{"push_id":825476202,"size":109,"distinct_size":109,"ref":"refs/heads/linux-3.2.y","head":"0149138c4142da287d23f9d5c6038f7fb5e30ac2","before":"d07c3d992f7b4cafa50490751725db83276554e2","commits":[{"sha":"a1a1e789bed910db9f193109b4481327fa8d42db","author":{"email":"73675debcd8a436be48ec22211dcf44fe0df0a64@decadent.org.uk","name":"Ben Hutchings"},"message":"ipv6: Fix build failure when CONFIG_INET disabled\n\noutput_core.c, added in 3.2.66, is only needed and can only be\ncompiled when CONFIG_INET is enabled.\n\nThe condition in the Makefile is already correct upstream.\n\nReported-by: kbuild test robot <fengguang.wu@intel.com>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/a1a1e789bed910db9f193109b4481327fa8d42db"},{"sha":"516aa86b9ffaa8daba9dd3e8ef16350ffafbb25e","author":{"email":"17c2d8920621522552b392f72d8fdb4d1e866b44@suug.ch","name":"Thomas Graf"},"message":"pktgen: Require CONFIG_INET due to use of IPv4 checksum function\n\ncommit ffd756b3174e496cf6f3c5458c434e31d2cd48b0 upstream.\n\nUnlike for IPv6, the IPv4 checksum functions are only available\nif CONFIG_INET is set.\n\nReported-by: kbuild test robot <fengguang.wu@intel.com>\nSigned-off-by: Thomas Graf <tgraf@suug.ch>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/516aa86b9ffaa8daba9dd3e8ef16350ffafbb25e"},{"sha":"7f63bfd0051575b4487f2e17b44e2cc4eb39384b","author":{"email":"596727c8a0ea4db3ba2ceceedccbacd3d7b371b8@suse.cz","name":"Jan Kara"},"message":"jbd2: protect all log tail updates with j_checkpoint_mutex\n\ncommit a78bb11d7acd525623c6a0c2ff4e213d527573fa upstream.\n\nThere are some log tail updates that are not protected by j_checkpoint_mutex.\nSome of these are harmless because they happen during startup or shutdown but\nupdates in jbd2_journal_commit_transaction() and jbd2_journal_flush() can\nreally race with other log tail updates (e.g. someone doing\njbd2_journal_flush() with someone running jbd2_cleanup_journal_tail()). So\nprotect all log tail updates with j_checkpoint_mutex.\n\nSigned-off-by: Jan Kara <jack@suse.cz>\nSigned-off-by: \"Theodore Ts'o\" <tytso@mit.edu>\n[bwh: Backported to 3.2:\n - Adjust context\n - Add unlock on the error path in jbd2_journal_flush()]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nCc: Bartosz Kwitniewski <zerg2000@astral.org.pl>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/7f63bfd0051575b4487f2e17b44e2cc4eb39384b"},{"sha":"f96051e525023fcb88fe5df5858cbee0371c0b4a","author":{"email":"b9d45bd1f671e508cd8daa63dfc3cabb597562df@citrix.com","name":"David Vrabel"},"message":"xen/gntdev: convert priv->lock to a mutex\n\ncommit 1401c00e59ea021c575f74612fe2dbba36d6a4ee upstream.\n\nUnmapping may require sleeping and we unmap while holding priv->lock, so\nconvert it to a mutex.\n\nSigned-off-by: David Vrabel <david.vrabel@citrix.com>\nReviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>\n[bwh: Backported to 3.2:\n - Adjust context\n - Drop changes to functions we don't have]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/f96051e525023fcb88fe5df5858cbee0371c0b4a"},{"sha":"a97233643dcf324d983d92118099213fd08b7fba","author":{"email":"b37867d4e08020cf5bb17f05a2c036fbc82d5481@invisiblethingslab.com","name":"Marek Marczykowski-Górecki"},"message":"xen/gntdevt: Fix race condition in gntdev_release()\n\ncommit 30b03d05e07467b8c6ec683ea96b5bffcbcd3931 upstream.\n\nWhile gntdev_release() is called the MMU notifier is still registered\nand can traverse priv->maps list even if no pages are mapped (which is\nthe case -- gntdev_release() is called after all). But\ngntdev_release() will clear that list, so make sure that only one of\nthose things happens at the same time.