{"push_id":687687214,"size":71,"distinct_size":8,"ref":"refs/heads/new","head":"81a99ec039abc82ed27540a9229e378b5a438462","before":"2927d0d376a8e43355240c086748aa86fd2fad50","commits":[{"sha":"2b9fdee2b14a3b5a14b9327c59e456e47ababd41","author":{"email":"b71cb89e0280c07ae5269139c6fbbabd15b1b3dd@gmail.com","name":"katinatez"},"message":"Merge branch 'cm-12.1' of https://github.com/CyanogenMod/android_kernel_oneplus_msm8974 into HEAD","distinct":true,"url":"https://api.github.com/repos/jgcaaprom/android_kernel_oneplus_msm8974/commits/2b9fdee2b14a3b5a14b9327c59e456e47ababd41"},{"sha":"a456902935fa4c91bac562281928db91ded18838","author":{"email":"a8167b9d27aca9c6624754deb52c4c6420eded04@huawei.com","name":"Zefan Li"},"message":"Linux 3.4.107\n\nspi: dw: Fix dynamic speed change.\n\ncommit 0a8727e69778683495058852f783eeda141a754e upstream.\n\nAn IOCTL call that calls spi_setup() and then dw_spi_setup() will\noverwrite the persisted last transfer speed. On each transfer, the\nSPI speed is compared to the last transfer speed to determine if the\nclock divider registers need to be updated (did the speed change?).\nThis bug was observed with the spidev driver using spi-config to\nupdate the max transfer speed.\n\nThis fix: Don't overwrite the persisted last transaction clock speed\nwhen updating the SPI parameters in dw_spi_setup(). On the next\ntransaction, the new speed won't match the persisted last speed\nand the hardware registers will be updated.\nOn initialization, the persisted last transaction clock\nspeed will be 0 but will be updated after the first SPI\ntransaction.\n\nMove zeroed clock divider check into clock change test because\nchip->clk_div is zero on startup and would cause a divide-by-zero\nerror. The calculation was wrong as well (can't support odd #).\n\nReported-by: Vlastimil Setka <setka@vsis.cz>\nSigned-off-by: Vlastimil Setka <setka@vsis.cz>\nSigned-off-by: Thor Thayer <tthayer@opensource.altera.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nUSB: serial: cp210x: add IDs for CEL MeshConnect USB Stick\n\ncommit ffcfe30ebd8dd703d0fc4324ffe56ea21f5479f4 upstream.\n\nSigned-off-by: Preston Fick <pffick@gmail.com>\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\niio: Fix IIO_EVENT_CODE_EXTRACT_DIR bit mask\n\ncommit ccf54555da9a5e91e454b909ca6a5303c7d6b910 upstream.\n\nThe direction field is set on 7 bits, thus we need to AND it with 0111 111 mask\nin order to retrieve it, that is 0x7F, not 0xCF as it is now.\n\nFixes: ade7ef7ba (staging:iio: Differential channel handling)\nSigned-off-by: Cristina Ciocan <cristina.ciocan@intel.com>\nSigned-off-by: Jonathan Cameron <jic23@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nusb: serial: ftdi_sio: add PIDs for Matrix Orbital products\n\ncommit 204ec6e07ea7aff863df0f7c53301f9cbbfbb9d3 upstream.\n\nAdd PIDs for new Matrix Orbital GTT series products.\n\nSigned-off-by: Troy Clark <tclark@matrixorbital.ca>\n[johan: shorten commit message ]\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nUSB: keyspan: fix tty line-status reporting\n\ncommit 5d1678a33c731b56e245e888fdae5e88efce0997 upstream.\n\nFix handling of TTY error flags, which are not bitmasks and must\nspecifically not be ORed together as this prevents the line discipline\nfrom recognising them.\n\nAlso insert null characters when reporting overrun errors as these are\nnot associated with the received character.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Johan Hovold <johan@kernel.org>\n[lizf: Backported to 3.4:\n - s/&port->port/tty/\n - adjust context\n - adjust indentation]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nUSB: keyspan: fix overrun-error reporting\n\ncommit 855515a6d3731242d85850a206f2ec084c917338 upstream.\n\nFix reporting of overrun errors, which are not associated with a\ncharacter. Instead insert a null character and report only once.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Johan Hovold <johan@kernel.org>\n[lizf: Backported to 3.4:\n - s/&port->port/tty\n - adjust context\n - adjust indentation]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nUSB: ssu100: fix overrun-error reporting\n\ncommit 75bcbf29c284dd0154c3e895a0bd1ef0e796160e upstream.\n\nFix reporting of overrun errors, which should only be reported once\nusing the inserted null character.\n\nFixes: 6b8f1ca5581b (\"USB: ssu100: set tty_flags in ssu100_process_packet\")\nSigned-off-by: Johan Hovold <johan@kernel.org>\n[lizf: Backported to 3.4:\n - adjust context\n - lookup tty using tty_port_tty_get()]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nSUNRPC: Fix locking around callback channel reply receive\n\ncommit 093a1468b6edb0e568be7311b8d2228d205702db upstream.\n\nBoth xprt_lookup_rqst() and xprt_complete_rqst() require that you\ntake the transport lock in order to avoid races with xprt_transmit().\n\nSigned-off-by: Trond Myklebust <trond.myklebust@primarydata.com>\nReviewed-by: Jeff Layton <jlayton@primarydata.com>\nSigned-off-by: J. Bruce Fields <bfields@redhat.com>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nnfsd: Fix slot wake up race in the nfsv4.1 callback code\n\ncommit c6c15e1ed303ffc47e696ea1c9a9df1761c1f603 upstream.\n\nThe currect code for nfsd41_cb_get_slot() and nfsd4_cb_done() has no\nlocking in order to guarantee atomicity, and so allows for races of\nthe form.\n\nTask 1                                  Task 2\n======                                  ======\nif (test_and_set_bit(0) != 0) {\n                                        clear_bit(0)\n                                        rpc_wake_up_next(queue)\n        rpc_sleep_on(queue)\n        return false;\n}\n\nThis patch breaks the race condition by adding a retest of the bit\nafter the call to rpc_sleep_on().\n\nSigned-off-by: Trond Myklebust <trond.myklebust@primarydata.com>\nSigned-off-by: J. Bruce Fields <bfields@redhat.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nbnx2fc: do not add shared skbs to the fcoe_rx_list\n\ncommit 01a4cc4d0cd6a836c7b923760e8eb1cbb6a47258 upstream.\n\nIn some cases, the fcoe_rx_list may contains multiple instances\nof the same skb (the so called \"shared skbs\").\n\nthe bnx2fc_l2_rcv thread is a loop that extracts a skb from the list,\nmodifies (and destroys) its content and then proceed to the next one.\nThe problem is that if the skb is shared, the remaining instances will\nbe corrupted.\n\nThe solution is to use skb_share_check() before adding the skb to the\nfcoe_rx_list.\n\n[ 6286.808725] ------------[ cut here ]------------\n[ 6286.808729] WARNING: at include/scsi/fc_frame.h:173 bnx2fc_l2_rcv_thread+0x425/0x450 [bnx2fc]()\n[ 6286.808748] Modules linked in: bnx2x(-) mdio dm_service_time bnx2fc cnic uio fcoe libfcoe 8021q garp stp mrp libfc llc scsi_transport_fc scsi_tgt sg iTCO_wdt iTCO_vendor_support coretemp kvm_intel kvm crct10dif_pclmul crc32_pclmul crc32c_intel e1000e ghash_clmulni_intel aesni_intel lrw gf128mul glue_helper ablk_helper ptp cryptd hpilo serio_raw hpwdt lpc_ich pps_core ipmi_si pcspkr mfd_core ipmi_msghandler shpchp pcc_cpufreq mperf nfsd auth_rpcgss nfs_acl lockd sunrpc dm_multipath xfs libcrc32c ata_generic pata_acpi sd_mod crc_t10dif crct10dif_common mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit ata_piix drm_kms_helper ttm drm libata i2c_core hpsa dm_mirror dm_region_hash dm_log dm_mod [last unloaded: mdio]\n[ 6286.808750] CPU: 3 PID: 1304 Comm: bnx2fc_l2_threa Not tainted 3.10.0-121.el7.x86_64 #1\n[ 6286.808750] Hardware name: HP ProLiant DL120 G7, BIOS J01 07/01/2013\n[ 6286.808752]  0000000000000000 000000000b36e715 ffff8800deba1e00 ffffffff815ec0ba\n[ 6286.808753]  ffff8800deba1e38 ffffffff8105dee1 ffffffffa05618c0 ffff8801e4c81888\n[ 6286.808754]  ffffe8ffff663868 ffff8801f402b180 ffff8801f56bc000 ffff8800deba1e48\n[ 6286.808754] Call Trace:\n[ 6286.808759]  [<ffffffff815ec0ba>] dump_stack+0x19/0x1b\n[ 6286.808762]  [<ffffffff8105dee1>] warn_slowpath_common+0x61/0x80\n[ 6286.808763]  [<ffffffff8105e00a>] warn_slowpath_null+0x1a/0x20\n[ 6286.808765]  [<ffffffffa054f415>] bnx2fc_l2_rcv_thread+0x425/0x450 [bnx2fc]\n[ 6286.808767]  [<ffffffffa054eff0>] ? bnx2fc_disable+0x90/0x90 [bnx2fc]\n[ 6286.808769]  [<ffffffff81085aef>] kthread+0xcf/0xe0\n[ 6286.808770]  [<ffffffff81085a20>] ? kthread_create_on_node+0x140/0x140\n[ 6286.808772]  [<ffffffff815fc76c>] ret_from_fork+0x7c/0xb0\n[ 6286.808773]  [<ffffffff81085a20>] ? kthread_create_on_node+0x140/0x140\n[ 6286.808774] ---[ end trace c6cdb939184ccb4e ]---\n\nSigned-off-by: Maurizio Lombardi <mlombard@redhat.com>\nAcked-by: Chad Dupuis <chad.dupuis@qlogic.com>\nSigned-off-by: Christoph Hellwig <hch@lst.de>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nARM: 8216/1: xscale: correct auxiliary register in suspend/resume\n\ncommit ef59a20ba375aeb97b3150a118318884743452a8 upstream.\n\nAccording to the manuals I have, XScale auxiliary register should be\nreached with opc_2 = 1 instead of crn = 1. cpu_xscale_proc_init\ncorrectly uses c1, c0, 1 arguments, but cpu_xscale_do_suspend and\ncpu_xscale_do_resume use c1, c1, 0. Correct suspend/resume functions to\nalso use c1, c0, 1.\n\nThe issue was primarily noticed thanks to qemu reporing \"unsupported\ninstruction\" on the pxa suspend path. Confirmed in PXA210/250 and PXA255\nXScale Core manuals and in PXA270 and PXA320 Developers Guides.\n\nHarware tested by me on tosa (pxa255). Robert confirmed on pxa270 board.\n\nTested-by: Robert Jarzmik <robert.jarzmik@free.fr>\nSigned-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>\nAcked-by: Robert Jarzmik <robert.jarzmik@free.fr>\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nUSB: xhci: don't start a halted endpoint before its new dequeue is set\n\ncommit c3492dbfa1050debf23a5b5cd2bc7514c5b37896 upstream.\n\nA halted endpoint ring must first be reset, then move the ring\ndequeue pointer past the problematic TRB. If we start the ring too\nearly after reset, but before moving the dequeue pointer we\nwill end up executing the same problematic TRB again.\n\nAs we always issue a set transfer dequeue command after a reset\nendpoint command we can skip starting endpoint rings at reset endpoint\ncommand completion.\n\nWithout this fix we end up trying to handle the same faulty TD for\ncontol endpoints. causing timeout, and failing testusb ctrl_out write\ntests.\n\nFixes: e9df17e (USB: xhci: Correct assumptions about number of rings per endpoint.)\nTested-by: Felipe Balbi <balbi@ti.com>\nSigned-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nUSB: xhci: Reset a halted endpoint immediately when we encounter a stall.\n\ncommit 8e71a322fdb127814bcba423a512914ca5bc6cf5 upstream.\n\nIf a device is halted and reuturns a STALL, then the halted endpoint\nneeds to be cleared both on the host and device side. The host\nside halt is cleared by issueing a xhci reset endpoint command. The device side\nis cleared with a ClearFeature(ENDPOINT_HALT) request, which should\nbe issued by the device driver if a URB reruen -EPIPE.\n\nPreviously we cleared the host side halt after the device side was cleared.\nTo make sure the host side halt is cleared in time we want to issue the\nreset endpoint command immedialtely when a STALL status is encountered.\n\nOtherwise we end up not following the specs and not returning -EPIPE\nseveral times in a row when trying to transfer data to a halted endpoint.\n\nFixes: bcef3fd (USB: xhci: Handle errors that cause endpoint halts.)\nTested-by: Felipe Balbi <balbi@ti.com>\nSigned-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nusb: xhci: rework root port wake bits if controller isn't allowed to wakeup\n\ncommit a1377e5397ab321e21b793ec8cd2b6f12bd3c718 upstream.\n\nWhen system is being suspended, if host device is not allowed to do wakeup,\nxhci_suspend() needs to clear all root port wake on bits. Otherwise, some\nplatforms may generate spurious wakeup, even if PCI PME# is disabled.\n\nThe initial commit ff8cbf250b44 (\"xhci: clear root port wake on bits\"),\nwhich also got into stable, turned out to not work correctly and had to\nbe reverted, and is now rewritten.\n\nSigned-off-by: Lu Baolu <baolu.lu@linux.intel.com>\nSuggested-by: Alan Stern <stern@rowland.harvard.edu>\nAcked-by: Alan Stern <stern@rowland.harvard.edu>\n[Mathias Nyman: reword commit message]\nSigned-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n[lizf: Backported to 3.4:\n - adjust context\n - drop changes to xhci_plat_suspend()]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nALSA: hda - Limit 40bit DMA for AMD HDMI controllers\n\ncommit 413cbf469a19e7662ba5025695bf5a573927105a upstream.\n\nAMD/ATI HDMI controller chip models, we already have a filter to lower\nto 32bit DMA, but the rest are supposed to be working with 64bit\nalthough the hardware doesn't really work with 63bit but only with 40\nor 48bit DMA.  In this patch, we take 40bit DMA for safety for the\nAMD/ATI controllers as the graphics drivers does.\n\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>\n[lizf: Backported to 3.4:\n - adjust context\n - s/AZX_GCAP_640K/ICH6_GCAP_64OK]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nMIPS: Loongson: Make platform serial setup always built-in.\n\ncommit 26927f76499849e095714452b8a4e09350f6a3b9 upstream.\n\nIf SERIAL_8250 is compiled as a module, the platform specific setup\nfor Loongson will be a module too, and it will not work very well.\nAt least on Loongson 3 it will trigger a build failure,\nsince loongson_sysconf is not exported to modules.\n\nFix by making the platform specific serial code always built-in.\n\nSigned-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>\nReported-by: Ralf Baechle <ralf@linux-mips.org>\nCc: linux-mips@linux-mips.org\nCc: Huacai Chen <chenhc@lemote.com>\nCc: Markos Chandras <Markos.Chandras@imgtec.com>\nPatchwork: https://patchwork.linux-mips.org/patch/8533/\nSigned-off-by: Ralf Baechle <ralf@linux-mips.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nusb-quirks: Add reset-resume quirk for MS Wireless Laser Mouse 6000\n\ncommit 263e80b43559a6103e178a9176938ce171b23872 upstream.\n\nThis wireless mouse receiver needs a reset-resume quirk to properly come\nout of reset.\n\nBugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1165206\nSigned-off-by: Hans de Goede <hdegoede@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nInput: xpad - use proper endpoint type\n\ncommit a1f9a4072655843fc03186acbad65990cc05dd2d upstream.\n\nThe xpad wireless endpoint is not a bulk endpoint on my devices, but\nrather an interrupt one, so the USB core complains when it is submitted.\nI'm guessing that the author really did mean that this should be an\ninterrupt urb, but as there are a zillion different xpad devices out\nthere, let's cover out bases and handle both bulk and interrupt\nendpoints just as easily.\n\nSigned-off-by: \"Pierre-Loup A. Griffais\" <pgriffais@valvesoftware.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\npowerpc/pseries: Fix endiannes issue in RTAS call from xmon\n\ncommit 3b8a3c01096925a824ed3272601082289d9c23a5 upstream.\n\nOn pseries system (LPAR) xmon failed to enter when running in LE mode,\nsystem is hunging. Inititating xmon will lead to such an output on the\nconsole:\n\nSysRq : Entering xmon\ncpu 0x15: Vector: 0  at [c0000003f39ffb10]\n    pc: c00000000007ed7c: sysrq_handle_xmon+0x5c/0x70\n    lr: c00000000007ed7c: sysrq_handle_xmon+0x5c/0x70\n    sp: c0000003f39ffc70\n   msr: 8000000000009033\n  current = 0xc0000003fafa7180\n  paca    = 0xc000000007d75e80\t softe: 0\t irq_happened: 0x01\n    pid   = 14617, comm = bash\nBad kernel stack pointer fafb4b0 at eca7cc4\ncpu 0x15: Vector: 300 (Data Access) at [c000000007f07d40]\n    pc: 000000000eca7cc4\n    lr: 000000000eca7c44\n    sp: fafb4b0\n   msr: 8000000000001000\n   dar: 10000000\n dsisr: 42000000\n  current = 0xc0000003fafa7180\n  paca    = 0xc000000007d75e80\t softe: 0\t irq_happened: 0x01\n    pid   = 14617, comm = bash\ncpu 0x15: Exception 300 (Data Access) in xmon, returning to main loop\nxmon: WARNING: bad recursive fault on cpu 0x15\n\nThe root cause is that xmon is calling RTAS to turn off the surveillance\nwhen entering xmon, and RTAS is requiring big endian parameters.\n\nThis patch is byte swapping the RTAS arguments when running in LE mode.\n\nSigned-off-by: Laurent Dufour <ldufour@linux.vnet.ibm.com>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ndrm/i915: Unlock panel even when LVDS is disabled\n\ncommit b0616c5306b342ceca07044dbc4f917d95c4f825 upstream.\n\nOtherwise we'll have backtraces in assert_panel_unlocked because the\nBIOS locks the register. In the reporter's case this regression was\nintroduced in\n\ncommit c31407a3672aaebb4acddf90944a114fa5c8af7b\nAuthor: Chris Wilson <chris@chris-wilson.co.uk>\nDate:   Thu Oct 18 21:07:01 2012 +0100\n\n    drm/i915: Add no-lvds quirk for Supermicro X7SPA-H\n\nReported-by: Alexey Orishko <alexey.orishko@gmail.com>\nCc: Alexey Orishko <alexey.orishko@gmail.com>\nCc: Chris Wilson <chris@chris-wilson.co.uk>\nCc: Francois Tigeot <ftigeot@wolfpond.org>\nSigned-off-by: Daniel Vetter <daniel.vetter@intel.com>\nTested-by: Alexey Orishko <alexey.orishko@gmail.com>\nSigned-off-by: Jani Nikula <jani.nikula@intel.com>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nAHCI: Add DeviceIDs for Sunrise Point-LP SATA controller\n\ncommit 249cd0a187ed4ef1d0af7f74362cc2791ec5581b upstream.\n\nThis patch adds DeviceIDs for Sunrise Point-LP.\n\nSigned-off-by: Devin Ryles <devin.ryles@intel.com>\nSigned-off-by: Tejun Heo <tj@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nsata_fsl: fix error handling of irq_of_parse_and_map\n\ncommit aad0b624129709c94c2e19e583b6053520353fa8 upstream.\n\nirq_of_parse_and_map() returns 0 on error (the result is unsigned int),\nso testing for negative result never works.\n\nSigned-off-by: Dmitry Torokhov <dtor@chromium.org>\nSigned-off-by: Tejun Heo <tj@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ndrm/radeon: kernel panic in drm_calc_vbltimestamp_from_scanoutpos with 3.18.0-rc6\n\ncommit f5475cc43c899e33098d4db44b7c5e710f16589d upstream.\n\nI was unable too boot 3.18.0-rc6 because of the following kernel\npanic in drm_calc_vbltimestamp_from_scanoutpos():\n\n    [drm] Initialized drm 1.1.0 20060810\n    [drm] radeon kernel modesetting enabled.\n    [drm] initializing kernel modesetting (RV100 0x1002:0x515E 0x15D9:0x8080).\n    [drm] register mmio base: 0xC8400000\n    [drm] register mmio size: 65536\n    radeon 0000:0b:01.0: VRAM: 128M 0x00000000D0000000 - 0x00000000D7FFFFFF (16M used)\n    radeon 0000:0b:01.0: GTT: 512M 0x00000000B0000000 - 0x00000000CFFFFFFF\n    [drm] Detected VRAM RAM=128M, BAR=128M\n    [drm] RAM width 16bits DDR\n    [TTM] Zone  kernel: Available graphics memory: 3829346 kiB\n    [TTM] Zone   dma32: Available graphics memory: 2097152 kiB\n    [TTM] Initializing pool allocator\n    [TTM] Initializing DMA pool allocator\n    [drm] radeon: 16M of VRAM memory ready\n    [drm] radeon: 512M of GTT memory ready.