[PATCH 4.9 25/63] vmw_balloon: do not use 2MB without batching

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Nadav Amit commit 5081efd112560d3febb328e627176235b250d59d upstream. If the hypervisor sets 2MB batching is on, while batching is cleared, the balloon code breaks. In this case the legacy mecha

[PATCH 4.9 28/63] rtc: omap: fix potential crash on power off

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Johan Hovold commit 5c8b84f410b3819d14cb1ebf32e4b3714b5a6e0b upstream. Do not set the system power-off callback and omap power-off rtc pointer until we're done setting up our device to avoid le

[PATCH 4.9 24/63] vmw_balloon: fix inflation of 64-bit GFNs

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Nadav Amit commit 09755690c6b7c1eabdc4651eb3b276f8feb1e447 upstream. When balloon batching is not supported by the hypervisor, the guest frame number (GFN) must fit in 32-bit. However, due to a

[PATCH 4.9 03/63] 9p/net: Fix zero-copy path in the 9p virtio transport

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Chirantan Ekbote commit d28c756caee6e414d9ba367d0b92da24145af2a8 upstream. The zero-copy optimization when reading or writing large chunks of data is quite useful. However, the 9p messages cre

[PATCH 4.9 26/63] vmw_balloon: VMCI_DOORBELL_SET does not check status

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Nadav Amit commit ce664331b2487a5d244a51cbdd8cb54f866fbe5d upstream. When vmballoon_vmci_init() sets a doorbell using VMCI_DOORBELL_SET, for some reason it does not consider the status and look

[PATCH 4.9 27/63] vmw_balloon: fix VMCI use when balloon built into kernel

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Nadav Amit commit c3cc1b0fc27508da53fe955a3b23d03964410682 upstream. Currently, when all modules, including VMCI and VMware balloon are built into the kernel, the initialization of the balloon

[PATCH 4.9 09/63] powerpc/fadump: handle crash memory ranges array index overflow

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Hari Bathini commit 1bd6a1c4b80a28d975287630644e6b47d0f977a5 upstream. Crash memory ranges is an array of memory ranges of the crashing kernel to be exported as a dump via /proc/vmcore file. Th

[PATCH 4.9 23/63] iio: ad9523: Fix return value for ad952x_store()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Lars-Peter Clausen commit 9a5094ca29ea9b1da301b31fd377c0c0c4c23034 upstream. A sysfs write callback function needs to either return the number of consumed characters or an error. The ad952x_st

[PATCH 4.9 07/63] libertas: fix suspend and resume for SDIO connected cards

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Daniel Mack commit 7444a8092906ed44c09459780c56ba57043e39b1 upstream. Prior to commit 573185cc7e64 ("mmc: core: Invoke sdio func driver's PM callbacks from the sdio bus"), the MMC core used to

[PATCH 4.9 08/63] mailbox: xgene-slimpro: Fix potential NULL pointer dereference

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Gustavo A. R. Silva commit 3512a18cbd8d09e22a790540cb9624c3c49827ba upstream. There is a potential execution path in which function platform_get_resource() returns NULL. If this happens, we wil

[PATCH 4.9 31/63] uprobes: Use synchronize_rcu() not synchronize_sched()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Steven Rostedt (VMware) commit 016f8ffc48cb01d1e7701649c728c5d2e737d295 upstream. While debugging another bug, I was looking at all the synchronize*() functions being used in kernel/trace, and

[PATCH 4.9 05/63] spi: spi-fsl-dspi: Fix imprecise abort on VF500 during probe

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Krzysztof Kozlowski commit d8ffee2f551a627ffb7b216e2da322cb9a037f77 upstream. Registers of DSPI should not be accessed before enabling its clock. On Toradex Colibri VF50 on Iris carrier board

[PATCH 4.9 00/63] 4.9.126-stable review

This is the start of the stable review cycle for the 4.9.126 release. There are 63 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun Sep 9 21:09:58 UTC 2018. Anything receiv

[PATCH v3 1/2] Fix cg_read_strcmp()

