 November 2015 15:55:56 Michał Kępień wrote: > > > /* Shortcut and audio panel keys */ > > > > > > - { KE_IGNORE, 0xe025, { KEY_RESERVED } }, > > > + { KE_KEY, 0xe025, { KEY_PROG4 } }, > > > > > > { KE_IGNORE, 0xe026, { KEY_RESERVED } }, > > > > I'm trying to figure out if tho

Re: [radeon r100] when ring test fails, provide users with option to test

On 28.11.2015 21:58, Pavel Machek wrote: Ring test failure is often caused by too high agpmode. Tell the user what to try. Signed-off-by: Pavel Machek NAK, the ring test can fail for any number of reasons and the agpmode is actually rather unlikely to be the cause. Regards, Christian. d

Re: [ovirt-users] [ovirt-devel] Networking fails for VM running on Centos6.7.Works on Centos6.5

2015-11-29 8:59 GMT+01:00 Dan Kenigsberg : > On Sat, Nov 28, 2015 at 08:10:06PM +0530, mad Engineer wrote: >> hello all i am having strange network issue with vms that are running on >> centos 6.7 ovirt nodes. >> >> I recently added one more ovirt node which is running centos6.7 and >> upgraded fro

[git pull] drm nouveau and radeon fixes.

Hi Linus, just some nouveau and radeon/amdgpu fixes, the nouveau fixes look large as the firmware context files are regenerated, but the actual change is quite small. Dave. The following changes since commit 78c4a49a69e910a162b05e4e8727b9bdbf948f13: Merge branch 'for-linus' of git://git.ker

Re: [ovirt-devel] Networking fails for VM running on Centos6.7.Works on Centos6.5

each vm has 4 nics connected to 4 different bridges which is connected to 4 different physical interface in access mode VLAN.No bonding between interfaces.I have IP assigned on "ovirtmgmt" bridge which is used for storage,migration,console and VM internet access.All interfaces are 10G with MTU 900

kmod-hfsplus

Hi, I have version 0.0-2 of this installed on my CentOS machines. When I try to copy an entire hard drive that is formatted with the hfs+ file system to another, it makes my system completely freeze after a period of time. I have tried this on two different CentOS machines of mine and the same

Re: perf test unwind failing

On Fri, Nov 27, 2015 at 01:17:40PM -0300, Arnaldo Carvalho de Melo wrote: > Em Fri, Nov 27, 2015 at 01:03:11PM -0300, Arnaldo Carvalho de Melo escreveu: > > Em Fri, Nov 27, 2015 at 09:21:21AM +0100, Jiri Olsa escreveu: > > > On Thu, Nov 26, 2015 at 05:45:59PM -0300, Arnaldo Carvalho de Melo wrote:

[RFC] kvm - possible out of bounds

Hello, I have found a possible out of bounds reading in arch/powerpc/kvm/book3s_64_mmu.c (kvmppc_mmu_book3s_64_xlate function). pteg[] array could be accessed twice using the i variable after the for iteration. What happens is that in the last iteration the i index is incremented to 16, checked (i

RE: [PATCH 11/14] mmc: sdhci-pic32: Add PIC32 SDHC host controller driver

On 11/25/2015 8:55 AM, Ulf Hansson wrote: > On 21 November 2015 at 01:17, Joshua Henderson > wrote: > > From: Andrei Pistirica > > > > This driver supports the SDHCI host controller found on the PIC32 in > > DMA or PIO mode. > > > > Signed-off-by: Andrei Pistirica > > Signed-off-by: Joshua Hende

Re: gigaset: freeing an active object

On zo, 2015-11-29 at 19:47 +0100, Tilman Schmidt wrote: > Btw I don't see a timer_list object in struct platform_device either. > Nor in the embedded struct device. I found two instances of struct timer_list, rather deep down struct ser_cardstate: struct ser_cardstate { struct platform_de

[PATCH] staging: gdm72xx: fix address space parse warnings

copy_to_user() and copy_from_user() functions expect the user space pointers to be marked with __user. Sparse throws following warnings. For copy_to_user(): warning: incorrect type in argument 1 (different address spaces) expected void [noderef] *to got void *buf For copy_from_user(): warning:

[RFC PATCH] af_unix: fix entry locking in unix_dgram_recvmsg

This will probably earn me a reputation as the most single-minded monomaniac on this planet (insofar there's still anything to earn in this respect) but this issue has been irking me "ever since". NB: This is somewhat loser formatted than a proper patch submission in order to explain the backgroun

