[PATCH 3.10 029/143] 8250: use callbacks to access UART_DLL/UART_DLM

2016-06-05 Thread Willy Tarreau
From: Sebastian Frias commit 0b41ce991052022c030fd868e03877700220b090 upstream. Some UART HW has a single register combining UART_DLL/UART_DLM (this was probably forgotten in the change that introduced the callbacks, commit b32b19b8ffc05cbd3bf91c65e205f6a912ca15d9) Fixes: b32b19b8ffc0 ("[SERIAL

[PATCH 3.10 005/143] x86: LLVMLinux: Fix "incomplete type const struct x86cpu_device_id"

2016-06-05 Thread Willy Tarreau
From: Behan Webster commit c4586256f0c440bc2bdb29d2cbb915f0ca785d26 upstream. Similar to the fix in 40413dcb7b273bda681dca38e6ff0bbb3728ef11 MODULE_DEVICE_TABLE(x86cpu, ...) expects the struct to be called struct x86cpu_device_id, and not struct x86_cpu_id which is what is used in the rest of t

[PATCH 3.10 021/143] USB: mct_u232: add sanity checking in probe

2016-06-05 Thread Willy Tarreau
From: Oliver Neukum commit 4e9a0b05257f29cf4b75f3209243ed71614d062e upstream. An attack using the lack of sanity checking in probe is known. This patch checks for the existence of a second port. CVE-2016-3136 Signed-off-by: Oliver Neukum CC: sta...@vger.kernel.org [johan: add error message ]

[PATCH 3.10 015/143] aacraid: Fix memory leak in aac_fib_map_free

2016-06-05 Thread Willy Tarreau
From: Raghava Aditya Renukunta commit f88fa79a61726ce9434df9b4aede36961f709f17 upstream. aac_fib_map_free() calls pci_free_consistent() without checking that dev->hw_fib_va is not NULL and dev->max_fib_size is not zero.If they are indeed NULL/0, this will result in a hang as pci_free_consistent(

[PATCH 3.10 094/143] paride: make 'verbose' parameter an 'int' again

2016-06-05 Thread Willy Tarreau
From: Arnd Bergmann commit dec63a4dec2d6d01346fd5d96062e67c0636852b upstream. gcc-6.0 found an ancient bug in the paride driver, which had a "module_param(verbose, bool, 0);" since before 2.6.12, but actually uses it to accept '0', '1' or '2' as arguments: drivers/block/paride/pd.c: In functi

[PATCH 3.10 013/143] x86/iopl: Fix iopl capability check on Xen PV

2016-06-05 Thread Willy Tarreau
From: Andy Lutomirski commit c29016cf41fe9fa994a5ecca607cf5f1cd98801e upstream. iopl(3) is supposed to work if iopl is already 3, even if unprivileged. This didn't work right on Xen PV. Fix it. Reviewewd-by: Jan Beulich Signed-off-by: Andy Lutomirski Cc: Andrew Cooper Cc: Andy Lutomirski

[PATCH 3.10 002/143] x86/iopl/64: Properly context-switch IOPL on Xen PV

2016-06-05 Thread Willy Tarreau
From: Kamal Mostafa commit b7a584598aea7ca73140cb87b40319944dd3393f upstream. From: Andy Lutomirski On Xen PV, regs->flags doesn't reliably reflect IOPL and the exit-to-userspace code doesn't change IOPL. We need to context switch it manually. I'm doing this without going through paravirt be

[PATCH 3.10 117/143] crypto: hash - Fix page length clamping in hash walk

2016-06-05 Thread Willy Tarreau
From: Herbert Xu commit 13f4bb78cf6a312bbdec367ba3da044b09bf0e29 upstream. The crypto hash walk code is broken when supplied with an offset greater than or equal to PAGE_SIZE. This patch fixes it by adjusting walk->pg and walk->offset when this happens. Cc: Reported-by: Steffen Klassert Sign

[PATCH 3.10 071/143] qmi_wwan: add "D-Link DWM-221 B1" device id

2016-06-05 Thread Willy Tarreau
From: Bjørn Mork commit e84810c7b85a2d7897797b3ad3e879168a8e032a upstream. Thomas reports: "Windows: 00 diagnostics 01 modem 02 at-port 03 nmea 04 nic Linux: T: Bus=02 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vend

[PATCH 3.10 045/143] tracing: Fix crash from reading trace_pipe with sendfile

2016-06-05 Thread Willy Tarreau
From: "Steven Rostedt (Red Hat)" commit a29054d9478d0435ab01b7544da4f674ab13f533 upstream. If tracing contains data and the trace_pipe file is read with sendfile(), then it can trigger a NULL pointer dereference and various BUG_ON within the VM code. There's a patch to fix this in the splice_to

[PATCH 3.10 135/143] mmc: mmc: Fix partition switch timeout for some eMMCs

2016-06-05 Thread Willy Tarreau
From: Adrian Hunter commit 1c447116d017a98c90f8f71c8c5a611e0aa42178 upstream. Some eMMCs set the partition switch timeout too low. Now typically eMMCs are considered a critical component (e.g. because they store the root file system) and consequently are expected to be reliable. Thus we can ne

[PATCH 3.10 086/143] nl80211: check netlink protocol in socket release notification

2016-06-05 Thread Willy Tarreau
From: Dmitry Ivanov commit 8f815cdde3e550e10c2736990d791f60c2ce43eb upstream. A non-privileged user can create a netlink socket with the same port_id as used by an existing open nl80211 netlink socket (e.g. as used by a hostapd process) with a different protocol number. Closing this socket will

