{"push_id":901735139,"size":488,"distinct_size":4,"ref":"refs/heads/linux-linaro-lsk-v3.18-eas-test","head":"b4ac03693e33029871eb54e0913e458894109485","before":"45637436056fd3a554596f04a653434ba11728b7","commits":[{"sha":"edf9af7863f2ae49310836de15669704ce1bf876","author":{"email":"547fa85bb3888a0222eed8ec39e36708605c6d53@imgtec.com","name":"James Hogan"},"message":"MIPS: Malta: Don't reinitialise RTC\n\n[ Upstream commit 106eccb4d20f35ebc58ff2286c170d9e79c5ff68 ]\n\nOn Malta, since commit a87ea88d8f6c (\"MIPS: Malta: initialise the RTC at\nboot\"), the RTC is reinitialised and forced into binary coded decimal\n(BCD) mode during init, even if the bootloader has already initialised\nit, and may even have already put it into binary mode (as YAMON does).\nThis corrupts the current time, can result in the RTC seconds being an\ninvalid BCD (e.g. 0x1a..0x1f) for up to 6 seconds, as well as confusing\nYAMON for a while after reset, enough for it to report timeouts when\nattempting to load from TFTP (it actually uses the RTC in that code).\n\nTherefore only initialise the RTC to the extent that is necessary so\nthat Linux avoids interfering with the bootloader setup, while also\nallowing it to estimate the CPU frequency without hanging, without a\nbootloader necessarily having done anything with the RTC (for example\nwhen the kernel is loaded via EJTAG).\n\nThe divider control is configured for a 32KHZ reference clock if\nnecessary, and the SET bit of the RTC_CONTROL register is cleared if\nnecessary without changing any other bits (this bit will be set when\ncoming out of reset if the battery has been disconnected).\n\nFixes: a87ea88d8f6c (\"MIPS: Malta: initialise the RTC at boot\")\nSigned-off-by: James Hogan <james.hogan@imgtec.com>\nReviewed-by: Paul Burton <paul.burton@imgtec.com>\nCc: Ralf Baechle <ralf@linux-mips.org>\nCc: Maciej W. Rozycki <macro@linux-mips.org>\nCc: linux-mips@linux-mips.org\nCc: <stable@vger.kernel.org> # 3.14+\nPatchwork: https://patchwork.linux-mips.org/patch/10739/\nSigned-off-by: Ralf Baechle <ralf@linux-mips.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/kykdev/linux-linaro-stable/commits/edf9af7863f2ae49310836de15669704ce1bf876"},{"sha":"be98cdc06716c01197d843801e9b3a6da1347ba8","author":{"email":"118ed6118e893d16e8c6e0776e0ebc290952c897@openwrt.org","name":"Felix Fietkau"},"message":"MIPS: Fix sched_getaffinity with MT FPAFF enabled\n\n[ Upstream commit 1d62d737555e1378eb62a8bba26644f7d97139d2 ]\n\np->thread.user_cpus_allowed is zero-initialized and is only filled on\nthe first sched_setaffinity call.\n\nTo avoid adding overhead in the task initialization codepath, simply OR\nthe returned mask in sched_getaffinity with p->cpus_allowed.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Felix Fietkau <nbd@openwrt.org>\nCc: linux-mips@linux-mips.org\nPatchwork: https://patchwork.linux-mips.org/patch/10740/\nSigned-off-by: Ralf Baechle <ralf@linux-mips.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/kykdev/linux-linaro-stable/commits/be98cdc06716c01197d843801e9b3a6da1347ba8"},{"sha":"e5e8829b1a84bddf48b56c11f22ee8af218da48a","author":{"email":"547fa85bb3888a0222eed8ec39e36708605c6d53@imgtec.com","name":"James Hogan"},"message":"MIPS: do_mcheck: Fix kernel code dump with EVA\n\n[ Upstream commit 55c723e181ccec30fb5c672397fe69ec35967d97 ]\n\nIf a machine check exception is raised in kernel mode, user context,\nwith EVA enabled, then the do_mcheck handler will attempt to read the\ncode around the EPC using EVA load instructions, i.e. as if the reads\nwere from user mode. This will either read random user data if the\nprocess has anything mapped at the same address, or it will cause an\nexception which is handled by __get_user, resulting in this output:\n\n Code: (Bad address in epc)\n\nFix by setting the current user access mode to kernel if the saved\nregister context indicates the exception was taken in kernel mode. This\ncauses __get_user to use normal loads to read the kernel code.