[PATCH 3.16 045/233] USB: hub: fix SS hub-descriptor handling

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Johan Hovold commit 2c25a2c818023df64463aac3288a9f969491e507 upstream. A SuperSpeed hub descriptor does not have any variable-length fields so bail out when reading a short descriptor. This a

[PATCH 3.16 020/233] staging: rtl8192e: rtl92e_get_eeprom_size Fix read size of EPROM_CMD.

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Malcolm Priestley commit 90be652c9f157d44b9c2803f902a8839796c090d upstream. EPROM_CMD is 2 byte aligned on PCI map so calling with rtl92e_readl will return invalid data so use rtl92e_readw. T

[PATCH 3.16 152/233] HID: usbhid: Quirk a AMI virtual mouse and keyboard with ALWAYS_POLL

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Colin Ian King commit ed9ab4287f96e66340e0390e2c583f2f9110cba0 upstream. Quirking the following AMI USB device with ALWAYS_POLL fixes an AMI virtual keyboard and mouse from not responding and

[PATCH 3.16 132/233] HID: microsoft: Add Surface Power Cover

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Raimund Roth commit 18eec2cd7e9746cd672ada102987534ae16f0f44 upstream. Adding support for the Microsoft Surface Pro Power Cover. Signed-off-by: Raimund Roth Signed-off-by: Jiri Kosina [bwh:

[PATCH 3.16 076/233] ext4: handle the rest of ext4_mb_load_buddy() ENOMEM errors

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Konstantin Khlebnikov commit 9651e6b2e20648d04d5e1fe6479a3056047e8781 upstream. I've got another report about breaking ext4 by ENOMEM error returned from ext4_mb_load_buddy() caused by memory

[PATCH 3.16 066/233] powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Michael Ellerman commit e41e53cd4fe331d0d1f06f8e4ed7e2cc63ee2c34 upstream. virt_addr_valid() is supposed to tell you if it's OK to call virt_to_page() on an address. What this means in practic

[PATCH 3.16 115/233] alarmtimer: Prevent overflow of relative timers

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit f4781e76f90df7aec400635d73ea4c35ee1d4765 upstream. Andrey reported a alartimer related RCU stall while fuzzing the kernel with syzkaller. The reason for this is an over

Re: [PATCH 0/6] Cache coherent device memory (CDM) with HMM v5

On Wed, Sep 6, 2017 at 3:36 AM, Jerome Glisse wrote: > On Thu, Jul 20, 2017 at 08:48:20PM -0700, Dan Williams wrote: >> On Thu, Jul 20, 2017 at 6:41 PM, Jerome Glisse wrote: >> > On Fri, Jul 21, 2017 at 09:15:29AM +0800, Bob Liu wrote: >> >> On 2017/7/20 23:03, Jerome Glisse wrote: >> >> > On Wed

[PATCH 3.16 099/233] net: phy: fix marvell phy status reading

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Russell King commit 898805e0cdf7fd860ec21bf661d3a0285a3defbd upstream. The Marvell driver incorrectly provides phydev->lp_advertising as the logical and of the link partner's advert and our ad

[PATCH 3.16 047/233] USB: hub: fix SS max number of ports

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Johan Hovold commit 93491ced3c87c94b12220dbac0527e1356702179 upstream. Add define for the maximum number of ports on a SuperSpeed hub as per USB 3.1 spec Table 10-5, and use it when verifying

[PATCH 3.16 079/233] crypto: gcm - wait for crypto op not signal safe

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Gilad Ben-Yossef commit f3ad587070d6bd961ab942b3fd7a85d00dfc934b upstream. crypto_gcm_setkey() was using wait_for_completion_interruptible() to wait for completion of async crypto op but if a

[PATCH 3.16 039/233] uwb: fix device quirk on big-endian hosts

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Johan Hovold commit 41318a2b82f5d5fe1fb408f6d6e0b22aa557111d upstream. Add missing endianness conversion when using the USB device-descriptor idProduct field to apply a hardware quirk. Fixes:

[PATCH 3.16 075/233] ext4: use __GFP_NOFAIL in ext4_free_blocks()

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Konstantin Khlebnikov commit adb7ef600cc9d9d15ecc934cc26af5c1379777df upstream. This might be unexpected but pages allocated for sbi->s_buddy_cache are charged to current memory cgroup. So, GF

[PATCH 3.16 185/233] cpufreq: conservative: Allow down_threshold to take values from 1 to 10

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Tomasz Wilczyński commit b8e11f7d2791bd9320be1c6e772a60b2aa093e45 upstream. Commit 27ed3cd2ebf4 (cpufreq: conservative: Fix the logic in frequency decrease checking) removed the 10 point subst

[PATCH 3.16 140/233] HID: add HID_QUIRK_NOGET to Quanta 3003 too

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Benjamin Tissoires commit 962b7a0e77015802f0ceefe6f0e3cad3f10fd4f8 upstream. dmesg shows a lot of: [ 1374.890348] hid-multitouch 0003:0408:3003.0007: usb_submit_urb(ctrl) failed: -1 [ 1384.91

[PATCH 3.16 029/233] kvm: arm/arm64: Fix use after free of stage2 page table

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Suzuki K Poulose commit 0c428a6a9256fcd66817e12db32a50b405ed2e5c upstream. We yield the kvm->mmu_lock occassionaly while performing an operation (e.g, unmap or permission changes) on a large a

[PATCH 3.16 043/233] USB: gadget: dummy_hcd: fix hub-descriptor removable fields

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Johan Hovold commit d81182ce30dbd497a1e7047d7fda2af040347790 upstream. Flag the first and only port as removable while also leaving the remaining bits (including the reserved bit zero) unset i

[PATCH 3.16 097/233] ext4: fix data corruption for mmap writes

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Jan Kara commit a056bdaae7a181f7dcc876cfab2f94538e508709 upstream. mpage_submit_page() can race with another process growing i_size and writing data via mmap to the written-back page. As mpage

[PATCH 3.16 036/233] USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Andrey Korolyov commit 5f63424ab7daac840df2b12dd5bcc5b38d50f779 upstream. This patch adds support for recognition of ARM-USB-TINY(H) devices which are almost identical to ARM-USB-OCD(H) but la

[PATCH 3.16 031/233] btrfs: fix incorrect error return ret being passed to mapping_set_error

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Colin Ian King commit bff5baf8aa37a97293725a16c03f49872249c07e upstream. The setting of return code ret should be based on the error code passed into function end_extent_writepage and not on r

[PATCH 3.16 052/233] usb: chipidea: udc: fix NULL pointer dereference if udc_start failed

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Jisheng Zhang commit aa1f058d7d9244423b8c5a75b9484b1115df7f02 upstream. Fix below NULL pointer dereference. we set ci->roles[CI_ROLE_GADGET] too early in ci_hdrc_gadget_init(), if udc_start()

[PATCH 3.16 019/233] staging: rtl8192e: fix 2 byte alignment of register BSSIDR.

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Malcolm Priestley commit 867510bde14e7b7fc6dd0f50b48f6753cfbd227a upstream. BSSIDR has two byte alignment on PCI ioremap correct the write by swapping to 16 bits first. This fixes a problem t

[PATCH 3.16 044/233] USB: usbip: fix nonconforming hub descriptor

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Johan Hovold commit ec963b412a54aac8e527708ecad06a6988a86fb4 upstream. Fix up the root-hub descriptor to accommodate the variable-length DeviceRemovable and PortPwrCtrlMask fields, while marki

[PATCH 3.16 188/233] KVM: PPC: Book3S HV: Context-switch EBB registers properly

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Paul Mackerras commit ca8efa1df1d15a1795a2da57f9f6aada6ed6b946 upstream. This adds code to save the values of three SPRs (special-purpose registers) used by userspace to control event-based br

[PATCH 3.16 111/233] mm/migrate: fix refcount handling when !hugepage_migration_supported()

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Punit Agrawal commit 30809f559a0d348c2dfd7ab05e9a451e2384962e upstream. On failing to migrate a page, soft_offline_huge_page() performs the necessary update to the hugepage ref-count. But whe