From: Jay Kamat Fix a couple issues with cg_read_strcmp(), to improve correctness of cgroup tests - Fix cg_read_strcmp() always returning 0 for empty "needle" strings. Previously, this function read to a size = 1 buffer when comparing against empty strings, which would lead to cg_read_strcmp() co

[PATCH 4.9 06/63] drm/i915/userptr: reject zero user_size

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Matthew Auld commit c11c7bfd213495784b22ef82a69b6489f8d0092f upstream. Operating on a zero sized GEM userptr object will lead to explosions. Fixes: 5cc9ed4b9a7a ("drm/i915: Introduce mapping o

[PATCH v3 2/2] Add tests for memory.oom.group

From: Jay Kamat Add tests for memory.oom.group for the following cases: - Killing all processes in a leaf cgroup, but leaving the parent untouched - Killing all processes in a parent and leaf cgroup - Keeping processes marked by OOM_SCORE_ADJ_MIN alive when considered for being killed by the

[PATCH 4.9 40/63] ARM: tegra: Fix Tegra30 Cardhu PCA954x reset

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jon Hunter commit 6e1811900b6fe6f2b4665dba6bd6ed32c6b98575 upstream. On all versions of Tegra30 Cardhu, the reset signal to the NXP PCA9546 I2C mux is connected to the Tegra GPIO BB0. Currently

[PATCH 4.9 43/63] mm/tlb: Remove tlb_remove_table() non-concurrent condition

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Peter Zijlstra commit a6f572084fbee8b30f91465f4a085d7a90901c57 upstream. Will noted that only checking mm_users is incorrect; we should also check mm_count in order to cover CPUs that have a la

[PATCH 4.9 41/63] Replace magic for trusting the secondary keyring with #define

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Yannik Sembritzki commit 817aef260037f33ee0f44c17fe341323d3aebd6d upstream. Replace the use of a magic number that indicates that verify_*_signature() should use the secondary keyring with a sy

kselftests for memory.oom.group

Here is the third version of the patchset. Changes since the last patchset: - Updated commit message of first patch to clarify fixes - Add ack from Roman There should be no code changes since the last patchset. Let me know if any improvements can be made, and thanks for your time! -Jay

[PATCH 4.9 44/63] iommu/vt-d: Add definitions for PFSID

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jacob Pan commit 0f725561e168485eff7277d683405c05b192f537 upstream. When SRIOV VF device IOTLB is invalidated, we need to provide the PF source ID such that IOMMU hardware can gauge the depth o

[PATCH 4.9 45/63] iommu/vt-d: Fix dev iotlb pfsid use

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jacob Pan commit 1c48db44924298ad0cb5a6386b88017539be8822 upstream. PFSID should be used in the invalidation descriptor for flushing device IOTLBs on SRIOV VFs. Signed-off-by: Jacob Pan Cc: s

[PATCH 4.9 46/63] osf_getdomainname(): use copy_to_user()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Al Viro commit 9ba3eb5103cf56f0daaf07de4507df76e7813ed7 upstream. Signed-off-by: Al Viro Signed-off-by: Greg Kroah-Hartman --- arch/alpha/kernel/osf_sys.c | 23 +-- 1

[PATCH 4.9 47/63] sys: dont hold uts_sem while accessing userspace memory

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jann Horn commit 42a0cc3478584d4d63f68f2f5af021ddbea771fa upstream. Holding uts_sem as a writer while accessing userspace memory allows a namespace admin to stall all processes that attempt to

[PATCH 4.9 49/63] ubifs: Fix memory leak in lprobs self-check

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Richard Weinberger commit eef19816ada3abd56d9f20c88794cc2fea83ebb2 upstream. Allocate the buffer after we return early. Otherwise memory is being leaked. Cc: Fixes: 1e51764a3c2a ("UBIFS: add

[PATCH 4.9 32/63] mfd: hi655x: Fix regmap area declared size for hi655x

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Rafael David Tinoco commit 6afebb70ee7a4bde106dc1a875e7ac7997248f84 upstream. Fixes https://bugs.linaro.org/show_bug.cgi?id=3903 LTP Functional tests have caused a bad paging request when trig