\n    [drm] GART: num cpu pages 131072, num gpu pages 131072\n    [drm] PCI GART of 512M enabled (table at 0x0000000037880000).\n    radeon 0000:0b:01.0: WB disabled\n    radeon 0000:0b:01.0: fence driver on ring 0 use gpu addr 0x00000000b0000000 and cpu addr 0xffff8800bbbfa000\n    [drm] Supports vblank timestamp caching Rev 2 (21.10.2013).\n    [drm] Driver supports precise vblank timestamp query.\n    [drm] radeon: irq initialized.\n    [drm] Loading R100 Microcode\n    radeon 0000:0b:01.0: Direct firmware load for radeon/R100_cp.bin failed with error -2\n    radeon_cp: Failed to load firmware \"radeon/R100_cp.bin\"\n    [drm:r100_cp_init] *ERROR* Failed to load firmware!\n    radeon 0000:0b:01.0: failed initializing CP (-2).\n    radeon 0000:0b:01.0: Disabling GPU acceleration\n    [drm] radeon: cp finalized\n    BUG: unable to handle kernel NULL pointer dereference at 000000000000025c\n    IP: [<ffffffff8150423b>] drm_calc_vbltimestamp_from_scanoutpos+0x4b/0x320\n    PGD 0\n    Oops: 0000 [#1] SMP\n    Modules linked in:\n    CPU: 1 PID: 1 Comm: swapper/0 Not tainted 3.18.0-rc6-4-default #2649\n    Hardware name: Supermicro X7DB8/X7DB8, BIOS 6.00 07/26/2006\n    task: ffff880234da2010 ti: ffff880234da4000 task.ti: ffff880234da4000\n    RIP: 0010:[<ffffffff8150423b>]  [<ffffffff8150423b>] drm_calc_vbltimestamp_from_scanoutpos+0x4b/0x320\n    RSP: 0000:ffff880234da7918  EFLAGS: 00010086\n    RAX: ffffffff81557890 RBX: 0000000000000000 RCX: ffff880234da7a48\n    RDX: ffff880234da79f4 RSI: 0000000000000000 RDI: ffff880232e15000\n    RBP: ffff880234da79b8 R08: 0000000000000000 R09: 0000000000000000\n    R10: 000000000000000a R11: 0000000000000001 R12: ffff880232dda1c0\n    R13: ffff880232e1518c R14: 0000000000000292 R15: ffff880232e15000\n    FS:  0000000000000000(0000) GS:ffff88023fc40000(0000) knlGS:0000000000000000\n    CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n    CR2: 000000000000025c CR3: 0000000002014000 CR4: 00000000000007e0\n    Stack:\n     ffff880234da79d8 0000000000000286 ffff880232dcbc00 0000000000002480\n     ffff880234da7958 0000000000000296 ffff880234da7998 ffffffff8151b51d\n     ffff880234da7a48 0000000032dcbeb0 ffff880232dcbc00 ffff880232dcbc58\n    Call Trace:\n     [<ffffffff8151b51d>] ? drm_vma_offset_remove+0x1d/0x110\n     [<ffffffff8152dc98>] radeon_get_vblank_timestamp_kms+0x38/0x60\n     [<ffffffff8152076a>] ? ttm_bo_release_list+0xba/0x180\n     [<ffffffff81503751>] drm_get_last_vbltimestamp+0x41/0x70\n     [<ffffffff81503933>] vblank_disable_and_save+0x73/0x1d0\n     [<ffffffff81106b2f>] ? try_to_del_timer_sync+0x4f/0x70\n     [<ffffffff81505245>] drm_vblank_cleanup+0x65/0xa0\n     [<ffffffff815604fa>] radeon_irq_kms_fini+0x1a/0x70\n     [<ffffffff8156c07e>] r100_init+0x26e/0x410\n     [<ffffffff8152ae3e>] radeon_device_init+0x7ae/0xb50\n     [<ffffffff8152d57f>] radeon_driver_load_kms+0x8f/0x210\n     [<ffffffff81506965>] drm_dev_register+0xb5/0x110\n     [<ffffffff8150998f>] drm_get_pci_dev+0x8f/0x200\n     [<ffffffff815291cd>] radeon_pci_probe+0xad/0xe0\n     [<ffffffff8141a365>] local_pci_probe+0x45/0xa0\n     [<ffffffff8141b741>] pci_device_probe+0xd1/0x130\n     [<ffffffff81633dad>] driver_probe_device+0x12d/0x3e0\n     [<ffffffff8163413b>] __driver_attach+0x9b/0xa0\n     [<ffffffff816340a0>] ? __device_attach+0x40/0x40\n     [<ffffffff81631cd3>] bus_for_each_dev+0x63/0xa0\n     [<ffffffff8163378e>] driver_attach+0x1e/0x20\n     [<ffffffff81633390>] bus_add_driver+0x180/0x240\n     [<ffffffff81634914>] driver_register+0x64/0xf0\n     [<ffffffff81419cac>] __pci_register_driver+0x4c/0x50\n     [<ffffffff81509bf5>] drm_pci_init+0xf5/0x120\n     [<ffffffff821dc871>] ? ttm_init+0x6a/0x6a\n     [<ffffffff821dc908>] radeon_init+0x97/0xb5\n     [<ffffffff810002fc>] do_one_initcall+0xbc/0x1f0\n     [<ffffffff810e3278>] ? __wake_up+0x48/0x60\n     [<ffffffff8218e256>] kernel_init_freeable+0x18a/0x215\n     [<ffffffff8218d983>] ? initcall_blacklist+0xc0/0xc0\n     [<ffffffff818a78f0>] ? rest_init+0x80/0x80\n     [<ffffffff818a78fe>] kernel_init+0xe/0xf0\n     [<ffffffff818c0c3c>] ret_from_fork+0x7c/0xb0\n     [<ffffffff818a78f0>] ? rest_init+0x80/0x80\n    Code: 45 ac 0f 88 a8 01 00 00 3b b7 d0 01 00 00 49 89 ff 0f 83 99 01 00 00 48 8b 47 20 48 8b 80 88 00 00 00 48 85 c0 0f 84 cd 01 00 00 <41> 8b b1 5c 02 00 00 41 8b 89 58 02 00 00 89 75 98 41 8b b1 60\n    RIP  [<ffffffff8150423b>] drm_calc_vbltimestamp_from_scanoutpos+0x4b/0x320\n     RSP <ffff880234da7918>\n    CR2: 000000000000025c\n    ---[ end trace ad2c0aadf48e2032 ]---\n    Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009\n\nIt has helped me to add a NULL pointer check that was suggested at\nhttp://lists.freedesktop.org/archives/dri-devel/2014-October/070663.html\n\nI am not familiar with the code. But the change looks sane\nand we need something fast at this stage of 3.18 development.\n\nSuggested-by: Helge Deller <deller@gmx.de>\nSigned-off-by: Petr Mladek <pmladek@suse.cz>\nTested-by: Petr Mladek <pmladek@suse.cz>\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nmm: fix swapoff hang after page migration and fork\n\ncommit 2022b4d18a491a578218ce7a4eca8666db895a73 upstream.\n\nI've been seeing swapoff hangs in recent testing: it's cycling around\ntrying unsuccessfully to find an mm for some remaining pages of swap.\n\nI have been exercising swap and page migration more heavily recently,\nand now notice a long-standing error in copy_one_pte(): it's trying to\nadd dst_mm to swapoff's mmlist when it finds a swap entry, but is doing\nso even when it's a migration entry or an hwpoison entry.\n\nWhich wouldn't matter much, except it adds dst_mm next to src_mm,\nassuming src_mm is already on the mmlist: which may not be so.  Then if\npages are later swapped out from dst_mm, swapoff won't be able to find\nwhere to replace them.\n\nThere's already a !non_swap_entry() test for stats: move that up before\nthe swap_duplicate() and the addition to mmlist.\n\nSigned-off-by: Hugh Dickins <hughd@google.com>\nCc: Kelley Nielsen <kelleynnn@gmail.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nahci: disable NCQ on Samsung pci-e SSDs on macbooks\n\ncommit 67809f85d31eac600f6b28defa5386c9d2a13b1d upstream.\n\nSamsung's pci-e SSDs with device ID 0x1600 which are found on some\nmacbooks time out on NCQ commands.  Blacklist NCQ on the device so\nthat the affected machines can at least boot.\n\nOriginal-patch-by: Levente Kurusa <levex@linux.com>\nSigned-off-by: Tejun Heo <tj@kernel.org>\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=60731\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nahci: disable MSI instead of NCQ on Samsung pci-e SSDs on macbooks\n\ncommit 66a7cbc303f4d28f201529b06061944d51ab530c upstream.\n\nSamsung pci-e SSDs on macbooks failed miserably on NCQ commands, so\n67809f85d31e (\"ahci: disable NCQ on Samsung pci-e SSDs on macbooks\")\ndisabled NCQ on them.  It turns out that NCQ is fine as long as MSI is\nnot used, so let's turn off MSI and leave NCQ on.\n\nSigned-off-by: Tejun Heo <tj@kernel.org>\nLink: https://bugzilla.kernel.org/show_bug.cgi?id=60731\nTested-by: <dorin@i51.org>\nTested-by: Imre Kaloz <kaloz@openwrt.org>\nFixes: 67809f85d31e (\"ahci: disable NCQ on Samsung pci-e SSDs on macbooks\")\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nahci: disable MSI on SAMSUNG 0xa800 SSD\n\ncommit 2b21ef0aae65f22f5ba86b13c4588f6f0c2dbefb upstream.\n\nJust like 0x1600 which got blacklisted by 66a7cbc303f4 (\"ahci: disable\nMSI instead of NCQ on Samsung pci-e SSDs on macbooks\"), 0xa800 chokes\non NCQ commands if MSI is enabled.  Disable MSI.\n\nSigned-off-by: Tejun Heo <tj@kernel.org>\nReported-by: Dominik Mierzejewski <dominik@greysector.net>\nLink: https://bugzilla.kernel.org/show_bug.cgi?id=89171\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ni2c: davinci: generate STP always when NACK is received\n\ncommit 9ea359f7314132cbcb5a502d2d8ef095be1f45e4 upstream.\n\nAccording to I2C specification the NACK should be handled as follows:\n\"When SDA remains HIGH during this ninth clock pulse, this is defined as the Not\nAcknowledge signal. The master can then generate either a STOP condition to\nabort the transfer, or a repeated START condition to start a new transfer.\"\n[I2C spec Rev. 6, 3.1.6: http://www.nxp.com/documents/user_manual/UM10204.pdf]\n\nCurrently the Davinci i2c driver interrupts the transfer on receipt of a\nNACK but fails to send a STOP in some situations and so makes the bus\nstuck until next I2C IP reset (idle/enable).\n\nFor example, the issue will happen during SMBus read transfer which\nconsists from two i2c messages write command/address and read data:\n\nS Slave Address Wr A Command Code A Sr Slave Address Rd A D1..Dn A P\n<--- write -----------------------> <--- read --------------------->\n\nThe I2C client device will send NACK if it can't recognize \"Command Code\"\nand it's expected from I2C master to generate STP in this case.\nBut now, Davinci i2C driver will just exit with -EREMOTEIO and STP will\nnot be generated.\n\nHence, fix it by generating Stop condition (STP) always when NACK is received.\n\nThis patch fixes Davinci I2C in the same way it was done for OMAP I2C\ncommit cda2109a26eb (\"i2c: omap: query STP always when NACK is received\").\n\nReviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>\nReported-by: Hein Tibosch <hein_tibosch@yahoo.es>\nSigned-off-by: Grygorii Strashko <grygorii.strashko@ti.com>\nSigned-off-by: Wolfram Sang <wsa@the-dreams.de>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\neCryptfs: Force RO mount when encrypted view is enabled\n\ncommit 332b122d39c9cbff8b799007a825d94b2e7c12f2 upstream.\n\nThe ecryptfs_encrypted_view mount option greatly changes the\nfunctionality of an eCryptfs mount. Instead of encrypting and decrypting\nlower files, it provides a unified view of the encrypted files in the\nlower filesystem. The presence of the ecryptfs_encrypted_view mount\noption is intended to force a read-only mount and modifying files is not\nsupported when the feature is in use. See the following commit for more\ninformation:\n\n  e77a56d [PATCH] eCryptfs: Encrypted passthrough\n\nThis patch forces the mount to be read-only when the\necryptfs_encrypted_view mount option is specified by setting the\nMS_RDONLY flag on the superblock. Additionally, this patch removes some\nbroken logic in ecryptfs_open() that attempted to prevent modifications\nof files when the encrypted view feature was in use. The check in\necryptfs_open() was not sufficient to prevent file modifications using\nsystem calls that do not operate on a file descriptor.\n\nSigned-off-by: Tyler Hicks <tyhicks@canonical.com>\nReported-by: Priya Bansal <p.bansal@samsung.com>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nwriteback: Move I_DIRTY_PAGES handling\n\ncommit 6290be1c1dc6589eeda213aa40946b27fa4faac8 upstream.\n\nInstead of clearing I_DIRTY_PAGES and resetting it when we didn't succeed in\nwriting them all, just clear the bit only when we succeeded writing all the\npages. We also move the clearing of the bit close to other i_state handling to\nseparate it from writeback list handling. This is desirable because list\nhandling will differ for flusher thread and other writeback_single_inode()\ncallers in future. No filesystem plays any tricks with I_DIRTY_PAGES (like\nchecking it in ->writepages or ->write_inode implementation) so this movement\nis safe.\n\nSigned-off-by: Jan Kara <jack@suse.cz>\nSigned-off-by: Fengguang Wu <fengguang.wu@intel.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nwriteback: fix a subtle race condition in I_DIRTY clearing\n\ncommit 9c6ac78eb3521c5937b2dd8a7d1b300f41092f45 upstream.\n\nAfter invoking ->dirty_inode(), __mark_inode_dirty() does smp_mb() and\ntests inode->i_state locklessly to see whether it already has all the\nnecessary I_DIRTY bits set.  The comment above the barrier doesn't\ncontain any useful information - memory barriers can't ensure \"changes\nare seen by all cpus\" by itself.\n\nAnd it sure enough was broken.  Please consider the following\nscenario.\n\n CPU 0\t\t\t\t\tCPU 1\n -------------------------------------------------------------------------------\n\n\t\t\t\t\tenters __writeback_single_inode()\n\t\t\t\t\tgrabs inode->i_lock\n\t\t\t\t\ttests PAGECACHE_TAG_DIRTY which is clear\n enters __set_page_dirty()\n grabs mapping->tree_lock\n sets PAGECACHE_TAG_DIRTY\n releases mapping->tree_lock\n leaves __set_page_dirty()\n\n enters __mark_inode_dirty()\n smp_mb()\n sees I_DIRTY_PAGES set\n leaves __mark_inode_dirty()\n\t\t\t\t\tclears I_DIRTY_PAGES\n\t\t\t\t\treleases inode->i_lock\n\nNow @inode has dirty pages w/ I_DIRTY_PAGES clear.  This doesn't seem\nto lead to an immediately critical problem because requeue_inode()\nlater checks PAGECACHE_TAG_DIRTY instead of I_DIRTY_PAGES when\ndeciding whether the inode needs to be requeued for IO and there are\nenough unintentional memory barriers inbetween, so while the inode\nends up with inconsistent I_DIRTY_PAGES flag, it doesn't fall off the\nIO list.\n\nThe lack of explicit barrier may also theoretically affect the other\nI_DIRTY bits which deal with metadata dirtiness.  There is no\nguarantee that a strong enough barrier exists between\nI_DIRTY_[DATA]SYNC clearing and write_inode() writing out the dirtied\ninode.  Filesystem inode writeout path likely has enough stuff which\ncan behave as full barrier but it's theoretically possible that the\nwriteout may not see all the updates from ->dirty_inode().\n\nFix it by adding an explicit smp_mb() after I_DIRTY clearing.  Note\nthat I_DIRTY_PAGES needs a special treatment as it always needs to be\ncleared to be interlocked with the lockless test on\n__mark_inode_dirty() side.  It's cleared unconditionally and\nreinstated after smp_mb() if the mapping still has dirty pages.\n\nAlso add comments explaining how and why the barriers are paired.\n\nLightly tested.\n\nSigned-off-by: Tejun Heo <tj@kernel.org>\nCc: Jan Kara <jack@suse.cz>\nCc: Mikulas Patocka <mpatocka@redhat.com>\nCc: Jens Axboe <axboe@kernel.dk>\nCc: Al Viro <viro@zeniv.linux.org.uk>\nReviewed-by: Jan Kara <jack@suse.cz>\nSigned-off-by: Jens Axboe <axboe@fb.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nusb: renesas_usbhs: gadget: fix NULL pointer dereference in ep_disable()\n\ncommit 11432050f070810ba139d0226344eef120c3a559 upstream.\n\nThis patch fixes an issue that the NULL pointer dereference happens\nwhen we uses g_audio driver. Since the g_audio driver will call\nusb_ep_disable() in afunc_set_alt() before it calls usb_ep_enable(),\nthe uep->pipe of renesas usbhs driver will be NULL. So, this patch\nadds a condition to avoid the oops.\n\nSigned-off-by: Kazuya Mizuguchi <kazuya.mizuguchi.ks@renesas.com>\nSigned-off-by: Takeshi Kihara <takeshi.kihara.df@renesas.com>\nSigned-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>\nFixes: 2f98382dc (usb: renesas_usbhs: Add Renesas USBHS Gadget)\nSigned-off-by: Felipe Balbi <balbi@ti.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nUBI: Fix invalid vfree()\n\ncommit f38aed975c0c3645bbdfc5ebe35726e64caaf588 upstream.\n\nThe logic of vfree()'ing vol->upd_buf is tied to vol->updating.\nIn ubi_start_update() vol->updating is set long before vmalloc()'ing\nvol->upd_buf. If we encounter a write failure in ubi_start_update()\nbefore vmalloc() the UBI device release function will try to vfree()\nvol->upd_buf because vol->updating is set.\nFix this by allocating vol->upd_buf directly after setting vol->updating.\n\nFixes:\n[   31.559338] UBI warning: vol_cdev_release: update of volume 2 not finished, volume is damaged\n[   31.559340] ------------[ cut here ]------------\n[   31.559343] WARNING: CPU: 1 PID: 2747 at mm/vmalloc.c:1446 __vunmap+0xe3/0x110()\n[   31.559344] Trying to vfree() nonexistent vm area (ffffc90001f2b000)\n[   31.559345] Modules linked in:\n[   31.565620]  0000000000000bba ffff88002a0cbdb0 ffffffff818f0497 ffff88003b9ba148\n[   31.566347]  ffff88002a0cbde0 ffffffff8156f515 ffff88003b9ba148 0000000000000bba\n[   31.567073]  0000000000000000 0000000000000000 ffff88002a0cbe88 ffffffff8156c10a\n[   31.567793] Call Trace:\n[   31.568034]  [<ffffffff818f0497>] dump_stack+0x4e/0x7a\n[   31.568510]  [<ffffffff8156f515>] ubi_io_write_vid_hdr+0x155/0x160\n[   31.569084]  [<ffffffff8156c10a>] ubi_eba_write_leb+0x23a/0x870\n[   31.569628]  [<ffffffff81569b36>] vol_cdev_write+0x226/0x380\n[   31.570155]  [<ffffffff81179265>] vfs_write+0xb5/0x1f0\n[   31.570627]  [<ffffffff81179f8a>] SyS_pwrite64+0x6a/0xa0\n[   31.571123]  [<ffffffff818fde12>] system_call_fastpath+0x16/0x1b\n\nSigned-off-by: Richard Weinberger <richard@nod.at>\nSigned-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ndriver core: Fix unbalanced device reference in drivers_probe\n\ncommit bb34cb6bbd287b57e955bc5cfd42fcde6aaca279 upstream.\n\nbus_find_device_by_name() acquires a device reference which is never\nreleased.  This results in an object leak, which on older kernels\nresults in failure to release all resources of PCI devices.  libvirt\nuses drivers_probe to re-attach devices to the host after assignment\nand is therefore a common trigger for this leak.\n\nExample:\n\n pci 0000:01:10.0: [8086:10ca] type 00 class 0x020000\n kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_add_internal: parent: '0000:00:01.0', set: 'devices'\n kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_uevent_env\n kobject: '0000:01:10.0' (ffff8801d79cd0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0'\n kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_uevent_env\n kobject: '0000:01:10.0' (ffff8801d79cd0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0'\n kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_uevent_env\n kobject: '0000:01:10.0' (ffff8801d79cd0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0'\n kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_cleanup, parent           (null)\n kobject: '0000:01:10.0' (ffff8801d79cd0a8): calling ktype release\n kobject: '0000:01:10.0': free name\n\n[kobject freed as expected]\n\n pci 0000:01:10.0: [8086:10ca] type 00 class 0x020000\n kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_add_internal: parent: '0000:00:01.0', set: 'devices'\n kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_uevent_env\n kobject: '0000:01:10.0' (ffff8801d79ce0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0'\n kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_uevent_env\n kobject: '0000:01:10.0' (ffff8801d79ce0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0'\n kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_uevent_env\n kobject: '0000:01:10.0' (ffff8801d79ce0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0'\n\n[no free]\n\nSigned-off-by: Alex Williamson <alex.williamson@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ndrbd: merge_bvec_fn: properly remap bvm->bi_bdev\n\ncommit 3b9d35d744bb5139f9fed57f38c019bb8c7d351c upstream.