Re: [PATCH v2 0/3] Add PWM clock support for bcm2835

Hi Remi, Am 29.11.2015 um 01:31 schrieb Remi Pommarel: Hi Stefan, On Sat, Nov 28, 2015 at 09:52:07PM +0100, Stefan Wahren wrote: i applied the series including the devicetree modification, but it doesn't work for me. First of all i get an ugly division by zero warning from the pwm driver. The

Re: [PATCH 01/04] pinctrl: sh-pfc: r8a7794: Add DU pin groups

On Tue, Nov 17, 2015 at 4:18 AM, Magnus Damm wrote: > From: Koji Matsuoka > > r8a7794 PFC DU support from the R-Car Gen2 v1.9.4 BSP > > Signed-off-by: Koji Matsuoka > Signed-off-by: Magnus Damm Acked-by for all from my side, Geert, I expect that you queue these with the rest of the SH PFC stu

Re: [PATCH 1/3] ste_dma40: Delete an unnecessary check before the function call "kmem_cache_destroy"

On Mon, Nov 16, 2015 at 10:23 PM, SF Markus Elfring wrote: > From: Markus Elfring > Date: Mon, 16 Nov 2015 20:26:27 +0100 > > The kmem_cache_destroy() function tests whether its argument is NULL > and then returns immediately. Thus the test around the call is not needed. > > This issue was detec

Re: [PATCH 2/3] ste_dma40: Delete another unnecessary check in d40_probe()

On Mon, Nov 16, 2015 at 10:24 PM, SF Markus Elfring wrote: > From: Markus Elfring > Date: Mon, 16 Nov 2015 21:56:07 +0100 > > A single jump label was used by the d40_probe() function in several cases > for error handling which was a bit inefficient here. > > * This implementation detail could be

Re: [PATCH 3/3] ste_dma40: Delete an unnecessary variable initialisation in d40_probe()

On Mon, Nov 16, 2015 at 10:26 PM, SF Markus Elfring wrote: > From: Markus Elfring > Date: Mon, 16 Nov 2015 22:00:28 +0100 > > The variable "res" will eventually be set to a resource pointer from > a call of the d40_hw_detect_init(() function. > Thus let us omit the explicit initialisation at the

Re: [PATCH 01/12] Ext4: Fix extended timestamp encoding and decoding

On Saturday 28 November 2015 21:45:55 Theodore Ts'o wrote: > On Tue, Nov 24, 2015 at 09:10:53PM +0100, Arnd Bergmann wrote: > > On Tuesday 24 November 2015 14:36:46 Theodore Ts'o wrote: > > > This is the patch I would prefer to use (and in fact which I have > > > added to the ext4 tree): > > > > >

Re: [RFC] kvm - possible out of bounds

On Sun, Nov 29, 2015 at 05:14:03PM -0300, Geyslan Gregório Bem wrote: > Hello, > > I have found a possible out of bounds reading in > arch/powerpc/kvm/book3s_64_mmu.c (kvmppc_mmu_book3s_64_xlate > function). pteg[] array could be accessed twice using the i variable > after the for iteration. What

Re: [PATCH] pinctrl: mediatek: fix a memleak when do dt maps.

On Tue, Nov 17, 2015 at 11:33 PM, Hongzhou Yang wrote: > configs will kmemdup to dup_configs in pictrl util function. > So configs need to be freed. > > Signed-off-by: Hongzhou Yang > Reviewed-by: Daniel Kurtz > Reviewed-by: Matthias Brugger > --- > Fix a memleak issue. > According to Yingjo

Re: [PATCH] Improve Atheros ethernet driver not to do order 4 GFP_ATOMIC allocation

Hello. On 11/28/2015 5:51 PM, Pavel Machek wrote: atl1c driver is doing order-4 allocation with GFP_ATOMIC priority. That often breaks networking after resume. Switch to GFP_KERNEL. Still not ideal, but should be significantly better. Signed-off-by: Pavel Machek diff --git a/drivers/net/eth

[PATCH 2.6.32 00/38] 2.6.32.69-longterm review

This is the start of the longterm review cycle for the 2.6.32.69 release. All patches will be posted as a response to this one. If anyone has any issue with these being applied, please let me know. If anyone is a maintainer of the proper subsystem, and wants to add a Signed-off-by: line to the patc