[PATCH 4.9 48/63] userns: move user access out of the mutex

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jann Horn commit 5820f140edef111a9ea2ef414ab2428b8cb805b1 upstream. The old code would hold the userns_state_mutex indefinitely if memdup_user_nul stalled due to e.g. a userfault region. Preven

[PATCH 4.9 53/63] pwm: tiehrpwm: Fix disabling of output of PWMs

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Vignesh R commit 38dabd91ff0bde33352ca3cc65ef515599b77a05 upstream. pwm-tiehrpwm driver disables PWM output by putting it in low output state via active AQCSFRC register in ehrpwm_pwm_disable()

[PATCH 4.9 56/63] getxattr: use correct xattr length

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Christian Brauner commit 82c9a927bc5df6e06b72d206d24a9d10cced4eb5 upstream. When running in a container with a user namespace, if you call getxattr with name = "system.posix_acl_access" and siz

[PATCH 4.9 55/63] udlfb: set optimal write delay

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Mikulas Patocka commit bb24153a3f13dd0dbc1f8055ad97fe346d598f66 upstream. The default delay 5 jiffies is too much when the kernel is compiled with HZ=100 - it results in jumpy cursor in Xwindow

[PATCH 4.9 54/63] fb: fix lost console when the user unplugs a USB adapter

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Mikulas Patocka commit 8c5b044299951acd91e830a688dd920477ea1eda upstream. I have a USB display adapter using the udlfb driver and I use it on an ARM board that doesn't have any graphics card. W

[PATCH 4.9 61/63] crypto: vmx - Fix sleep-in-atomic bugs

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Ondrej Mosnacek commit 0522236d4f9c5ab2e79889cb020d1acbe5da416e upstream. This patch fixes sleep-in-atomic bugs in AES-CBC and AES-XTS VMX implementations. The problem is that the blkcipher_* f

[PATCH 4.9 51/63] ubifs: Check data node size before truncate

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Richard Weinberger commit 95a22d2084d72ea067d8323cc85677dba5d97cae upstream. Check whether the size is within bounds before using it. If the size is not correct, abort and dump the bad data nod

[PATCH 4.9 58/63] printk/tracing: Do not trace printk_nmi_enter()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Steven Rostedt (VMware) commit d1c392c9e2a301f38998a353f467f76414e38725 upstream. I hit the following splat in my tests: [ cut here ] IRQs not enabled as expected WARNI

[PATCH 4.9 50/63] Revert "UBIFS: Fix potential integer overflow in allocation"

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Richard Weinberger commit 08acbdd6fd736b90f8d725da5a0de4de2dd6de62 upstream. This reverts commit 353748a359f1821ee934afc579cf04572406b420. It bypassed the linux-mtd review process and fixes the

[PATCH 4.9 57/63] libnvdimm: fix ars_status output length calculation

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Vishal Verma commit 286e87718103acdf85f4ed323a37e4839a8a7c05 upstream. Commit efda1b5d87cb ("acpi, nfit, libnvdimm: fix / harden ars_status output length handling") Introduced additional harde

[PATCH 4.9 52/63] ubifs: Fix synced_i_size calculation for xattr inodes

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Richard Weinberger commit 59965593205fa4044850d35ee3557cf0b7edcd14 upstream. In ubifs_jnl_update() we sync parent and child inodes to the flash, in case of xattrs, the parent inode (AKA host in

[PATCH 4.9 60/63] perf auxtrace: Fix queue resize

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Adrian Hunter commit 99cbbe56eb8bede625f410ab62ba34673ffa7d21 upstream. When the number of queues grows beyond 32, the array of queues is resized but not all members were being copied. Fix by a

[PATCH 4.9 33/63] 9p: fix multiple NULL-pointer-dereferences

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Tomas Bortoli commit 10aa14527f458e9867cf3d2cc6b8cb0f6704448b upstream. Added checks to prevent GPFs from raising. Link: http://lkml.kernel.org/r/20180727110558.5479-1-tomasbort...@gmail.com S