\n\nThis was not noticed for many years. Affects operation if\nmd raid is used a backing device for DRBD.\n\nSigned-off-by: Philipp Reisner <philipp.reisner@linbit.com>\nSigned-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>\nSigned-off-by: Jens Axboe <axboe@fb.com>\n[lizf: Backported to 3.4: s/device/mdev]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nPCI: Restore detection of read-only BARs\n\ncommit 36e8164882ca6d3c41cb91e6f09a3ed236841f80 upstream.\n\nCommit 6ac665c63dca (\"PCI: rewrite PCI BAR reading code\") masked off\nlow-order bits from 'l', but not from 'sz'.  Both are passed to pci_size(),\nwhich compares 'base == maxbase' to check for read-only BARs.  The masking\nof 'l' means that comparison will never be 'true', so the check for\nread-only BARs no longer works.\n\nResolve this by also masking off the low-order bits of 'sz' before passing\nit into pci_size() as 'maxbase'.  With this change, pci_size() will once\nagain catch the problems that have been encountered to date:\n\n  - AGP aperture BAR of AMD-7xx host bridges: if the AGP window is\n    disabled, this BAR is read-only and read as 0x00000008 [1]\n\n  - BARs 0-4 of ALi IDE controllers can be non-zero and read-only [1]\n\n  - Intel Sandy Bridge - Thermal Management Controller [8086:0103];\n    BAR 0 returning 0xfed98004 [2]\n\n  - Intel Xeon E5 v3/Core i7 Power Control Unit [8086:2fc0];\n    Bar 0 returning 0x00001a [3]\n\nLink: [1] https://git.kernel.org/cgit/linux/kernel/git/tglx/history.git/commit/drivers/pci/probe.c?id=1307ef6621991f1c4bc3cec1b5a4ebd6fd3d66b9 (\"PCI: probing read-only BARs\" (pre-git))\nLink: [2] https://bugzilla.kernel.org/show_bug.cgi?id=43331\nLink: [3] https://bugzilla.kernel.org/show_bug.cgi?id=85991\nReported-by: William Unruh <unruh@physics.ubc.ca>\nReported-by: Martin Lucina <martin@lucina.net>\nSigned-off-by: Myron Stowe <myron.stowe@redhat.com>\nSigned-off-by: Bjorn Helgaas <bhelgaas@google.com>\nCC: Matthew Wilcox <willy@linux.intel.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nscsi: correct return values for .eh_abort_handler implementations\n\ncommit b6c92b7e0af575e2b8b05bdf33633cf9e1661cbf upstream.\n\nThe .eh_abort_handler needs to return SUCCESS, FAILED, or\nFAST_IO_FAIL. So fixup all callers to adhere to this requirement.\n\nReviewed-by: Robert Elliott <elliott@hp.com>\nSigned-off-by: Hannes Reinecke <hare@suse.de>\nSigned-off-by: Christoph Hellwig <hch@lst.de>\n[lizf: Backported to 3.4: drop changes to esas2r_main.c]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ngenhd: check for int overflow in disk_expand_part_tbl()\n\ncommit 5fabcb4c33fe11c7e3afdf805fde26c1a54d0953 upstream.\n\nWe can get here from blkdev_ioctl() -> blkpg_ioctl() -> add_partition()\nwith a user passed in partno value. If we pass in 0x7fffffff, the\nnew target in disk_expand_part_tbl() overflows the 'int' and we\naccess beyond the end of ptbl->part[] and even write to it when we\ndo the rcu_assign_pointer() to assign the new partition.\n\nReported-by: David Ramos <daramos@stanford.edu>\nSigned-off-by: Jens Axboe <axboe@fb.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nASoC: sigmadsp: Refuse to load firmware files with a non-supported version\n\ncommit 50c0f21b42dd4cd02b51f82274f66912d9a7fa32 upstream.\n\nMake sure to check the version field of the firmware header to make sure to\nnot accidentally try to parse a firmware file with a different layout.\nTrying to do so can result in loading invalid firmware code to the device.\n\nSigned-off-by: Lars-Peter Clausen <lars@metafoo.de>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nmegaraid_sas: corrected return of wait_event from abort frame path\n\ncommit 170c238701ec38b1829321b17c70671c101bac55 upstream.\n\nCorrected wait_event() call which was waiting for wrong completion\nstatus (0xFF).\n\nSigned-off-by: Sumit Saxena <sumit.saxena@avagotech.com>\nSigned-off-by: Kashyap Desai <kashyap.desai@avagotech.com>\nReviewed-by: Tomas Henzl <thenzl@redhat.com>\nSigned-off-by: Christoph Hellwig <hch@lst.de>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ncdc-acm: memory leak in error case\n\ncommit d908f8478a8d18e66c80a12adb27764920c1f1ca upstream.\n\nIf probe() fails not only the attributes need to be removed\nbut also the memory freed.\n\nReported-by: Ahmed Tamrawi <ahmedtamrawi@gmail.com>\nSigned-off-by: Oliver Neukum <oneukum@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nUSB: cdc-acm: check for valid interfaces\n\ncommit 403dff4e2c94f275e24fd85f40b2732ffec268a1 upstream.\n\nWe need to check that we have both a valid data and control inteface for both\ntypes of headers (union and not union.)\n\nReferences: https://bugzilla.kernel.org/show_bug.cgi?id=83551\nReported-by: Simon Schubert <2+kernel@0x2c.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nmfd: tc6393xb: Fail ohci suspend if full state restore is required\n\ncommit 1a5fb99de4850cba710d91becfa2c65653048589 upstream.\n\nSome boards with TC6393XB chip require full state restore during system\nresume thanks to chip's VCC being cut off during suspend (Sharp SL-6000\ntosa is one of them). Failing to do so would result in ohci Oops on\nresume due to internal memory contentes being changed. Fail ohci suspend\non tc6393xb is full state restore is required.\n\nRecommended workaround is to unbind tmio-ohci driver before suspend and\nrebind it after resume.\n\nSigned-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>\nSigned-off-by: Lee Jones <lee.jones@linaro.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nserial: samsung: wait for transfer completion before clock disable\n\ncommit 1ff383a4c3eda8893ec61b02831826e1b1f46b41 upstream.\n\nThis patch adds waiting until transmit buffer and shifter will be empty\nbefore clock disabling.\n\nWithout this fix it's possible to have clock disabled while data was\nnot transmited yet, which causes unproper state of TX line and problems\nin following data transfers.\n\nSigned-off-by: Robert Baldyga <r.baldyga@samsung.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nath9k_hw: fix hardware queue allocation\n\ncommit ad8fdccf9c197a89e2d2fa78c453283dcc2c343f upstream.\n\nThe driver passes the desired hardware queue index for a WMM data queue\nin qinfo->tqi_subtype. This was ignored in ath9k_hw_setuptxqueue, which\ninstead relied on the order in which the function is called.\n\nReported-by: Hubert Feurstein <h.feurstein@gmail.com>\nSigned-off-by: Felix Fietkau <nbd@openwrt.org>\nSigned-off-by: John W. Linville <linville@tuxdriver.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nath9k: fix BE/BK queue order\n\ncommit 78063d81d353e10cbdd279c490593113b8fdae1c upstream.\n\nHardware queues are ordered by priority. Use queue index 0 for BK, which\nhas lower priority than BE.\n\nSigned-off-by: Felix Fietkau <nbd@openwrt.org>\nSigned-off-by: John W. Linville <linville@tuxdriver.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nath5k: fix hardware queue index assignment\n\ncommit 9e4982f6a51a2442f1bb588fee42521b44b4531c upstream.\n\nLike with ath9k, ath5k queues also need to be ordered by priority.\nqueue_info->tqi_subtype already contains the correct index, so use it\ninstead of relying on the order of ath5k_hw_setup_tx_queue calls.\n\nSigned-off-by: Felix Fietkau <nbd@openwrt.org>\nSigned-off-by: John W. Linville <linville@tuxdriver.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\niommu/vt-d: Fix an off-by-one bug in __domain_mapping()\n\ncommit cc4f14aa170d895c9a43bdb56f62070c8a6da908 upstream.\n\nThere's an off-by-one bug in function __domain_mapping(), which may\ntrigger the BUG_ON(nr_pages < lvl_pages) when\n\t(nr_pages + 1) & superpage_mask == 0\n\nThe issue was introduced by commit 9051aa0268dc \"intel-iommu: Combine\ndomain_pfn_mapping() and domain_sg_mapping()\", which sets sg_res to\n\"nr_pages + 1\" to avoid some of the 'sg_res==0' code paths.\n\nIt's safe to remove extra \"+1\" because sg_res is only used to calculate\npage size now.\n\nReported-And-Tested-by: Sudeep Dutt <sudeep.dutt@intel.com>\nSigned-off-by: Jiang Liu <jiang.liu@linux.intel.com>\nAcked-By: David Woodhouse <David.Woodhouse@intel.com>\nSigned-off-by: Joerg Roedel <jroedel@suse.de>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ndrm/vmwgfx: Don't use memory accounting for kernel-side fence objects\n\ncommit 1f563a6a46544602183e7493b6ef69769d3d76d9 upstream.\n\nKernel side fence objects are used when unbinding resources and may thus be\ncreated as part of a memory reclaim operation. This might trigger recursive\nmemory reclaims and result in the kernel running out of stack space.\n\nSo a simple way out is to avoid accounting of these fence objects.\nIn principle this is OK since while user-space can trigger the creation of\nsuch objects, it can't really hold on to them. However, their lifetime is\nquite long, so some form of accounting should perhaps be implemented in the\nfuture.\n\nFixes kernel crashes when running, for example viewperf11 ensight-04 test 3\nwith low system memory settings.\n\nSigned-off-by: Thomas Hellstrom <thellstrom@vmware.com>\nReviewed-by: Jakob Bornecrantz <jakob@vmware.com>\nReviewed-by: Sinclair Yeh <syeh@vmware.com>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ndrm/vmwgfx: Fix fence event code\n\ncommit 89669e7a7f96be3ee8d9a22a071d7c0d3b4428fc upstream.\n\nThe commit \"vmwgfx: Rework fence event action\" introduced a number of bugs\nthat are fixed with this commit:\n\na) A forgotten return stateemnt.\nb) An if statement with identical branches.\n\nReported-by: Rob Clark <robdclark@gmail.com>\nSigned-off-by: Thomas Hellstrom <thellstrom@vmware.com>\nReviewed-by: Jakob Bornecrantz <jakob@vmware.com>\nReviewed-by: Sinclair Yeh <syeh@vmware.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nhp_accel: Add support for HP ZBook 15\n\ncommit 6583659e0f92e38079a8dd081e0a1181a0f37747 upstream.\n\nHP ZBook 15 laptop needs a non-standard mapping (x_inverted).\n\nBugLink: http://bugzilla.opensuse.org/show_bug.cgi?id=905329\nSigned-off-by: Dominique Leuenberger <dimstar@opensuse.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Darren Hart <dvhart@linux.intel.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ndrm/radeon: check the right ring in radeon_evict_flags()\n\ncommit 5e5c21cac1001089007260c48b0c89ebaace0e71 upstream.\n\nCheck the that ring we are using for copies is functional\nrather than the GFX ring.  On newer asics we use the DMA\nring for bo moves.\n\nReviewed-by: Christian König <christian.koenig@amd.com>\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ncan: peak_usb: fix memset() usage\n\ncommit dc50ddcd4c58a5a0226038307d6ef884bec9f8c2 upstream.\n\nThis patchs fixes a misplaced call to memset() that fills the request\nbuffer with 0. The problem was with sending PCAN_USBPRO_REQ_FCT\nrequests, the content set by the caller was thus lost.\n\nWith this patch, the memory area is zeroed only when requesting info\nfrom the device.\n\nSigned-off-by: Stephane Grosjean <s.grosjean@peak-system.com>\nSigned-off-by: Marc Kleine-Budde <mkl@pengutronix.de>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ncan: peak_usb: fix cleanup sequence order in case of error during init\n\ncommit af35d0f1cce7a990286e2b94c260a2c2d2a0e4b0 upstream.\n\nThis patch sets the correct reverse sequence order to the instructions\nset to run, when any failure occurs during the initialization steps.\nIt also adds the missing unregistration call of the can device if the\nfailure appears after having been registered.\n\nSigned-off-by: Stephane Grosjean <s.grosjean@peak-system.com>\nSigned-off-by: Marc Kleine-Budde <mkl@pengutronix.de>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nALSA: usb-audio: Don't resubmit pending URBs at MIDI error recovery\n\ncommit 66139a48cee1530c91f37c145384b4ee7043f0b7 upstream.\n\nIn snd_usbmidi_error_timer(), the driver tries to resubmit MIDI input\nURBs to reactivate the MIDI stream, but this causes the error when\nsome of URBs are still pending like:\n\n WARNING: CPU: 0 PID: 0 at ../drivers/usb/core/urb.c:339 usb_submit_urb+0x5f/0x70()\n URB ef705c40 submitted while active\n CPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.16.6-2-desktop #1\n Hardware name: FOXCONN TPS01/TPS01, BIOS 080015  03/23/2010\n  c0984bfa f4009ed4 c078deaf f4009ee4 c024c884 c09a135c f4009f00 00000000\n  c0984bfa 00000153 c061ac4f c061ac4f 00000009 00000001 ef705c40 e854d1c0\n  f4009eec c024c8d3 00000009 f4009ee4 c09a135c f4009f00 f4009f04 c061ac4f\n Call Trace:\n  [<c0205df6>] try_stack_unwind+0x156/0x170\n  [<c020482a>] dump_trace+0x5a/0x1b0\n  [<c0205e56>] show_trace_log_lvl+0x46/0x50\n  [<c02049d1>] show_stack_log_lvl+0x51/0xe0\n  [<c0205eb7>] show_stack+0x27/0x50\n  [<c078deaf>] dump_stack+0x45/0x65\n  [<c024c884>] warn_slowpath_common+0x84/0xa0\n  [<c024c8d3>] warn_slowpath_fmt+0x33/0x40\n  [<c061ac4f>] usb_submit_urb+0x5f/0x70\n  [<f7974104>] snd_usbmidi_submit_urb+0x14/0x60 [snd_usbmidi_lib]\n  [<f797483a>] snd_usbmidi_error_timer+0x6a/0xa0 [snd_usbmidi_lib]\n  [<c02570c0>] call_timer_fn+0x30/0x130\n  [<c0257442>] run_timer_softirq+0x1c2/0x260\n  [<c0251493>] __do_softirq+0xc3/0x270\n  [<c0204732>] do_softirq_own_stack+0x22/0x30\n  [<c025186d>] irq_exit+0x8d/0xa0\n  [<c0795228>] smp_apic_timer_interrupt+0x38/0x50\n  [<c0794a3c>] apic_timer_interrupt+0x34/0x3c\n  [<c0673d9e>] cpuidle_enter_state+0x3e/0xd0\n  [<c028bb8d>] cpu_idle_loop+0x29d/0x3e0\n  [<c028bd23>] cpu_startup_entry+0x53/0x60\n  [<c0bfac1e>] start_kernel+0x415/0x41a\n\nFor avoiding these errors, check the pending URBs and skip\nresubmitting such ones.\n\nReported-and-tested-by: Stefan Seyfried <stefan.seyfried@googlemail.com>\nAcked-by: Clemens Ladisch <clemens@ladisch.de>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nKEYS: Fix stale key registration at error path\n\ncommit b26bdde5bb27f3f900e25a95e33a0c476c8c2c48 upstream.\n\nWhen loading encrypted-keys module, if the last check of\naes_get_sizes() in init_encrypted() fails, the driver just returns an\nerror without unregistering its key type.  This results in the stale\nentry in the list.  In addition to memory leaks, this leads to a kernel\ncrash when registering a new key type later.\n\nThis patch fixes the problem by swapping the calls of aes_get_sizes()\nand register_key_type(), and releasing resources properly at the error\npaths.\n\nBugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=908163\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nBtrfs: fix fs corruption on transaction abort if device supports discard\n\ncommit 678886bdc6378c1cbd5072da2c5a3035000214e3 upstream.\n\nWhen we abort a transaction we iterate over all the ranges marked as dirty\nin fs_info->freed_extents[0] and fs_info->freed_extents[1], clear them\nfrom those trees, add them back (unpin) to the free space caches and, if\nthe fs was mounted with \"-o discard\", perform a discard on those regions.\nAlso, after adding the regions to the free space caches, a fitrim ioctl call\ncan see those ranges in a block group's free space cache and perform a discard\non the ranges, so the same issue can happen without \"-o discard\" as well.\n\nThis causes corruption, affecting one or multiple btree nodes (in the worst\ncase leaving the fs unmountable) because some of those ranges (the ones in\nthe fs_info->pinned_extents tree) correspond to btree nodes/leafs that are\nreferred by the last committed super block - breaking the rule that anything\nthat was committed by a transaction is untouched until the next transaction\ncommits successfully.\n\nI ran into this while running in a loop (for several hours) the fstest that\nI recently submitted:\n\n  [PATCH] fstests: add btrfs test to stress chunk allocation/removal and fstrim\n\nThe corruption always happened when a transaction aborted and then fsck complained\nlike this:\n\n   _check_btrfs_filesystem: filesystem on /dev/sdc is inconsistent\n   *** fsck.btrfs output ***\n   Check tree block failed, want=94945280, have=0\n   Check tree block failed, want=94945280, have=0\n   Check tree block failed, want=94945280, have=0\n   Check tree block failed, want=94945280, have=0\n   Check tree block failed, want=94945280, have=0\n   read block failed check_tree_block\n   Couldn't open file system\n\nIn this case 94945280 corresponded to the root of a tree.\nUsing frace what I observed was the following sequence of steps happened:\n\n   1) transaction N started, fs_info->pinned_extents pointed to\n      fs_info->freed_extents[0];\n\n   2) node/eb 94945280 is created;\n\n   3) eb is persisted to disk;\n\n   4) transaction N commit starts, fs_info->pinned_extents now points to\n      fs_info->freed_extents[1], and transaction N completes;\n\n   5) transaction N + 1 starts;\n\n   6) eb is COWed, and btrfs_free_tree_block() called for this eb;\n\n   7) eb range (94945280 to 94945280 + 16Kb) is added to\n      fs_info->pinned_extents (fs_info->freed_extents[1]);\n\n   8) Something goes wrong in transaction N + 1, like hitting ENOSPC\n      for example, and the transaction is aborted, turning the fs into\n      readonly mode. The stack trace I got for example:\n\n      [112065.253935]  [<ffffffff8140c7b6>] dump_stack+0x4d/0x66\n      [112065.254271]  [<ffffffff81042984>] warn_slowpath_common+0x7f/0x98\n      [112065.254567]  [<ffffffffa0325990>] ? __btrfs_abort_transaction+0x50/0x10b [btrfs]\n      [112065.261674]  [<ffffffff810429e5>] warn_slowpath_fmt+0x48/0x50\n      [112065.261922]  [<ffffffffa032949e>] ? btrfs_free_path+0x26/0x29 [btrfs]\n      [112065.262211]  [<ffffffffa0325990>] __btrfs_abort_transaction+0x50/0x10b [btrfs]\n      [112065.262545]  [<ffffffffa036b1d6>] btrfs_remove_chunk+0x537/0x58b [btrfs]\n      [112065.262771]  [<ffffffffa033840f>] btrfs_delete_unused_bgs+0x1de/0x21b [btrfs]\n      [112065.263105]  [<ffffffffa0343106>] cleaner_kthread+0x100/0x12f [btrfs]\n      (...)