[PATCH 2.6.32 06/38] [PATCH 06/38] USB: whiteheat: fix potential null-deref at probe

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit cbb4be652d374f64661137756b8f357a1827d6a4 upstream. Fix potential null-pointer dereference at probe by making sure that the required endpoints are present. The whiteheat driver assumes ther

[PATCH 2.6.32 34/38] [PATCH 34/38] binfmt_elf: Dont clobber passed executables file header

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit b582ef5c53040c5feef4c96a8f9585b6831e2441 upstream. Do not clobber the buffer space passed from `search_binary_handler' and originally preloaded by `prepare_binprm' with the executable's fil

[PATCH 2.6.32 08/38] [PATCH 08/38] Initialize msg/shm IPC objects before doing ipc_addid()

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit b9a532277938798b53178d5a66af6e2915cb27cf upstream. As reported by Dmitry Vyukov, we really shouldn't do ipc_addid() before having initialized the IPC object state. Yes, we initialize the I

[PATCH 2.6.32 01/38] [PATCH 01/38] dcache: Handle escaped paths in prepend_path

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit cde93be45a8a90d8c264c776fab63487b5038a65 upstream. A rename can result in a dentry that by walking up d_parent will never reach it's mnt_root. For lack of a better term I call this an esca

[PATCH 2.6.32 26/38] [PATCH 26/38] module: Fix locking in symbol_put_addr()

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit 275d7d44d802ef271a42dc87ac091a495ba72fc5 upstream. Poma (on the way to another bug) reported an assertion triggering: [] module_assert_mutex_or_preempt+0x49/0x90 [] __module_address+0x

[PATCH 2.6.32 36/38] [PATCH 36/38] ipmr: fix possible race resulting from improper usage of IP_INC_STATS_BH() in preemptible context.

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- [ Upstream commit 44f49dd8b5a606870a1f21101522a0f9c4414784 ] Fixes the following kernel BUG : BUG: using __this_cpu_add() in preemptible [] code: bash/2758 caller is __this_cpu_preempt_ch

[PATCH 2.6.32 37/38] [PATCH 37/38] net: avoid NULL deref in inet_ctl_sock_destroy()

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- [ Upstream commit 8fa677d2706d325d71dab91bf6e6512c05214e37 ] Under low memory conditions, tcp_sk_init() and icmp_sk_init() can both iterate on all possible cpus and call inet_ctl_sock_destroy(), w

[PATCH 2.6.32 32/38] [PATCH 32/38] HID: core: Avoid uninitialized buffer access

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit 79b568b9d0c7c5d81932f4486d50b38efdd6da6d upstream. hid_connect adds various strings to the buffer but they're all conditional. You can find circumstances where nothing would be written to i

[PATCH 2.6.32 20/38] [PATCH 20/38] hfs,hfsplus: cache pages correctly between bnode_create and bnode_free

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit 7cb74be6fd827e314f81df3c5889b87e4c87c569 upstream. Pages looked up by __hfs_bnode_create() (called by hfs_bnode_create() and hfs_bnode_find() for finding or creating pages corresponding to

[PATCH 2.6.32 18/38] [PATCH 18/38] Input: evdev - do not report errors form flush()

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit eb38f3a4f6e86f8bb10a3217ebd85ecc5d763aae upstream. We've got bug reports showing the old systemd-logind (at least system-210) aborting unexpectedly, and this turned out to be because of an

[PATCH 2.6.32 33/38] [PATCH 33/38] devres: fix a for loop bounds check

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit 1f35d04a02a652f14566f875aef3a6f2af4cb77b upstream. The iomap[] array has PCIM_IOMAP_MAX (6) elements and not DEVICE_COUNT_RESOURCE (16). This bug was found using a static checker. It may b

[PATCH 2.6.32 38/38] [PATCH 38/38] splice: sendfile() at once fails for big files

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit 0ff28d9f4674d781e492bcff6f32f0fe48cf0fed upstream. Using sendfile with below small program to get MD5 sums of some files, it appear that big files (over 64kbytes with 4k pages system) get a

[PATCH 2.6.32 23/38] [PATCH 23/38] RDS: verify the underlying transport exists before creating a connection

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit 74e98eb085889b0d2d4908f59f6e00026063014f upstream. There was no verification that an underlying transport exists when creating a connection, this would cause dereferencing a NULL ptr. It m

[PATCH 2.6.32 21/38] [PATCH 21/38] hfs: fix B-tree corruption after insertion at position 0

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit b4cc0efea4f0bfa2477c56af406cfcf3d3e58680 upstream. Fix B-tree corruption when a new record is inserted at position 0 in the node in hfs_brec_insert(). This is an identical change to the co

[PATCH 2.6.32 14/38] [PATCH 14/38] devres: fix devres_get()

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit 64526370d11ce8868ca495723d595b61e8697fbf upstream. Currently, devres_get() passes devres_free() the pointer to devres, but devres_free() should be given with the pointer to resource data.