[PATCH 4.9 59/63] bcache: release dc->writeback_lock properly in bch_writeback_thread()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Shan Hai commit 3943b040f11ed0cc6d4585fd286a623ca8634547 upstream. The writeback thread would exit with a lock held when the cache device is detached via sysfs interface, fix it by releasing th

[PATCH 4.9 63/63] fs/quota: Fix spectre gadget in do_quotactl

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Jeremy Cline commit 7b6924d94a60c6b8c1279ca003e8744e6cd9e8b1 upstream. 'type' is user-controlled, so sanitize it after the bounds check to avoid using it in speculative execution. This covers t

[PATCH 4.9 35/63] KVM: VMX: fixes for vmentry_l1d_flush module parameter

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Paolo Bonzini commit 0027ff2a75f9dcf0537ac0a65c5840b0e21a4950 upstream. Two bug fixes: 1) missing entries in the l1d_param array; this can cause a host crash if an access attempts to reach the

[PATCH 4.9 34/63] PM / sleep: wakeup: Fix build error caused by missing SRCU support

4.9-stable review patch. If anyone has any objections, please let me know. -- From: zhangyi (F) commit 3df6f61fff49632492490fb6e42646b803a9958a upstream. Commit ea0212f40c6 (power: auto select CONFIG_SRCU) made the code in drivers/base/power/wakeup.c use SRCU instead of RCU, b

[PATCH 4.9 36/63] xtensa: limit offsets in __loop_cache_{all,page}

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Max Filippov commit be75de25251f7cf3e399ca1f584716a95510d24a upstream. When building kernel for xtensa cores with big cache lines (e.g. 128 bytes or more) __loop_cache_all and __loop_cache_page

[PATCH 4.9 37/63] xtensa: increase ranges in ___invalidate_{i,d}cache_all

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Max Filippov commit fec3259c9f747c039f90e99570540114c8d81a14 upstream. Cache invalidation macros use cache line size to iterate over invalidated cache lines, assuming that all cache ways are in

[PATCH 4.9 38/63] pnfs/blocklayout: off by one in bl_map_stripe()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Dan Carpenter commit 0914bb965e38a055e9245637aed117efbe976e91 upstream. "dev->nr_children" is the number of children which were parsed successfully in bl_parse_stripe(). It could be all of the

[PATCH 4.4 11/47] net/9p/client.c: version pointer uninitialized

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Tomas Bortoli commit 7913690dcc5e18e235769fd87c34143072f5dbea upstream. The p9_client_version() does not initialize the version pointer. If the call to p9pdu_readf() returns an error and versio

[PATCH 4.9 30/63] tracing/blktrace: Fix to allow setting same value

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Steven Rostedt (VMware) commit 757d9140072054528b13bbe291583d9823cde195 upstream. Masami Hiramatsu reported: Current trace-enable attribute in sysfs returns an error if user writes the sam

[PATCH 4.4 10/47] 9p/virtio: fix off-by-one error in sg list bounds check

4.4-stable review patch. If anyone has any objections, please let me know. -- From: jiangyiwen commit 23cba9cbde0bba05d772b335fe5f66aa82b9ad19 upstream. Because the value of limit is VIRTQUEUE_NUM, if index is equal to limit, it will cause sg array out of bounds, so correct th

[PATCH 4.9 39/63] NFSv4 client live hangs after live data migration recovery

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Bill Baker commit 0f90be132cbf1537d87a6a8b9e80867adac892f6 upstream. After a live data migration event at the NFS server, the client may send I/O requests to the wrong server, causing a live ha

[PATCH 4.4 12/47] net/9p/trans_fd.c: fix race-condition by flushing workqueue before the kfree()

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Tomas Bortoli commit 430ac66eb4c5b5c4eb846b78ebf65747510b30f1 upstream. The patch adds the flush in p9_mux_poll_stop() as it the function used by p9_conn_destroy(), in turn called by p9_fd_clos