[PATCH 3.10 092/143] workqueue: fix ghost PENDING flag while doing MQ IO

2016-06-05 Thread Willy Tarreau
From: Roman Pen commit 346c09f80459a3ad97df1816d6d606169a51001a upstream. The bug in a workqueue leads to a stalled IO request in MQ ctx->rq_list with the following backtrace: [ 601.347452] INFO: task kworker/u129:5:1636 blocked for more than 120 seconds. [ 601.347574] Tainted: G

[PATCH 3.10 129/143] net: bridge: fix old ioctl unlocked net device walk

2016-06-05 Thread Willy Tarreau
From: Nikolay Aleksandrov commit 31ca0458a61a502adb7ed192bf9716c6d05791a5 upstream. get_bridge_ifindices() is used from the old "deviceless" bridge ioctl calls which aren't called with rtnl held. The comment above says that it is called with rtnl but that is not really the case. Here's a sample

[PATCH 3.10 119/143] Input: max8997-haptic - fix NULL pointer dereference

2016-06-05 Thread Willy Tarreau
From: Marek Szyprowski commit 6ae645d5fa385f3787bf1723639cd907fe5865e7 upstream. NULL pointer derefence happens when booting with DTB because the platform data for haptic device is not set in supplied data from parent MFD device. The MFD device creates only platform data (from Device Tree) for

[PATCH 3.10 137/143] Bluetooth: vhci: purge unhandled skbs

2016-06-05 Thread Willy Tarreau
From: Jiri Slaby commit 13407376b255325fa817798800117a839f3aa055 upstream. The write handler allocates skbs and queues them into data->readq. Read side should read them, if there is any. If there is none, skbs should be dropped by hdev->flush. But this happens only if the device is HCI_UP, i.e.

[PATCH 3.10 100/143] Drivers: hv: vmbus: prevent cpu offlining on newer hypervisors

2016-06-05 Thread Willy Tarreau
From: Vitaly Kuznetsov commit e513229b4c386e6c9f66298c13fde92f73e6e1ac upstream. When an SMP Hyper-V guest is running on top of 2012R2 Server and secondary cpus are sent offline (with echo 0 > /sys/devices/system/cpu/cpu$cpu/online) the system freeze is observed. This happens due to the fact tha

[PATCH 3.10 127/143] net: fix infoleak in rtnetlink

2016-06-05 Thread Willy Tarreau
From: Kangjie Lu commit 5f8e44741f9f216e33736ea4ec65ca9ac03036e6 upstream. The stack object “map” has a total size of 32 bytes. Its last 4 bytes are padding generated by compiler. These padding bytes are not initialized and sent out via “nla_put”. Signed-off-by: Kangjie Lu Signed-off-b

[PATCH 3.10 110/143] batman-adv: Fix broadcast/ogm queue limit on a removed interface

2016-06-05 Thread Willy Tarreau
From: Linus Lüssing commit c4fdb6cff2aa0ae740c5f19b6f745cbbe786d42f upstream. When removing a single interface while a broadcast or ogm packet is still pending then we will free the forward packet without releasing the queue slots again. This patch is supposed to fix this issue. Fixes: 6d5808d

[PATCH 3.10 041/143] ipr: Fix out-of-bounds null overwrite

2016-06-05 Thread Willy Tarreau
From: Insu Yun commit d63c7dd5bcb9441af0526d370c43a65ca2c980d9 upstream. Return value of snprintf is not bound by size value, 2nd argument. (https://www.kernel.org/doc/htmldocs/kernel-api/API-snprintf.html). Return value is number of printed chars, can be larger than 2nd argument. Therefore, it

[PATCH 3.10 111/143] MAINTAINERS: Remove asterisk from EFI directory names

2016-06-05 Thread Willy Tarreau
From: Matt Fleming commit e8dfe6d8f6762d515fcd4f30577f7bfcf7659887 upstream. Mark reported that having asterisks on the end of directory names confuses get_maintainer.pl when it encounters subdirectories, and that my name does not appear when run on drivers/firmware/efi/libstub. Reported-by: Ma

[PATCH 3.10 032/143] ALSA: intel8x0: Add clock quirk entry for AD1981B on IBM ThinkPad X41.

2016-06-05 Thread Willy Tarreau
From: "Vittorio Gambaletta (VittGam)" commit 4061db03dd71d195b9973ee466f6ed32f6a3fc16 upstream. The clock measurement on the AC'97 audio card found in the IBM ThinkPad X41 will often fail, so add a quirk entry to fix it. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=441087 Cc: Signed-o

[PATCH 3.10 070/143] ppp: take reference on channels netns

2016-06-05 Thread Willy Tarreau
From: Guillaume Nault commit 1f461dcdd296eecedac6bae2bfa90bd7eb89 upstream. Let channels hold a reference on their network namespace. Some channel types, like ppp_async and ppp_synctty, can have their userspace controller running in a different namespace. Therefore they can't rely on them to

[PATCH 3.10 131/143] fs/cifs: correctly to anonymous authentication via NTLMSSP

2016-06-05 Thread Willy Tarreau
From: Stefan Metzmacher commit cfda35d98298131bf38fbad3ce4cd5ecb3cf18db upstream. See [MS-NLMP] 3.2.5.1.2 Server Receives an AUTHENTICATE_MESSAGE from the Client: ... Set NullSession to FALSE If (AUTHENTICATE_MESSAGE.UserNameLen == 0 AND AUTHENTICATE_MESSAGE.NtChallengeResponse.L

[PATCH 3.10 126/143] net: fix infoleak in llc

2016-06-05 Thread Willy Tarreau
From: Kangjie Lu commit b8670c09f37bdf2847cc44f36511a53afc6161fd upstream. The stack object “info” has a total size of 12 bytes. Its last byte is padding which is not initialized and leaked via “put_cmsg”. Signed-off-by: Kangjie Lu Signed-off-by: David S. Miller Signed-off-by: Willy T