[PATCH 3.16 098/233] ext4: fix fdatasync(2) after extent manipulation operations

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Jan Kara commit 67a7d5f561f469ad2fa5154d2888258ab8e6df7c upstream. Currently, extent manipulation operations such as hole punch, range zeroing, or extent shifting do not record the fact that f

[PATCH 3.16 146/233] HID: support for keyboard - Corsair STRAFE

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Marian Krivoš commit 3da30bfc0b0a572a4f977a586edf34cf3dd503c3 upstream. Add quirk for Corsair STRAFE keyboard, similarly to what we've been doing for other CORSAIR devices already, in order to

[PATCH 3.16 170/233] KVM: cpuid: Fix read/write out-of-bounds vulnerability in cpuid emulation

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Wanpeng Li commit a3641631d14571242eec0d30c9faa786cbf52d44 upstream. If "i" is the last element in the vcpu->arch.cpuid_entries[] array, it potentially can be exploited the vulnerability. this

[PATCH 3.16 190/233] mac80211: don't look at the PM bit of BAR frames

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Emmanuel Grumbach commit 769dc04db3ed8484798aceb015b94deacc2ba557 upstream. When a peer sends a BAR frame with PM bit clear, we should not modify its PM state as madated by the spec in 802.11-

[PATCH 3.16 101/233] target/iscsi: Fix indentation in iscsi_target_start_negotiation()

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Bart Van Assche commit 1efaa949396b5d9e8d1e6edef7e97e9ce1a97319 upstream. This patch avoids that smatch complains about inconsistent indentation in iscsi_target_start_negotiation(). Signed-of

[PATCH 3.16 085/233] dmaengine: ep93xx: Always start from BASE0

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Alexander Sverdlin commit 0037ae47812b1f431cc602100d1d51f37d77b61e upstream. The current buffer is being reset to zero on device_free_chan_resources() but not on device_terminate_all(). It cou

[PATCH 3.16 048/233] mac80211: strictly check mesh address extension mode

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Rajkumar Manoharan commit 5667c86acf021e6dcf02584408b4484a273ac68f upstream. Mesh forwarding path checks for address extension mode to fetch appropriate proxied address and MPP address. Existi

[PATCH 3.16 030/233] usb: dwc3: gadget: Prevent losing events in event cache

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Thinh Nguyen commit d325a1de49d61ee11aca58a529571c91ecea7879 upstream. The dwc3 driver can overwite its previous events if its top-half IRQ handler (TH) gets invoked again before processing th

[PATCH 3.16 033/233] tcp: eliminate negative reordering in tcp_clean_rtx_queue

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Soheil Hassas Yeganeh commit bafbb9c73241760023d8981191ddd30bb1c6dbac upstream. tcp_ack() can call tcp_fragment() which may dededuct the value tp->fackets_out when MSS changes. When prior_fack

[PATCH 3.16 126/233] HID: kye: Fix report descriptor for Genius PenSketch M912

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Milan Plzik commit feb6faf1e5d46276c5430e36ffb4a6f62bf8d55b upstream. Genius PenSketch M912 digitizer tablet sends incorrect report descriptor by default. This patch replaces it with a correct

[PATCH 3.16 050/233] of: fdt: add missing allocation-failure check

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Johan Hovold commit 49e67dd17649b60b4d54966e18ec9c80198227f0 upstream. The memory allocator passed to __unflatten_device_tree() (e.g. a wrapped kzalloc) can fail so add the missing sanity chec

[PATCH 3.16 074/233] ext4: keep existing extra fields when inode expands

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Konstantin Khlebnikov commit 887a9730614727c4fff7cb756711b190593fc1df upstream. ext4_expand_extra_isize() should clear only space between old and new size. Fixes: 6dd4ee7cab7e # v2.6.23 Signe

[PATCH 3.16 192/233] xfrm: Oops on error in pfkey_msg2xfrm_state()