[PATCH 4.4 18/47] vmw_balloon: do not use 2MB without batching

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Nadav Amit commit 5081efd112560d3febb328e627176235b250d59d upstream. If the hypervisor sets 2MB batching is on, while batching is cleared, the balloon code breaks. In this case the legacy mecha

[PATCH 4.4 16/47] iio: ad9523: Fix return value for ad952x_store()

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Lars-Peter Clausen commit 9a5094ca29ea9b1da301b31fd377c0c0c4c23034 upstream. A sysfs write callback function needs to either return the number of consumed characters or an error. The ad952x_st

[PATCH 4.4 01/47] net: 6lowpan: fix reserved space for single frames

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Alexander Aring commit ac74f87c789af40936a80131c4759f3e72579c3a upstream. This patch fixes patch add handling to take care tail and headroom for single 6lowpan frames. We need to be sure we hav

[PATCH 4.4 21/47] tracing: Do not call start/stop() functions when tracing_on does not change

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Steven Rostedt (VMware) commit f143641bfef9a4a60c57af30de26c63057e7e695 upstream. Currently, when one echo's in 1 into tracing_on, the current tracer's "start()" function is executed, even if t

[PATCH 4.4 02/47] net: mac802154: tx: expand tailroom if necessary

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Alexander Aring commit f9c52831133050c6b82aa8b6831c92da2bbf2a0b upstream. This patch is necessary if case of AF_PACKET or other socket interface which I am aware of it and didn't allocated the

[PATCH 4.4 20/47] vmw_balloon: fix VMCI use when balloon built into kernel

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Nadav Amit commit c3cc1b0fc27508da53fe955a3b23d03964410682 upstream. Currently, when all modules, including VMCI and VMware balloon are built into the kernel, the initialization of the balloon

[PATCH 4.4 13/47] x86/mm/pat: Fix L1TF stable backport for CPA, 2nd call

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Jiri Slaby Mostly recycling the commit log from adaba23ccd7d which fixed populate_pmd, but did not fix populate_pud. The same problem exists there. Stable trees reverted the following patch:

[PATCH 4.4 19/47] vmw_balloon: VMCI_DOORBELL_SET does not check status

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Nadav Amit commit ce664331b2487a5d244a51cbdd8cb54f866fbe5d upstream. When vmballoon_vmci_init() sets a doorbell using VMCI_DOORBELL_SET, for some reason it does not consider the status and look

[PATCH 4.4 17/47] vmw_balloon: fix inflation of 64-bit GFNs

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Nadav Amit commit 09755690c6b7c1eabdc4651eb3b276f8feb1e447 upstream. When balloon batching is not supported by the hypervisor, the guest frame number (GFN) must fit in 32-bit. However, due to a

[PATCH 4.4 14/47] dm cache metadata: save in-core policy_hint_size to on-disk superblock

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Mike Snitzer commit fd2fa95416188a767a63979296fa3e169a9ef5ec upstream. policy_hint_size starts as 0 during __write_initial_superblock(). It isn't until the policy is loaded that policy_hint_si

[PATCH 4.4 23/47] kthread, tracing: Dont expose half-written comm when creating kthreads

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Snild Dolkow commit 3e536e222f2930534c252c1cc7ae799c725c5ff9 upstream. There is a window for racing when printing directly to task->comm, allowing other threads to see a non-terminated string.

[PATCH 4.4 22/47] tracing/blktrace: Fix to allow setting same value

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Steven Rostedt (VMware) commit 757d9140072054528b13bbe291583d9823cde195 upstream. Masami Hiramatsu reported: Current trace-enable attribute in sysfs returns an error if user writes the sam

[PATCH 4.4 15/47] iio: ad9523: Fix displayed phase

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Lars-Peter Clausen commit 5a4e33c1c53ae7d4425f7d94e60e4458a37b349e upstream. Fix the displayed phase for the ad9523 driver. Currently the most significant decimal place is dropped and all other