\n\nSigned-off-by: James Hogan <james.hogan@imgtec.com>\nCc: Markos Chandras <markos.chandras@imgtec.com>\nCc: Leonid Yegoshin <leonid.yegoshin@imgtec.com>\nCc: linux-mips@linux-mips.org\nCc: <stable@vger.kernel.org> # 3.15+\nPatchwork: https://patchwork.linux-mips.org/patch/10777/\nSigned-off-by: Ralf Baechle <ralf@linux-mips.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/kykdev/linux-linaro-stable/commits/e5e8829b1a84bddf48b56c11f22ee8af218da48a"},{"sha":"101f163197025dfe02aa8c5235baa041d0c00a75","author":{"email":"547fa85bb3888a0222eed8ec39e36708605c6d53@imgtec.com","name":"James Hogan"},"message":"MIPS: show_stack: Fix stack trace with EVA\n\n[ Upstream commit 1e77863a51698c4319587df34171bd823691a66a ]\n\nThe show_stack() function deals exclusively with kernel contexts, but if\nit gets called in user context with EVA enabled, show_stacktrace() will\nattempt to access the stack using EVA accesses, which will either read\nother user mapped data, or more likely cause an exception which will be\nhandled by __get_user().\n\nThis is easily reproduced using SysRq t to show all task states, which\nresults in the following stack dump output:\n\n Stack : (Bad stack address)\n\nFix by setting the current user access mode to kernel around the call to\nshow_stacktrace(). This causes __get_user() to use normal loads to read\nthe kernel stack.\n\nNow we get the correct output, like this:\n\n Stack : 00000000 80168960 00000000 004a0000 00000000 00000000 8060016c 1f3abd0c\n           1f172cd8 8056f09c 7ff1e450 8014fc3c 00000001 806dd0b0 0000001d 00000002\n           1f17c6a0 1f17c804 1f17c6a0 8066f6e0 00000000 0000000a 00000000 00000000\n           00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000\n           00000000 00000000 00000000 00000000 00000000 0110e800 1f3abd6c 1f17c6a0\n           ...\n\nSigned-off-by: James Hogan <james.hogan@imgtec.com>\nCc: Markos Chandras <markos.chandras@imgtec.com>\nCc: Leonid Yegoshin <leonid.yegoshin@imgtec.com>\nCc: linux-mips@linux-mips.org\nCc: <stable@vger.kernel.org> # 3.15+\nPatchwork: https://patchwork.linux-mips.org/patch/10778/\nSigned-off-by: Ralf Baechle <ralf@linux-mips.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/kykdev/linux-linaro-stable/commits/101f163197025dfe02aa8c5235baa041d0c00a75"},{"sha":"e1c3e51cf7e1de53b9279ac6a02ceb8630dd15f2","author":{"email":"547fa85bb3888a0222eed8ec39e36708605c6d53@imgtec.com","name":"James Hogan"},"message":"MIPS: Flush RPS on kernel entry with EVA\n\n[ Upstream commit 3aff47c062b944a5e1f9af56a37a23f5295628fc ]\n\nWhen EVA is enabled, flush the Return Prediction Stack (RPS) present on\nsome MIPS cores on entry to the kernel from user mode.\n\nThis is important specifically for interAptiv with EVA enabled,\notherwise kernel mode RPS mispredicts may trigger speculative fetches of\nuser return addresses, which may be sensitive in the kernel address\nspace due to EVA's overlapping user/kernel address spaces.\n\nSigned-off-by: James Hogan <james.hogan@imgtec.com>\nCc: Ralf Baechle <ralf@linux-mips.org>\nCc: Markos Chandras <markos.chandras@imgtec.com>\nCc: Leonid Yegoshin <leonid.yegoshin@imgtec.com>\nCc: linux-mips@linux-mips.org\nCc: <stable@vger.kernel.org> # 3.15.x-\nPatchwork: https://patchwork.linux-mips.org/patch/10812/\nSigned-off-by: Ralf Baechle <ralf@linux-mips.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/kykdev/linux-linaro-stable/commits/e1c3e51cf7e1de53b9279ac6a02ceb8630dd15f2"},{"sha":"204041c4a640f004a5df152434f05b96ee76dfab","author":{"email":"eec15f2dea0e7d114bf41a5bde8a2858b8f3e893@cavium.com","name":"David Daney"},"message":"MIPS: Make set_pte() SMP safe.\n\n[ Upstream commit 46011e6ea39235e4aca656673c500eac81a07a17 ]\n\nOn MIPS the GLOBAL bit of the PTE must have the same value in any\naligned pair of PTEs.  These pairs of PTEs are referred to as\n\"buddies\".  In a SMP system is is possible for two CPUs to be calling\nset_pte() on adjacent PTEs at the same time.  There is a race between\nsetting the PTE and a different CPU setting the GLOBAL bit in its\nbuddy PTE.