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Dan Carpenter commit 1e3d0c2c70cd3edb5deed186c5f5c75f2b84a633 upstream. There are some missing error codes here so we accidentally return NULL instead of an error pointer. It results in a NUL

[PATCH 3.16 107/233] bnx2x: Fix Multi-Cos

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: "Mintz, Yuval" commit 3968d38917eb9bd0cd391265f6c9c538d9b33ffa upstream. Apparently multi-cos isn't working for bnx2x quite some time - driver implements ndo_select_queue() to allow queue-sele

[PATCH 3.16 102/233] iscsi-target: Fix initial login PDU asynchronous socket close OOPs

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Nicholas Bellinger commit 25cdda95fda78d22d44157da15aa7ea34be3c804 upstream. This patch fixes a OOPs originally introduced by: commit bb048357dad6d604520c91586334c9c230366a14 Author: Ni

[PATCH 3.16 200/233] mm: numa: avoid waiting on freed migrated pages

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Mark Rutland commit 3c226c637b69104f6b9f1c6ec5b08d7b741b3229 upstream. In do_huge_pmd_numa_page(), we attempt to handle a migrating thp pmd by waiting until the pmd is unlocked before we retur

[PATCH 3.16 179/233] ufs: restore maintaining ->i_blocks

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Al Viro commit eb315d2ae614493fd1ebb026c75a80573d84f7ad upstream. Signed-off-by: Al Viro [bwh: Backported to 3.16: open-code i_blocksize()] Signed-off-by: Ben Hutchings --- fs/stat.c

[PATCH 3.16 061/233] serial: ifx6x60: Remove dangerous spi_driver casts

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Geert Uytterhoeven commit 9a499db0325b8a8e2368f21fef66705b120f38ba upstream. Casting spi_driver pointers to "void *" when calling spi_{,un}register_driver() bypasses all type checking. Remove

[PATCH 3.16 093/233] xfs: fix off-by-one on max nr_pages in xfs_find_get_desired_pgoff()

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Eryu Guan commit 8affebe16d79ebefb1d9d6d56a46dc89716f9453 upstream. xfs_find_get_desired_pgoff() is used to search for offset of hole or data in page range [index, end] (both inclusive), and t

[PATCH 3.16 042/233] usb: r8a66597-hcd: select a different endpoint on timeout

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Chris Brandt commit 1f873d857b6c2fefb4dada952674aa01bcfb92bd upstream. If multiple endpoints on a single device have pending IN URBs and one endpoint times out due to NAKs (perfectly legal), s

[PATCH 3.16 104/233] powerpc/spufs: Fix coredump of SPU contexts

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Michael Ellerman commit 99acc9bede06bbb2662aafff51f5b9e529fa845e upstream. If a process dumps core while it has SPU contexts active then we have code to also dump information about the SPU con

[PATCH 3.16 136/233] HID: Add new Microsoft Type Cover 3 product ID

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Donavan Lance commit c6956eb70e2549a3c2fa6ee525e02776d293caf4 upstream. Adds support for Microsoft Type Cover 3 with 0x07e2 product ID. Signed-off-by: Donavan Lance Signed-off-by: Jiri Kosin

[PATCH 3.16 186/233] usb: xhci: ASMedia ASM1042A chipset need shorts TX quirk

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Corentin Labbe commit d2f48f05cd2a2a0a708fbfa45f1a00a87660d937 upstream. When plugging an USB webcam I see the following message: [106385.615559] xhci_hcd :04:00.0: WARN Successful complet

[PATCH 3.16 120/233] net: ping: do not abuse udp_poll()

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet commit 77d4b1d36926a9b8387c6b53eeba42bcaaffcea3 upstream. Alexander reported various KASAN messages triggered in recent kernels The problem is that ping sockets should not use ud

[PATCH 3.16 157/233] KVM: nVMX: Fix exception injection

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Wanpeng Li commit d4912215d1031e4fb3d1038d2e1857218dba0d0a upstream. WARNING: CPU: 3 PID: 2840 at arch/x86/kvm/vmx.c:10966 nested_vmx_vmexit+0xdcd/0xde0 [kvm_intel] CPU: 3 PID: 2840 Comm: q