[PATCH 2.6.32 22/38] [PATCH 22/38] x86/paravirt: Replace the paravirt nop with a bona fide empty function

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit fc57a7c68020dcf954428869eafd934c0ab1536f upstream. PARAVIRT_ADJUST_EXCEPTION_FRAME generates this code (using nmi as an example, trimmed for readability): ff 15 00 00 00 00 callq

[PATCH 2.6.32 28/38] [PATCH 28/38] mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy a fault

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit 2f84a8990ebbe235c59716896e017c6b2ca1200f upstream. SunDong reported the following on https://bugzilla.kernel.org/show_bug.cgi?id=103841 I think I find a linux bug, I have the te

[PATCH 2.6.32 19/38] [PATCH 19/38] pagemap: hide physical addresses from non-privileged users

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit 1c90308e7a77af6742a97d1021cca923b23b7f0d upstream. This patch makes pagemap readable for normal users and hides physical addresses from them. For some use-cases PFN isn't required at all.

[PATCH 2.6.32 29/38] [PATCH 29/38] tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.c

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit e81107d4c6bd098878af9796b24edc8d4a9524fd upstream. My colleague ran into a program stall on a x86_64 server, where n_tty_read() was waiting for data even if there was data in the buffer in

[PATCH 2.6.32 16/38] [PATCH 16/38] xfs: Fix xfs_attr_leafblock definition

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit ffeecc5213024ae663377b442eedcfbacf6d0c5d upstream. struct xfs_attr_leafblock contains 'entries' array which is declared with size 1 altough it can in fact contain much more entries. Since t

[PATCH 2.6.32 17/38] [PATCH 17/38] SUNRPC: xs_reset_transport must mark the connection as disconnected

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit 0c78789e3a030615c6650fde89546cadf40ec2cc upstream. In case the reconnection attempt fails. Signed-off-by: Trond Myklebust [bwh: Backported to 3.2: add local variable xprt] Signed-off-by:

Re: [RFC] kvm - possible out of bounds

2015-11-29 18:33 GMT-03:00 Paul Mackerras : > On Sun, Nov 29, 2015 at 05:14:03PM -0300, Geyslan Gregório Bem wrote: >> Hello, >> >> I have found a possible out of bounds reading in >> arch/powerpc/kvm/book3s_64_mmu.c (kvmppc_mmu_book3s_64_xlate >> function). pteg[] array could be accessed twice usi

[PATCH 2.6.32 05/38] [PATCH 05/38] virtio-net: drop NETIF_F_FRAGLIST

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit 48900cb6af4282fa0fb6ff4d72a81aa3dadb5c39 upstream. virtio declares support for NETIF_F_FRAGLIST, but assumes that there are at most MAX_SKB_FRAGS + 2 fragments which isn't always true with

[PATCH 2.6.32 31/38] [PATCH 31/38] ethtool: Use kcalloc instead of kmalloc for ethtool_get_strings

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- [ Upstream commit 077cb37fcf6f00a45f375161200b5ee0cd4e937b ] It seems that kernel memory can leak into userspace by a kmalloc, ethtool_get_strings, then copy_to_user sequence. Avoid this by using

[PATCH 2.6.32 35/38] [PATCH 35/38] RDS-TCP: Recover correctly from pskb_pull()/pksb_trim() failure in rds_tcp_data_recv

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- [ Upstream commit 8ce675ff39b9958d1c10f86cf58e357efaafc856 ] Either of pskb_pull() or pskb_trim() may fail under low memory conditions. If rds_tcp_data_recv() ignores such failures, the applicatio

[PATCH 2.6.32 10/38] [PATCH 10/38] rds: fix an integer overflow test in rds_info_getsockopt()

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit 468b732b6f76b138c0926eadf38ac88467dcd271 upstream. "len" is a signed integer. We check that len is not negative, so it goes from zero to INT_MAX. PAGE_SIZE is unsigned long so the compari