\n\nThis race can be observed when multiple CPUs are executing\nvmap()/vfree() at the same time.\n\nMake setting the buddy PTE's GLOBAL bit an atomic operation to close\nthe race condition.\n\nThe case of CONFIG_64BIT_PHYS_ADDR && CONFIG_CPU_MIPS32 is *not*\nhandled.\n\nSigned-off-by: David Daney <david.daney@cavium.com>\nCc: <stable@vger.kernel.org>\nCc: linux-mips@linux-mips.org\nPatchwork: https://patchwork.linux-mips.org/patch/10835/\nSigned-off-by: Ralf Baechle <ralf@linux-mips.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/kykdev/linux-linaro-stable/commits/204041c4a640f004a5df152434f05b96ee76dfab"},{"sha":"81f2af92d90824ba6a37157118d5bf997fc5f4d9","author":{"email":"596727c8a0ea4db3ba2ceceedccbacd3d7b371b8@suse.com","name":"Jan Kara"},"message":"fsnotify: fix oops in fsnotify_clear_marks_by_group_flags()\n\n[ Upstream commit 8f2f3eb59dff4ec538de55f2e0592fec85966aab ]\n\nfsnotify_clear_marks_by_group_flags() can race with\nfsnotify_destroy_marks() so that when fsnotify_destroy_mark_locked()\ndrops mark_mutex, a mark from the list iterated by\nfsnotify_clear_marks_by_group_flags() can be freed and thus the next\nentry pointer we have cached may become stale and we dereference free\nmemory.\n\nFix the problem by first moving marks to free to a special private list\nand then always free the first entry in the special list.  This method\nis safe even when entries from the list can disappear once we drop the\nlock.\n\nSigned-off-by: Jan Kara <jack@suse.com>\nReported-by: Ashish Sangwan <a.sangwan@samsung.com>\nReviewed-by: Ashish Sangwan <a.sangwan@samsung.com>\nCc: Lino Sanfilippo <LinoSanfilippo@gmx.de>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/kykdev/linux-linaro-stable/commits/81f2af92d90824ba6a37157118d5bf997fc5f4d9"},{"sha":"89cc013797bc47c50ebf5b4a89ead3d19b1ac2e3","author":{"email":"711c73f64afdce07b7e38039a96d2224209e9a6c@chris-wilson.co.uk","name":"Chris Wilson"},"message":"drm/i915: Replace WARN inside I915_READ64_2x32 with retry loop\n\n[ Upstream commit ee0a227b7ac6e75f28e10269f81c7ec6eb600952 ]\n\nSince we may conceivably encounter situations where the upper part of the\n64bit register changes between reads, for example when a timestamp\ncounter overflows, change the WARN into a retry loop.\n\nSigned-off-by: Chris Wilson <chris@chris-wilson.co.uk>\nCc: Michał Winiarski <michal.winiarski@intel.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/kykdev/linux-linaro-stable/commits/89cc013797bc47c50ebf5b4a89ead3d19b1ac2e3"},{"sha":"82fbf139b01c499a7d175d8a152c36d616d29630","author":{"email":"08dc22c6156113f2deff178e35e3ed9b24d6af9e@amd.com","name":"Alex Deucher"},"message":"drm/radeon/combios: add some validation of lvds values\n\n[ Upstream commit 0a90a0cff9f429f886f423967ae053150dce9259 ]\n\nFixes a broken hsync start value uncovered by:\nabc0b1447d4974963548777a5ba4a4457c82c426\n(drm: Perform basic sanity checks on probed modes)\n\nThe driver handled the bad hsync start elsewhere, but\nthe above commit prevented it from getting added.\n\nbug:\nhttps://bugs.freedesktop.org/show_bug.cgi?id=91401\n\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/kykdev/linux-linaro-stable/commits/82fbf139b01c499a7d175d8a152c36d616d29630"},{"sha":"3fa2a2f918ccd66db81a774776dca3ebb7fcfc61","author":{"email":"c1b6782c4af8f0673da8923a0702a1832e5940f4@ffwll.ch","name":"Daniel Vetter"},"message":"drm/dp-mst: Remove debug WARN_ON\n\n[ Upstream commit 42639ba554655c280ae6cb72df0522b1201f2961 ]\n\nApparently been in there since forever and fairly easy to hit when\nhotplugging really fast. I can do that since my mst hub has a manual\nbutton to flick the hpd line for reprobing. The resulting WARNING spam\nisn't pretty.