[PATCH 3.10 039/143] md/raid5: Compare apples to apples (or sectors to sectors)

2016-06-05 Thread Willy Tarreau
From: Jes Sorensen commit e7597e69dec59b65c5525db1626b9d34afdfa678 upstream. 'max_discard_sectors' is in sectors, while 'stripe' is in bytes. This fixes the problem where DISCARD would get disabled on some larger RAID5 configurations (6 or more drives in my testing), while it worked as expected

[PATCH 3.10 108/143] ARM: SoCFPGA: Fix secondary CPU startup in thumb2 kernel

2016-06-05 Thread Willy Tarreau
From: Sascha Hauer commit 5616f36713ea77f57ae908bf2fef641364403c9f upstream. The secondary CPU starts up in ARM mode. When the kernel is compiled in thumb2 mode we have to explicitly compile the secondary startup trampoline in ARM mode, otherwise the CPU will go to Nirvana. Signed-off-by: Sasch

[PATCH 3.10 065/143] sh_eth: fix NULL pointer dereference in sh_eth_ring_format()

2016-06-05 Thread Willy Tarreau
From: Sergei Shtylyov commit c1b7fca65070bfadca94dd53a4e6b71cd4f69715 upstream. In a low memory situation, if netdev_alloc_skb() fails on a first RX ring loop iteration in sh_eth_ring_format(), 'rxdesc' is still NULL. Avoid kernel oops by adding the 'rxdesc' check after the loop. Reported-by:

[PATCH 3.10 019/143] USB: iowarrior: fix oops with malicious USB descriptors

2016-06-05 Thread Willy Tarreau
From: Josh Boyer commit 4ec0ef3a82125efc36173062a50624550a900ae0 upstream. The iowarrior driver expects at least one valid endpoint. If given malicious descriptors that specify 0 for the number of endpoints, it will crash in the probe function. Ensure there is at least one endpoint on the inte

[PATCH 3.10 082/143] usbvision: fix crash on detecting device with invalid configuration

2016-06-05 Thread Willy Tarreau
From: Vladis Dronov commit fa52bd506f274b7619955917abfde355e3d19ffe upstream. The usbvision driver crashes when a specially crafted usb device with invalid number of interfaces or endpoints is detected. This fix adds checks that the device has proper configuration expected by the driver. Report

[PATCH 3.10 139/143] USB: serial: quatech2: fix use-after-free in probe error path

2016-06-05 Thread Willy Tarreau
From: Johan Hovold commit 028c49f5e02a257c94129cd815f7c8485f51d4ef upstream. The interface read URB is submitted in attach, but was only unlinked by the driver at disconnect. In case of a late probe error (e.g. due to failed minor allocation), disconnect is never called and we would end up with

[PATCH 3.10 052/143] mtd: onenand: fix deadlock in onenand_block_markbad

2016-06-05 Thread Willy Tarreau
From: Aaro Koskinen commit 5e64c29e98bfbba1b527b0a164f9493f3db9e8cb upstream. Commit 5942ddbc500d ("mtd: introduce mtd_block_markbad interface") incorrectly changed onenand_block_markbad() to call mtd_block_markbad instead of onenand_chip's block_markbad function. As a result the function will n

[PATCH 3.10 067/143] farsync: fix off-by-one bug in fst_add_one

2016-06-05 Thread Willy Tarreau
From: Arnd Bergmann commit e725a66c0202b5f36c2f9d59d26a65c53bbf21f7 upstream. gcc-6 finds an out of bounds access in the fst_add_one function when calculating the end of the mmio area: drivers/net/wan/farsync.c: In function 'fst_add_one': drivers/net/wan/farsync.c:418:53: error: index 2 denotes

[PATCH 3.10 068/143] ath9k: fix buffer overrun for ar9287

2016-06-05 Thread Willy Tarreau
From: Arnd Bergmann commit 83d6f1f15f8cce844b0a131cbc63e444620e48b5 upstream. Code that was added back in 2.6.38 has an obvious overflow when accessing a static array, and at the time it was added only a code comment was put in front of it as a reminder to have it reviewed properly. This has no

[PATCH 3.10 099/143] include/linux/poison.h: fix LIST_POISON{1,2} offset

2016-06-05 Thread Willy Tarreau
From: Vasily Kulikov commit 8a5e5e02fc83aaf67053ab53b359af08c6c49aaf upstream. Poison pointer values should be small enough to find a room in non-mmap'able/hardly-mmap'able space. E.g. on x86 "poison pointer space" is located starting from 0x0. Given unprivileged users cannot mmap anything be

[PATCH 3.10 136/143] mmc: longer timeout for long read time quirk

2016-06-05 Thread Willy Tarreau
From: Matt Gumbel commit 32ecd320db39bcb007679ed42f283740641b81ea upstream. 008GE0 Toshiba mmc in some Intel Baytrail tablets responds to MMC_SEND_EXT_CSD in 450-600ms. This patch will... () Increase the long read time quirk timeout from 300ms to 600ms. Original author of that quirk says 30

[PATCH 3.10 042/143] ipr: Fix regression when loading firmware

2016-06-05 Thread Willy Tarreau
From: Gabriel Krisman Bertazi commit 21b81716c6bff24cda52dc75588455f879ddbfe9 upstream. Commit d63c7dd5bcb9 ("ipr: Fix out-of-bounds null overwrite") removed the end of line handling when storing the update_fw sysfs attribute. This changed the userpace API because it started refusing writes term

[PATCH 3.10 091/143] efi: Fix out-of-bounds read in variable_matches()