\n      [112065.264493] ---[ end trace dd7903a975a31a08 ]---\n      [112065.264673] BTRFS: error (device sdc) in btrfs_remove_chunk:2625: errno=-28 No space left\n      [112065.264997] BTRFS info (device sdc): forced readonly\n\n   9) The clear kthread sees that the BTRFS_FS_STATE_ERROR bit is set in\n      fs_info->fs_state and calls btrfs_cleanup_transaction(), which in\n      turn calls btrfs_destroy_pinned_extent();\n\n   10) Then btrfs_destroy_pinned_extent() iterates over all the ranges\n       marked as dirty in fs_info->freed_extents[], and for each one\n       it calls discard, if the fs was mounted with \"-o discard\", and\n       adds the range to the free space cache of the respective block\n       group;\n\n   11) btrfs_trim_block_group(), invoked from the fitrim ioctl code path,\n       sees the free space entries and performs a discard;\n\n   12) After an umount and mount (or fsck), our eb's location on disk was full\n       of zeroes, and it should have been untouched, because it was marked as\n       dirty in the fs_info->pinned_extents tree, and therefore used by the\n       trees that the last committed superblock points to.\n\nFix this by not performing a discard and not adding the ranges to the free space\ncaches - it's useless from this point since the fs is now in readonly mode and\nwe won't write free space caches to disk anymore (otherwise we would leak space)\nnor any new superblock. By not adding the ranges to the free space caches, it\nprevents other code paths from allocating that space and write to it as well,\ntherefore being safer and simpler.\n\nThis isn't a new problem, as it's been present since 2011 (git commit\nacce952b0263825da32cf10489413dec78053347).\n\nSigned-off-by: Filipe Manana <fdmanana@suse.com>\nSigned-off-by: Chris Mason <clm@fb.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nncpfs: return proper error from NCP_IOC_SETROOT ioctl\n\ncommit a682e9c28cac152e6e54c39efcf046e0c8cfcf63 upstream.\n\nIf some error happens in NCP_IOC_SETROOT ioctl, the appropriate error\nreturn value is then (in most cases) just overwritten before we return.\nThis can result in reporting success to userspace although error happened.\n\nThis bug was introduced by commit 2e54eb96e2c8 (\"BKL: Remove BKL from\nncpfs\").  Propagate the errors correctly.\n\nCoverity id: 1226925.\n\nFixes: 2e54eb96e2c80 (\"BKL: Remove BKL from ncpfs\")\nSigned-off-by: Jan Kara <jack@suse.cz>\nCc: Petr Vandrovec <petr@vandrovec.name>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nx86_64, switch_to(): Load TLS descriptors before switching DS and ES\n\ncommit f647d7c155f069c1a068030255c300663516420e upstream.\n\nOtherwise, if buggy user code points DS or ES into the TLS\narray, they would be corrupted after a context switch.\n\nThis also significantly improves the comments and documents some\ngotchas in the code.\n\nBefore this patch, the both tests below failed.  With this\npatch, the es test passes, although the gsbase test still fails.\n\n ----- begin es test -----\n\n/*\n * Copyright (c) 2014 Andy Lutomirski\n * GPL v2\n */\n\nstatic unsigned short GDT3(int idx)\n{\n\treturn (idx << 3) | 3;\n}\n\nstatic int create_tls(int idx, unsigned int base)\n{\n\tstruct user_desc desc = {\n\t\t.entry_number    = idx,\n\t\t.base_addr       = base,\n\t\t.limit           = 0xfffff,\n\t\t.seg_32bit       = 1,\n\t\t.contents        = 0, /* Data, grow-up */\n\t\t.read_exec_only  = 0,\n\t\t.limit_in_pages  = 1,\n\t\t.seg_not_present = 0,\n\t\t.useable         = 0,\n\t};\n\n\tif (syscall(SYS_set_thread_area, &desc) != 0)\n\t\terr(1, \"set_thread_area\");\n\n\treturn desc.entry_number;\n}\n\nint main()\n{\n\tint idx = create_tls(-1, 0);\n\tprintf(\"Allocated GDT index %d\\n\", idx);\n\n\tunsigned short orig_es;\n\tasm volatile (\"mov %%es,%0\" : \"=rm\" (orig_es));\n\n\tint errors = 0;\n\tint total = 1000;\n\tfor (int i = 0; i < total; i++) {\n\t\tasm volatile (\"mov %0,%%es\" : : \"rm\" (GDT3(idx)));\n\t\tusleep(100);\n\n\t\tunsigned short es;\n\t\tasm volatile (\"mov %%es,%0\" : \"=rm\" (es));\n\t\tasm volatile (\"mov %0,%%es\" : : \"rm\" (orig_es));\n\t\tif (es != GDT3(idx)) {\n\t\t\tif (errors == 0)\n\t\t\t\tprintf(\"[FAIL]\\tES changed from 0x%hx to 0x%hx\\n\",\n\t\t\t\t       GDT3(idx), es);\n\t\t\terrors++;\n\t\t}\n\t}\n\n\tif (errors) {\n\t\tprintf(\"[FAIL]\\tES was corrupted %d/%d times\\n\", errors, total);\n\t\treturn 1;\n\t} else {\n\t\tprintf(\"[OK]\\tES was preserved\\n\");\n\t\treturn 0;\n\t}\n}\n\n ----- end es test -----\n\n ----- begin gsbase test -----\n\n/*\n * gsbase.c, a gsbase test\n * Copyright (c) 2014 Andy Lutomirski\n * GPL v2\n */\n\nstatic unsigned char *testptr, *testptr2;\n\nstatic unsigned char read_gs_testvals(void)\n{\n\tunsigned char ret;\n\tasm volatile (\"movb %%gs:%1, %0\" : \"=r\" (ret) : \"m\" (*testptr));\n\treturn ret;\n}\n\nint main()\n{\n\tint errors = 0;\n\n\ttestptr = mmap((void *)0x200000000UL, 1, PROT_READ | PROT_WRITE,\n\t\t       MAP_PRIVATE | MAP_FIXED | MAP_ANONYMOUS, -1, 0);\n\tif (testptr == MAP_FAILED)\n\t\terr(1, \"mmap\");\n\n\ttestptr2 = mmap((void *)0x300000000UL, 1, PROT_READ | PROT_WRITE,\n\t\t       MAP_PRIVATE | MAP_FIXED | MAP_ANONYMOUS, -1, 0);\n\tif (testptr2 == MAP_FAILED)\n\t\terr(1, \"mmap\");\n\n\t*testptr = 0;\n\t*testptr2 = 1;\n\n\tif (syscall(SYS_arch_prctl, ARCH_SET_GS,\n\t\t    (unsigned long)testptr2 - (unsigned long)testptr) != 0)\n\t\terr(1, \"ARCH_SET_GS\");\n\n\tusleep(100);\n\n\tif (read_gs_testvals() == 1) {\n\t\tprintf(\"[OK]\\tARCH_SET_GS worked\\n\");\n\t} else {\n\t\tprintf(\"[FAIL]\\tARCH_SET_GS failed\\n\");\n\t\terrors++;\n\t}\n\n\tasm volatile (\"mov %0,%%gs\" : : \"r\" (0));\n\n\tif (read_gs_testvals() == 0) {\n\t\tprintf(\"[OK]\\tWriting 0 to gs worked\\n\");\n\t} else {\n\t\tprintf(\"[FAIL]\\tWriting 0 to gs failed\\n\");\n\t\terrors++;\n\t}\n\n\tusleep(100);\n\n\tif (read_gs_testvals() == 0) {\n\t\tprintf(\"[OK]\\tgsbase is still zero\\n\");\n\t} else {\n\t\tprintf(\"[FAIL]\\tgsbase was corrupted\\n\");\n\t\terrors++;\n\t}\n\n\treturn errors == 0 ? 0 : 1;\n}\n\n ----- end gsbase test -----\n\nSigned-off-by: Andy Lutomirski <luto@amacapital.net>\nCc: Andi Kleen <andi@firstfloor.org>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nLink: http://lkml.kernel.org/r/509d27c9fec78217691c3dad91cec87e1006b34a.1418075657.git.luto@amacapital.net\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ngenirq: Prevent proc race against freeing of irq descriptors\n\ncommit c291ee622165cb2c8d4e7af63fffd499354a23be upstream.\n\nSince the rework of the sparse interrupt code to actually free the\nunused interrupt descriptors there exists a race between the /proc\ninterfaces to the irq subsystem and the code which frees the interrupt\ndescriptor.\n\nCPU0\t\t\t\tCPU1\n\t\t\t\tshow_interrupts()\n\t\t\t\t  desc = irq_to_desc(X);\nfree_desc(desc)\n  remove_from_radix_tree();\n  kfree(desc);\n\t\t\t\t  raw_spinlock_irq(&desc->lock);\n\n/proc/interrupts is the only interface which can actively corrupt\nkernel memory via the lock access. /proc/stat can only read from freed\nmemory. Extremly hard to trigger, but possible.\n\nThe interfaces in /proc/irq/N/ are not affected by this because the\nremoval of the proc file is serialized in procfs against concurrent\nreaders/writers. The removal happens before the descriptor is freed.\n\nFor architectures which have CONFIG_SPARSE_IRQ=n this is a non issue\nas the descriptor is never freed. It's merely cleared out with the irq\ndescriptor lock held. So any concurrent proc access will either see\nthe old correct value or the cleared out ones.\n\nProtect the lookup and access to the irq descriptor in\nshow_interrupts() with the sparse_irq_lock.\n\nProvide kstat_irqs_usr() which is protecting the lookup and access\nwith sparse_irq_lock and switch /proc/stat to use it.\n\nDocument the existing kstat_irqs interfaces so it's clear that the\ncaller needs to take care about protection. The users of these\ninterfaces are either not affected due to SPARSE_IRQ=n or already\nprotected against removal.\n\nFixes: 1f5a5b87f78f \"genirq: Implement a sane sparse_irq allocator\"\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\n[lizf: Backported to 3.4:\n - define kstat_irqs() for CONFIG_GENERIC_HARDIRQS\n - add ifdef/endif CONFIG_SPARSE_IRQ]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nx86/tls: Disallow unusual TLS segments\n\ncommit 0e58af4e1d2166e9e33375a0f121e4867010d4f8 upstream.\n\nUsers have no business installing custom code segments into the\nGDT, and segments that are not present but are otherwise valid\nare a historical source of interesting attacks.\n\nFor completeness, block attempts to set the L bit.  (Prior to\nthis patch, the L bit would have been silently dropped.)\n\nThis is an ABI break.  I've checked glibc, musl, and Wine, and\nnone of them look like they'll have any trouble.\n\nNote to stable maintainers: this is a hardening patch that fixes\nno known bugs.  Given the possibility of ABI issues, this\nprobably shouldn't be backported quickly.\n\nSigned-off-by: Andy Lutomirski <luto@amacapital.net>\nAcked-by: H. Peter Anvin <hpa@zytor.com>\nCc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: security@kernel.org <security@kernel.org>\nCc: Willy Tarreau <w@1wt.eu>\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nx86/tls: Don't validate lm in set_thread_area() after all\n\ncommit 3fb2f4237bb452eb4e98f6a5dbd5a445b4fed9d0 upstream.\n\nIt turns out that there's a lurking ABI issue.  GCC, when\ncompiling this in a 32-bit program:\n\nstruct user_desc desc = {\n\t.entry_number    = idx,\n\t.base_addr       = base,\n\t.limit           = 0xfffff,\n\t.seg_32bit       = 1,\n\t.contents        = 0, /* Data, grow-up */\n\t.read_exec_only  = 0,\n\t.limit_in_pages  = 1,\n\t.seg_not_present = 0,\n\t.useable         = 0,\n};\n\nwill leave .lm uninitialized.  This means that anything in the\nkernel that reads user_desc.lm for 32-bit tasks is unreliable.\n\nRevert the .lm check in set_thread_area().  The value never did\nanything in the first place.\n\nFixes: 0e58af4e1d21 (\"x86/tls: Disallow unusual TLS segments\")\nSigned-off-by: Andy Lutomirski <luto@amacapital.net>\nAcked-by: Thomas Gleixner <tglx@linutronix.de>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nLink: http://lkml.kernel.org/r/d7875b60e28c512f6a6fc0baf5714d58e7eaadbb.1418856405.git.luto@amacapital.net\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\n[lizf: Backported to 3.4: adjust filename]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nstorvsc: ring buffer failures may result in I/O freeze\n\ncommit e86fb5e8ab95f10ec5f2e9430119d5d35020c951 upstream.\n\nWhen ring buffer returns an error indicating retry, storvsc may not\nreturn a proper error code to SCSI when bounce buffer is not used.\nThis has introduced I/O freeze on RAID running atop storvsc devices.\nThis patch fixes it by always returning a proper error code.\n\nSigned-off-by: Long Li <longli@microsoft.com>\nReviewed-by: K. Y. Srinivasan <kys@microsoft.com>\nSigned-off-by: Christoph Hellwig <hch@lst.de>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nisofs: Fix infinite looping over CE entries\n\ncommit f54e18f1b831c92f6512d2eedb224cd63d607d3d upstream.\n\nRock Ridge extensions define so called Continuation Entries (CE) which\ndefine where is further space with Rock Ridge data. Corrupted isofs\nimage can contain arbitrarily long chain of these, including a one\ncontaining loop and thus causing kernel to end in an infinite loop when\ntraversing these entries.\n\nLimit the traversal to 32 entries which should be more than enough space\nto store all the Rock Ridge data.\n\nReported-by: P J P <ppandit@redhat.com>\nSigned-off-by: Jan Kara <jack@suse.cz>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\niscsi-target: Fail connection on short sendmsg writes\n\ncommit 6bf6ca7515c1df06f5c03737537f5e0eb191e29e upstream.\n\nThis patch changes iscsit_do_tx_data() to fail on short writes\nwhen kernel_sendmsg() returns a value different than requested\ntransfer length, returning -EPIPE and thus causing a connection\nreset to occur.\n\nThis avoids a potential bug in the original code where a short\nwrite would result in kernel_sendmsg() being called again with\nthe original iovec base + length.\n\nIn practice this has not been an issue because iscsit_do_tx_data()\nis only used for transferring 48 byte headers + 4 byte digests,\nalong with seldom used control payloads from NOPIN + TEXT_RSP +\nREJECT with less than 32k of data.\n\nSo following Al's audit of iovec consumers, go ahead and fail\nthe connection on short writes for now, and remove the bogus\nlogic ahead of his proper upstream fix.\n\nReported-by: Al Viro <viro@zeniv.linux.org.uk>\nCc: David S. Miller <davem@davemloft.net>\nSigned-off-by: Nicholas Bellinger <nab@linux-iscsi.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nALSA: usb-audio: extend KEF X300A FU 10 tweak to Arcam rPAC\n\ncommit d70a1b9893f820fdbcdffac408c909c50f2e6b43 upstream.\n\nThe Arcam rPAC seems to have the same problem - whenever anything\n(alsamixer, udevd, 3.9+ kernel from 60af3d037eb8c, ..) attempts to\naccess mixer / control interface of the card, the firmware \"locks up\"\nthe entire device, resulting in\n  SNDRV_PCM_IOCTL_HW_PARAMS failed (-5): Input/output error\nfrom alsa-lib.\n\nOther operating systems can somehow read the mixer (there seems to be\nplayback volume/mute), but any manipulation is ignored by the device\n(which has hardware volume controls).\n\nSigned-off-by: Jiri Jaburek <jjaburek@redhat.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nocfs2: fix journal commit deadlock\n\ncommit 136f49b9171074872f2a14ad0ab10486d1ba13ca upstream.\n\nFor buffer write, page lock will be got in write_begin and released in\nwrite_end, in ocfs2_write_end_nolock(), before it unlock the page in\nocfs2_free_write_ctxt(), it calls ocfs2_run_deallocs(), this will ask\nfor the read lock of journal->j_trans_barrier.  Holding page lock and\nask for journal->j_trans_barrier breaks the locking order.\n\nThis will cause a deadlock with journal commit threads, ocfs2cmt will\nget write lock of journal->j_trans_barrier first, then it wakes up\nkjournald2 to do the commit work, at last it waits until done.  To\ncommit journal, kjournald2 needs flushing data first, it needs get the\ncache page lock.\n\nSince some ocfs2 cluster locks are holding by write process, this\ndeadlock may hung the whole cluster.\n\nunlock pages before ocfs2_run_deallocs() can fix the locking order, also\nput unlock before ocfs2_commit_trans() to make page lock is unlocked\nbefore j_trans_barrier to preserve unlocking order.\n\nSigned-off-by: Junxiao Bi <junxiao.bi@oracle.com>\nReviewed-by: Wengang Wang <wen.gang.wang@oracle.com>\nReviewed-by: Mark Fasheh <mfasheh@suse.de>\nCc: Joel Becker <jlbec@evilplan.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nisofs: Fix unchecked printing of ER records\n\ncommit 4e2024624e678f0ebb916e6192bd23c1f9fdf696 upstream.\n\nWe didn't check length of rock ridge ER records before printing them.\nThus corrupted isofs image can cause us to access and print some memory\nbehind the buffer with obvious consequences.\n\nReported-and-tested-by: Carl Henrik Lunde <chlunde@ping.uio.no>\nSigned-off-by: Jan Kara <jack@suse.cz>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nudf: Verify i_size when loading inode\n\ncommit e159332b9af4b04d882dbcfe1bb0117f0a6d4b58 upstream.\n\nVerify that inode size is sane when loading inode with data stored in\nICB. Otherwise we may get confused later when working with the inode and\ninode size is too big.\n\nReported-by: Carl Henrik Lunde <chlunde@ping.uio.no>\nSigned-off-by: Jan Kara <jack@suse.cz>\n[lizf: Backported to 3.4: just return on error, as there's no \"out\" label]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nudf: Verify symlink size before loading it\n\ncommit a1d47b262952a45aae62bd49cfaf33dd76c11a2c upstream.\n\nUDF specification allows arbitrarily large symlinks. However we support\nonly symlinks at most one block large. Check the length of the symlink\nso that we don't access memory beyond end of the symlink block.\n\nReported-by: Carl Henrik Lunde <chlunde@gmail.com>\nSigned-off-by: Jan Kara <jack@suse.cz>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nudf: Check path length when reading symlink\n\ncommit 0e5cc9a40ada6046e6bc3bdfcd0c0d7e4b706b14 upstream.\n\nSymlink reading code does not check whether the resulting path fits into\nthe page provided by the generic code. This isn't as easy as just\nchecking the symlink size because of various encoding conversions we\nperform on path. So we have to check whether there is still enough space\nin the buffer on the fly.\n\nReported-by: Carl Henrik Lunde <chlunde@ping.uio.no>\nSigned-off-by: Jan Kara <jack@suse.cz>\n[lizf: Backported to 3.4: udf_get_filename() is called in do_udf_readdir()]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nx86_64, vdso: Fix the vdso address randomization algorithm\n\ncommit 394f56fe480140877304d342dec46d50dc823d46 upstream.\n\nThe theory behind vdso randomization is that it's mapped at a random\noffset above the top of the stack.  To avoid wasting a page of\nmemory for an extra page table, the vdso isn't supposed to extend\npast the lowest PMD into which it can fit.  Other than that, the\naddress should be a uniformly distributed address that meets all of\nthe alignment requirements.\n\nThe current algorithm is buggy: the vdso has about a 50% probability\nof being at the very end of a PMD.  The current algorithm also has a\ndecent chance of failing outright due to incorrect handling of the\ncase where the top of the stack is near the top of its PMD.\n\nThis fixes the implementation.  The paxtest estimate of vdso\n\"randomisation\" improves from 11 bits to 18 bits.  (Disclaimer: I\ndon't know what the paxtest code is actually calculating.)\n\nIt's worth noting that this algorithm is inherently biased: the vdso\nis more likely to end up near the end of its PMD than near the\nbeginning.  Ideally we would either nix the PMD sharing requirement\nor jointly randomize the vdso and the stack to reduce the bias.\n\nIn the mean time, this is a considerable improvement with basically\nno risk of compatibility issues, since the allowed outputs of the\nalgorithm are unchanged.\n\nAs an easy test, doing this:\n\nfor i in `seq 10000`\n  do grep -P vdso /proc/self/maps |cut -d- -f1\ndone |sort |uniq -d\n\nused to produce lots of output (1445 lines on my most recent run).\nA tiny subset looks like this:\n\n7fffdfffe000\n7fffe01fe000\n7fffe05fe000\n7fffe07fe000\n7fffe09fe000\n7fffe0bfe000\n7fffe0dfe000\n\nNote the suspicious fe000 endings.  With the fix, I get a much more\npalatable 76 repeated addresses.\n\nReviewed-by: Kees Cook <keescook@chromium.org>\nSigned-off-by: Andy Lutomirski <luto@amacapital.net>\n[lizf: Backported to 3.4:\n - adjust context\n - adjust comment]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nudf: Check component length before reading it\n\ncommit e237ec37ec154564f8690c5bd1795339955eeef9 upstream.