\n\nSigned-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>\nSigned-off-by: David Vrabel <david.vrabel@citrix.com>\n[bwh: Backported to 3.2: adjust context]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/a97233643dcf324d983d92118099213fd08b7fba"},{"sha":"1d9fd24206b274e4adf1e88dd48c781692e983c5","author":{"email":"ef65de1c7be0aa837fe7b25ba9a7739905af6a55@gondor.apana.org.au","name":"Herbert Xu"},"message":"crypto: ixp4xx - Remove bogus BUG_ON on scattered dst buffer\n\ncommit f898c522f0e9ac9f3177d0762b76e2ab2d2cf9c0 upstream.\n\nThis patch removes a bogus BUG_ON in the ablkcipher path that\ntriggers when the destination buffer is different from the source\nbuffer and is scattered.\n\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/1d9fd24206b274e4adf1e88dd48c781692e983c5"},{"sha":"6735cd0e46a5e0f9f28c801ba20b91d892bfbe34","author":{"email":"65191830245723325aed938dddb6d81810e13fc4@de.bosch.com","name":"Dirk Behme"},"message":"USB: sierra: add 1199:68AB device ID\n\ncommit 74472233233f577eaa0ca6d6e17d9017b6e53150 upstream.\n\nAdd support for the Sierra Wireless AR8550 device with\nUSB descriptor 0x1199, 0x68AB.\n\nIt is common with MC879x modules 1199:683c/683d which\nalso are composite devices with 7 interfaces (0..6)\nand also MDM62xx based as the AR8550.\n\nThe major difference are only the interface attributes\n02/02/01 on interfaces 3 and 4 on the AR8550. They are\nvendor specific ff/ff/ff on MC879x modules.\n\nlsusb reports:\n\nBus 001 Device 004: ID 1199:68ab Sierra Wireless, Inc.\nDevice Descriptor:\n  bLength                18\n  bDescriptorType         1\n  bcdUSB               2.00\n  bDeviceClass            0 (Defined at Interface level)\n  bDeviceSubClass         0\n  bDeviceProtocol         0\n  bMaxPacketSize0        64\n  idVendor           0x1199 Sierra Wireless, Inc.\n  idProduct          0x68ab\n  bcdDevice            0.06\n  iManufacturer           3 Sierra Wireless, Incorporated\n  iProduct                2 AR8550\n  iSerial                 0\n  bNumConfigurations      1\n  Configuration Descriptor:\n    bLength                 9\n    bDescriptorType         2\n    wTotalLength          198\n    bNumInterfaces          7\n    bConfigurationValue     1\n    iConfiguration          1 Sierra Configuration\n    bmAttributes         0xe0\n      Self Powered\n      Remote Wakeup\n    MaxPower                0mA\n    Interface Descriptor:\n      bLength                 9\n      bDescriptorType         4\n      bInterfaceNumber        0\n      bAlternateSetting       0\n      bNumEndpoints           2\n      bInterfaceClass       255 Vendor Specific Class\n      bInterfaceSubClass    255 Vendor Specific Subclass\n      bInterfaceProtocol    255 Vendor Specific Protocol\n      iInterface              0\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x81  EP 1 IN\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x01  EP 1 OUT\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\n    Interface Descriptor:\n      bLength                 9\n      bDescriptorType         4\n      bInterfaceNumber        1\n      bAlternateSetting       0\n      bNumEndpoints           2\n      bInterfaceClass       255 Vendor Specific Class\n      bInterfaceSubClass    255 Vendor Specific Subclass\n      bInterfaceProtocol    255 Vendor Specific Protocol\n      iInterface              0\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x82  EP 2 IN\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x02  EP 2 OUT\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\n    Interface Descriptor:\n      bLength                 9\n      bDescriptorType         4\n      bInterfaceNumber        2\n      bAlternateSetting       0\n      