[PATCH 3.16 063/233] drivers: char: mem: Check for address space wraparound with mmap()

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Julius Werner commit b299cde245b0b76c977f4291162cf668e087b408 upstream. /dev/mem currently allows mmap() mappings that wrap around the end of the physical address space, which should probably

[PATCH 3.16 056/233] usb: host: xhci: simplify irq handler return

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Felipe Balbi commit 76a35293b901915c5dcb4a87a4a0da8d7caf39fe upstream. Instead of having several return points, let's use a local variable and a single place to return. This makes the code sli

[PATCH 3.16 060/233] serial: efm32: Fix parity management in 'efm32_uart_console_get_options()'

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Christophe JAILLET commit be40597a1bc173bf9dadccdf5388b956f620ae8f upstream. UARTn_FRAME_PARITY_ODD is 0x0300 UARTn_FRAME_PARITY_EVEN is 0x0200 So if the UART is configured for EVEN parity, it

[PATCH 3.16 022/233] USB: serial: mct_u232: fix big-endian baud-rate handling

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Johan Hovold commit 26cede343656c0bc2c33cdc783771282405c7fb2 upstream. Drop erroneous cpu_to_le32 when setting the baud rate, something which corrupted the divisor on big-endian hosts. Found

[PATCH 3.16 072/233] osf_wait4(): fix infoleak

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Al Viro commit a8c39544a6eb2093c04afd5005b6192bd0e880c6 upstream. failing sys_wait4() won't fill struct rusage... Signed-off-by: Al Viro Signed-off-by: Ben Hutchings --- arch/alpha/kernel/

[PATCH 3.16 137/233] HID: usbhid: Fix for the WiiU adapter from Mayflash

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Oliver Schmitt commit b6ad9a26e7c6fae74062baa9b8a7f583a803e092 upstream. The WiiU adapter from Mayflash (see http://www.mayflash.com/Products/NINTENDOWiiU/W009.html) is not working correctly.

[PATCH 3.16 100/233] iscsi-target: Fix early sk_data_ready LOGIN_FLAGS_READY race

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Nicholas Bellinger commit 8f0dfb3d8b1120c61f6e2cc3729290db10772b2d upstream. There is a iscsi-target/tcp login race in LOGIN_FLAGS_READY state assignment that can result in frequent errors dur

[PATCH 3.16 071/233] KVM: x86: zero base3 of unusable segments

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Radim Krčmář commit f0367ee1d64d27fa08be2407df5c125442e885e3 upstream. Static checker noticed that base3 could be used uninitialized if the segment was not present (useable). Random stack val

[PATCH 3.16 068/233] selftests/powerpc: Fix TM resched DSCR test with some compilers

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Michael Ellerman commit fe06fe860250a4f01d0eaf70a2563b1997174a74 upstream. The tm-resched-dscr test has started failing sometimes, depending on what compiler it's built with, eg: test: tm_r

[PATCH 3.16 082/233] block: fix an error code in add_partition()

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Dan Carpenter commit 7bd897cfce1eb373892d35d7f73201b0f9b221c4 upstream. We don't set an error code on this path. It means that we return NULL instead of an error pointer and the caller does a

[PATCH 3.16 155/233] HID: usbhid: Add HID_QUIRK_NOGET for Aten CS-1758 KVM switch

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Vasilis Liaskovitis commit d529a4ad91efcf68b65440c6555895fd7ad5a08e upstream. Like other switches, the Aten CS-1758 KVM switch needs a quirk to avoid spewing errors: [12599018.071059] usb 5-2

[PATCH 3.16 123/233] powerpc/numa: Fix percpu allocations to be NUMA aware

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Michael Ellerman commit ba4a648f12f4cd0a8003dd229b6ca8a53348ee4b upstream. In commit 8c272261194d ("powerpc/numa: Enable USE_PERCPU_NUMA_NODE_ID"), we switched to the generic implementation of