\n\nCheck that length specified in a component of a symlink fits in the\ninput buffer we are reading. Also properly ignore component length for\ncomponent types that do not use it. Otherwise we read memory after end\nof buffer for corrupted udf image.\n\nReported-by: Carl Henrik Lunde <chlunde@ping.uio.no>\nSigned-off-by: Jan Kara <jack@suse.cz>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ncrypto: af_alg - fix backlog handling\n\ncommit 7e77bdebff5cb1e9876c561f69710b9ab8fa1f7e upstream.\n\nIf a request is backlogged, it's complete() handler will get called\ntwice: once with -EINPROGRESS, and once with the final error code.\n\naf_alg's complete handler, unlike other users, does not handle the\n-EINPROGRESS but instead always completes the completion that recvmsg()\nis waiting on.  This can lead to a return to user space while the\nrequest is still pending in the driver.  If userspace closes the sockets\nbefore the requests are handled by the driver, this will lead to\nuse-after-frees (and potential crashes) in the kernel due to the tfm\nhaving been freed.\n\nThe crashes can be easily reproduced (for example) by reducing the max\nqueue length in cryptod.c and running the following (from\nhttp://www.chronox.de/libkcapi.html) on AES-NI capable hardware:\n\n $ while true; do kcapi -x 1 -e -c '__ecb-aes-aesni' \\\n    -k 00000000000000000000000000000000 \\\n    -p 00000000000000000000000000000000 >/dev/null & done\n\nSigned-off-by: Rabin Vincent <rabin.vincent@axis.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nnet: Fix stacked vlan offload features computation\n\ncommit 796f2da81bead71ffc91ef70912cd8d1827bf756 upstream.\n\nWhen vlan tags are stacked, it is very likely that the outer tag is stored\nin skb->vlan_tci and skb->protocol shows the inner tag's vlan_proto.\nCurrently netif_skb_features() first looks at skb->protocol even if there\nis the outer tag in vlan_tci, thus it incorrectly retrieves the protocol\nencapsulated by the inner vlan instead of the inner vlan protocol.\nThis allows GSO packets to be passed to HW and they end up being\ncorrupted.\n\nFixes: 58e998c6d239 (\"offloading: Force software GSO for multiple vlan tags.\")\nSigned-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n[lizf: Backported to 3.4:\n - remove ETH_P_8021AD\n - pass protocol to harmonize_features()]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nvideo/logo: prevent use of logos after they have been freed\n\ncommit 92b004d1aa9f367c372511ca0330f58216b25703 upstream.\n\nIf the probe of an fb driver has been deferred due to missing\ndependencies, and the probe is later ran when a module is loaded, the\nfbdev framework will try to find a logo to use.\n\nHowever, the logos are __initdata, and have already been freed. This\ncauses sometimes page faults, if the logo memory is not mapped,\nsometimes other random crashes as the logo data is invalid, and\nsometimes nothing, if the fbdev decides to reject the logo (e.g. the\nrandom value depicting the logo's height is too big).\n\nThis patch adds a late_initcall function to mark the logos as freed. In\nreality the logos are freed later, and fbdev probe may be ran between\nthis late_initcall and the freeing of the logos. In that case we will\nmiss drawing the logo, even if it would be possible.\n\nSigned-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nUSB: cp210x: fix ID for production CEL MeshConnect USB Stick\n\ncommit 90441b4dbe90ba0c38111ea89fa093a8c9627801 upstream.\n\nFixing typo for MeshConnect IDs. The original PID (0x8875) is not in\nproduction and is not needed. Instead it has been changed to the\nofficial production PID (0x8857).\n\nSigned-off-by: Preston Fick <pffick@gmail.com>\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nx86, um: actually mark system call tables readonly\n\ncommit b485342bd79af363c77ef1a421c4a0aef2de9812 upstream.\n\nCommit a074335a370e (\"x86, um: Mark system call tables readonly\") was\nsupposed to mark the sys_call_table in UML as RO by adding the const,\nbut it doesn't have the desired effect as it's nevertheless being placed\ninto the data section since __cacheline_aligned enforces sys_call_table\nbeing placed into .data..cacheline_aligned instead. We need to use\nthe ____cacheline_aligned version instead to fix this issue.\n\nBefore:\n\n$ nm -v arch/x86/um/sys_call_table_64.o | grep -1 \"sys_call_table\"\n                 U sys_writev\n0000000000000000 D sys_call_table\n0000000000000000 D syscall_table_size\n\nAfter:\n\n$ nm -v arch/x86/um/sys_call_table_64.o | grep -1 \"sys_call_table\"\n                 U sys_writev\n0000000000000000 R sys_call_table\n0000000000000000 D syscall_table_size\n\nFixes: a074335a370e (\"x86, um: Mark system call tables readonly\")\nCc: H. Peter Anvin <hpa@zytor.com>\nCc: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Daniel Borkmann <dborkman@redhat.com>\nSigned-off-by: Richard Weinberger <richard@nod.at>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nALSA: hda - Fix wrong gpio_dir & gpio_mask hint setups for IDT/STAC codecs\n\ncommit c507de88f6a336bd7296c9ec0073b2d4af8b4f5e upstream.\n\nstac_store_hints() does utterly wrong for masking the values for\ngpio_dir and gpio_data, likely due to copy&paste errors.  Fortunately,\nthis feature is used very rarely, so the impact must be really small.\n\nReported-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nvirtio: use dev_to_virtio wrapper in virtio\n\ncommit 9bffdca8c64a72ac54c47a552734ab457bc720d4 upstream.\n\nUse dev_to_virtio wrapper in virtio to make code clearly.\n\nCc: Rusty Russell <rusty@rustcorp.com.au>\nCc: \"Michael S. Tsirkin\" <mst@redhat.com>\nSigned-off-by: Wanlong Gao <gaowanlong@cn.fujitsu.com>\nSigned-off-by: Rusty Russell <rusty@rustcorp.com.au>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nvirtio_pci: defer kfree until release callback\n\ncommit 63bd62a08ca45a0c804c3c89777edc7f76a2d6da upstream.\n\nA struct device which has just been unregistered can live on past the\npoint at which a driver decides to drop it's initial reference to the\nkobject gained on allocation.\n\nThis implies that when releasing a virtio device, we can't free a struct\nvirtio_device until the underlying struct device has been released,\nwhich might not happen immediately on device_unregister().\n\nUnfortunately, this is exactly what virtio pci does:\nit has an empty release callback, and frees memory immediately\nafter unregistering the device.\n\nThis causes an easy to reproduce crash if CONFIG_DEBUG_KOBJECT_RELEASE\nit enabled.\n\nTo fix, free the memory only once we know the device is gone in the release\ncallback.\n\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>\nSigned-off-by: Michael S. Tsirkin <mst@redhat.com>\n[lizf: Backported to 3.4: adjust filename]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nvirtio_pci: document why we defer kfree\n\ncommit a1eb03f546d651a8f39c7d0692b1f7f5b4e7e3cd upstream.\n\nThe reason we defer kfree until release function is because it's a\ngeneral rule for kobjects: kfree of the reference counter itself is only\nlegal in the release function.\n\nPrevious patch didn't make this clear, document this in code.\n\nSigned-off-by: Michael S. Tsirkin <mst@redhat.com>\n[lizf: Backported to 3.4: adjust filename]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nUSB: cp210x: add IDs for CEL USB sticks and MeshWorks devices\n\ncommit 1ae78a4870989a354028cb17dabf819b595e70e3 upstream.\n\nAdded virtual com port VID/PID entries for CEL USB sticks and MeshWorks\ndevices.\n\nSigned-off-by: David Peterson <david.peterson@cel.com>\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nmm: propagate error from stack expansion even for guard page\n\ncommit fee7e49d45149fba60156f5b59014f764d3e3728 upstream.\n\nJay Foad reports that the address sanitizer test (asan) sometimes gets\nconfused by a stack pointer that ends up being outside the stack vma\nthat is reported by /proc/maps.\n\nThis happens due to an interaction between RLIMIT_STACK and the guard\npage: when we do the guard page check, we ignore the potential error\nfrom the stack expansion, which effectively results in a missing guard\npage, since the expected stack expansion won't have been done.\n\nAnd since /proc/maps explicitly ignores the guard page (commit\nd7824370e263: \"mm: fix up some user-visible effects of the stack guard\npage\"), the stack pointer ends up being outside the reported stack area.\n\nThis is the minimal patch: it just propagates the error.  It also\neffectively makes the guard page part of the stack limit, which in turn\nmeasn that the actual real stack is one page less than the stack limit.\n\nLet's see if anybody notices.  We could teach acct_stack_growth() to\nallow an extra page for a grow-up/grow-down stack in the rlimit test,\nbut I don't want to add more complexity if it isn't needed.\n\nReported-and-tested-by: Jay Foad <jay.foad@gmail.com>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nsata_dwc_460ex: fix resource leak on error path\n\ncommit 4aaa71873ddb9faf4b0c4826579e2f6d18ff9ab4 upstream.\n\nDMA mapped IO should be unmapped on the error path in probe() and\nunconditionally on remove().\n\nFixes: 62936009f35a ([libata] Add 460EX on-chip SATA driver, sata_dwc_460ex)\nSigned-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>\nSigned-off-by: Tejun Heo <tj@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ntime: settimeofday: Validate the values of tv from user\n\ncommit 6ada1fc0e1c4775de0e043e1bd3ae9d065491aa5 upstream.\n\nAn unvalidated user input is multiplied by a constant, which can result in\nan undefined behaviour for large values. While this is validated later,\nwe should avoid triggering undefined behaviour.\n\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>\n[jstultz: include trivial milisecond->microsecond correction noticed\nby Andy]\nSigned-off-by: John Stultz <john.stultz@linaro.org>\n[lizf: Backported to 3.4: adjust filename]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ntime: adjtimex: Validate the ADJ_FREQUENCY values\n\ncommit 5e5aeb4367b450a28f447f6d5ab57d8f2ab16a5f upstream.\n\nVerify that the frequency value from userspace is valid and makes sense.\n\nUnverified values can cause overflows later on.\n\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>\n[jstultz: Fix up bug for negative values and drop redunent cap check]\nSigned-off-by: John Stultz <john.stultz@linaro.org>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nInput: i8042 - reset keyboard to fix Elantech touchpad detection\n\ncommit 148e9a711e034e06310a8c36b64957934ebe30f2 upstream.\n\nOn some laptops, keyboard needs to be reset in order to successfully detect\ntouchpad (e.g., some Gigabyte laptop models with Elantech touchpads).\nWithout resettin keyboard touchpad pretends to be completely dead.\n\nBased on the original patch by Mateusz Jończyk this version has been\nexpanded to include DMI based detection & application of the fix\nautomatically on the affected models of laptops. This has been confirmed to\nfix problem by three users already on three different models of laptops.\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=81331\nSigned-off-by: Srihari Vijayaraghavan <linux.bug.reporting@gmail.com>\nAcked-by: Mateusz Jończyk <mat.jonczyk@o2.pl>\nTested-by: Srihari Vijayaraghavan <linux.bug.reporting@gmail.com>\nTested by: Zakariya Dehlawi <zdehlawi@gmail.com>\nTested-by: Guillaum Bouchard <guillaum.bouchard@gmail.com>\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nInput: I8042 - add Acer Aspire 7738 to the nomux list\n\ncommit 9333caeaeae4f831054e0e127a6ed3948b604d3e upstream.\n\nWhen KBC is in active multiplexing mode the touchpad on this laptop does\nnot work.\n\nReported-by: Bilal Koc <koc.bilo@googlemail.com>\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nmac80211: fix multicast LED blinking and counter\n\ncommit d025933e29872cb1fe19fc54d80e4dfa4ee5779c upstream.\n\nAs multicast-frames can't be fragmented, \"dot11MulticastReceivedFrameCount\"\nstopped being incremented after the use-after-free fix. Furthermore, the\nRX-LED will be triggered by every multicast frame (which wouldn't happen\nbefore) which wouldn't allow the LED to rest at all.\n\nFixes https://bugzilla.kernel.org/show_bug.cgi?id=89431 which also had the\npatch.\n\nFixes: b8fff407a180 (\"mac80211: fix use-after-free in defragmentation\")\nSigned-off-by: Andreas Müller <goo@stapelspeicher.org>\n[rewrite commit message]\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nmm: prevent endless growth of anon_vma hierarchy\n\ncommit 7a3ef208e662f4b63d43a23f61a64a129c525bbc upstream.\n\nConstantly forking task causes unlimited grow of anon_vma chain.  Each\nnext child allocates new level of anon_vmas and links vma to all\nprevious levels because pages might be inherited from any level.\n\nThis patch adds heuristic which decides to reuse existing anon_vma\ninstead of forking new one.  It adds counter anon_vma->degree which\ncounts linked vmas and directly descending anon_vmas and reuses anon_vma\nif counter is lower than two.  As a result each anon_vma has either vma\nor at least two descending anon_vmas.  In such trees half of nodes are\nleafs with alive vmas, thus count of anon_vmas is no more than two times\nbigger than count of vmas.\n\nThis heuristic reuses anon_vmas as few as possible because each reuse\nadds false aliasing among vmas and rmap walker ought to scan more ptes\nwhen it searches where page is might be mapped.\n\nLink: http://lkml.kernel.org/r/20120816024610.GA5350@evergreen.ssec.wisc.edu\nFixes: 5beb49305251 (\"mm: change anon_vma linking to fix multi-process server scalability issue\")\n[akpm@linux-foundation.org: fix typo, per Rik]\nSigned-off-by: Konstantin Khlebnikov <koct9i@gmail.com>\nReported-by: Daniel Forrest <dan.forrest@ssec.wisc.edu>\nTested-by: Michal Hocko <mhocko@suse.cz>\nTested-by: Jerome Marchand <jmarchan@redhat.com>\nReviewed-by: Michal Hocko <mhocko@suse.cz>\nReviewed-by: Rik van Riel <riel@redhat.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nmm: protect set_page_dirty() from ongoing truncation\n\ncommit 2d6d7f98284648c5ed113fe22a132148950b140f upstream.\n\nTejun, while reviewing the code, spotted the following race condition\nbetween the dirtying and truncation of a page:\n\n__set_page_dirty_nobuffers()       __delete_from_page_cache()\n  if (TestSetPageDirty(page))\n                                     page->mapping = NULL\n\t\t\t\t     if (PageDirty())\n\t\t\t\t       dec_zone_page_state(page, NR_FILE_DIRTY);\n\t\t\t\t       dec_bdi_stat(mapping->backing_dev_info, BDI_RECLAIMABLE);\n    if (page->mapping)\n      account_page_dirtied(page)\n        __inc_zone_page_state(page, NR_FILE_DIRTY);\n\t__inc_bdi_stat(mapping->backing_dev_info, BDI_RECLAIMABLE);\n\nwhich results in an imbalance of NR_FILE_DIRTY and BDI_RECLAIMABLE.\n\nDirtiers usually lock out truncation, either by holding the page lock\ndirectly, or in case of zap_pte_range(), by pinning the mapcount with\nthe page table lock held.  The notable exception to this rule, though,\nis do_wp_page(), for which this race exists.  However, do_wp_page()\nalready waits for a locked page to unlock before setting the dirty bit,\nin order to prevent a race where clear_page_dirty() misses the page bit\nin the presence of dirty ptes.  Upgrade that wait to a fully locked\nset_page_dirty() to also cover the situation explained above.\n\nAfterwards, the code in set_page_dirty() dealing with a truncation race\nis no longer needed.  Remove it.\n\nReported-by: Tejun Heo <tj@kernel.org>\nSigned-off-by: Johannes Weiner <hannes@cmpxchg.org>\nAcked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>\nReviewed-by: Jan Kara <jack@suse.cz>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n[lizf: Backported to 3.4:\n - adjust context\n - use VM_BUG_ON() instead of VM_BUG_ON_PAGE()]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nHID: roccat: potential out of bounds in pyra_sysfs_write_settings()\n\ncommit 606185b20caf4c57d7e41e5a5ea4aff460aef2ab upstream.\n\nThis is a static checker fix.  We write some binary settings to the\nsysfs file.  One of the settings is the \"->startup_profile\".  There\nisn't any checking to make sure it fits into the\npyra->profile_settings[] array in the profile_activated() function.\n\nI added a check to pyra_sysfs_write_settings() in both places because\nI wasn't positive that the other callers were correct.\n\nSigned-off-by: Dan Carpenter <dan.carpenter@oracle.com>\nSigned-off-by: Jiri Kosina <jkosina@suse.cz>\n[lizf: Backported to 3.4: define the variable @settings]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nOHCI: add a quirk for ULi M5237 blocking on reset\n\ncommit 56abcab833fafcfaeb2f5b25e0364c1dec45f53e upstream.\n\nCommit 8dccddbc2368 (\"OHCI: final fix for NVIDIA problems (I hope)\")\nintroduced into 3.1.9 broke boot on e.g. Freescale P2020DS development\nboard. The code path that was previously specific to NVIDIA controllers\nhad then become taken for all chips.\n\nHowever, the M5237 installed on the board wedges solid when accessing\nits base+OHCI_FMINTERVAL register, making it impossible to boot any\nkernel newer than 3.1.8 on this particular and apparently other similar\nmachines.\n\nDon't readl() and writel() base+OHCI_FMINTERVAL on PCI ID 10b9:5237.\n\nThe patch is suitable for the -next tree as well as all maintained\nkernels up to 3.2 inclusive.\n\nSigned-off-by: Arseny Solokha <asolokha@kb.kras.ru>\nAcked-by: Alan Stern <stern@rowland.harvard.edu>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nUSB: console: fix potential use after free\n\ncommit 32a4bf2e81ec378e5925d4e069e0677a6c86a6ad upstream.\n\nUse tty kref to release the fake tty in usb_console_setup to avoid use\nafter free if the underlying serial driver has acquired a reference.\n\nNote that using the tty destructor release_one_tty requires some more\nstate to be initialised.\n\nFixes: 4a90f09b20f4 (\"tty: usb-serial krefs\")\nSigned-off-by: Johan Hovold <johan@kernel.org>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nmm: Don't count the stack guard page towards RLIMIT_STACK\n\ncommit 690eac53daff34169a4d74fc7bfbd388c4896abb upstream.\n\nCommit fee7e49d4514 (\"mm: propagate error from stack expansion even for\nguard page\") made sure that we return the error properly for stack\ngrowth conditions.  It also theorized that counting the guard page\ntowards the stack limit might break something, but also said \"Let's see\nif anybody notices\".\n\nSomebody did notice.  Apparently android-x86 sets the stack limit very\nclose to the limit indeed, and including the guard page in the rlimit\ncheck causes the android 'zygote' process problems.