2016-06-05 Thread Willy Tarreau
From: Laszlo Ersek commit 630ba0cc7a6dbafbdee43795617c872b35cde1b4 upstream. The variable_matches() function can currently read "var_name[len]", for example when: - var_name[0] == 'a', - len == 1 - match_name points to the NUL-terminated string "ab". This function is supposed to accept "var

[PATCH 3.10 078/143] HID: usbhid: fix inconsistent reset/resume/reset-resume behavior

2016-06-05 Thread Willy Tarreau
From: Alan Stern commit 972e6a993f278b416a8ee3ec65475724fc36feb2 upstream. The usbhid driver has inconsistently duplicated code in its post-reset, resume, and reset-resume pathways. reset-resume doesn't check HID_STARTED before trying to restart the I/O queues. resume f

[PATCH 3.10 085/143] crypto: gcm - Fix rfc4543 decryption crash

2016-06-05 Thread Willy Tarreau
From: Herbert Xu This bug has already bee fixed upstream since 4.2. However, it was fixed during the AEAD conversion so no fix was backported to the older kernels. When we do an RFC 4543 decryption, we will end up writing the ICV beyond the end of the dst buffer. This should lead to a crash bu

[PATCH 3.10 072/143] ipv4: l2tp: fix a potential issue in l2tp_ip_recv

2016-06-05 Thread Willy Tarreau
From: Haishuang Yan commit 5745b8232e942abd5e16e85fa9b27cc21324acf0 upstream. pskb_may_pull() can change skb->data, so we have to load ptr/optr at the right place. Signed-off-by: Haishuang Yan Signed-off-by: David S. Miller Signed-off-by: Willy Tarreau --- net/l2tp/l2tp_ip.c | 8 +--- 1

[PATCH 3.10 142/143] tty: vt, return error when con_startup fails

2016-06-05 Thread Willy Tarreau
From: Jiri Slaby commit 6798df4c5fe0a7e6d2065cf79649a794e5ba7114 upstream. When csw->con_startup() fails in do_register_con_driver, we return no error (i.e. 0). This was changed back in 2006 by commit 3e795de763. Before that we used to return -ENODEV. So fix the return value to be -ENODEV in th

[PATCH 3.10 093/143] USB: usbip: fix potential out-of-bounds write

2016-06-05 Thread Willy Tarreau
From: Ignat Korchagin commit b348d7dddb6c4fbfc810b7a0626e8ec9e29f7cbb upstream. Fix potential out-of-bounds write to urb->transfer_buffer usbip handles network communication directly in the kernel. When receiving a packet from its peer, usbip code parses headers according to protocol. As part of

[PATCH 3.10 097/143] rtc: vr41xx: Wire up alarm_irq_enable

2016-06-05 Thread Willy Tarreau
From: Geert Uytterhoeven commit a25f4a95ec3cded34c1250364eba704c5e4fdac4 upstream. drivers/rtc/rtc-vr41xx.c:229: warning: ‘vr41xx_rtc_alarm_irq_enable’ defined but not used Apparently the conversion to alarm_irq_enable forgot to wire up the callback. Fixes: 16380c153a69c378 ("RTC: Convert

[PATCH 3.10 125/143] atl2: Disable unimplemented scatter/gather feature

2016-06-05 Thread Willy Tarreau
From: Ben Hutchings commit f43bfaeddc79effbf3d0fcb53ca477cca66f3db8 upstream. atl2 includes NETIF_F_SG in hw_features even though it has no support for non-linear skbs. This bug was originally harmless since the driver does not claim to implement checksum offload and that used to be a requireme

[PATCH 3.10 044/143] tracing: Have preempt(irqs)off trace preempt disabled functions

2016-06-05 Thread Willy Tarreau
From: "Steven Rostedt (Red Hat)" commit cb86e05390debcc084cfdb0a71ed4c5dbbec517d upstream. Joel Fernandes reported that the function tracing of preempt disabled sections was not being reported when running either the preemptirqsoff or preemptoff tracers. This was due to the fact that the functio

[PATCH 3.10 038/143] xtensa: clear all DBREAKC registers on start

2016-06-05 Thread Willy Tarreau
From: Max Filippov commit 7de7ac785ae18a2cdc78d7560f48e3213d9ea0ab upstream. There are XCHAL_NUM_DBREAK registers, clear them all. This also fixes cryptic assembler error message with binutils 2.25 when XCHAL_NUM_DBREAK is 0: as: out of memory allocating 18446744073709551575 bytes after a tot

[PATCH 3.10 018/143] USB: cdc-acm: more sanity checking

2016-06-05 Thread Willy Tarreau
From: Oliver Neukum commit 8835ba4a39cf53f705417b3b3a94eb067673f2c9 upstream. An attack has become available which pretends to be a quirky device circumventing normal sanity checks and crashes the kernel by an insufficient number of interfaces. This patch adds a check to the code path for quirky

[PATCH 3.10 075/143] usb: renesas_usbhs: avoid NULL pointer derefernce in usbhsf_pkt_handler()

2016-06-05 Thread Willy Tarreau
From: Yoshihiro Shimoda commit 894f2fc44f2f3f48c36c973b1123f6ab298be160 upstream. When unexpected situation happened (e.g. tx/rx irq happened while DMAC is used), the usbhsf_pkt_handler() was possible to cause NULL pointer dereference like the followings: Unable to handle kernel NULL pointer de

[PATCH 3.10 004/143] compiler-gcc: integrate the various compiler-gcc[345].h files

2016-06-05 Thread Willy Tarreau
From: Joe Perches commit cb984d101b30eb7478d32df56a0023e4603cba7f upstream. As gcc major version numbers are going to advance rather rapidly in the future, there's no real value in separate files for each compiler version. Deduplicate some of the macros #defined in each file too. Neaten commen

[PATCH 3.10 031/143] media: v4l2-compat-ioctl32: fix missing length copy in put_v4l2_buffer32

2016-06-05 Thread Willy Tarreau
From: Tiffany Lin commit 7df5ab8774aa383c6d2bff00688d004585d96dfd upstream. In v4l2-compliance utility, test QUERYBUF required correct length value to go through each planar to check planar's length in multi-planar buffer type Signed-off-by: Tiffany Lin Reviewed-by: Laurent Pinchart Signed-of

[PATCH 3.10 069/143] qlge: Fix receive packets drop.