[PATCH 4.4 24/47] uprobes: Use synchronize_rcu() not synchronize_sched()

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Steven Rostedt (VMware) commit 016f8ffc48cb01d1e7701649c728c5d2e737d295 upstream. While debugging another bug, I was looking at all the synchronize*() functions being used in kernel/trace, and

[PATCH 4.4 25/47] 9p: fix multiple NULL-pointer-dereferences

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Tomas Bortoli commit 10aa14527f458e9867cf3d2cc6b8cb0f6704448b upstream. Added checks to prevent GPFs from raising. Link: http://lkml.kernel.org/r/20180727110558.5479-1-tomasbort...@gmail.com S

[PATCH 4.4 26/47] PM / sleep: wakeup: Fix build error caused by missing SRCU support

4.4-stable review patch. If anyone has any objections, please let me know. -- From: zhangyi (F) commit 3df6f61fff49632492490fb6e42646b803a9958a upstream. Commit ea0212f40c6 (power: auto select CONFIG_SRCU) made the code in drivers/base/power/wakeup.c use SRCU instead of RCU, b

[PATCH 4.4 03/47] 9p/net: Fix zero-copy path in the 9p virtio transport

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Chirantan Ekbote commit d28c756caee6e414d9ba367d0b92da24145af2a8 upstream. The zero-copy optimization when reading or writing large chunks of data is quite useful. However, the 9p messages cre

[PATCH 4.4 29/47] mm/tlb: Remove tlb_remove_table() non-concurrent condition

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Peter Zijlstra commit a6f572084fbee8b30f91465f4a085d7a90901c57 upstream. Will noted that only checking mm_users is incorrect; we should also check mm_count in order to cover CPUs that have a la

[PATCH 4.4 28/47] ARM: tegra: Fix Tegra30 Cardhu PCA954x reset

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Jon Hunter commit 6e1811900b6fe6f2b4665dba6bd6ed32c6b98575 upstream. On all versions of Tegra30 Cardhu, the reset signal to the NXP PCA9546 I2C mux is connected to the Tegra GPIO BB0. Currently

[PATCH 4.4 27/47] pnfs/blocklayout: off by one in bl_map_stripe()

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Dan Carpenter commit 0914bb965e38a055e9245637aed117efbe976e91 upstream. "dev->nr_children" is the number of children which were parsed successfully in bl_parse_stripe(). It could be all of the

[PATCH 4.4 30/47] iommu/vt-d: Add definitions for PFSID

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Jacob Pan commit 0f725561e168485eff7277d683405c05b192f537 upstream. When SRIOV VF device IOTLB is invalidated, we need to provide the PF source ID such that IOMMU hardware can gauge the depth o

[PATCH 4.4 05/47] spi: davinci: fix a NULL pointer dereference

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Bartosz Golaszewski commit 563a53f3906a6b43692498e5b3ae891fac93a4af upstream. On non-OF systems spi->controlled_data may be NULL. This causes a NULL pointer derefence on dm365-evm. Signed-off-

[PATCH 4.4 32/47] osf_getdomainname(): use copy_to_user()

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Al Viro commit 9ba3eb5103cf56f0daaf07de4507df76e7813ed7 upstream. Signed-off-by: Al Viro Signed-off-by: Greg Kroah-Hartman --- arch/alpha/kernel/osf_sys.c | 23 +-- 1

[PATCH 4.4 33/47] sys: dont hold uts_sem while accessing userspace memory

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Jann Horn commit 42a0cc3478584d4d63f68f2f5af021ddbea771fa upstream. Holding uts_sem as a writer while accessing userspace memory allows a namespace admin to stall all processes that attempt to

[PATCH 4.4 31/47] iommu/vt-d: Fix dev iotlb pfsid use

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Jacob Pan commit 1c48db44924298ad0cb5a6386b88017539be8822 upstream. PFSID should be used in the invalidation descriptor for flushing device IOTLBs on SRIOV VFs. Signed-off-by: Jacob Pan Cc: s