\n\nSo this adds the (fairly trivial) code to make the stack rlimit check be\nagainst the actual real stack size, rather than the size of the vma that\nincludes the guard page.\n\nReported-and-tested-by: Chih-Wei Huang <cwhuang@android-x86.org>\nCc: Jay Foad <jay.foad@gmail.com>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nmm: fix corner case in anon_vma endless growing prevention\n\ncommit b800c91a0517071156e772d4fb329ad33590da62 upstream.\n\nFix for BUG_ON(anon_vma->degree) splashes in unlink_anon_vmas() (\"kernel\nBUG at mm/rmap.c:399!\") caused by commit 7a3ef208e662 (\"mm: prevent\nendless growth of anon_vma hierarchy\")\n\nAnon_vma_clone() is usually called for a copy of source vma in\ndestination argument.  If source vma has anon_vma it should be already\nin dst->anon_vma.  NULL in dst->anon_vma is used as a sign that it's\ncalled from anon_vma_fork().  In this case anon_vma_clone() finds\nanon_vma for reusing.\n\nVma_adjust() calls it differently and this breaks anon_vma reusing\nlogic: anon_vma_clone() links vma to old anon_vma and updates degree\ncounters but vma_adjust() overrides vma->anon_vma right after that.  As\na result final unlink_anon_vmas() decrements degree for wrong anon_vma.\n\nThis patch assigns ->anon_vma before calling anon_vma_clone().\n\nSigned-off-by: Konstantin Khlebnikov <koct9i@gmail.com>\nReported-and-tested-by: Chris Clayton <chris2553@googlemail.com>\nReported-and-tested-by: Oded Gabbay <oded.gabbay@amd.com>\nReported-and-tested-by: Chih-Wei Huang <cwhuang@android-x86.org>\nAcked-by: Rik van Riel <riel@redhat.com>\nAcked-by: Vlastimil Babka <vbabka@suse.cz>\nCc: Daniel Forrest <dan.forrest@ssec.wisc.edu>\nCc: Michal Hocko <mhocko@suse.cz>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n[lizf: Backported to 3.4: define variable @error and return this instead\n of returning -ENOMEM]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ngpio: fix memory and reference leaks in gpiochip_add error path\n\ncommit 5539b3c938d64a60cb1fc442ac3ce9263d52de0c upstream.\n\nMemory allocated and references taken by of_gpiochip_add and\nacpi_gpiochip_add were never released on errors in gpiochip_add (e.g.\nfailure to find free gpio range).\n\nFixes: 391c970c0dd1 (\"of/gpio: add default of_xlate function if device\nhas a node pointer\")\nFixes: 664e3e5ac64c (\"gpio / ACPI: register to ACPI events\nautomatically\")\n\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Linus Walleij <linus.walleij@linaro.org>\n[lizf: Backported to 3.4:\n - move the call to of_gpiochip_add() into the above if condition.\n - remove the call to acpi_gpiochip_remove()]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nftrace/jprobes/x86: Fix conflict between jprobes and function graph tracing\n\ncommit 237d28db036e411f22c03cfd5b0f6dc2aa9bf3bc upstream.\n\nIf the function graph tracer traces a jprobe callback, the system will\ncrash. This can easily be demonstrated by compiling the jprobe\nsample module that is in the kernel tree, loading it and running the\nfunction graph tracer.\n\n # modprobe jprobe_example.ko\n # echo function_graph > /sys/kernel/debug/tracing/current_tracer\n # ls\n\nThe first two commands end up in a nice crash after the first fork.\n(do_fork has a jprobe attached to it, so \"ls\" just triggers that fork)\n\nThe problem is caused by the jprobe_return() that all jprobe callbacks\nmust end with. The way jprobes works is that the function a jprobe\nis attached to has a breakpoint placed at the start of it (or it uses\nftrace if fentry is supported). The breakpoint handler (or ftrace callback)\nwill copy the stack frame and change the ip address to return to the\njprobe handler instead of the function. The jprobe handler must end\nwith jprobe_return() which swaps the stack and does an int3 (breakpoint).\nThis breakpoint handler will then put back the saved stack frame,\nsimulate the instruction at the beginning of the function it added\na breakpoint to, and then continue on.\n\nFor function tracing to work, it hijakes the return address from the\nstack frame, and replaces it with a hook function that will trace\nthe end of the call. This hook function will restore the return\naddress of the function call.\n\nIf the function tracer traces the jprobe handler, the hook function\nfor that handler will not be called, and its saved return address\nwill be used for the next function. This will result in a kernel crash.\n\nTo solve this, pause function tracing before the jprobe handler is called\nand unpause it before it returns back to the function it probed.\n\nSome other updates:\n\nUsed a variable \"saved_sp\" to hold kcb->jprobe_saved_sp. This makes the\ncode look a bit cleaner and easier to understand (various tries to fix\nthis bug required this change).\n\nNote, if fentry is being used, jprobes will change the ip address before\nthe function graph tracer runs and it will not be able to trace the\nfunction that the jprobe is probing.\n\nLink: http://lkml.kernel.org/r/20150114154329.552437962@goodmis.org\n\nAcked-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>\nSigned-off-by: Steven Rostedt <rostedt@goodmis.org>\n[lizf: Backported to 3.4:\n - adjust filename\n - adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ncan: dev: fix crtlmode_supported check\n\ncommit 9b1087aa5e86448fe6ad40a58964e35f3ba423d5 upstream.\n\nWhen changing flags in the CAN drivers ctrlmode the provided new content has to\nbe checked whether the bits are allowed to be changed. The bits that are to be\nchanged are given as a bitfield in cm->mask. Therefore checking against\ncm->flags is wrong as the content can hold any kind of values.\n\nThe iproute2 tool sets the bits in cm->mask and cm->flags depending on the\ndetected command line options. To be robust against bogus user space\napplications additionally sanitize the provided flags with the provided mask.\n\nCc: Wolfgang Grandegger <wg@grandegger.com>\nSigned-off-by: Oliver Hartkopp <socketcan@hartkopp.net>\nSigned-off-by: Marc Kleine-Budde <mkl@pengutronix.de>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nsysfs.h: add ATTRIBUTE_GROUPS() macro\n\ncommit f2f37f58b1b933b06d6d84e80a31a1b500fb0db2 upstream.\n\nTo make it easier for driver subsystems to work with attribute groups,\ncreate the ATTRIBUTE_GROUPS macro to remove some of the repetitive\ntyping for the most common use for attribute groups.\n\nReviewed-by: Guenter Roeck <linux@roeck-us.net>\nTested-by: Guenter Roeck <linux@roeck-us.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ndriver core: Introduce device_create_groups\n\ncommit 39ef311204941ddd01ea2950d6220c8ccc710d15 upstream.\n\ndevice_create_groups lets callers create devices as well as associated\nsysfs attributes with a single call. This avoids race conditions seen\nif sysfs attributes on new devices are created later.\n\n[fixed up comment block placement and add checks for printk buffer\nformats - gregkh]\n\nSigned-off-by: Guenter Roeck <linux@roeck-us.net>\nCc: Jean Delvare <khali@linux-fr.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ngpio: sysfs: fix gpio-chip device-attribute leak\n\ncommit 121b6a79955a3a3fd7bbb9b8cb88d5b9dad6283d upstream.\n\nThe gpio-chip device attributes were never destroyed when the device was\nremoved.\n\nFix by using device_create_with_groups() to create the device attributes\nof the chip class device.\n\nNote that this also fixes the attribute-creation race with userspace.\n\nFixes: d8f388d8dc8d (\"gpio: sysfs interface\")\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Linus Walleij <linus.walleij@linaro.org>\n[lizf: Backported to 3.4: adjust filename]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ngpiolib: Refactor gpio_export\n\ncommit fc4e2514995d9cd7f3e1a67098ce65d72acf8ec7 upstream.\n\nThe gpio_export function uses nested if statements and the status\nvariable to handle the failure cases. This makes the function logic\ndifficult to follow. Refactor the code to abort immediately on failure\nusing goto. This makes the code slightly longer, but significantly\nreduces the nesting and number of split lines and makes the code easier\nto read.\n\nSigned-off-by: Ryan Mallon <rmallon@gmail.com>\nSigned-off-by: Linus Walleij <linus.walleij@linaro.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ngpio: sysfs: fix gpio device-attribute leak\n\ncommit 0915e6feb38de8d3601819992a5bd050201a56fa upstream.\n\nThe gpio device attributes were never destroyed when the gpio was\nunexported (or on export failures).\n\nUse device_create_with_groups() to create the default device attributes\nof the gpio class device. Note that this also fixes the\nattribute-creation race with userspace for these attributes.\n\nRemove contingent attributes in export error path and on unexport.\n\nFixes: d8f388d8dc8d (\"gpio: sysfs interface\")\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Linus Walleij <linus.walleij@linaro.org>\n[lizf: Backported to 3.4:\n - adjust filename\n - adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ngpio: sysfs: fix gpio attribute-creation race\n\ncommit ebbeba120ab2ec6ac5f3afc1425ec6ff0b77ad6f upstream.\n\nFix attribute-creation race with userspace by using the default group\nto create also the contingent gpio device attributes.\n\nFixes: d8f388d8dc8d (\"gpio: sysfs interface\")\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Linus Walleij <linus.walleij@linaro.org>\n[lizf:\n - adjust filename\n - call gpio_to_irq() instead of gpiod_to_irq]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nALSA: usb-audio: Add mic volume fix quirk for Logitech Webcam C210\n\nlibata: allow sata_sil24 to opt-out of tag ordered submission\n\ncommit 72dd299d5039a336493993dcc63413cf31d0e662 upstream.\n\nRonny reports: https://bugzilla.kernel.org/show_bug.cgi?id=87101\n    \"Since commit 8a4aeec8d \"libata/ahci: accommodate tag ordered\n    controllers\" the access to the harddisk on the first SATA-port is\n    failing on its first access. The access to the harddisk on the\n    second port is working normal.\n\n    When reverting the above commit, access to both harddisks is working\n    fine again.\"\n\nMaintain tag ordered submission as the default, but allow sata_sil24 to\ncontinue with the old behavior.\n\nCc: Tejun Heo <tj@kernel.org>\nReported-by: Ronny Hegewald <Ronny.Hegewald@online.de>\nSigned-off-by: Dan Williams <dan.j.williams@intel.com>\nSigned-off-by: Tejun Heo <tj@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nscripts/recordmcount.pl: There is no -m32 gcc option on Super-H anymore\n\ncommit 1caf6aaaa47471831d77c75f094d4e00ad1ec808 upstream.\n\nCompiling SH with gcc-4.8 fails due to the -m32 option not being\nsupported.\n\nFrom http://buildd.debian-ports.org/status/fetch.php?pkg=linux&arch=sh4&ver=3.16.7-ckt4-1&stamp=1421425783\n\n      CC      init/main.o\n    gcc-4.8: error: unrecognized command line option '-m32'\n    ld: cannot find init/.tmp_mc_main.o: No such file or directory\n    objcopy: 'init/.tmp_mx_main.o': No such file\n    rm: cannot remove 'init/.tmp_mx_main.o': No such file or directory\n    rm: cannot remove 'init/.tmp_mc_main.o': No such file or directory\n\nLink: http://lkml.kernel.org/r/1421537778-29001-1-git-send-email-kernel@mkarcher.dialup.fu-berlin.de\nLink: http://lkml.kernel.org/r/54BCBDD4.10102@physik.fu-berlin.de\n\nCc: Matt Fleming <matt@console-pimps.org>\nReported-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>\nSigned-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>\nSigned-off-by: Steven Rostedt <rostedt@goodmis.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nlibata: prevent HSM state change race between ISR and PIO\n\ncommit ce7514526742c0898b837d4395f515b79dfb5a12 upstream.\n\nIt is possible for ata_sff_flush_pio_task() to set ap->hsm_task_state to\nHSM_ST_IDLE in between the time __ata_sff_port_intr() checks for HSM_ST_IDLE\nand before it calls ata_sff_hsm_move() causing ata_sff_hsm_move() to BUG().\n\nThis problem is hard to reproduce making this patch hard to verify, but this\nfix will prevent the race.\n\nI have not been able to reproduce the problem, but here is a crash dump from\na 2.6.32 kernel.\n\nOn examining the ata port's state, its hsm_task_state field has a value of HSM_ST_IDLE:\n\ncrash> struct ata_port.hsm_task_state ffff881c1121c000\n  hsm_task_state = 0\n\nNormally, this should not be possible as ata_sff_hsm_move() was called from ata_sff_host_intr(),\nwhich checks hsm_task_state and won't call ata_sff_hsm_move() if it has a HSM_ST_IDLE value.\n\nPID: 11053  TASK: ffff8816e846cae0  CPU: 0   COMMAND: \"sshd\"\n #0 [ffff88008ba03960] machine_kexec at ffffffff81038f3b\n #1 [ffff88008ba039c0] crash_kexec at ffffffff810c5d92\n #2 [ffff88008ba03a90] oops_end at ffffffff8152b510\n #3 [ffff88008ba03ac0] die at ffffffff81010e0b\n #4 [ffff88008ba03af0] do_trap at ffffffff8152ad74\n #5 [ffff88008ba03b50] do_invalid_op at ffffffff8100cf95\n #6 [ffff88008ba03bf0] invalid_op at ffffffff8100bf9b\n    [exception RIP: ata_sff_hsm_move+317]\n    RIP: ffffffff813a77ad  RSP: ffff88008ba03ca0  RFLAGS: 00010097\n    RAX: 0000000000000000  RBX: ffff881c1121dc60  RCX: 0000000000000000\n    RDX: ffff881c1121dd10  RSI: ffff881c1121dc60  RDI: ffff881c1121c000\n    RBP: ffff88008ba03d00   R8: 0000000000000000   R9: 000000000000002e\n    R10: 000000000001003f  R11: 000000000000009b  R12: ffff881c1121c000\n    R13: 0000000000000000  R14: 0000000000000050  R15: ffff881c1121dd78\n    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018\n #7 [ffff88008ba03d08] ata_sff_host_intr at ffffffff813a7fbd\n #8 [ffff88008ba03d38] ata_sff_interrupt at ffffffff813a821e\n #9 [ffff88008ba03d78] handle_IRQ_event at ffffffff810e6ec0\n\nx86, hyperv: Mark the Hyper-V clocksource as being continuous\n\ncommit 32c6590d126836a062b3140ed52d898507987017 upstream.\n\nThe Hyper-V clocksource is continuous; mark it accordingly.\n\nSigned-off-by: K. Y. Srinivasan <kys@microsoft.com>\nAcked-by: jasowang@redhat.com\nCc: gregkh@linuxfoundation.org\nCc: devel@linuxdriverproject.org\nCc: olaf@aepfle.de\nCc: apw@canonical.com\nLink: http://lkml.kernel.org/r/1421108762-3331-1-git-send-email-kys@microsoft.com\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nspi: dw: Fix detecting FIFO depth\n\ncommit d297933cc7fcfbaaf2d37570baac73287bf0357d upstream.\n\nCurrent code tries to find the highest valid fifo depth by checking the value\nit wrote to DW_SPI_TXFLTR. There are a few problems in current code:\n1) There is an off-by-one in dws->fifo_len setting because it assumes the latest\n   register write fails so the latest valid value should be fifo - 1.\n2) We know the depth could be from 2 to 256 from HW spec, so it is not necessary\n   to test fifo == 257. In the case fifo is 257, it means the latest valid\n   setting is fifo = 256. So after the for loop iteration, we should check\n   fifo == 2 case instead of fifo == 257 if detecting the FIFO depth fails.\nThis patch fixes above issues.\n\nSigned-off-by: Axel Lin <axel.lin@ingics.com>\nReviewed-and-tested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nspi: dw-mid: fix FIFO size\n\ncommit 67bf9cda4b498b8cea4a40be67a470afe57d2e88 upstream.\n\nThe FIFO size is 40 accordingly to the specifications, but this means 0x40,\ni.e. 64 bytes. This patch fixes the typo and enables FIFO size autodetection\nfor Intel MID devices.\n\nFixes: 7063c0d942a1 (spi/dw_spi: add DMA support)\nSigned-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nASoC: wm8960: Fix capture sample rate from 11250 to 11025\n\ncommit 22ee76daddb87f88d2336d1b4737ef27c4f307ac upstream.\n\nwm8960 codec can't support sample rate 11250, it must be 11025.\n\nSigned-off-by: Zidan Wang <b50113@freescale.com>\nAcked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nregulator: core: fix race condition in regulator_put()\n\ncommit 83b0302d347a49f951e904184afe57ac3723476e upstream.\n\nThe regulator framework maintains a list of consumer regulators\nfor a regulator device and protects it from concurrent access using\nthe regulator device's mutex lock.\n\nIn the case of regulator_put() the consumer is removed and regulator\ndevice's parameters are updated without holding the regulator device's\nmutex. This would lead to a race condition between the regulator_put()\nand any function which traverses the consumer list or modifies regulator\ndevice's parameters.\nFix this race condition by holding the regulator device's mutex in case\nof regulator_put.\n\nSigned-off-by: Ashay Jaiswal <ashayj@codeaurora.org>\nSigned-off-by: Mark Brown <broonie@kernel.org>\n[lizf: Backported to 3.4:\n - adjust context\n - no need to change the comment]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\npowerpc/xmon: Fix another endiannes issue in RTAS call from xmon\n\ncommit e6eb2eba494d6f99e69ca3c3748cd37a2544ab38 upstream.\n\nThe commit 3b8a3c010969 (\"powerpc/pseries: Fix endiannes issue in RTAS\ncall from xmon\") was fixing an endianness issue in the call made from\nxmon to RTAS.\n\nHowever, as Michael Ellerman noticed, this fix was not complete, the\ntoken value was not byte swapped. This lead to call an unexpected and\nmost of the time unexisting RTAS function, which is silently ignored by\nRTAS.\n\nThis fix addresses this hole.\n\nReported-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Laurent Dufour <ldufour@linux.vnet.ibm.com>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nnl80211: fix per-station group key get/del and memory leak\n\ncommit 0fa7b39131576dd1baa6ca17fca53c65d7f62249 upstream.\n\nIn case userspace attempts to obtain key information for or delete a\nunicast key, this is currently erroneously rejected unless the driver\nsets the WIPHY_FLAG_IBSS_RSN flag. Apparently enough drivers do so it\nwas never noticed.\n\nFix that, and while at it fix a potential memory leak: the error path\nin the get_key() function was placed after allocating a message but\ndidn't free it - move it to a better place. Luckily admin permissions\nare needed to call this operation.\n\nFixes: e31b82136d1ad (\"cfg80211/mac80211: allow per-station GTKs\")\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nusb-storage/SCSI: Add broken_fua blacklist flag\n\ncommit b14bf2d0c0358140041d1c1805a674376964d0e0 upstream.\n\nSome buggy JMicron USB-ATA bridges don't know how to translate the FUA\nbit in READs or WRITEs.  This patch adds an entry in unusual_devs.h\nand a blacklist flag to tell the sd driver not to use FUA.\n\nSigned-off-by: Alan Stern <stern@rowland.harvard.edu>\nReported-by: Michael Büsch <m@bues.ch>\nTested-by: Michael Büsch <m@bues.ch>\nAcked-by: James Bottomley <James.Bottomley@HansenPartnership.com>\nCC: Matthew Dharm <mdharm-usb@one-eyed-alien.