2016-06-05 Thread Willy Tarreau
From: Manish Chopra commit 2c9a266afefe137bff06bbe0fc48b4d3b3cb348c upstream. When running small packets [length < 256 bytes] traffic, packets were being dropped due to invalid data in those packets which were delivered by the driver upto the stack. Using pci_dma_sync_single_for_cpu ensures copy

[PATCH 3.10 062/143] cdc_ncm: toggle altsetting to force reset before setup

2016-06-05 Thread Willy Tarreau
From: Bjørn Mork commit 48906f62c96cc2cd35753e59310cb70eb08cc6a5 upstream. Some devices will silently fail setup unless they are reset first. This is necessary even if the data interface is already in altsetting 0, which it will be when the device is probed for the first time. Briefly toggling

[PATCH 3.10 084/143] usb: hcd: out of bounds access in for_each_companion

2016-06-05 Thread Willy Tarreau
From: Robert Dobrowolski commit e86103a75705c7c530768f4ffaba74cf382910f2 upstream. On BXT platform Host Controller and Device Controller figure as same PCI device but with different device function. HCD should not pass data to Device Controller but only to Host Controllers. Checking if companion

[PATCH 3.10 066/143] net: Fix use after free in the recvmmsg exit path

2016-06-05 Thread Willy Tarreau
From: Arnaldo Carvalho de Melo commit 34b88a68f26a75e4fded796f1a49c40f82234b7d upstream. The syzkaller fuzzer hit the following use-after-free: Call Trace: [] __asan_report_load8_noabort+0x3e/0x40 mm/kasan/report.c:295 [] __sys_recvmmsg+0x6fa/0x7f0 net/socket.c:2261 [< inline

[PATCH 3.10 057/143] parisc: Fix kernel crash with reversed copy_from_user()

2016-06-05 Thread Willy Tarreau
From: Helge Deller commit ef72f3110d8b19f4c098a0bff7ed7d11945e70c6 upstream. The kernel module testcase (lib/test_user_copy.c) exhibited a kernel crash on parisc if the parameters for copy_from_user were reversed ("illegal reversed copy_to_user" testcase). Fix this potential crash by checking t

[PATCH 3.10 043/143] drm/radeon: Don't drop DP 2.7 Ghz link setup on some cards.

2016-06-05 Thread Willy Tarreau
From: Mario Kleiner commit 459ee1c3fd097ab56ababd8ff4bb7ef6a792de33 upstream. As observed on Apple iMac10,1, DCE-3.2, RV-730, link rate of 2.7 Ghz is not selected, because the args.v1.ucConfig flag setting for 2.7 Ghz gets overwritten by a following assignment of the transmitter to use. Move li

[PATCH 3.10 040/143] rapidio/rionet: fix deadlock on SMP

2016-06-05 Thread Willy Tarreau
From: Aurelien Jacquiot commit 36915976eca58f2eefa040ba8f9939672564df61 upstream. Fix deadlocking during concurrent receive and transmit operations on SMP platforms caused by the use of incorrect lock: on transmit 'tx_lock' spinlock should be used instead of 'lock' which is used for receive oper

[PATCH 3.10 034/143] bcache: fix cache_set_flush() NULL pointer dereference on OOM

2016-06-05 Thread Willy Tarreau
From: Eric Wheeler commit f8b11260a445169989d01df75d35af0f56178f95 upstream. When bch_cache_set_alloc() fails to kzalloc the cache_set, the asyncronous closure handling tries to dereference a cache_set that hadn't yet been allocated inside of cache_set_flush() which is called by __cache_set_unre

[PATCH 3.10 010/143] linux/const.h: Add _BITUL() and _BITULL()

2016-06-05 Thread Willy Tarreau
From: "H. Peter Anvin" commit 2fc016c5bd8aad2e201cdf71b9fb4573f94775bd upstream. Add macros for single bit definitions of a specific type. These are similar to the BIT() macro that already exists, but with a few exceptions: 1. The namespace is such that they can be used in uapi definitions. 2.

[PATCH 3.10 033/143] jbd2: fix FS corruption possibility in jbd2_journal_destroy() on umount path

2016-06-05 Thread Willy Tarreau
From: OGAWA Hirofumi commit c0a2ad9b50dd80eeccd73d9ff962234590d5ec93 upstream. On umount path, jbd2_journal_destroy() writes latest transaction ID (->j_tail_sequence) to be used at next mount. The bug is that ->j_tail_sequence is not holding latest transaction ID in some cases. So, at next moun

[PATCH 3.10 017/143] usb: retry reset if a device times out

2016-06-05 Thread Willy Tarreau
From: Oliver Neukum commit 264904ccc33c604d4b3141bbd33808152dfac45b upstream. Some devices I got show an inability to operate right after power on if they are already connected. They are beyond recovery if the descriptors are requested multiple times. So in case of a timeout we rather bail early

[PATCH 3.10 037/143] xtensa: ISS: don't hang if stdin EOF is reached

2016-06-05 Thread Willy Tarreau
From: Max Filippov commit 362014c8d9d51d504c167c44ac280169457732be upstream. Simulator stdin may be connected to a file, when its end is reached kernel hangs in infinite loop inside rs_poll, because simc_poll always signals that descriptor 0 is readable and simc_read always returns 0. Check simc

[PATCH 3.10 008/143] EDAC, amd64_edac: Shift wrapping issue in f1x_get_norm_dct_addr()

2016-06-05 Thread Willy Tarreau
From: Dan Carpenter commit 6f3508f61c814ee852c199988a62bd954c50dfc1 upstream. dct_sel_base_off is declared as a u64 but we're only using the lower 32 bits because of a shift wrapping bug. This can possibly truncate the upper 16 bits of DctSelBaseOffset[47:26], causing us to misdecode the CS row.