[PATCH 2.6.32 11/38] [PATCH 11/38] net: Clone skb before setting peeked flag

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit 738ac1ebb96d02e0d23bc320302a6ea94c612dec upstream. Shared skbs must not be modified and this is crucial for broadcast and/or multicast paths where we use it as an optimisation to avoid unne

[PATCH 2.6.32 04/38] [PATCH 04/38] ipv6: addrconf: validate new MTU before applying it

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit 77751427a1ff25b27d47a4c36b12c3c8667855ac upstream. Currently we don't check if the new MTU is valid or not and this allows one to configure a smaller than minimum allowed by RFCs or even bi

[PATCH 2.6.32 15/38] [PATCH 15/38] windfarm: decrement client count when unregistering

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit fe2b592173ff0274e70dc44d1d28c19bb995aa7c upstream. wf_unregister_client() increments the client count when a client unregisters. That is obviously incorrect. Decrement that client count ins

[PATCH 2.6.32 27/38] [PATCH 27/38] x86/process: Add proper bound checks in 64bit get_wchan()

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit eddd3826a1a0190e5235703d1e666affa4d13b96 upstream. Dmitry Vyukov reported the following using trinity and the memory error detector AddressSanitizer (https://code.google.com/p/address-sanit

[PATCH 2.6.32 07/38] [PATCH 07/38] ipc/sem.c: fully initialize sem_array before making it visible

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit e8577d1f0329d4842e8302e289fb2c22156abef4 upstream. ipc_addid() makes a new ipc identifier visible to everyone. New objects start as locked, so that the caller can complete the initializati

[PATCH 2.6.32 12/38] [PATCH 12/38] net: Fix skb_set_peeked use-after-free bug

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit a0a2a6602496a45ae838a96db8b8173794b5d398 upstream. The commit 738ac1ebb96d02e0d23bc320302a6ea94c612dec ("net: Clone skb before setting peeked flag") introduced a use-after-free bug in skb_r

[PATCH 2.6.32 25/38] [PATCH 25/38] net: add length argument to skb_copy_and_csum_datagram_iovec

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- Without this length argument, we can read past the end of the iovec in memcpy_toiovec because we have no way of knowing the total length of the iovec's buffers. This is needed for stable kernels w

[PATCH 2.6.32 24/38] [PATCH 24/38] net: Fix skb csum races when peeking

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- [ Upstream commit 89c22d8c3b278212eef6a8cc66b570bc840a6f5a ] When we calculate the checksum on the recv path, we store the result in the skb as an optimisation in case we need the checksum again d

[PATCH 2.6.32 03/38] [PATCH 03/38] md: use kzalloc() when bitmap is disabled

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit b6878d9e03043695dbf3fa1caa6dfc09db225b16 upstream. In drivers/md/md.c get_bitmap_file() uses kmalloc() for creating a mdu_bitmap_file_t called "file". 5769 file = kmalloc(sizeof(*f

[PATCH 2.6.32 13/38] [PATCH 13/38] ipc,sem: fix use after free on IPC_RMID after a task using same semaphore set exits

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit 602b8593d2b4138c10e922eeaafe306f6b51817b upstream. The current semaphore code allows a potential use after free: in exit_sem we may free the task's sem_undo_list while there is still anothe

[PATCH 0/3] constify mmu_notifier_ops structures

mmu_notifier_ops structures are never modified, so declare them all as const. --- drivers/infiniband/core/umem_odp.c |2 +- drivers/iommu/amd_iommu_v2.c |2 +- drivers/xen/gntdev.c |2 +- 3 files changed, 3 insertions(+), 3 deletions(-) -- To unsubscribe from this

[PATCH 3/3] IB/core: constify mmu_notifier_ops structures

This mmu_notifier_ops structure is never modified, so declare it as const, like the other mmu_notifier_ops structures. Done with the help of Coccinelle. Signed-off-by: Julia Lawall --- The patches in this series are independent of each other. drivers/infiniband/core/umem_odp.c |2 +- 1 fi

[PATCH 2/3] iommu/amd: constify mmu_notifier_ops structures

This mmu_notifier_ops structure is never modified, so declare it as const, like the other mmu_notifier_ops structures. Done with the help of Coccinelle. Signed-off-by: Julia Lawall --- The patches in this series are independent of each other. drivers/iommu/amd_iommu_v2.c |2 +- 1 file cha