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nusb-storage/SCSI: blacklist FUA on JMicron 152d:2566 USB-SATA controller\n\ncommit bf5c4136fa5ce471bdbf4cf59a813e32755fd014 upstream.\n\nIt looks like FUA support is broken on JMicron 152d:2566 bridge:\n\n[223159.885704] sd 7:0:0:0: [sdc] Write Protect is off\n[223159.885706] sd 7:0:0:0: [sdc] Mode Sense: 47 00 10 08\n[223159.885942] sd 7:0:0:0: [sdc] Write cache: enabled, read cache: enabled, supports DPO and FUA\n\n[223283.691677] sd 7:0:0:0: [sdc]\n[223283.691680] Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE\n[223283.691681] sd 7:0:0:0: [sdc]\n[223283.691682] Sense Key : Illegal Request [current]\n[223283.691684] sd 7:0:0:0: [sdc]\n[223283.691685] Add. Sense: Invalid field in cdb\n[223283.691686] sd 7:0:0:0: [sdc] CDB:\n[223283.691687] Write(10): 2a 08 15 d0 83 0d 00 00 01 00\n[223283.691690] blk_update_request: critical target error, dev sdc, sector 2927892584\n\nThis patch adds blacklist flag so that sd will not use FUA\n\nSigned-off-by: Dmitry Nezhevenko <dion@dion.org.ua>\nCc: Phil Dibowitz <phil@ipom.com>\nCc: Alan Stern <stern@rowland.harvard.edu>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nusb-core bInterval quirk\n\ncommit cd83ce9e6195aa3ea15ab4db92892802c20df5d0 upstream.\n\nThis patch adds a usb quirk to support devices with interupt endpoints\nand bInterval values expressed as microframes. The quirk causes the\nparse endpoint function to modify the reported bInterval to a standards\nconforming value.\n\nThere is currently code in the endpoint parser that checks for\nbIntervals that are outside of the valid range (1-16 for USB 2+ high\nspeed and super speed interupt endpoints). In this case, the code assumes\nthe bInterval is being reported in 1ms frames. As well, the correction\nis only applied if the original bInterval value is out of the 1-16 range.\n\nWith this quirk applied to the device, the bInterval will be\naccurately adjusted from microframes to an exponent.\n\nSigned-off-by: James P Michels III <james.p.michels@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nUSB: Add OTG PET device to TPL\n\ncommit e5dff0e80463cc3fa236e898ef1491b40be70b19 upstream.\n\nOTG device shall support this device for allowing compliance automated testing.\nThe modification is derived from Pavankumar and Vijayavardhans' previous work.\n\nSigned-off-by: Macpaul Lin <macpaul@gmail.com>\nCc: Pavankumar Kondeti <pkondeti@codeaurora.org>\nCc: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ndrm/i915: Only fence tiled region of object.\n\ncommit af1a7301c7cf8912dca03065d448c4437c5c239f upstream.\n\nWhen creating a fence for a tiled object, only fence the area that\nmakes up the actual tiles.  The object may be larger than the tiled\narea and if we allow those extra addresses to be fenced, they'll\nget converted to addresses beyond where the object is mapped. This\nopens up the possiblity of writes beyond the end of object.\n\nTo prevent this, we adjust the size of the fence to only encompass\nthe area that makes up the actual tiles.  The extra space is considered\nun-tiled and now behaves as if it was a linear object.\n\nTestcase: igt/gem_tiled_fence_overflow\nReported-by: Dan Hettena <danh@ghs.com>\nSigned-off-by: Bob Paauwe <bob.j.paauwe@intel.com>\nReviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>\nSigned-off-by: Jani Nikula <jani.nikula@intel.com>\n[lizf: Backported to 3.4:\n - adjust context\n - adjust indentation\n - make the same change to both sandybridge_write_fence_reg()\n   and i965_write_fence_reg()]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nALSA: seq-dummy: remove deadlock-causing events on close\n\ncommit 0767e95bb96d7fdddcd590fb809e6975d93aebc5 upstream.\n\nWhen the last subscriber to a \"Through\" port has been removed, the\nsubscribed destination ports might still be active, so it would be\nwrong to send \"all sounds off\" and \"reset controller\" events to them.\nThe proper place for such a shutdown would be the closing of the actual\nMIDI port (and close_substream() in rawmidi.c already can do this).\n\nThis also fixes a deadlock when dummy_unuse() tries to send events to\nits own port that is already locked because it is being freed.\n\nReported-by: Peter Billam <peter@www.pjb.com.au>\nSigned-off-by: Clemens Ladisch <clemens@ladisch.de>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nnet: sctp: fix slab corruption from use after free on INIT collisions\n\ncommit 600ddd6825543962fb807884169e57b580dba208 upstream.\n\nWhen hitting an INIT collision case during the 4WHS with AUTH enabled, as\nalready described in detail in commit 1be9a950c646 (\"net: sctp: inherit\nauth_capable on INIT collisions\"), it can happen that we occasionally\nstill remotely trigger the following panic on server side which seems to\nhave been uncovered after the fix from commit 1be9a950c646 ...\n\n[  533.876389] BUG: unable to handle kernel paging request at 00000000ffffffff\n[  533.913657] IP: [<ffffffff811ac385>] __kmalloc+0x95/0x230\n[  533.940559] PGD 5030f2067 PUD 0\n[  533.957104] Oops: 0000 [#1] SMP\n[  533.974283] Modules linked in: sctp mlx4_en [...]\n[  534.939704] Call Trace:\n[  534.951833]  [<ffffffff81294e30>] ? crypto_init_shash_ops+0x60/0xf0\n[  534.984213]  [<ffffffff81294e30>] crypto_init_shash_ops+0x60/0xf0\n[  535.015025]  [<ffffffff8128c8ed>] __crypto_alloc_tfm+0x6d/0x170\n[  535.045661]  [<ffffffff8128d12c>] crypto_alloc_base+0x4c/0xb0\n[  535.074593]  [<ffffffff8160bd42>] ? _raw_spin_lock_bh+0x12/0x50\n[  535.105239]  [<ffffffffa0418c11>] sctp_inet_listen+0x161/0x1e0 [sctp]\n[  535.138606]  [<ffffffff814e43bd>] SyS_listen+0x9d/0xb0\n[  535.166848]  [<ffffffff816149a9>] system_call_fastpath+0x16/0x1b\n\n... or depending on the the application, for example this one:\n\n[ 1370.026490] BUG: unable to handle kernel paging request at 00000000ffffffff\n[ 1370.026506] IP: [<ffffffff811ab455>] kmem_cache_alloc+0x75/0x1d0\n[ 1370.054568] PGD 633c94067 PUD 0\n[ 1370.070446] Oops: 0000 [#1] SMP\n[ 1370.085010] Modules linked in: sctp kvm_amd kvm [...]\n[ 1370.963431] Call Trace:\n[ 1370.974632]  [<ffffffff8120f7cf>] ? SyS_epoll_ctl+0x53f/0x960\n[ 1371.000863]  [<ffffffff8120f7cf>] SyS_epoll_ctl+0x53f/0x960\n[ 1371.027154]  [<ffffffff812100d3>] ? anon_inode_getfile+0xd3/0x170\n[ 1371.054679]  [<ffffffff811e3d67>] ? __alloc_fd+0xa7/0x130\n[ 1371.080183]  [<ffffffff816149a9>] system_call_fastpath+0x16/0x1b\n\nWith slab debugging enabled, we can see that the poison has been overwritten:\n\n[  669.826368] BUG kmalloc-128 (Tainted: G        W     ): Poison overwritten\n[  669.826385] INFO: 0xffff880228b32e50-0xffff880228b32e50. First byte 0x6a instead of 0x6b\n[  669.826414] INFO: Allocated in sctp_auth_create_key+0x23/0x50 [sctp] age=3 cpu=0 pid=18494\n[  669.826424]  __slab_alloc+0x4bf/0x566\n[  669.826433]  __kmalloc+0x280/0x310\n[  669.826453]  sctp_auth_create_key+0x23/0x50 [sctp]\n[  669.826471]  sctp_auth_asoc_create_secret+0xcb/0x1e0 [sctp]\n[  669.826488]  sctp_auth_asoc_init_active_key+0x68/0xa0 [sctp]\n[  669.826505]  sctp_do_sm+0x29d/0x17c0 [sctp] [...]\n[  669.826629] INFO: Freed in kzfree+0x31/0x40 age=1 cpu=0 pid=18494\n[  669.826635]  __slab_free+0x39/0x2a8\n[  669.826643]  kfree+0x1d6/0x230\n[  669.826650]  kzfree+0x31/0x40\n[  669.826666]  sctp_auth_key_put+0x19/0x20 [sctp]\n[  669.826681]  sctp_assoc_update+0x1ee/0x2d0 [sctp]\n[  669.826695]  sctp_do_sm+0x674/0x17c0 [sctp]\n\nSince this only triggers in some collision-cases with AUTH, the problem at\nheart is that sctp_auth_key_put() on asoc->asoc_shared_key is called twice\nwhen having refcnt 1, once directly in sctp_assoc_update() and yet again\nfrom within sctp_auth_asoc_init_active_key() via sctp_assoc_update() on\nthe already kzfree'd memory, which is also consistent with the observation\nof the poison decrease from 0x6b to 0x6a (note: the overwrite is detected\nat a later point in time when poison is checked on new allocation).\n\nReference counting of auth keys revisited:\n\nShared keys for AUTH chunks are being stored in endpoints and associations\nin endpoint_shared_keys list. On endpoint creation, a null key is being\nadded; on association creation, all endpoint shared keys are being cached\nand thus cloned over to the association. struct sctp_shared_key only holds\na pointer to the actual key bytes, that is, struct sctp_auth_bytes which\nkeeps track of users internally through refcounting. Naturally, on assoc\nor enpoint destruction, sctp_shared_key are being destroyed directly and\nthe reference on sctp_auth_bytes dropped.\n\nUser space can add keys to either list via setsockopt(2) through struct\nsctp_authkey and by passing that to sctp_auth_set_key() which replaces or\nadds a new auth key. There, sctp_auth_create_key() creates a new sctp_auth_bytes\nwith refcount 1 and in case of replacement drops the reference on the old\nsctp_auth_bytes. A key can be set active from user space through setsockopt()\non the id via sctp_auth_set_active_key(), which iterates through either\nendpoint_shared_keys and in case of an assoc, invokes (one of various places)\nsctp_auth_asoc_init_active_key().\n\nsctp_auth_asoc_init_active_key() computes the actual secret from local's\nand peer's random, hmac and shared key parameters and returns a new key\ndirectly as sctp_auth_bytes, that is asoc->asoc_shared_key, plus drops\nthe reference if there was a previous one. The secret, which where we\neventually double drop the ref comes from sctp_auth_asoc_set_secret() with\nintitial refcount of 1, which also stays unchanged eventually in\nsctp_assoc_update(). This key is later being used for crypto layer to\nset the key for the hash in crypto_hash_setkey() from sctp_auth_calculate_hmac().\n\nTo close the loop: asoc->asoc_shared_key is freshly allocated secret\nmaterial and independant of the sctp_shared_key management keeping track\nof only shared keys in endpoints and assocs. Hence, also commit 4184b2a79a76\n(\"net: sctp: fix memory leak in auth key management\") is independant of\nthis bug here since it concerns a different layer (though same structures\nbeing used eventually). asoc->asoc_shared_key is reference dropped correctly\non assoc destruction in sctp_association_free() and when active keys are\nbeing replaced in sctp_auth_asoc_init_active_key(), it always has a refcount\nof 1. Hence, it's freed prematurely in sctp_assoc_update(). Simple fix is\nto remove that sctp_auth_key_put() from there which fixes these panics.\n\nFixes: 730fc3d05cd4 (\"[SCTP]: Implete SCTP-AUTH parameter processing\")\nSigned-off-by: Daniel Borkmann <dborkman@redhat.com>\nAcked-by: Vlad Yasevich <vyasevich@gmail.com>\nAcked-by: Neil Horman <nhorman@tuxdriver.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nipv6: replacing a rt6_info needs to purge possible propagated rt6_infos too\n\ncommit 6e9e16e6143b725662e47026a1d0f270721cdd24 upstream.\n\nLubomir Rintel reported that during replacing a route the interface\nreference counter isn't correctly decremented.\n\nTo quote bug <https://bugzilla.kernel.org/show_bug.cgi?id=91941>:\n| [root@rhel7-5 lkundrak]# sh -x lal\n| + ip link add dev0 type dummy\n| + ip link set dev0 up\n| + ip link add dev1 type dummy\n| + ip link set dev1 up\n| + ip addr add 2001:db8:8086::2/64 dev dev0\n| + ip route add 2001:db8:8086::/48 dev dev0 proto static metric 20\n| + ip route add 2001:db8:8088::/48 dev dev1 proto static metric 10\n| + ip route replace 2001:db8:8086::/48 dev dev1 proto static metric 20\n| + ip link del dev0 type dummy\n| Message from syslogd@rhel7-5 at Jan 23 10:54:41 ...\n|  kernel:unregister_netdevice: waiting for dev0 to become free. Usage count = 2\n|\n| Message from syslogd@rhel7-5 at Jan 23 10:54:51 ...\n|  kernel:unregister_netdevice: waiting for dev0 to become free. Usage count = 2\n\nDuring replacement of a rt6_info we must walk all parent nodes and check\nif the to be replaced rt6_info got propagated. If so, replace it with\nan alive one.\n\nFixes: 4a287eba2de3957 (\"IPv6 routing, NLM_F_* flag support: REPLACE and EXCL flags support, warn about missing CREATE flag\")\nReported-by: Lubomir Rintel <lkundrak@v3.sk>\nSigned-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nTested-by: Lubomir Rintel <lkundrak@v3.sk>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nvm: add VM_FAULT_SIGSEGV handling support\n\ncommit 33692f27597fcab536d7cbbcc8f52905133e4aa7 upstream.\n\nThe core VM already knows about VM_FAULT_SIGBUS, but cannot return a\n\"you should SIGSEGV\" error, because the SIGSEGV case was generally\nhandled by the caller - usually the architecture fault handler.\n\nThat results in lots of duplication - all the architecture fault\nhandlers end up doing very similar \"look up vma, check permissions, do\nretries etc\" - but it generally works.  However, there are cases where\nthe VM actually wants to SIGSEGV, and applications _expect_ SIGSEGV.\n\nIn particular, when accessing the stack guard page, libsigsegv expects a\nSIGSEGV.  And it usually got one, because the stack growth is handled by\nthat duplicated architecture fault handler.\n\nHowever, when the generic VM layer started propagating the error return\nfrom the stack expansion in commit fee7e49d4514 (\"mm: propagate error\nfrom stack expansion even for guard page\"), that now exposed the\nexisting VM_FAULT_SIGBUS result to user space.  And user space really\nexpected SIGSEGV, not SIGBUS.\n\nTo fix that case, we need to add a VM_FAULT_SIGSEGV, and teach all those\nduplicate architecture fault handlers about it.  They all already have\nthe code to handle SIGSEGV, so it's about just tying that new return\nvalue to the existing code, but it's all a bit annoying.\n\nThis is the mindless minimal patch to do this.  A more extensive patch\nwould be to try to gather up the mostly shared fault handling logic into\none generic helper routine, and long-term we really should do that\ncleanup.\n\nJust from this patch, you can generally see that most architectures just\ncopied (directly or indirectly) the old x86 way of doing things, but in\nthe meantime that original x86 model has been improved to hold the VM\nsemaphore for shorter times etc and to handle VM_FAULT_RETRY and other\n\"newer\" things, so it would be a good idea to bring all those\nimprovements to the generic case and teach other architectures about\nthem too.\n\nReported-and-tested-by: Takashi Iwai <tiwai@suse.de>\nTested-by: Jan Engelhardt <jengelh@inai.de>\nAcked-by: Heiko Carstens <heiko.carstens@de.ibm.com> # \"s390 still compiles and boots\"\nCc: linux-arch@vger.kernel.org\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n[bwh: Backported to 3.2:\n - Adjust filenames, context\n - Drop arc, metag, nios2 and lustre changes\n - For sh, patch both 32-bit and 64-bit implementations to use goto bad_area\n - For s390, pass int_code and trans_exc_code as arguments to do_no_context()\n   and do_sigsegv()]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\n[lizf: Backported to 3.4:\n - adjust context in arch/power/mm/fault.c\n - apply the original change in upstream commit for s390]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nvm: make stack guard page errors return VM_FAULT_SIGSEGV rather than SIGBUS\n\ncommit 9c145c56d0c8a0b62e48c8d71e055ad0fb2012ba upstream.\n\nThe stack guard page error case has long incorrectly caused a SIGBUS\nrather than a SIGSEGV, but nobody actually noticed until commit\nfee7e49d4514 (\"mm: propagate error from stack expansion even for guard\npage\") because that error case was never actually triggered in any\nnormal situations.\n\nNow that we actually report the error, people noticed the wrong signal\nthat resulted.  So far, only the test suite of libsigsegv seems to have\nactually cared, but there are real applications that use libsigsegv, so\nlet's not wait for any of those to break.\n\nReported-and-tested-by: Takashi Iwai <tiwai@suse.de>\nTested-by: Jan Engelhardt <jengelh@inai.de>\nAcked-by: Heiko Carstens <heiko.carstens@de.ibm.com> # \"s390 still compiles and boots\"\nCc: linux-arch@vger.kernel.org\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nnet: sctp: fix panic on duplicate ASCONF chunks\n\ncommit b69040d8e39f20d5215a03502a8e8b4c6ab78395 upstream.\n\nWhen receiving a e.g. semi-good formed connection scan in the\nform of ...\n\n  -------------- INIT[ASCONF; ASCONF_ACK] ------------->\n  <----------- INIT-ACK[ASCONF; ASCONF_ACK] ------------\n  -------------------- COOKIE-ECHO -------------------->\n  <-------------------- COOKIE-ACK ---------------------\n  ---------------- ASCONF_a; ASCONF_b ----------------->\n\n... where ASCONF_a equals ASCONF_b chunk (at least both serials\nneed to be equal), we panic an SCTP server!\n\nThe problem is that good-formed ASCONF chunks that we reply with\nASCONF_ACK chunks are cached per serial. Thus, when we receive a\nsame ASCONF chunk twice (e.g. through a lost ASCONF_ACK), we do\nnot need to process them again on the server side (that was the\nidea, also proposed in the RFC). Instead, we know it was cached\nand we just resend the cached chunk instead. So far, so good.\n\nWhere things get nasty is in SCTP's side effect interpreter, that\nis, sctp_cmd_interpreter():\n\nWhile incoming ASCONF_a (chunk = event_arg) is being marked\n!end_of_packet and !singleton, and we have an association context,\nwe do not flush the outqueue the first time after processing the\nASCONF_ACK singleton chunk via SCTP_CMD_REPLY. Instead, we keep it\nqueued up, although we set local_cork to 1. Commit 2e3216cd54b1\nchanged the precedence, so that as long as we get bundled, incoming\nchunks we try possible bundling on outgoing queue as well. Before\nthis commit, we would just flush the output queue.\n\nNow, while ASCONF_a's ASCONF_ACK sits in the corked outq, we\ncontinue to process the same ASCONF_b chunk from the packet. As\nwe have cached the previous ASCONF_ACK, we find it, grab it and\ndo another SCTP_CMD_REPLY command on it. So, effectively, we rip\nthe chunk->list pointers and requeue the same ASCONF_ACK chunk\nanother time. Since we process ASCONF_b, it's correctly marked\nwith end_of_packet and we enforce an uncork, and thus flush, thus\ncrashing the kernel.\n\nFix it by testing if the ASCONF_ACK is currently pending and if\nthat is the case, do not requeue it. When flushing the output\nqueue we may relink the chunk for preparing an outgoing packet,\nbut eventually unlink it when it's copied into the skb right\nbefore transmission.\n\nJoint work with Vlad Yasevich.\n\nFixes: 2e3216cd54b1 (\"sctp: Follow security requirement of responding with 1 packet\")\nSigned-off-by: Daniel Borkmann <dborkman@redhat.com>\nSigned-off-by: Vlad Yasevich <vyasevich@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nnet: sctp: fix skb_over_panic when receiving malformed ASCONF chunks\n\ncommit 9de7922bc709eee2f609cd01d98aaedc4cf5ea74 upstream.