[PATCH 3.10 026/143] pwc: Add USB id for Philips Spc880nc webcam

2016-06-05 Thread Willy Tarreau
From: Hans de Goede commit 7445e45d19a09e5269dc85f17f9635be29d2f76c upstream. SPC 880NC PC camera discussions: http://www.pclinuxos.com/forum/index.php/topic,135688.0.html Cc: sta...@vger.kernel.org Reported-by: Kikim Signed-off-by: Hans de Goede Signed-off-by: Mauro Carvalho Chehab

[PATCH 3.10 009/143] PCI: Disable IO/MEM decoding for devices with non-compliant BARs

2016-06-05 Thread Willy Tarreau
From: Bjorn Helgaas commit b84106b4e2290c081cdab521fa832596cdfea246 upstream. The PCI config header (first 64 bytes of each device's config space) is defined by the PCI spec so generic software can identify the device and manage its usage of I/O, memory, and IRQ resources. Some non-spec-complia

[PATCH 3.10 012/143] x86, processor-flags: Fix the datatypes and add bit number defines

2016-06-05 Thread Willy Tarreau
From: "H. Peter Anvin" commit d1fbefcb3aa608599a3c9e4582cbeeb6ba6c8939 upstream. The control registers are unsigned long (32 bits on i386, 64 bits on x86-64), and so make that manifest in the data type for the various constants. Add defines with a _BIT suffix which defines the bit number, as op

[PATCH 3.10 001/143] pipe: Fix buffer offset after partially failed read

2016-06-05 Thread Willy Tarreau
From: Ben Hutchings Quoting the RHEL advisory: > It was found that the fix for CVE-2015-1805 incorrectly kept buffer > offset and buffer length in sync on a failed atomic read, potentially > resulting in a pipe buffer state corruption. A local, unprivileged user > could use this flaw to crash th

[PATCH 3.10 003/143] ext4: fix NULL pointer dereference in ext4_mark_inode_dirty()

2016-06-05 Thread Willy Tarreau
From: Eryu Guan commit 5e1021f2b6dff1a86a468a1424d59faae2bc63c1 upstream. ext4_reserve_inode_write() in ext4_mark_inode_dirty() could fail on error (e.g. EIO) and iloc.bh can be NULL in this case. But the error is ignored in the following "if" condition and ext4_expand_extra_isize() might be cal

Re: [linux-sunxi] Re: [PATCH 5/5] RFC spi: sun4i: add DMA support

2016-06-05 Thread Michal Suchanek
On 2 June 2016 at 16:26, Mark Brown wrote: > On Thu, Jun 02, 2016 at 02:14:26PM +0200, Michal Suchanek wrote: >> On 2 June 2016 at 06:42, Priit Laes wrote: >> > On Wed, 2016-06-01 at 20:00 +0200, Maxime Ripard wrote: > >> > Actually it non-DMA case works fine if you don't need SPI transfers >> >

arch/ia64/kernel/entry.S:621: Error: Operand 2 of `adds' should be a 14-bit integer (-8192-8191)

2016-06-05 Thread kbuild test robot
Hi, FYI, the error/warning still remains. tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master head: 049ec1b5a76d34a6980cccdb7c0baeb4eed7a993 commit: da48d094ce5d7c7dcdad9011648a81c42fd1c2ef Kconfig: remove HAVE_LATENCYTOP_SUPPORT date: 5 months ago config: ia64

[PATCH] coredump: fix dumping through pipes

2016-06-05 Thread Mateusz Guzik
The offset in the core file used to be tracked with ->written field of the coredump_params structure. Commit a0083939510 ("get rid of coredump_params->written") replaced all its uses with file->f_pos. However, ->f_pos is not maintained for pipes which leads to breakage. Restore explicit tracking

[GIT PULL] parisc architecture fixes for 4.7-rc2

2016-06-05 Thread Helge Deller
Hi Linus, Please pull some parisc architecture fixes for kernel 4.7-rc2 from git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux.git parisc-4.7-2 Changes in this patch set: - Fix printk time stamps on SMP systems which got wrong due to a patch which was added during the merge

drivers/mfd/syscon.c:67:9: error: implicit declaration of function 'ioremap'

2016-06-05 Thread kbuild test robot
Hi, FYI, the error/warning still remains. tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master head: 049ec1b5a76d34a6980cccdb7c0baeb4eed7a993 commit: ca668f0edfae65438c3f0a3ad5d3e59e3515915f mfd: syscon: Set regmap max_register in of_syscon_register date: 3 mont

drivers/gpio/gpiolib-of.c:317:2: error: implicit declaration of function 'iounmap'

2016-06-05 Thread kbuild test robot
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master head: 049ec1b5a76d34a6980cccdb7c0baeb4eed7a993 commit: 296ad4acb8efeffa456e344c73dc9459f4e9e1a0 gpio: remove deps on ARCH_[WANT_OPTIONAL|REQUIRE]_GPIOLIB date: 6 weeks ago config: um-allmodconfig (attached as .c