bNumEndpoints           2\n      bInterfaceClass       255 Vendor Specific Class\n      bInterfaceSubClass    255 Vendor Specific Subclass\n      bInterfaceProtocol    255 Vendor Specific Protocol\n      iInterface              0\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x83  EP 3 IN\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x03  EP 3 OUT\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\n    Interface Descriptor:\n      bLength                 9\n      bDescriptorType         4\n      bInterfaceNumber        3\n      bAlternateSetting       0\n      bNumEndpoints           3\n      bInterfaceClass         2 Communications\n      bInterfaceSubClass      2 Abstract (modem)\n      bInterfaceProtocol      1 AT-commands (v.25ter)\n      iInterface              0\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x84  EP 4 IN\n        bmAttributes            3\n          Transfer Type            Interrupt\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0040  1x 64 bytes\n        bInterval               5\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x85  EP 5 IN\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x04  EP 4 OUT\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\n    Interface Descriptor:\n      bLength                 9\n      bDescriptorType         4\n      bInterfaceNumber        4\n      bAlternateSetting       0\n      bNumEndpoints           3\n      bInterfaceClass         2 Communications\n      bInterfaceSubClass      2 Abstract (modem)\n      bInterfaceProtocol      1 AT-commands (v.25ter)\n      iInterface              0\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x86  EP 6 IN\n        bmAttributes            3\n          Transfer Type            Interrupt\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0040  1x 64 bytes\n        bInterval               5\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x87  EP 7 IN\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x05  EP 5 OUT\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\n    Interface Descriptor:\n      bLength                 9\n      bDescriptorType         4\n      bInterfaceNumber        5\n      bAlternateSetting       0\n      bNumEndpoints           3\n      bInterfaceClass       255 Vendor Specific Class\n      bInterfaceSubClass    255 Vendor Specific Subclass\n      bInterfaceProtocol    255 Vendor Specific Protocol\n      iInterface              0\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x88  EP 8 IN\n        bmAttributes            3\n          Transfer Type            Interrupt\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0040  1x 64 bytes\n        bInterval               5\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x89  EP 9 IN\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x06  EP 6 OUT\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\n    Interface Descriptor:\n      bLength                 9\n      bDescriptorType         4\n      bInterfaceNumber        6\n      bAlternateSetting       0\n      bNumEndpoints           3\n      bInterfaceClass       255 Vendor Specific Class\n      bInterfaceSubClass    255 Vendor Specific Subclass\n      bInterfaceProtocol    255 Vendor Specific Protocol\n      iInterface              0\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x8a  EP 10 IN\n        bmAttributes            3\n          Transfer Type            Interrupt\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0040  1x 64 bytes\n        bInterval               5\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x8b  EP 11 IN\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x07  EP 7 