\n\nCc: Dave Airlie <airlied@gmail.com>\nCc: stable@vger.kernel.org\nReviewed-by: Thierry Reding <treding@nvidia.com>\nReviewed-by: Ander Conselvan de Oliveira <conselvan2@gmail.com>\nSigned-off-by: Daniel Vetter <daniel.vetter@intel.com>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/kykdev/linux-linaro-stable/commits/3fa2a2f918ccd66db81a774776dca3ebb7fcfc61"},{"sha":"e58bb36e35bba8f4ea1185f04ff35cc0c25c0761","author":{"email":"bf668d4b220231d97fe248d4ae0ba63a1d887e4c@linux.vnet.ibm.com","name":"Brian King"},"message":"ipr: Fix locking for unit attention handling\n\n[ Upstream commit 36b8e180e1e929e00b351c3b72aab3147fc14116 ]\n\nMake sure we have the host lock held when calling scsi_report_bus_reset. Fixes\na crash seen as the __devices list in the scsi host was changing as we were\niterating through it.\n\nCc: <stable@vger.kernel.org>\nReviewed-by: Wen Xiong <wenxiong@linux.vnet.ibm.com>\nReviewed-by: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>\nSigned-off-by: Brian King <brking@linux.vnet.ibm.com>\nReviewed-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: James Bottomley <JBottomley@Odin.com>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/kykdev/linux-linaro-stable/commits/e58bb36e35bba8f4ea1185f04ff35cc0c25c0761"},{"sha":"e383a58df7d4625f3e2bbe4a7c6a7aff156f2a19","author":{"email":"bf668d4b220231d97fe248d4ae0ba63a1d887e4c@linux.vnet.ibm.com","name":"Brian King"},"message":"ipr: Fix incorrect trace indexing\n\n[ Upstream commit bb7c54339e6a10ecce5c4961adf5e75b3cf0af30 ]\n\nWhen ipr's internal driver trace was changed to an atomic, a signed/unsigned\nbug slipped in which results in us indexing backwards in our memory buffer\nwriting on memory that does not belong to us. This patch fixes this by removing\nthe modulo and instead just mask off the low bits.\n\nCc: <stable@vger.kernel.org>\nTested-by: Wen Xiong <wenxiong@linux.vnet.ibm.com>\nReviewed-by: Wen Xiong <wenxiong@linux.vnet.ibm.com>\nReviewed-by: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>\nSigned-off-by: Brian King <brking@linux.vnet.ibm.com>\nReviewed-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: James Bottomley <JBottomley@Odin.com>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/kykdev/linux-linaro-stable/commits/e383a58df7d4625f3e2bbe4a7c6a7aff156f2a19"},{"sha":"d37dfe249a92e5848f5d29b2c567c2884752eef2","author":{"email":"bf668d4b220231d97fe248d4ae0ba63a1d887e4c@linux.vnet.ibm.com","name":"Brian King"},"message":"ipr: Fix invalid array indexing for HRRQ\n\n[ Upstream commit 3f1c0581310d5d94bd72740231507e763a6252a4 ]\n\nFixes another signed / unsigned array indexing bug in the ipr driver.\nCurrently, when hrrq_index wraps, it becomes a negative number. We\ndo the modulo, but still have a negative number, so we end up indexing\nbackwards in the array. Given where the hrrq array is located in memory,\nwe probably won't actually reference memory we don't own, but nonetheless\nipr is still looking at data within struct ipr_ioa_cfg and interpreting it as\nstruct ipr_hrr_queue data, so bad things could certainly happen.\n\nEach ipr adapter has anywhere from 1 to 16 HRRQs. By default, we use 2 on new\nadapters.  Let's take an example:\n\nAssume ioa_cfg->hrrq_index=0x7fffffffe and ioa_cfg->hrrq_num=4:\n\nThe atomic_add_return will then return -1. We mod this with 3 and get -2, add\none and get -1 for an array index.\n\nOn adapters which support more than a single HRRQ, we dedicate HRRQ to adapter\ninitialization and error interrupts so that we can optimize the other queues\nfor fast path I/O. So all normal I/O uses HRRQ 1-15. So we want to spread the\nI/O requests across those HRRQs.\n\nWith the default module parameter settings, this bug won't hit, only when\nsomeone sets the ipr.number_of_msix parameter to a value larger than 3 is when\nbad things start to happen.\n\nCc: <stable@vger.kernel.org>\nTested-by: Wen Xiong <wenxiong@linux.vnet.ibm.com>\nReviewed-by: Wen Xiong <wenxiong@linux.vnet.ibm.com>\nReviewed-by: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>\nSigned-off-by: Brian King <brking@linux.vnet.ibm.com>\nReviewed-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: James Bottomley <JBottomley@Odin.com>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/kykdev/linux-linaro-stable/commits/d37dfe249a92e5848f5d29b2c567c2884752eef2"},{"sha":"38096a07aa1f4851146edcac94efc88553e3bb70","author":{"email":"2d4473c5e67eb83655334d4e9a7757f781607241@linux.intel.com","name":"Mathias Nyman"},"message":"xhci: fix off by one error in TRB DMA address boundary check\n\n[ Upstream commit 7895086afde2a05fa24a0e410d8e6b75ca7c8fdd ]\n\nWe need to check that a TRB is part of the current segment\nbefore calculating its DMA address.