[PATCH 1/1 linux-next] ASoC: cs53l30: include gpio/consumer.h

2016-06-05 Thread Fabian Frederick
cs53l30 breaks kernel compilation when CONFIG_GPIOLIB is disabled. sound/soc/codecs/cs53l30.c:931:2: error: implicit declaration of function devm_gpiod_get_optional [-Werror=implicit-function-declaration] cs53l30->reset_gpio = devm_gpiod_get_optional(dev, "reset", ^ sound/soc/codecs/cs53l30.c:

include/linux/kprobes.h:332:2: error: invalid use of undefined type 'struct kprobe_ctlblk'

2016-06-05 Thread kbuild test robot
Hi, FYI, the error/warning still remains. tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master head: 049ec1b5a76d34a6980cccdb7c0baeb4eed7a993 commit: abec1a806e0c3cf168999667d5fb6218398ef12a percpu: Make __verify_pcu_ptr handle per cpu pointers to arrays date: 2

Re: [PATCH v2 2/2] lib/uuid.c: eliminate uuid_[bl]e_index arrays

2016-06-05 Thread Andy Shevchenko
On Sat, 2016-06-04 at 09:29 -0700, Joe Perches wrote: > (adding acpi folks) > > Trivially, acpi defines this but doesn't seem to use it. > > include/acpi/acconfig.h:#define UUID_STRING_LENGTH  36  /* > Total length of a UUID string */ > > And Ingo commented last month: > https://lkml.o

linux-next: error fetching the c6x tree

2016-06-05 Thread Stephen Rothwell
Hi Mark, Fetching the c6x tree has produced this error for the past few days: fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists. -- Cheers, Stephen Rothwell

Re: [PATCH v2 3/2] lib/uuid.c: Silence an unchecked return value warning

2016-06-05 Thread Andy Shevchenko
On Sat, 2016-06-04 at 09:16 -0400, George Spelvin wrote: > Andy Shevchenko pointed out that __uuid_to_bin doesn't need to check > the return value from hex2bin(), because the preceding uuid_is_valid() > check already took care of that. > > But hex2bin() is declared __must_check, so checking anyway

Re: [PATCH v2 1/2] lib/vsprintf.c: Simplify uuid_string()

2016-06-05 Thread Andy Shevchenko
On Sat, 2016-06-04 at 01:14 -0400, George Spelvin wrote: > Rather than have a second pass to upcase the buffer, just make the > hex lookup table a variable. > > Removing the conditional branch from the inner loop is also a > speedup, but since this is not hot code, the important factor > it shrink

Re: [PATCH] libnvdimm, nfit: treat volatile virtual CD region as read-only pmem

2016-06-05 Thread joeyli
On Sat, Jun 04, 2016 at 09:24:54AM -0700, Dan Williams wrote: > On Sat, Jun 4, 2016 at 4:01 AM, joeyli wrote: > > Hi Dan, > > > > Thanks for your review. > > > > On Fri, Jun 03, 2016 at 12:27:34PM -0700, Dan Williams wrote: > >> On Fri, Jun 3, 2016 at 12:13 AM, Lee, Chun-Yi > >> wrote: > >> > Th

Re: [PATCH v1 1/1] mei: me: use managed functions pcim_* and devm_*

2016-06-05 Thread Andy Shevchenko
On Mon, 2016-02-01 at 16:00 +0200, Andy Shevchenko wrote: > This makes the error handling much more simpler than open-coding > everything and > in addition makes the probe function smaller an tidier. > It's already one release cycle passed. What is the destiny of this change? > Signed-off-by: An

Re: [PATCH] libnvdimm, nfit: treat volatile virtual CD region as read-only pmem

2016-06-05 Thread joeyli
On Sat, Jun 04, 2016 at 09:24:54AM -0700, Dan Williams wrote: > On Sat, Jun 4, 2016 at 4:01 AM, joeyli wrote: > > Hi Dan, > > > > Thanks for your review. > > > > On Fri, Jun 03, 2016 at 12:27:34PM -0700, Dan Williams wrote: > >> On Fri, Jun 3, 2016 at 12:13 AM, Lee, Chun-Yi > >> wrote: > >> > Th

Re: [PATCH 09/12] net: mediatek: increase watchdog_timeo

2016-06-05 Thread Andrew Lunn
On Sun, Jun 05, 2016 at 08:33:02AM +0200, John Crispin wrote: > During stress testing, after reducing the threshold value, we have seen > TX timeouts that were caused by the watchdog_timeo value being too low. > Increase the value to 5 * HZ which is a value commonly used by many other > drivers. I

Re: [PATCH v2] ION: Sys_heap: Add cached pool to spead up cached buffer alloc

2016-06-05 Thread Greg KH
On Sun, Jun 05, 2016 at 04:51:23PM +0800, Chen Feng wrote: > Hi Greg, > > Can you take this patch? It's in my queue, please wait, staging patches are at the bottom of it, rightfully so... thanks, greg k-h

Re: [PATCH v1] KVM: VMX: enable guest access to LMCE related MSRs

2016-06-05 Thread Haozhong Zhang
On 06/03/16 17:34, Radim Krčmář wrote: > 2016-06-03 14:08+0800, Haozhong Zhang: > > On Intel platforms, this patch adds LMCE to KVM MCE supported > > capabilities and handles guest access to LMCE related MSRs. > > > > Signed-off-by: Ashok Raj > > Signed-off-by: Haozhong Zhang > > --- > > diff --

Re: [PATCH v1] KVM: VMX: enable guest access to LMCE related MSRs

2016-06-05 Thread Haozhong Zhang
On 06/04/16 13:01, Boris Petkov wrote: > Haozhong Zhang wrote: > > >On Intel platforms, this patch adds LMCE to KVM MCE supported > >capabilities and handles guest access to LMCE related MSRs. > > > >Signed-off-by: Ashok Raj > >Signed-off-by: Haozhong Zhang > > SOB chain needs correction wrt w