OUT\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval              32\nDevice Qualifier (for other device speed):\n  bLength                10\n  bDescriptorType         6\n  bcdUSB               2.00\n  bDeviceClass            0 (Defined at Interface level)\n  bDeviceSubClass         0\n  bDeviceProtocol         0\n  bMaxPacketSize0        64\n  bNumConfigurations      1\nDevice Status:     0x0001\n  Self Powered\n\nSigned-off-by: Dirk Behme <dirk.behme@de.bosch.com>\nCc: Lars Melin <larsm17@gmail.com>\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/6735cd0e46a5e0f9f28c801ba20b91d892bfbe34"},{"sha":"1faeb78fa64ca582f3b4bb1d432564714431486a","author":{"email":"7b9769c9c63db7b456a556857e9f88090ee9c9a2@purestorage.com","name":"Alexei Potashnik"},"message":"target/iscsi: Fix double free of a TUR followed by a solicited NOPOUT\n\ncommit 9547308bda296b6f69876c840a0291fcfbeddbb8 upstream.\n\nMake sure all non-READ SCSI commands get targ_xfer_tag initialized\nto 0xffffffff, not just WRITEs.\n\nDouble-free of a TUR cmd object occurs under the following scenario:\n\n1. TUR received (targ_xfer_tag is uninitialized and left at 0)\n2. TUR status sent\n3. First unsolicited NOPIN is sent to initiator (gets targ_xfer_tag of 0)\n4. NOPOUT for NOPIN (with TTT=0) arrives\n - its ExpStatSN acks TUR status, TUR is queued for removal\n - LIO tries to find NOPIN with TTT=0, but finds the same TUR instead,\n   TUR is queued for removal for the 2nd time\n\n(Drop unbalanced conditional bracket usage - nab)\n\nSigned-off-by: Alexei Potashnik <alexei@purestorage.com>\nSigned-off-by: Spencer Baugh <sbaugh@catern.com>\nSigned-off-by: Nicholas Bellinger <nab@linux-iscsi.org>\n[bwh: Backported to 3.2:\n - Adjust context\n - Keep the braces around the if-block]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/1faeb78fa64ca582f3b4bb1d432564714431486a"},{"sha":"966b20a399e17a861527fb92b0411a5deb90ba18","author":{"email":"1c00aa603bb92d594c03cff60ecf8e63b2a5bcb1@suse.com","name":"NeilBrown"},"message":"md/raid1: extend spinlock to protect raid1_end_read_request against inconsistencies\n\ncommit 423f04d63cf421ea436bcc5be02543d549ce4b28 upstream.\n\nraid1_end_read_request() assumes that the In_sync bits are consistent\nwith the ->degaded count.\nraid1_spare_active updates the In_sync bit before the ->degraded count\nand so exposes an inconsistency, as does error()\nSo extend the spinlock in raid1_spare_active() and error() to hide those\ninconsistencies.\n\nThis should probably be part of\n  Commit: 34cab6f42003 (\"md/raid1: fix test for 'was read error from\n  last working device'.\")\nas it addresses the same issue.  It fixes the same bug and should go\nto -stable for same reasons.\n\nFixes: 76073054c95b (\"md/raid1: clean up read_balance.\")\nSigned-off-by: NeilBrown <neilb@suse.com>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/966b20a399e17a861527fb92b0411a5deb90ba18"},{"sha":"823713324fe26978a9c468b93a5af43444849a45","author":{"email":"0d270388f2f92757a5de0f4bd891d3b392c44c4f@purestorage.com","name":"Roland Dreier"},"message":"target: REPORT LUNS should return LUN 0 even for dynamic ACLs\n\ncommit 9c395170a559d3b23dad100b01fc4a89d661c698 upstream.\n\nIf an initiator doesn't have any real LUNs assigned, we should report\nLUN 0 and a LUN list length of 1.  Some versions of Solaris at least\ngo beserk if we report a LUN list length of 0.\n\nSigned-off-by: Roland Dreier <roland@purestorage.com>\nSigned-off-by: Nicholas Bellinger <nab@linux-iscsi.org>\n[bwh: Backported to 3.2: adjust filename, context]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/823713324fe26978a9c468b93a5af43444849a45"},{"sha":"226302bdd94de8fd2a772f8c233b5e638ff56959","author":{"email":"118ed6118e893d16e8c6e0776e0ebc290952c897@openwrt.org","name":"Felix Fietkau"},"message":"MIPS: Fix sched_getaffinity with MT FPAFF enabled\n\ncommit 1d62d737555e1378eb62a8bba26644f7d97139d2 upstream.