\n\nPreviously a ring segment didn't use a full memory page, and every\nnew ring segment got a new memory page, so the off by one\nerror in checking the upper bound was never seen.\n\nNow that we use a full memory page, 256 TRBs (4096 bytes), the off by one\ndidn't catch the case when a TRB was the first element of the next segment.\n\nThis is triggered if the virtual memory pages for a ring segment are\nnext to each in increasing order where the ring buffer wraps around and\ncauses errors like:\n\n[  106.398223] xhci_hcd 0000:00:14.0: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 0 comp_code 1\n[  106.398230] xhci_hcd 0000:00:14.0: Looking for event-dma fffd3000 trb-start fffd4fd0 trb-end fffd5000 seg-start fffd4000 seg-end fffd4ff0\n\nThe trb-end address is one outside the end-seg address.\n\nCc: <stable@vger.kernel.org>\nTested-by: Arkadiusz Miśkiewicz <arekm@maven.pl>\nSigned-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/kykdev/linux-linaro-stable/commits/38096a07aa1f4851146edcac94efc88553e3bb70"},{"sha":"aab8865bcedc91f55a1ef6c2c80513ac2e97cc82","author":{"email":"0398910e4f4970259b451f0f9d0686cc5e961b81@linux.vnet.ibm.com","name":"Gavin Shan"},"message":"drivers/usb: Delete XHCI command timer if necessary\n\n[ Upstream commit ffe5adcb7661d94e952d6b5ed7f493cb4ef0c7bc ]\n\nWhen xhci_mem_cleanup() is called, it's possible that the command\ntimer isn't initialized and scheduled. For those cases, to delete\nthe command timer causes soft-lockup as below stack dump shows.\n\nThe patch avoids deleting the command timer if it's not scheduled\nwith the help of timer_pending().\n\nNMI watchdog: BUG: soft lockup - CPU#40 stuck for 23s! [kworker/40:1:8140]\n      :\nNIP [c000000000150b30] lock_timer_base.isra.34+0x90/0xa0\nLR [c000000000150c24] try_to_del_timer_sync+0x34/0xa0\nCall Trace:\n[c000000f67c975e0] [c0000000015b84f8] mon_ops+0x0/0x8 (unreliable)\n[c000000f67c97620] [c000000000150c24] try_to_del_timer_sync+0x34/0xa0\n[c000000f67c97660] [c000000000150cf0] del_timer_sync+0x60/0x80\n[c000000f67c97690] [c00000000070ac0c] xhci_mem_cleanup+0x5c/0x5e0\n[c000000f67c97740] [c00000000070c2e8] xhci_mem_init+0x1158/0x13b0\n[c000000f67c97860] [c000000000700978] xhci_init+0x88/0x110\n[c000000f67c978e0] [c000000000701644] xhci_gen_setup+0x2b4/0x590\n[c000000f67c97970] [c0000000006d4410] xhci_pci_setup+0x40/0x190\n[c000000f67c979f0] [c0000000006b1af8] usb_add_hcd+0x418/0xba0\n[c000000f67c97ab0] [c0000000006cb15c] usb_hcd_pci_probe+0x1dc/0x5c0\n[c000000f67c97b50] [c0000000006d3ba4] xhci_pci_probe+0x64/0x1f0\n[c000000f67c97ba0] [c0000000004fe9ac] local_pci_probe+0x6c/0x130\n[c000000f67c97c30] [c0000000000e5ce8] work_for_cpu_fn+0x38/0x60\n[c000000f67c97c60] [c0000000000eacb8] process_one_work+0x198/0x470\n[c000000f67c97cf0] [c0000000000eb6ac] worker_thread+0x37c/0x5a0\n[c000000f67c97d80] [c0000000000f2730] kthread+0x110/0x130\n[c000000f67c97e30] [c000000000009660] ret_from_kernel_thread+0x5c/0x7c\n\nCc: <stable@vger.kernel.org>\nReported-by: Priya M. A <priyama2@in.ibm.com>\nSigned-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>\nSigned-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/kykdev/linux-linaro-stable/commits/aab8865bcedc91f55a1ef6c2c80513ac2e97cc82"},{"sha":"6f3dd9c23a8d5b0fe17bfd8e66b42a0adef1d2d0","author":{"email":"65191830245723325aed938dddb6d81810e13fc4@de.bosch.com","name":"Dirk Behme"},"message":"USB: sierra: add 1199:68AB device ID\n\n[ Upstream commit 74472233233f577eaa0ca6d6e17d9017b6e53150 ]\n\nAdd support for the Sierra Wireless AR8550 device with\nUSB descriptor 0x1199, 0x68AB.\n\nIt is common with MC879x modules 1199:683c/683d which\nalso are composite devices with 7 interfaces (0..6)\nand also MDM62xx based as the AR8550.