[PATCH 4.4 34/47] userns: move user access out of the mutex

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Jann Horn commit 5820f140edef111a9ea2ef414ab2428b8cb805b1 upstream. The old code would hold the userns_state_mutex indefinitely if memdup_user_nul stalled due to e.g. a userfault region. Preven

[RFC 02/60] sched: Introduce set_entity_cfs() to place a SE into a certain CFS runqueue

Factor out the logic to place a SE into a CFS runqueue into its own function. This consolidates various sprinkled updates of se->cfs_rq, se->parent, and se->depth at the cost of updating se->depth unnecessarily on same-group movements between CPUs. Signed-off-by: Jan H. Schönherr --- kernel/sch

[PATCH 4.4 04/47] net: lan78xx: Fix misplaced tasklet_schedule() call

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Ben Hutchings Commit 136f55f66019 ("net: lan78xx: fix rx handling before first packet is send") was not correctly backported to 4.4. The call to tasklet_schedule() belongs in lan78xx_link_reset

[RFC 09/60] sched: Do not require a CFS in init_tg_cfs_entry()

Just like init_tg_cfs_entry() does something useful without a scheduling entity, let it do something useful without a CFS runqueue. This prepares for the addition of new types of SEs. Signed-off-by: Jan H. Schönherr --- kernel/sched/fair.c | 28 +++- 1 file changed, 15 i

[RFC 05/60] sched: Allow to retrieve the sched_domain_topology

While it is possible to simply overwrite the sched_domain_topology, it was not possible to retrieve the sched_domain_topology to modify it instead. Add a function to enable that use case. Note, that this does not help with the already existing potential memory leak, when one dynamically allocated

[PATCH 4.4 07/47] powerpc/fadump: handle crash memory ranges array index overflow

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Hari Bathini commit 1bd6a1c4b80a28d975287630644e6b47d0f977a5 upstream. Crash memory ranges is an array of memory ranges of the crashing kernel to be exported as a dump via /proc/vmcore file. Th

[RFC 04/60] sched: Replace sd_numa_mask() hack with something sane

Get rid of the global variable sched_domains_curr_level, which is used to pass state into a sd_numa_mask(), which is used as a callback for sched_domain_topology_level->mask(). Extend the ->mask() callback instead, so that it takes the topology level as an extra argument. Provide a backward compat

[PATCH 4.4 36/47] Revert "UBIFS: Fix potential integer overflow in allocation"

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Richard Weinberger commit 08acbdd6fd736b90f8d725da5a0de4de2dd6de62 upstream. This reverts commit 353748a359f1821ee934afc579cf04572406b420. It bypassed the linux-mtd review process and fixes the

[PATCH 4.4 08/47] powerpc/pseries: Fix endianness while restoring of r3 in MCE handler.

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Mahesh Salgaonkar commit cd813e1cd7122f2c261dce5b54d1e0c97f80e1a5 upstream. During Machine Check interrupt on pseries platform, register r3 points RTAS extended event log passed by hypervisor.

[PATCH 4.4 09/47] fs/9p/xattr.c: catch the error of p9_client_clunk when setting xattr failed

4.4-stable review patch. If anyone has any objections, please let me know. -- From: piaojun commit 3111784bee81591ea2815011688d28b65df03627 upstream. In my testing, v9fs_fid_xattr_set will return successfully even if the backend ext4 filesystem has no space to store xattr key-

[PATCH 4.4 00/47] 4.4.155-stable review

This is the start of the stable review cycle for the 4.4.155 release. There are 47 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun Sep 9 21:08:44 UTC 2018. Anything receiv

[PATCH 4.4 37/47] ubifs: Check data node size before truncate

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Richard Weinberger commit 95a22d2084d72ea067d8323cc85677dba5d97cae upstream. Check whether the size is within bounds before using it. If the size is not correct, abort and dump the bad data nod

[RFC 19/60] sched: Add entity variants of enqueue_task_fair() and dequeue_task_fair()