\n\np->thread.user_cpus_allowed is zero-initialized and is only filled on\nthe first sched_setaffinity call.\n\nTo avoid adding overhead in the task initialization codepath, simply OR\nthe returned mask in sched_getaffinity with p->cpus_allowed.\n\nSigned-off-by: Felix Fietkau <nbd@openwrt.org>\nCc: linux-mips@linux-mips.org\nPatchwork: https://patchwork.linux-mips.org/patch/10740/\nSigned-off-by: Ralf Baechle <ralf@linux-mips.org>\n[bwh: Backported to 3.2: also convert from obsolete cpumask API]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/226302bdd94de8fd2a772f8c233b5e638ff56959"},{"sha":"6e3ae6256145b5597bee0296eb5fc384cd86aa3d","author":{"email":"2d4473c5e67eb83655334d4e9a7757f781607241@linux.intel.com","name":"Mathias Nyman"},"message":"xhci: fix off by one error in TRB DMA address boundary check\n\ncommit 7895086afde2a05fa24a0e410d8e6b75ca7c8fdd upstream.\n\nWe need to check that a TRB is part of the current segment\nbefore calculating its DMA address.\n\nPreviously a ring segment didn't use a full memory page, and every\nnew ring segment got a new memory page, so the off by one\nerror in checking the upper bound was never seen.\n\nNow that we use a full memory page, 256 TRBs (4096 bytes), the off by one\ndidn't catch the case when a TRB was the first element of the next segment.\n\nThis is triggered if the virtual memory pages for a ring segment are\nnext to each in increasing order where the ring buffer wraps around and\ncauses errors like:\n\n[  106.398223] xhci_hcd 0000:00:14.0: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 0 comp_code 1\n[  106.398230] xhci_hcd 0000:00:14.0: Looking for event-dma fffd3000 trb-start fffd4fd0 trb-end fffd5000 seg-start fffd4000 seg-end fffd4ff0\n\nThe trb-end address is one outside the end-seg address.\n\nTested-by: Arkadiusz Miśkiewicz <arekm@maven.pl>\nSigned-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/6e3ae6256145b5597bee0296eb5fc384cd86aa3d"},{"sha":"f3a66bdc88c3261f55b942453476e623056b92d9","author":{"email":"ff341aa343d564f9e53e9dcb6996be8c04859a66@oracle.com","name":"Dan Carpenter"},"message":"rds: fix an integer overflow test in rds_info_getsockopt()\n\ncommit 468b732b6f76b138c0926eadf38ac88467dcd271 upstream.\n\n\"len\" is a signed integer.  We check that len is not negative, so it\ngoes from zero to INT_MAX.  PAGE_SIZE is unsigned long so the comparison\nis type promoted to unsigned long.  ULONG_MAX - 4095 is a higher than\nINT_MAX so the condition can never be true.\n\nI don't know if this is harmful but it seems safe to limit \"len\" to\nINT_MAX - 4095.\n\nFixes: a8c879a7ee98 ('RDS: Info and stats')\nSigned-off-by: Dan Carpenter <dan.carpenter@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/f3a66bdc88c3261f55b942453476e623056b92d9"},{"sha":"bc230ada485b9bcd42bfe17b8010ecfa21ed526b","author":{"email":"3fddac958924aef220f202ca567388ddab3f14a8@infradead.org","name":"Peter Zijlstra"},"message":"perf: Fix fasync handling on inherited events\n\ncommit fed66e2cdd4f127a43fd11b8d92a99bdd429528c upstream.\n\nVince reported that the fasync signal stuff doesn't work proper for\ninherited events. So fix that.\n\nInstalling fasync allocates memory and sets filp->f_flags |= FASYNC,\nwhich upon the demise of the file descriptor ensures the allocation is\nfreed and state is updated.\n\nNow for perf, we can have the events stick around for a while after the\noriginal FD is dead because of references from child events. So we\ncannot copy the fasync pointer around. We can however consistently use\nthe parent's fasync, as that will be updated.