\n\nThe major difference are only the interface attributes\n02/02/01 on interfaces 3 and 4 on the AR8550. They are\nvendor specific ff/ff/ff on MC879x modules.\n\nlsusb reports:\n\nBus 001 Device 004: ID 1199:68ab Sierra Wireless, Inc.\nDevice Descriptor:\n  bLength                18\n  bDescriptorType         1\n  bcdUSB               2.00\n  bDeviceClass            0 (Defined at Interface level)\n  bDeviceSubClass         0\n  bDeviceProtocol         0\n  bMaxPacketSize0        64\n  idVendor           0x1199 Sierra Wireless, Inc.\n  idProduct          0x68ab\n  bcdDevice            0.06\n  iManufacturer           3 Sierra Wireless, Incorporated\n  iProduct                2 AR8550\n  iSerial                 0\n  bNumConfigurations      1\n  Configuration Descriptor:\n    bLength                 9\n    bDescriptorType         2\n    wTotalLength          198\n    bNumInterfaces          7\n    bConfigurationValue     1\n    iConfiguration          1 Sierra Configuration\n    bmAttributes         0xe0\n      Self Powered\n      Remote Wakeup\n    MaxPower                0mA\n    Interface Descriptor:\n      bLength                 9\n      bDescriptorType         4\n      bInterfaceNumber        0\n      bAlternateSetting       0\n      bNumEndpoints           2\n      bInterfaceClass       255 Vendor Specific Class\n      bInterfaceSubClass    255 Vendor Specific Subclass\n      bInterfaceProtocol    255 Vendor Specific Protocol\n      iInterface              0\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x81  EP 1 IN\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x01  EP 1 OUT\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\n    Interface Descriptor:\n      bLength                 9\n      bDescriptorType         4\n      bInterfaceNumber        1\n      bAlternateSetting       0\n      bNumEndpoints           2\n      bInterfaceClass       255 Vendor Specific Class\n      bInterfaceSubClass    255 Vendor Specific Subclass\n      bInterfaceProtocol    255 Vendor Specific Protocol\n      iInterface              0\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x82  EP 2 IN\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x02  EP 2 OUT\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\n    Interface Descriptor:\n      bLength                 9\n      bDescriptorType         4\n      bInterfaceNumber        2\n      bAlternateSetting       0\n      bNumEndpoints           2\n      bInterfaceClass       255 Vendor Specific Class\n      bInterfaceSubClass    255 Vendor Specific Subclass\n      bInterfaceProtocol    255 Vendor Specific Protocol\n      iInterface              0\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x83  EP 3 IN\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x03  EP 3 OUT\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\n    Interface Descriptor:\n      bLength                 9\n      bDescriptorType         4\n      bInterfaceNumber        3\n      bAlternateSetting       0\n      bNumEndpoints           3\n      bInterfaceClass         2 Communications\n      bInterfaceSubClass      2 Abstract (modem)\n      bInterfaceProtocol      1 AT-commands (v.25ter)\n      iInterface              0\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x84  EP 4 IN\n        bmAttributes            3\n          Transfer Type            Interrupt\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0040  1x 64 bytes\n        bInterval               5\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x85  EP 5 IN\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x04  EP 4 OUT\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\n    Interface Descriptor:\n      bLength                 9\n      bDescriptorType         4\n      bInterfaceNumber        4\n      bAlternateSetting       0\n      bNumEndpoints           3\n      bInterfaceClass         2 Communications\n      bInterfaceSubClass      2 Abstract (modem)\n      bInterfaceProtocol      1 AT-commands (v.25ter)\n      