[PATCH 1/3] xen/gntdev: constify mmu_notifier_ops structures

This mmu_notifier_ops structure is never modified, so declare it as const, like the other mmu_notifier_ops structures. Done with the help of Coccinelle. Signed-off-by: Julia Lawall --- The patches in this series are independent of each other. drivers/xen/gntdev.c |2 +- 1 file changed, 1

Adding VIRTIO to the multi_v7_defconfig

Hi, I started a small project to test as many QEMU emulated ARM boards using the multi_v7 defconfig: https://lists.gnu.org/archive/html/qemu-devel/2015-10/msg00755.html One thing that came up was we cannot use the virt board as it relies on virtio hotplug and drivers to get block and network sup

Re: [radeon r100] when ring test fails, provide users with option to test

On Sun 2015-11-29 20:48:53, Christian König wrote: > On 28.11.2015 21:58, Pavel Machek wrote: > >Ring test failure is often caused by too high agpmode. Tell the user > >what to try. > > > >Signed-off-by: Pavel Machek > > NAK, the ring test can fail for any number of reasons and the agpmode is > a

Re: [PATCH v2 0/3] Add PWM clock support for bcm2835

On Sun, Nov 29, 2015 at 10:22:40PM +0100, Stefan Wahren wrote: > Hi Remi, > > Am 29.11.2015 um 01:31 schrieb Remi Pommarel: > >Hi Stefan, > > > >On Sat, Nov 28, 2015 at 09:52:07PM +0100, Stefan Wahren wrote: > >>i applied the series including the devicetree modification, but it > >>doesn't work fo

Re: Adding VIRTIO to the multi_v7_defconfig

On Sunday 29 November 2015 14:18:24 Peter Crosthwaite wrote: > > I started a small project to test as many QEMU emulated ARM boards > using the multi_v7 defconfig: > > https://lists.gnu.org/archive/html/qemu-devel/2015-10/msg00755.html > > One thing that came up was we cannot use the virt board

user controllable usermodehelper in br_stp_if.c

Hi! By spawning new network and user namesapces an unprivileged user is able to execute /sbin/bridge-stp within the initial mount namespace with global root rights. While this cannot directly be used to break out of a container or gain global root rights it could be used by exploit writers as valu

Re: Adding VIRTIO to the multi_v7_defconfig

On Sun, Nov 29, 2015 at 2:31 PM, Arnd Bergmann wrote: > On Sunday 29 November 2015 14:18:24 Peter Crosthwaite wrote: >> >> I started a small project to test as many QEMU emulated ARM boards >> using the multi_v7 defconfig: >> >> https://lists.gnu.org/archive/html/qemu-devel/2015-10/msg00755.html >

Re: [PATCH 5/5] arm: boot: store ATAGs structure into DT "/chosen/linux,atags" entry

On Sun, Nov 29, 2015 at 07:19:18PM +0100, Pali Rohár wrote: > On Sunday 29 November 2015 19:09:39 Russell King - ARM Linux wrote: > > On Sat, Nov 28, 2015 at 12:34:23PM -0500, Nicolas Pitre wrote: > > > Good. And Arnd likes the idea too. So we might be converging at > > > last which is a good thing

Re: Adding VIRTIO to the multi_v7_defconfig

On Sunday 29 November 2015 14:56:53 Peter Crosthwaite wrote: > > So minimally I am looking for: > > CONFIG_VIRTIO_PCI=y" > CONFIG_VIRTIO_BLK=y" > CONFIG_VIRTIO_NET=y" > > As that gets you booted with network without needing initrd. I guess > the rest of VIRTIO makes more sense as modules as foll

Re: gigaset: freeing an active object

On zo, 2015-11-29 at 21:26 +0100, Paul Bolle wrote: > If the above is correct it would be nice to know the .config of the > kernel used by syzkaller. > > Anyhow, without further details of the chain of events that triggered > this warning, I'm afraid it will be hard to determine which struct > tim

Re: [PATCH kernel] rcu: Define lockless version of list_for_each_entry_rcu

On Wed, Nov 18, 2015 at 11:13:28AM -0800, Paul E. McKenney wrote: > On Fri, Nov 06, 2015 at 01:17:17PM +1100, Alexey Kardashevskiy wrote: [snip] > > Still, is my approach correct? What does the comment for > > lockless_dereference() actally mean - it won't work together with > > RCU at all or this