\n\nReported-and-Tested-by: Vince Weaver <vincent.weaver@maine.edu>\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nCc: Arnaldo Carvalho deMelo <acme@kernel.org>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: eranian@google.com\nLink: http://lkml.kernel.org/r/1434011521.1495.71.camel@twins\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/bc230ada485b9bcd42bfe17b8010ecfa21ed526b"},{"sha":"a7c4bf9e8f7f847d7a5b33c40efde8541d652c41","author":{"email":"eec15f2dea0e7d114bf41a5bde8a2858b8f3e893@cavium.com","name":"David Daney"},"message":"MIPS: Make set_pte() SMP safe.\n\ncommit 46011e6ea39235e4aca656673c500eac81a07a17 upstream.\n\nOn MIPS the GLOBAL bit of the PTE must have the same value in any\naligned pair of PTEs.  These pairs of PTEs are referred to as\n\"buddies\".  In a SMP system is is possible for two CPUs to be calling\nset_pte() on adjacent PTEs at the same time.  There is a race between\nsetting the PTE and a different CPU setting the GLOBAL bit in its\nbuddy PTE.\n\nThis race can be observed when multiple CPUs are executing\nvmap()/vfree() at the same time.\n\nMake setting the buddy PTE's GLOBAL bit an atomic operation to close\nthe race condition.\n\nThe case of CONFIG_64BIT_PHYS_ADDR && CONFIG_CPU_MIPS32 is *not*\nhandled.\n\nSigned-off-by: David Daney <david.daney@cavium.com>\nCc: linux-mips@linux-mips.org\nPatchwork: https://patchwork.linux-mips.org/patch/10835/\nSigned-off-by: Ralf Baechle <ralf@linux-mips.org>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/a7c4bf9e8f7f847d7a5b33c40efde8541d652c41"},{"sha":"931a9653b9dd309f0dcdfaceff259316e5515e72","author":{"email":"88260f35dd98758635dbbf2145383e817a86f01c@huawei.com","name":"Joseph Qi"},"message":"ocfs2: fix BUG in ocfs2_downconvert_thread_do_work()\n\ncommit 209f7512d007980fd111a74a064d70a3656079cf upstream.\n\nThe \"BUG_ON(list_empty(&osb->blocked_lock_list))\" in\nocfs2_downconvert_thread_do_work can be triggered in the following case:\n\nocfs2dc has firstly saved osb->blocked_lock_count to local varibale\nprocessed, and then processes the dentry lockres.  During the dentry\nput, it calls iput and then deletes rw, inode and open lockres from\nblocked list in ocfs2_mark_lockres_freeing.  And this causes the\nvariable `processed' to not reflect the number of blocked lockres to be\nprocessed, which triggers the BUG.\n\nSigned-off-by: Joseph Qi <joseph.qi@huawei.com>\nCc: Mark Fasheh <mfasheh@suse.com>\nCc: Joel Becker <jlbec@evilplan.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/931a9653b9dd309f0dcdfaceff259316e5515e72"},{"sha":"72e6f0680249f5e0a87f2b282d033baefd90d84e","author":{"email":"ef65de1c7be0aa837fe7b25ba9a7739905af6a55@gondor.apana.org.au","name":"Herbert Xu"},"message":"net: Clone skb before setting peeked flag\n\ncommit 738ac1ebb96d02e0d23bc320302a6ea94c612dec upstream.\n\nShared skbs must not be modified and this is crucial for broadcast\nand/or multicast paths where we use it as an optimisation to avoid\nunnecessary cloning.\n\nThe function skb_recv_datagram breaks this rule by setting peeked\nwithout cloning the skb first.  This causes funky races which leads\nto double-free.\n\nThis patch fixes this by cloning the skb and replacing the skb\nin the list when setting skb->peeked.\n\nFixes: a59322be07c9 (\"[UDP]: Only increment counter on first peek/recv\")\nReported-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n[bwh: Backported to 3.2: adjust context]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/72e6f0680249f5e0a87f2b282d033baefd90d84e"},{"sha":"e553622ccb6b6e06079f980f55cf04128db3420c","author":{"email":"ef65de1c7be0aa837fe7b25ba9a7739905af6a55@gondor.apana.org.au","name":"Herbert Xu"},"message":"net: Fix skb_set_peeked use-after-free bug\n\ncommit a0a2a6602496a45ae838a96db8b8173794b5d398 upstream.