iInterface              0\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x86  EP 6 IN\n        bmAttributes            3\n          Transfer Type            Interrupt\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0040  1x 64 bytes\n        bInterval               5\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x87  EP 7 IN\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x05  EP 5 OUT\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\n    Interface Descriptor:\n      bLength                 9\n      bDescriptorType         4\n      bInterfaceNumber        5\n      bAlternateSetting       0\n      bNumEndpoints           3\n      bInterfaceClass       255 Vendor Specific Class\n      bInterfaceSubClass    255 Vendor Specific Subclass\n      bInterfaceProtocol    255 Vendor Specific Protocol\n      iInterface              0\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x88  EP 8 IN\n        bmAttributes            3\n          Transfer Type            Interrupt\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0040  1x 64 bytes\n        bInterval               5\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x89  EP 9 IN\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x06  EP 6 OUT\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\n    Interface Descriptor:\n      bLength                 9\n      bDescriptorType         4\n      bInterfaceNumber        6\n      bAlternateSetting       0\n      bNumEndpoints           3\n      bInterfaceClass       255 Vendor Specific Class\n      bInterfaceSubClass    255 Vendor Specific Subclass\n      bInterfaceProtocol    255 Vendor Specific Protocol\n      iInterface              0\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x8a  EP 10 IN\n        bmAttributes            3\n          Transfer Type            Interrupt\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0040  1x 64 bytes\n        bInterval               5\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x8b  EP 11 IN\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x07  EP 7 OUT\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\nDevice Qualifier (for other device speed):\n  bLength                10\n  bDescriptorType         6\n  bcdUSB               2.00\n  bDeviceClass            0 (Defined at Interface level)\n  bDeviceSubClass         0\n  bDeviceProtocol         0\n  bMaxPacketSize0        64\n  bNumConfigurations      1\nDevice Status:     0x0001\n  Self Powered\n\nSigned-off-by: Dirk Behme <dirk.behme@de.bosch.com>\nCc: Lars Melin <larsm17@gmail.com>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/kykdev/linux-linaro-stable/commits/6f3dd9c23a8d5b0fe17bfd8e66b42a0adef1d2d0"},{"sha":"7c70eda72eace5af36fecf69be6f9f5ea376ea2f","author":{"email":"75ea6bb7bfc1186f92d26164de5f9268c9a45b59@rowland.harvard.edu","name":"Alan Stern"},"message":"usb: udc: core: add device_del() call to error pathway\n\n[ Upstream commit c93e64e91248becd0edb8f01723dff9da890e2ab ]\n\nThis patch fixes a bug in the error pathway of\nusb_add_gadget_udc_release() in udc-core.c.  If the udc registration\nfails, the gadget registration is not fully undone; there's a\nput_device(&gadget->dev) call but no device_del().\n\nCC: <stable@vger.kernel.org>\nAcked-by: Peter Chen <peter.chen@freescale.com>\nSigned-off-by: Alan Stern <stern@rowland.harvard.edu>\nSigned-off-by: Felipe Balbi <balbi@ti.com>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/kykdev/linux-linaro-stable/commits/7c70eda72eace5af36fecf69be6f9f5ea376ea2f"},{"sha":"35242ba632639463b9b9c82780e2e91bdd1e3231","author":{"email":"1c00aa603bb92d594c03cff60ecf8e63b2a5bcb1@suse.de","name":"NeilBrown"},"message":"phy: twl4030-usb: make runtime pm more reliable.\n\n[ Upstream commit 56301df6bcaaed31e77b8c500ca1b437f46a3158 ]\n\nA construct like:\n\n        if (pm_runtime_suspended(twl->dev))\n               pm_runtime_get_sync(twl->dev);\n\nis against the spirit of the runtime_pm interface as it\nmakes the internal refcounting useless.