Re: [PATCH 5/5] arm: boot: store ATAGs structure into DT "/chosen/linux,atags" entry

On Sun, 29 Nov 2015, Russell King - ARM Linux wrote: > On Sat, Nov 28, 2015 at 12:34:23PM -0500, Nicolas Pitre wrote: > > Good. And Arnd likes the idea too. So we might be converging at last > > which is a good thing. > > I disagree with the idea that there is convergence. There might be > conv

Re: [PATCH 5/5] arm: boot: store ATAGs structure into DT "/chosen/linux,atags" entry

On Monday 30 November 2015 01:09:17 Nicolas Pitre wrote: > On Sun, 29 Nov 2015, Russell King - ARM Linux wrote: > > On Sat, Nov 28, 2015 at 12:34:23PM -0500, Nicolas Pitre wrote: > > > Good. And Arnd likes the idea too. So we might be converging at > > > last which is a good thing. > > > > I disag

Re: [PATCH] target: use offset_in_page macro

Hi Geliang, On Wed, 2015-11-25 at 21:49 +0800, Geliang Tang wrote: > Use offset_in_page macro instead of (addr & ~PAGE_MASK). > > Signed-off-by: Geliang Tang > --- > drivers/target/target_core_user.c | 2 +- > drivers/target/tcm_fc/tfc_io.c| 8 > 2 files changed, 5 insertions(+), 5

Re: [PATCH v3] clocksource: arm_global_timer: fix suspend resume

On 11/27/15 11:47 AM, Grygorii Strashko wrote: Now the System stall is observed on TI AM437x based board (am437x-gp-evm) during resuming from System suspend when ARM Global timer is selected as clocksource device (CPUIdle not enabled) - SysRq are working, but nothing else. The reason of stall i

Re: [PATCH 2/2] PCI support added to ARC

On Wed, Nov 25, 2015 at 05:25:37AM +, Vineet Gupta wrote: > On Tuesday 24 November 2015 08:02 PM, Joao Pinto wrote: > > +++ b/arch/arc/include/asm/mach/pci.h > > @@ -0,0 +1,97 @@ > > +/* > > + * arch/arc/include/asm/mach/pci.h > > + * > > + * Copyright (C) 2004-2014 Synopsys, Inc. (www.synop

[PATCH net] bpf: fix allocation warnings in bpf maps and integer overflow

From: Alexei Starovoitov For large map->value_size the user space can trigger memory allocation warnings like: WARNING: CPU: 2 PID: 11122 at mm/page_alloc.c:2989 __alloc_pages_nodemask+0x695/0x14e0() Call Trace: [< inline >] __dump_stack lib/dump_stack.c:15 [] dump_stack+0x68/0x92 lib/

Re: [PATCH] x86/PCI: Fix regression caused by commit 4d6b4e69a245

On 2015/11/28 0:06, Rafael J. Wysocki wrote: > On Friday, November 27, 2015 11:12:33 AM Jiang Liu wrote: >> From: Liu Jiang >> >> Commit 4d6b4e69a245 ("x86/PCI/ACPI: Use common interface to support >> PCI host bridge") converted x86 to use the common interface >> acpi_pci_root_create, but the conv

[PATCH] ARM: mxs: dt: cfa10057: fix backlight PWM

The backlight PWM is actually pwm4. Signed-off-by: Alexandre Belloni --- arch/arm/boot/dts/imx28-cfa10057.dts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/arm/boot/dts/imx28-cfa10057.dts b/arch/arm/boot/dts/imx28-cfa10057.dts index 5df0b24eaf59..3bc34cdb9269 10

[PATCH 2.6.32 09/38] [PATCH 09/38] xhci: fix off by one error in TRB DMA address boundary check

2.6.32-longterm review patch. If anyone has any objections, please let me know. -- commit 7895086afde2a05fa24a0e410d8e6b75ca7c8fdd upstream. We need to check that a TRB is part of the current segment before calculating its DMA address. Previously a ring segment didn't use a ful

[PATCH v4] mmc: core: fix __mmc_switch timeout caused by preempt

there is a time window between __mmc_send_status() and time_afer(), on some eMMC chip, the timeout_ms is only 10ms, if this thread was scheduled out during this period, then, even card has already changes to transfer state by the result of CMD13, this part of code also treat it to timeout error. So

<    1   2   3   4   >