There is fair amount of overlap between enqueue_task_fair() and unthrottle_cfs_rq(), as well as between dequeue_task_fair() and throttle_cfs_rq(). This is the first step toward having both of them use the same basic function. Signed-off-by: Jan H. Schönherr --- kernel/sched/fair.c | 82

[PATCH 4.4 46/47] x86/io: add interface to reserve io memtype for a resource range. (v1.1)

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Dave Airlie commit 8ef4227615e158faa4ee85a1d6466782f7e22f2f upstream. A recent change to the mm code in: 87744ab3832b mm: fix cache mode tracking in vm_insert_mixed() started enforcing checkin

[PATCH 4.4 45/47] fs/quota: Fix spectre gadget in do_quotactl

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Jeremy Cline commit 7b6924d94a60c6b8c1279ca003e8744e6cd9e8b1 upstream. 'type' is user-controlled, so sanitize it after the bounds check to avoid using it in speculative execution. This covers t

[RFC 20/60] sched: Let {en,de}queue_entity_fair() work with a varying amount of tasks

Make the task delta handled by enqueue_entity_fair() and dequeue_task_fair() variable as required by unthrottle_cfs_rq() and throttle_cfs_rq(). Signed-off-by: Jan H. Schönherr --- kernel/sched/fair.c | 18 ++ kernel/sched/sched.h | 6 -- 2 files changed, 14 insertions(+), 1

[RFC 21/60] sched: Add entity variants of put_prev_task_fair() and set_curr_task_fair()

Add entity variants of put_prev_task_fair() and set_curr_task_fair() that will be later used by coscheduling. Signed-off-by: Jan H. Schönherr --- kernel/sched/fair.c | 34 +- kernel/sched/sched.h | 2 ++ 2 files changed, 23 insertions(+), 13 deletions(-) diff -

[PATCH 4.4 41/47] udlfb: set optimal write delay

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Mikulas Patocka commit bb24153a3f13dd0dbc1f8055ad97fe346d598f66 upstream. The default delay 5 jiffies is too much when the kernel is compiled with HZ=100 - it results in jumpy cursor in Xwindow

[PATCH 3.18 10/29] tracing: Do not call start/stop() functions when tracing_on does not change

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Steven Rostedt (VMware) commit f143641bfef9a4a60c57af30de26c63057e7e695 upstream. Currently, when one echo's in 1 into tracing_on, the current tracer's "start()" function is executed, even if

[RFC 35/60] cosched: Adjust rq_lock() functions to work with hierarchical runqueues

Locks within the runqueue hierarchy are always taken from bottom to top to avoid deadlocks. Let the lock validator know about this by declaring different runqueue levels as distinct lock classes. Signed-off-by: Jan H. Schönherr --- kernel/sched/sched.h | 29 ++--- 1 file

[PATCH 3.18 11/29] tracing/blktrace: Fix to allow setting same value

3.18-stable review patch. If anyone has any objections, please let me know. -- From: Steven Rostedt (VMware) commit 757d9140072054528b13bbe291583d9823cde195 upstream. Masami Hiramatsu reported: Current trace-enable attribute in sysfs returns an error if user writes the sa

[RFC 25/60] cosched: Prepare scheduling domain topology for coscheduling

The ability to coschedule is coupled closely to the scheduling domain topology: all CPUs within a scheduling domain will context switch simultaneously. In other words, each scheduling domain also defines a synchronization domain. That means, that we should have a wider selection of scheduling doma

[PATCH 4.4 39/47] pwm: tiehrpwm: Fix disabling of output of PWMs

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Vignesh R commit 38dabd91ff0bde33352ca3cc65ef515599b77a05 upstream. pwm-tiehrpwm driver disables PWM output by putting it in low output state via active AQCSFRC register in ehrpwm_pwm_disable()

[RFC 31/60] cosched: Don't disable idle tick for now

Coscheduling relies on the leader to drive preemption of the group when the time slice is exhausted. This is also the case, when the leader is idle but the group as a whole is not. Because of that, we currently cannot disable the idle tick. Keep the tick enabled in code. This relieves the user fro

<    3   4   5   6   7   8   9   10   >