\n\nThe commit 738ac1ebb96d02e0d23bc320302a6ea94c612dec (\"net: Clone\nskb before setting peeked flag\") introduced a use-after-free bug\nin skb_recv_datagram.  This is because skb_set_peeked may create\na new skb and free the existing one.  As it stands the caller will\ncontinue to use the old freed skb.\n\nThis patch fixes it by making skb_set_peeked return the new skb\n(or the old one if unchanged).\n\nFixes: 738ac1ebb96d (\"net: Clone skb before setting peeked flag\")\nReported-by: Brenden Blanco <bblanco@plumgrid.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nTested-by: Brenden Blanco <bblanco@plumgrid.com>\nReviewed-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/e553622ccb6b6e06079f980f55cf04128db3420c"},{"sha":"ef64c0a84e38a0319fa7ff60cf8c23a10110cba3","author":{"email":"2cc0d0d76de2e6f37b92deeb83c85cb306fc5dc1@kernel.org","name":"Andy Lutomirski"},"message":"x86/ldt: Make modify_ldt synchronous\n\ncommit 37868fe113ff2ba814b3b4eb12df214df555f8dc upstream.\n\nmodify_ldt() has questionable locking and does not synchronize\nthreads.  Improve it: redesign the locking and synchronize all\nthreads' LDTs using an IPI on all modifications.\n\nThis will dramatically slow down modify_ldt in multithreaded\nprograms, but there shouldn't be any multithreaded programs that\ncare about modify_ldt's performance in the first place.\n\nThis fixes some fallout from the CVE-2015-5157 fixes.\n\nSigned-off-by: Andy Lutomirski <luto@kernel.org>\nReviewed-by: Borislav Petkov <bp@suse.de>\nCc: Andrew Cooper <andrew.cooper3@citrix.com>\nCc: Andy Lutomirski <luto@amacapital.net>\nCc: Boris Ostrovsky <boris.ostrovsky@oracle.com>\nCc: Borislav Petkov <bp@alien8.de>\nCc: Brian Gerst <brgerst@gmail.com>\nCc: Denys Vlasenko <dvlasenk@redhat.com>\nCc: H. Peter Anvin <hpa@zytor.com>\nCc: Jan Beulich <jbeulich@suse.com>\nCc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Sasha Levin <sasha.levin@oracle.com>\nCc: Steven Rostedt <rostedt@goodmis.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: security@kernel.org <security@kernel.org>\nCc: xen-devel <xen-devel@lists.xen.org>\nLink: http://lkml.kernel.org/r/4c6978476782160600471bd865b318db34c7b628.1438291540.git.luto@kernel.org\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\n[bwh: Backported to 3.2:\n - Adjust context\n - Drop comment changes in switch_mm()\n - Drop changes to get_segment_base() in arch/x86/kernel/cpu/perf_event.c\n - Open-code lockless_dereference(), smp_store_release(), on_each_cpu_mask()]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/ef64c0a84e38a0319fa7ff60cf8c23a10110cba3"},{"sha":"75a146b383c8b5175bc313ee73ebe6f9afb248c9","author":{"email":"29bbaec13092d36559e3abc6f27f7d09c395819f@suse.com","name":"Juergen Gross"},"message":"x86/ldt: Correct LDT access in single stepping logic\n\ncommit 136d9d83c07c5e30ac49fc83b27e8c4842f108fc upstream.\n\nCommit 37868fe113ff (\"x86/ldt: Make modify_ldt synchronous\")\nintroduced a new struct ldt_struct anchored at mm->context.ldt.\n\nconvert_ip_to_linear() was changed to reflect this, but indexing\ninto the ldt has to be changed as the pointer is no longer void *.\n\nSigned-off-by: Juergen Gross <jgross@suse.com>\nReviewed-by: Andy Lutomirski <luto@kernel.org>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: bp@suse.de\nLink: http://lkml.kernel.org/r/1438848278-12906-1-git-send-email-jgross@suse.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/75a146b383c8b5175bc313ee73ebe6f9afb248c9"}]}