[PATCH 3.16 135/233] HID: quirks: add QUIRK_NOGET for an other TPV touchscreen

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Benjamin Tissoires commit c9b57724b38d4c1555ee49418be3d76801e3327c upstream. Looks like 0x8882 needs the same quirk than 0x8883. Given that both devices claim they are "TPV OpticalTouchScreen"

[PATCH 3.16 109/233] ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt()

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Ben Hutchings commit 6e80ac5cc992ab6256c3dae87f7e57db15e1a58c upstream. xfrm6_find_1stfragopt() may now return an error code and we must not treat it as a length. Fixes: 2423496af35d ("ipv6:

[PATCH 3.16 177/233] can: gs_usb: fix memory leak in gs_cmd_reset()

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Marc Kleine-Budde commit 5cda3ee5138e91ac369ed9d0b55eab0dab077686 upstream. This patch adds the missing kfree() in gs_cmd_reset() to free the memory that is not used anymore after usb_control_

[PATCH 3.16 069/233] batman-adv: Fix rx packet/bytes stats on local ARP reply

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Sven Eckelmann commit 36d4d68cd658d914ef73ac845705c4a89e7d9e2f upstream. The stats are generated by batadv_interface_stats and must not be stored directly in the net_device stats member variab

[PATCH 3.16 049/233] USB: serial: qcserial: add more Lenovo EM74xx device IDs

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Bjørn Mork commit 8d7a10dd323993cc40bd37bce8bc570133b0c396 upstream. In their infinite wisdom, and never ending quest for end user frustration, Lenovo has decided to use new USB device IDs for

[PATCH 3.16 041/233] usb: r8a66597-hcd: decrease timeout

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Chris Brandt commit dd14a3e9b92ac6f0918054f9e3477438760a4fa6 upstream. The timeout for BULK packets was 300ms which is a long time if other endpoints or devices are waiting for their turn. Cha

[PATCH 3.16 038/233] USB: core: replace %p with %pK

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Vamsi Krishna Samavedam commit 2f964780c03b73de269b08d12aff96a9618d13f3 upstream. Format specifier %p can leak kernel addresses while not valuing the kptr_restrict system settings. When kptr_r

[PATCH 3.16 184/233] configfs: Fix race between create_link and configfs_rmdir

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Nicholas Bellinger commit ba80aa909c99802c428682c352b0ee0baac0acd3 upstream. This patch closes a long standing race in configfs between the creation of a new symlink in create_link(), while th

[PATCH 3.16 064/233] sh_eth: Use platform device for printing before register_netdev()

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Geert Uytterhoeven commit 5f5c5449acad0cd3322e53e1ac68c044483b0aa5 upstream. The MDIO initialization failure message is printed using the network device, before it has been registered, leading

[PATCH 3.16 204/233] drm/radeon: add a quirk for Toshiba Satellite L20-183

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Alex Deucher commit acfd6ee4fa7ebeee75511825fe02be3f7ac1d668 upstream. Fixes resume from suspend. bug: https://bugzilla.kernel.org/show_bug.cgi?id=196121 Reported-by: Przemek Signed-off-by:

[PATCH 3.16 073/233] ext4: fix SEEK_HOLE

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Jan Kara commit 7d95eddf313c88b24f99d4ca9c2411a4b82fef33 upstream. Currently, SEEK_HOLE implementation in ext4 may both return that there's a hole at some offset although that offset already h

[PATCH 3.16 046/233] USB: hub: fix non-SS hub-descriptor handling

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Johan Hovold commit bec444cd1c94c48df409a35ad4e5b143c245c3f7 upstream. Add missing sanity check on the non-SuperSpeed hub-descriptor length in order to avoid parsing and leaking two bytes of u

[PATCH 3.16 040/233] USB: iowarrior: fix info ioctl on big-endian hosts

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Johan Hovold commit dd5ca753fa92fb736b1395db892bd29f78e6d408 upstream. Drop erroneous le16_to_cpu when returning the USB device speed which is already in host byte order. Found using sparse:

[PATCH 3.16 106/233] btrfs: fix memory leak in update_space_info failure path

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Jeff Mahoney commit 896533a7da929136d0432713f02a3edffece2826 upstream. If we fail to add the space_info kobject, we'll leak the memory for the percpu counter. Fixes: 6ab0a2029c (btrfs: publis

[PATCH 3.16 091/233] drm/radeon/ci: disable mclk switching for high refresh rates (v2)

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Alex Deucher commit 58d7e3e427db1bd68f33025519a9468140280a75 upstream. Even if the vblank period would allow it, it still seems to be problematic on some cards. v2: fix logic inversion (Nils)

[PATCH 3.16 113/233] staging/lustre/lov: remove set_fs() call from lov_getstripe()

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Oleg Drokin commit 0a33252e060e97ed3fbdcec9517672f1e91aaef3 upstream. lov_getstripe() calls set_fs(KERNEL_DS) so that it can handle a struct lov_user_md pointer from user- or kernel-space. Th

[PATCH 3.16 070/233] KVM: X86: Fix read out-of-bounds vulnerability in kvm pio emulation

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Wanpeng Li commit cbfc6c9184ce71b52df4b1d82af5afc81a709178 upstream. Huawei folks reported a read out-of-bounds vulnerability in kvm pio emulation. - "inb" instruction to access PIT Mod/Comma

[PATCH 3.16 035/233] uio: fix incorrect memory leak cleanup

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Suman Anna commit 0d83539092ddb1ab79b4d65bccb866bf07ea2ccd upstream. Commit 75f0aef6220d ("uio: fix memory leak") has fixed up some memory leaks during the failure paths of the addition of uio

[PATCH 3.16 144/233] HID: usbhid: quirks for Corsair RGB keyboard & mice (K70R, K95RGB, M65RGB, K70RGB, K65RGB)

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Trent Lloyd commit 282bf1fe6dca4b768d6bedc14aea1b82c36241c1 upstream. These devices feature multiple interfaces/endpoints: a legacy BIOS/boot interface (endpoint 0x81), as well as 2 corsair-sp

[PATCH 3.16 167/233] perf script python: Fix wrong code snippets in documentation

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: SeongJae Park commit 26ddb8722df865aa67fbe459107d2f3f8e5c6829 upstream. This commit fixes wrong code snippets for trace_begin() and trace_end() function example definition. Signed-off-by: Seo

[PATCH 3.16 089/233] scsi: qla2xxx: don't disable a not previously enabled PCI device

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Johannes Thumshirn commit ddff7ed45edce4a4c92949d3c61cd25d229c4a14 upstream. When pci_enable_device() or pci_enable_device_mem() fail in qla2x00_probe_one() we bail out but do a call to pci_di

[PATCH 3.16 166/233] perf script: Fix documentation errors

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: SeongJae Park commit 34d4453dac257be53c21abf2f713c992fb692b5c upstream. This commit fixes two errors in documents for perf-script-python and perf-script-perl as below: - /sys/kernel/debug/tra

[PATCH 3.16 080/233] ALSA: hda - apply STAC_9200_DELL_M22 quirk for Dell Latitude D430

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Alexander Tsoy commit 1fc2e41f7af4572b07190f9dec28396b418e9a36 upstream. This model is actually called 92XXM2-8 in Windows driver. But since pin configs for M22 and M28 are identical, just reu

[PATCH 3.16 105/233] btrfs: use correct types for page indices in btrfs_page_exists_in_range

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: David Sterba commit cc2b702c52094b637a351d7491ac5200331d0445 upstream. Variables start_idx and end_idx are supposed to hold a page index derived from the file offsets. The int type is not the

[PATCH 3.16 077/233] i2c: i2c-tiny-usb: fix buffer not being DMA capable

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Sebastian Reichel commit 5165da5923d6c7df6f2927b0113b2e4d9288661e upstream. Since v4.9 i2c-tiny-usb generates the below call trace and longer works, since it can't communicate with the USB dev

[PATCH 3.16 181/233] excessive checks in ufs_write_failed() and ufs_evict_inode()