Re: [PATCH][RT] netpoll: Always take poll_lock when doing polling

2016-06-05 Thread Alison Chaiken
Steven Rostedt suggests in reference to "[PATCH][RT] netpoll: Always take poll_lock when doing polling" >> [ Alison, can you try this patch ] Sebastian follows up: >Alison, did you try it? Sorry for not responding sooner. I was hoping to come to a complete understanding of the system before rep

Re: [PATCH v2 2/2] lib/uuid.c: eliminate uuid_[bl]e_index arrays

2016-06-05 Thread Joe Perches
On Sun, 2016-06-05 at 17:19 +0300, Andy Shevchenko wrote: > On Sat, 2016-06-04 at 09:29 -0700, Joe Perches wrote: > > (adding acpi folks) > > Trivially, acpi defines this but doesn't seem to use it. > > > > include/acpi/acconfig.h:#define UUID_STRING_LENGTH  36  /* > > Total length of a UU

Re: [PATCH v2 2/2] lib/uuid.c: eliminate uuid_[bl]e_index arrays

2016-06-05 Thread Andy Shevchenko
On Sun, 2016-06-05 at 08:34 -0700, Joe Perches wrote: > On Sun, 2016-06-05 at 17:19 +0300, Andy Shevchenko wrote: > > On Sat, 2016-06-04 at 09:29 -0700, Joe Perches wrote: > > > (adding acpi folks) > > > Trivially, acpi defines this but doesn't seem to use it. > > > > > > include/acpi/acconfig.h:#

Re: [PATCH 1/4] irtl8188eu: Replace semaphore cmd_queue_sema with completion

2016-06-05 Thread Larry Finger
On 06/03/2016 04:59 AM, Binoy Jayan wrote: The semaphore 'cmd_queue_sema' is used as completion, so convert it to struct completion. Signed-off-by: Binoy Jayan The subject for this patch has a misplaced "i" at the beginning courtesy of vi. One other point, it is customary to start the patch

[PATCH RESEND] cpufreq: p4-clockmod: Replace bool_int_array[NR_CPUS] with bitmap

2016-06-05 Thread Denys Vlasenko
Straigntforward conversion from int has_N44_O17_errata[NR_CPUS] to DECLARE_BITMAP(has_N44_O17_errata, NR_CPUS) Saves about 2 kbytes in bss for NR_CPUS=512. Signed-off-by: Denys Vlasenko Acked-by: Viresh Kumar CC: Rafael J. Wysocki CC: Ingo Molnar CC: Bartosz Golaszewski CC: H. Peter

[PATCH RESEND] bufferhead: Force inlining of put_bh and get_bh

2016-06-05 Thread Denys Vlasenko
With both gcc 4.7.2 and 4.9.2, sometimes gcc mysteriously doesn't inline very small functions we expect to be inlined. See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66122 With this .config: http://busybox.net/~vda/kernel_config_OPTIMIZE_INLINING_and_Os, get_bh() gets deinlined 32 times, put

[PATCH RESEND] NFC: hci: delete unused nfc_llc_get_rx_head_tail_room()

2016-06-05 Thread Denys Vlasenko
It used to be EXPORTed, but then EXPORT usage was cleaned up (in 2012), without noticing that the function has no users at all (and curiously, never had any users). Delete it. While at it, remove non-static "inline" hints on nearby functions: these hints don't work across compilation units anyway

[PATCH RESEND] [media] fsl-viu: make inlines static

2016-06-05 Thread Denys Vlasenko
It looks like author of this code wasn't aware that plain "inline" without "static" does emit an (unused in this case) function body. Add "static" to every inline in drivers/media/platform/fsl-viu.c viu_default_settings() has only one callsite, so remove "inline" from it. viu_activate_next_buf()

Re: ath9k gpio request

2016-06-05 Thread Sudip Mukherjee
On Saturday 04 June 2016 08:07 PM, Kalle Valo wrote: (Fixing top posting) "Pan, Miaoqing" writes: --- a/drivers/net/wireless/ath/ath9k/reg.h +++ b/drivers/net/wireless/ath/ath9k/reg.h @@ -1122,8 +1122,8 @@ enum { #define AR9300_NUM_GPIO 16 #define AR9330_NUM_GPI

Re: [PATCH 07/34] clk: berlin: Migrate to clk_hw based registration and OF APIs

2016-06-05 Thread Alexandre Belloni
Hi, The main drawback of those patches is that they break the alignment (checkpatch.pl --strict complains). On 01/06/2016 at 16:15:06 -0700, Stephen Boyd wrote : > diff --git a/drivers/clk/berlin/berlin2-avpll.h > b/drivers/clk/berlin/berlin2-avpll.h > index a37f5068d299..17e311153b42 100644 > -

Re: [PATCH 00/13] deprecate pcommit

2016-06-05 Thread Andy Lutomirski
On Jun 4, 2016 1:53 PM, "Dan Williams" wrote: > > Platforms supporting NVDIMMs are now required to provide persistence > guarantees once pmem stores are accepted by the memory subsystem. Can you point us to a precise definition of what exactly constitutes stores being "accepted by the memory subs

Re: [PATCH 7/7] thermal: qoriq: Add thermal management support

2016-06-05 Thread kbuild test robot
Hi, [auto build test ERROR on v4.7-rc1] [also build test ERROR on next-20160603] [cannot apply to robh/for-next soc-thermal/next] [if your patch is applied to the wrong git tree, please drop us a note to help improve the system] url: https://github.com/0day-ci/linux/commits/Jia-Hongtao/dt-bi

<    1   2   3   4   5   6   7   8   >