\n\nIn this case it is also racy, particularly as 'put_autosuspend'\nis used to drop a reference.\nWhen that happens a timer is started and the device is\nruntime-suspended after the timeout.\nIf the above code runs in this window, the device will not be\nfound to be suspended so no pm_runtime reference is taken.\nWhen the timer expires the device will be suspended, which is\nagainst the intention of the code.\n\nSo be more direct is taking and dropping references.\nIf twl->linkstat is VBUS_VALID or ID_GROUND, then hold a\npm_runtime reference, otherwise don't.\nDefine \"cable_present()\" to test for this condition.\n\nTested-by: Tony Lindgren <tony@atomide.com>\nSigned-off-by: NeilBrown <neilb@suse.de>\nSigned-off-by: Kishon Vijay Abraham I <kishon@ti.com>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/kykdev/linux-linaro-stable/commits/35242ba632639463b9b9c82780e2e91bdd1e3231"},{"sha":"e46e18eb387767fa26356417210ef41d0855ef1e","author":{"email":"fe09bc2ef2737a3258f978e26226dcbac1b3f948@randazzo.fr","name":"Benjamin Randazzo"},"message":"md: use kzalloc() when bitmap is disabled\n\n[ Upstream commit 33afeac21b9cb79ad8fc5caf239af89c79e25e1e ]\n\ncommit b6878d9e03043695dbf3fa1caa6dfc09db225b16 upstream.\n\nIn drivers/md/md.c get_bitmap_file() uses kmalloc() for creating a\nmdu_bitmap_file_t called \"file\".\n\n5769         file = kmalloc(sizeof(*file), GFP_NOIO);\n5770         if (!file)\n5771                 return -ENOMEM;\n\nThis structure is copied to user space at the end of the function.\n\n5786         if (err == 0 &&\n5787             copy_to_user(arg, file, sizeof(*file)))\n5788                 err = -EFAULT\n\nBut if bitmap is disabled only the first byte of \"file\" is initialized\nwith zero, so it's possible to read some bytes (up to 4095) of kernel\nspace memory from user space. This is an information leak.\n\n5775         /* bitmap disabled, zero the first byte and copy out */\n5776         if (!mddev->bitmap_info.file)\n5777                 file->pathname[0] = '\\0';\n\nSigned-off-by: Benjamin Randazzo <benjamin@randazzo.fr>\nSigned-off-by: NeilBrown <neilb@suse.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/kykdev/linux-linaro-stable/commits/e46e18eb387767fa26356417210ef41d0855ef1e"},{"sha":"370f050fc757716e9b334d705f67a71396701f71","author":{"email":"fe08d3c717adf2ae63592e4c9aec6e3e404d8e3e@davemloft.net","name":"David S. Miller"},"message":"sparc64: Fix userspace FPU register corruptions.\n\n[ Upstream commit 44922150d87cef616fd183220d43d8fde4d41390 ]\n\nIf we have a series of events from userpsace, with %fprs=FPRS_FEF,\nlike follows:\n\nETRAP\n\tETRAP\n\t\tVIS_ENTRY(fprs=0x4)\n\t\tVIS_EXIT\n\t\tRTRAP (kernel FPU restore with fpu_saved=0x4)\n\tRTRAP\n\nWe will not restore the user registers that were clobbered by the FPU\nusing kernel code in the inner-most trap.\n\nTraps allocate FPU save slots in the thread struct, and FPU using\nsequences save the \"dirty\" FPU registers only.\n\nThis works at the initial trap level because all of the registers\nget recorded into the top-level FPU save area, and we'll return\nto userspace with the FPU disabled so that any FPU use by the user\nwill take an FPU disabled trap wherein we'll load the registers\nback up properly.\n\nBut this is not how trap returns from kernel to kernel operate.\n\nThe simplest fix for this bug is to always save all FPU register state\nfor anything other than the top-most FPU save area.\n\nGetting rid of the optimized inner-slot FPU saving code ends up\nmaking VISEntryHalf degenerate into plain VISEntry.\n\nLonger term we need to do something smarter to reinstate the partial\nsave optimizations.  Perhaps the fundament error is having trap entry\nand exit allocate FPU save slots and restore register state.  Instead,\nthe VISEntry et al. calls should be doing that work.\n\nThis bug is about two decades old.\n\nReported-by: James Y Knight <jyknight@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/kykdev/linux-linaro-stable/commits/370f050fc757716e9b334d705f67a71396701f71"}]}