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Al Viro commit babef37dccbaa49249a22bae9150686815d7be71 upstream. As it is, short copy in write() to append-only file will fail to truncate the excessive allocated blocks. As the matter of fa

[PATCH 3.16 028/233] kvm: arm/arm64: Force reading uncached stage2 PGD

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Suzuki K Poulose commit 2952a6070e07ebdd5896f1f5b861acad677caded upstream. Make sure we don't use a cached value of the KVM stage2 PGD while resetting the PGD. Cc: Marc Zyngier Signed-off-by

[PATCH 3.16 094/233] xfs: Fix missed holes in SEEK_HOLE implementation

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Jan Kara commit 5375023ae1266553a7baa0845e82917d8803f48c upstream. XFS SEEK_HOLE implementation could miss a hole in an unwritten extent as can be seen by the following command: xfs_io -c "fa

[PATCH 3.16 051/233] net: fix compile error in skb_orphan_partial()

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet commit 9142e9007f2d7ab58a587a1e1d921b0064a339aa upstream. If CONFIG_INET is not set, net/core/sock.c can not compile : net/core/sock.c: In function ‘skb_orphan_partial’: net/core

[PATCH 3.16 143/233] HID: Fix boot delay for Creative SB Omni Surround 5.1 with quirk

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Nazar Mokrynskyi commit 567a44ecb44eb2584ddb93e962cfb133ce77e0bb upstream. Needed for v2 of the device firmware, otherwise kernel will stuck for few seconds and throw "usb_submit_urb(ctrl) fai

[PATCH 3.16 026/233] dm space map disk: fix some book keeping in the disk space map

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Joe Thornber commit 0377a07c7a035e0d033cd8b29f0cb15244c0916a upstream. When decrementing the reference count for a block, the free count wasn't being updated if the reference count went to zer

[PATCH 3.16 096/233] net: ethernet: ax88796: don't call free_irq without request_irq first

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Uwe Kleine-König commit 82533ad9a1ce3a7a6863849a552c2cc041b55e0d upstream. The function ax_init_dev (which is called only from the driver's .probe function) calls free_irq in the error path wi

[PATCH 3.16 161/233] net: ethoc: enable NAPI before poll may be scheduled

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Max Filippov commit d220b942a4b6a0640aee78841608f4aa5e8e185e upstream. ethoc_reset enables device interrupts, ethoc_interrupt may schedule a NAPI poll before NAPI is enabled in the ethoc_open,

[PATCH 3.16 062/233] serial: ifx6x60: fix use-after-free on module unload

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Johan Hovold commit 1e948479b3d63e3ac0ecca13cbf4921c7d17c168 upstream. Make sure to deregister the SPI driver before releasing the tty driver to avoid use-after-free in the SPI remove callback

[PATCH 3.16 092/233] drm/radeon: Unbreak HPD handling for r600+

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Lyude commit 3d18e33735a02b1a90aecf14410bf3edbfd4d3dc upstream. We end up reading the interrupt register for HPD5, and then writing it to HPD6 which on systems without anything using HPD5 resu

[PATCH 3.16 116/233] alarmtimer: Rate limit periodic intervals

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit ff86bf0c65f14346bf2440534f9ba5ac232c39a0 upstream. The alarmtimer code has another source of potentially rearming itself too fast. Interval timers with a very samll inte

[PATCH 3.16 095/233] tcp: avoid fastopen API to be used on AF_UNSPEC

3.16.48-rc1 review patch. If anyone has any objections, please let me know. -- From: Wei Wang commit ba615f675281d76fd19aa03558777f81fb6b6084 upstream. Fastopen API should be used to perform fastopen operations on the TCP socket. It does not make sense to use fastopen API to p

[PATCH 3.2 009/106] ahci: Acer SA5-271 SSD Not Detected Fix

3.2.93-rc1 review patch. If anyone has any objections, please let me know. -- From: Sui Chen commit 8bfd174312629866efa535193d9e563768ff4307 upstream. (Correction in this resend: fixed function name acer_sa5_271_workaround; fixed the always-true condition in the function; fix

<    1   2   3   4   5   6   >