\n\nCommit 6f4c618ddb0 (\"SCTP : Add paramters validity check for\nASCONF chunk\") added basic verification of ASCONF chunks, however,\nit is still possible to remotely crash a server by sending a\nspecial crafted ASCONF chunk, even up to pre 2.6.12 kernels:\n\nskb_over_panic: text:ffffffffa01ea1c3 len:31056 put:30768\n head:ffff88011bd81800 data:ffff88011bd81800 tail:0x7950\n end:0x440 dev:<NULL>\n ------------[ cut here ]------------\nkernel BUG at net/core/skbuff.c:129!\n[...]\nCall Trace:\n <IRQ>\n [<ffffffff8144fb1c>] skb_put+0x5c/0x70\n [<ffffffffa01ea1c3>] sctp_addto_chunk+0x63/0xd0 [sctp]\n [<ffffffffa01eadaf>] sctp_process_asconf+0x1af/0x540 [sctp]\n [<ffffffff8152d025>] ? _read_unlock_bh+0x15/0x20\n [<ffffffffa01e0038>] sctp_sf_do_asconf+0x168/0x240 [sctp]\n [<ffffffffa01e3751>] sctp_do_sm+0x71/0x1210 [sctp]\n [<ffffffff8147645d>] ? fib_rules_lookup+0xad/0xf0\n [<ffffffffa01e6b22>] ? sctp_cmp_addr_exact+0x32/0x40 [sctp]\n [<ffffffffa01e8393>] sctp_assoc_bh_rcv+0xd3/0x180 [sctp]\n [<ffffffffa01ee986>] sctp_inq_push+0x56/0x80 [sctp]\n [<ffffffffa01fcc42>] sctp_rcv+0x982/0xa10 [sctp]\n [<ffffffffa01d5123>] ? ipt_local_in_hook+0x23/0x28 [iptable_filter]\n [<ffffffff8148bdc9>] ? nf_iterate+0x69/0xb0\n [<ffffffff81496d10>] ? ip_local_deliver_finish+0x0/0x2d0\n [<ffffffff8148bf86>] ? nf_hook_slow+0x76/0x120\n [<ffffffff81496d10>] ? ip_local_deliver_finish+0x0/0x2d0\n [<ffffffff81496ded>] ip_local_deliver_finish+0xdd/0x2d0\n [<ffffffff81497078>] ip_local_deliver+0x98/0xa0\n [<ffffffff8149653d>] ip_rcv_finish+0x12d/0x440\n [<ffffffff81496ac5>] ip_rcv+0x275/0x350\n [<ffffffff8145c88b>] __netif_receive_skb+0x4ab/0x750\n [<ffffffff81460588>] netif_receive_skb+0x58/0x60\n\nThis can be triggered e.g., through a simple scripted nmap\nconnection scan injecting the chunk after the handshake, for\nexample, ...\n\n  -------------- INIT[ASCONF; ASCONF_ACK] ------------->\n  <----------- INIT-ACK[ASCONF; ASCONF_ACK] ------------\n  -------------------- COOKIE-ECHO -------------------->\n  <-------------------- COOKIE-ACK ---------------------\n  ------------------ ASCONF; UNKNOWN ------------------>\n\n... where ASCONF chunk of length 280 contains 2 parameters ...\n\n  1) Add IP address parameter (param length: 16)\n  2) Add/del IP address parameter (param length: 255)\n\n... followed by an UNKNOWN chunk of e.g. 4 bytes. Here, the\nAddress Parameter in the ASCONF chunk is even missing, too.\nThis is just an example and similarly-crafted ASCONF chunks\ncould be used just as well.\n\nThe ASCONF chunk passes through sctp_verify_asconf() as all\nparameters passed sanity checks, and after walking, we ended\nup successfully at the chunk end boundary, and thus may invoke\nsctp_process_asconf(). Parameter walking is done with\nWORD_ROUND() to take padding into account.\n\nIn sctp_process_asconf()'s TLV processing, we may fail in\nsctp_process_asconf_param() e.g., due to removal of the IP\naddress that is also the source address of the packet containing\nthe ASCONF chunk, and thus we need to add all TLVs after the\nfailure to our ASCONF response to remote via helper function\nsctp_add_asconf_response(), which basically invokes a\nsctp_addto_chunk() adding the error parameters to the given\nskb.\n\nWhen walking to the next parameter this time, we proceed\nwith ...\n\n  length = ntohs(asconf_param->param_hdr.length);\n  asconf_param = (void *)asconf_param + length;\n\n... instead of the WORD_ROUND()'ed length, thus resulting here\nin an off-by-one that leads to reading the follow-up garbage\nparameter length of 12336, and thus throwing an skb_over_panic\nfor the reply when trying to sctp_addto_chunk() next time,\nwhich implicitly calls the skb_put() with that length.\n\nFix it by using sctp_walk_params() [ which is also used in\nINIT parameter processing ] macro in the verification *and*\nin ASCONF processing: it will make sure we don't spill over,\nthat we walk parameters WORD_ROUND()'ed. Moreover, we're being\nmore defensive and guard against unknown parameter types and\nmissized addresses.\n\nJoint work with Vlad Yasevich.\n\nFixes: b896b82be4ae (\"[SCTP] ADDIP: Support for processing incoming ASCONF_ACK chunks.\")\nSigned-off-by: Daniel Borkmann <dborkman@redhat.com>\nSigned-off-by: Vlad Yasevich <vyasevich@gmail.com>\nAcked-by: Neil Horman <nhorman@tuxdriver.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nx86, mm/ASLR: Fix stack randomization on 64-bit systems\n\ncommit 4e7c22d447bb6d7e37bfe39ff658486ae78e8d77 upstream.\n\nThe issue is that the stack for processes is not properly randomized on\n64 bit architectures due to an integer overflow.\n\nThe affected function is randomize_stack_top() in file\n\"fs/binfmt_elf.c\":\n\n  static unsigned long randomize_stack_top(unsigned long stack_top)\n  {\n           unsigned int random_variable = 0;\n\n           if ((current->flags & PF_RANDOMIZE) &&\n                   !(current->personality & ADDR_NO_RANDOMIZE)) {\n                   random_variable = get_random_int() & STACK_RND_MASK;\n                   random_variable <<= PAGE_SHIFT;\n           }\n           return PAGE_ALIGN(stack_top) + random_variable;\n           return PAGE_ALIGN(stack_top) - random_variable;\n  }\n\nNote that, it declares the \"random_variable\" variable as \"unsigned int\".\nSince the result of the shifting operation between STACK_RND_MASK (which\nis 0x3fffff on x86_64, 22 bits) and PAGE_SHIFT (which is 12 on x86_64):\n\n\t  random_variable <<= PAGE_SHIFT;\n\nthen the two leftmost bits are dropped when storing the result in the\n\"random_variable\". This variable shall be at least 34 bits long to hold\nthe (22+12) result.\n\nThese two dropped bits have an impact on the entropy of process stack.\nConcretely, the total stack entropy is reduced by four: from 2^28 to\n2^30 (One fourth of expected entropy).\n\nThis patch restores back the entropy by correcting the types involved\nin the operations in the functions randomize_stack_top() and\nstack_maxrandom_size().\n\nThe successful fix can be tested with:\n\n  $ for i in `seq 1 10`; do cat /proc/self/maps | grep stack; done\n  7ffeda566000-7ffeda587000 rw-p 00000000 00:00 0                          [stack]\n  7fff5a332000-7fff5a353000 rw-p 00000000 00:00 0                          [stack]\n  7ffcdb7a1000-7ffcdb7c2000 rw-p 00000000 00:00 0                          [stack]\n  7ffd5e2c4000-7ffd5e2e5000 rw-p 00000000 00:00 0                          [stack]\n  ...\n\nOnce corrected, the leading bytes should be between 7ffc and 7fff,\nrather than always being 7fff.\n\nSigned-off-by: Hector Marco-Gisbert <hecmargi@upv.es>\nSigned-off-by: Ismael Ripoll <iripoll@upv.es>\n[ Rebased, fixed 80 char bugs, cleaned up commit message, added test example and CVE ]\nSigned-off-by: Kees Cook <keescook@chromium.org>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Andrew Morton <akpm@linux-foundation.org>\nCc: Al Viro <viro@zeniv.linux.org.uk>\nFixes: CVE-2015-1593\nLink: http://lkml.kernel.org/r/20150214173350.GA18393@www.outflux.net\nSigned-off-by: Borislav Petkov <bp@suse.de>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nMIPS: IRQ: Fix disable_irq on CPU IRQs\n\ncommit a3e6c1eff54878506b2dddcc202df9cc8180facb upstream.\n\nIf the irq_chip does not define .irq_disable, any call to disable_irq\nwill defer disabling the IRQ until it fires while marked as disabled.\nThis assumes that the handler function checks for this condition, which\nhandle_percpu_irq does not. In this case, calling disable_irq leads to\nan IRQ storm, if the interrupt fires while disabled.\n\nThis optimization is only useful when disabling the IRQ is slow, which\nis not true for the MIPS CPU IRQ.\n\nDisable this optimization by implementing .irq_disable and .irq_enable\n\nSigned-off-by: Felix Fietkau <nbd@openwrt.org>\nCc: linux-mips@linux-mips.org\nPatchwork: https://patchwork.linux-mips.org/patch/8949/\nSigned-off-by: Ralf Baechle <ralf@linux-mips.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nASoC: atmel_ssc_dai: fix start event for I2S mode\n\ncommit a43bd7e125143b875caae6d4f9938855b440faaf upstream.\n\nAccording to the I2S specification information as following:\n  - WS = 0, channel 1 (left)\n  - WS = 1, channel 2 (right)\nSo, the start event should be TF/RF falling edge.\n\nReported-by: Songjun Wu <songjun.wu@atmel.com>\nSigned-off-by: Bo Shen <voice.shen@atmel.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nALSA: ak411x: Fix stall in work callback\n\ncommit 4161b4505f1690358ac0a9ee59845a7887336b21 upstream.\n\nWhen ak4114 work calls its callback and the callback invokes\nak4114_reinit(), it stalls due to flush_delayed_work().  For avoiding\nthis, control the reentrance by introducing a refcount.  Also\nflush_delayed_work() is replaced with cancel_delayed_work_sync().\n\nThe exactly same bug is present in ak4113.c and fixed as well.\n\nReported-by: Pavel Hofman <pavel.hofman@ivitera.com>\nAcked-by: Jaroslav Kysela <perex@perex.cz>\nTested-by: Pavel Hofman <pavel.hofman@ivitera.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\n[lizf: Backported to 3.4: snd_ak4113_reinit() and snd_ak4114_reinit()\nused flush_delayed_work_sync() instead of flush_delayed_work()]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nlib/checksum.c: fix carry in csum_tcpudp_nofold\n\ncommit 150ae0e94634714b23919f0c333fee28a5b199d5 upstream.\n\nThe carry from the 64->32bits folding was dropped, e.g with:\nsaddr=0xFFFFFFFF daddr=0xFF0000FF len=0xFFFF proto=0 sum=1,\ncsum_tcpudp_nofold returned 0 instead of 1.\n\nSigned-off-by: Karl Beldan <karl.beldan@rivierawaves.com>\nCc: Al Viro <viro@ZenIV.linux.org.uk>\nCc: Eric Dumazet <eric.dumazet@gmail.com>\nCc: Arnd Bergmann <arnd@arndb.de>\nCc: Mike Frysinger <vapier@gentoo.org>\nCc: netdev@vger.kernel.org\nCc: linux-kernel@vger.kernel.org\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ncaif: remove wrong dev_net_set() call\n\ncommit 8997c27ec41127bf57421cc0205413d525421ddc upstream.\n\nsrc_net points to the netns where the netlink message has been received. This\nnetns may be different from the netns where the interface is created (because\nthe user may add IFLA_NET_NS_[PID|FD]). In this case, src_net is the link netns.\n\nIt seems wrong to override the netns in the newlink() handler because if it\nwas not already src_net, it means that the user explicitly asks to create the\nnetdevice in another netns.\n\nCC: Sjur Brændeland <sjur.brandeland@stericsson.com>\nCC: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>\nFixes: 8391c4aab1aa (\"caif: Bugfixes in CAIF netdevice for close and flow control\")\nFixes: c41254006377 (\"caif-hsi: Add rtnl support\")\nSigned-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n[lizf: Backported to 3.4: drop the change to drivers/net/caif/caif_hsi.c]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nMIPS: Fix kernel lockup or crash after CPU offline/online\n\ncommit c7754e75100ed5e3068ac5085747f2bfc386c8d6 upstream.\n\nAs printk() invocation can cause e.g. a TLB miss, printk() cannot be\ncalled before the exception handlers have been properly initialized.\nThis can happen e.g. when netconsole has been loaded as a kernel module\nand the TLB table has been cleared when a CPU was offline.\n\nCall cpu_report() in start_secondary() only after the exception handlers\nhave been initialized to fix this.\n\nWithout the patch the kernel will randomly either lockup or crash\nafter a CPU is onlined and the console driver is a module.\n\nSigned-off-by: Hemmo Nieminen <hemmo.nieminen@iki.fi>\nSigned-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>\nCc: David Daney <david.daney@cavium.com>\nCc: linux-mips@linux-mips.org\nCc: linux-kernel@vger.kernel.org\nPatchwork: https://patchwork.linux-mips.org/patch/8953/\nSigned-off-by: Ralf Baechle <ralf@linux-mips.org>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ngpio: sysfs: fix memory leak in gpiod_export_link\n\ncommit 0f303db08df0df9bd0966443ad6001e63960af16 upstream.\n\nFix memory leak in the gpio sysfs interface due to failure to drop\nreference to device returned by class_find_device when creating a link.\n\nFixes: a4177ee7f1a8 (\"gpiolib: allow exported GPIO nodes to be named\nusing sysfs links\")\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Linus Walleij <linus.walleij@linaro.org>\n[lizf: Backported to 3.4: adjust filename]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ngpio: sysfs: fix memory leak in gpiod_sysfs_set_active_low\n\ncommit 49d2ca84e433dab854c7a866bc6add09cfab682d upstream.\n\nFix memory leak in the gpio sysfs interface due to failure to drop\nreference to device returned by class_find_device when setting the\ngpio-line polarity.\n\nFixes: 0769746183ca (\"gpiolib: add support for changing value polarity\nin sysfs\")\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Linus Walleij <linus.walleij@linaro.org>\n[lizf: Backported to 3.4: adjust filename]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nnet: sctp: fix NULL pointer dereference in af->from_addr_param on malformed packet\n\ncommit e40607cbe270a9e8360907cb1e62ddf0736e4864 upstream.\n\nAn SCTP server doing ASCONF will panic on malformed INIT ping-of-death\nin the form of:\n\n  ------------ INIT[PARAM: SET_PRIMARY_IP] ------------>\n\nWhile the INIT chunk parameter verification dissects through many things\nin order to detect malformed input, it misses to actually check parameters\ninside of parameters. E.g. RFC5061, section 4.2.4 proposes a 'set primary\nIP address' parameter in ASCONF, which has as a subparameter an address\nparameter.\n\nSo an attacker may send a parameter type other than SCTP_PARAM_IPV4_ADDRESS\nor SCTP_PARAM_IPV6_ADDRESS, param_type2af() will subsequently return 0\nand thus sctp_get_af_specific() returns NULL, too, which we then happily\ndereference unconditionally through af->from_addr_param().\n\nThe trace for the log:\n\nBUG: unable to handle kernel NULL pointer dereference at 0000000000000078\nIP: [<ffffffffa01e9c62>] sctp_process_init+0x492/0x990 [sctp]\nPGD 0\nOops: 0000 [#1] SMP\n[...]\nPid: 0, comm: swapper Not tainted 2.6.32-504.el6.x86_64 #1 Bochs Bochs\nRIP: 0010:[<ffffffffa01e9c62>]  [<ffffffffa01e9c62>] sctp_process_init+0x492/0x990 [sctp]\n[...]\nCall Trace:\n <IRQ>\n [<ffffffffa01f2add>] ? sctp_bind_addr_copy+0x5d/0xe0 [sctp]\n [<ffffffffa01e1fcb>] sctp_sf_do_5_1B_init+0x21b/0x340 [sctp]\n [<ffffffffa01e3751>] sctp_do_sm+0x71/0x1210 [sctp]\n [<ffffffffa01e5c09>] ? sctp_endpoint_lookup_assoc+0xc9/0xf0 [sctp]\n [<ffffffffa01e61f6>] sctp_endpoint_bh_rcv+0x116/0x230 [sctp]\n [<ffffffffa01ee986>] sctp_inq_push+0x56/0x80 [sctp]\n [<ffffffffa01fcc42>] sctp_rcv+0x982/0xa10 [sctp]\n [<ffffffffa01d5123>] ? ipt_local_in_hook+0x23/0x28 [iptable_filter]\n [<ffffffff8148bdc9>] ? nf_iterate+0x69/0xb0\n [<ffffffff81496d10>] ? ip_local_deliver_finish+0x0/0x2d0\n [<ffffffff8148bf86>] ? nf_hook_slow+0x76/0x120\n [<ffffffff81496d10>] ? ip_local_deliver_finish+0x0/0x2d0\n[...]\n\nA minimal way to address this is to check for NULL as we do on all\nother such occasions where we know sctp_get_af_specific() could\npossibly return with NULL.\n\nFixes: d6de3097592b (\"[SCTP]: Add the handling of \"Set Primary IP Address\" parameter to INIT\")\nSigned-off-by: Daniel Borkmann <dborkman@redhat.com>\nCc: Vlad Yasevich <vyasevich@gmail.com>\nAcked-by: Neil Horman <nhorman@tuxdriver.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nnet: sctp: fix passing wrong parameter header to param_type2af in sctp_process_param\n\ncommit cfbf654efc6d78dc9812e030673b86f235bf677d upstream.\n\nWhen making use of RFC5061, section 4.2.4. for setting the primary IP\naddress, we're passing a wrong parameter header to param_type2af(),\nresulting always in NULL being returned.\n\nAt this point, param.p points to a sctp_addip_param struct, containing\na sctp_paramhdr (type = 0xc004, length = var), and crr_id as a correlation\nid. Followed by that, as also presented in RFC5061 section 4.2.4., comes\nthe actual sctp_addr_param, which also contains a sctp_paramhdr, but\nthis time with the correct type SCTP_PARAM_IPV{4,6}_ADDRESS that\nparam_type2af() can make use of. Since we already hold a pointer to\naddr_param from previous line, just reuse it for param_type2af().\n\nFixes: d6de3097592b (\"[SCTP]: Add the handling of \"Set Primary IP Address\" parameter to INIT\")\nSigned-off-by: Saran Maruti Ramanara <saran.neti@telus.com>\nSigned-off-by: Daniel Borkmann <dborkman@redhat.com>\nAcked-by: Vlad Yasevich <vyasevich@gmail.com>\nAcked-by: Neil Horman <nhorman@tuxdriver.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nASoC: sgtl5000: add delay before first I2C access\n\ncommit 58cc9c9a175885bbf6bae3acf18233d0a8229a84 upstream.\n\nTo quote from section 1.3.1 of the data sheet:\n\tThe SGTL5000 has an internal reset that is deasserted\n\t8 SYS_MCLK cycles after all power rails have been brought\n\tup. After this time, communication can start\n\n\t...\n\t1.0us represents 8 SYS_MCLK cycles at the minimum 8.0 MHz SYS_MCLK.\n\nSigned-off-by: Eric Nelson <eric.nelson@boundarydevices.com>\nReviewed-by: Fabio Estevam <fabio.estevam@freescale.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nnilfs2: fix deadlock of segment constructor over I_SYNC flag\n\ncommit 7ef3ff2fea8bf5e4a21cef47ad87710a3d0fdb52 upstream.\n\nNilfs2 eventually hangs in a stress test with fsstress program.  This\nissue was caused by the following deadlock over I_SYNC flag between\nnilfs_segctor_thread() and writeback_sb_inodes():\n\n  nilfs_segctor_thread()\n    nilfs_segctor_thread_construct()\n      nilfs_segctor_unlock()\n        nilfs_dispose_list()\n          iput()\n            iput_final()\n              evict()\n                inode_wait_for_writeback()  * wait for I_SYNC flag\n\n  writeback_sb_inodes()\n     * set I_SYNC flag on inode->i_state\n    __writeback_single_inode()\n      do_writepages()\n        nilfs_writepages()\n          nilfs_construct_dsync_segment()\n            nilfs_segctor_sync()\n               * wait for completion of segment constructor\n    inode_sync_complete()\n       * clear I_SYNC flag after __writeback_single_inode() completed\n\nwriteback_sb_inodes() calls do_writepages() for dirty inodes after\nsetting I_SYNC flag on inode->i_state.  do_writepages() in turn calls\nnilfs_writepages(), which can run segment constructor and wait for its\ncompletion.  On the other hand, segment constructor calls iput(), which\ncan call evict() and wait for the I_SYNC flag on\ninode_wait_for_writeback().\n\nSince segment constructor doesn't know when I_SYNC will be set, it\ncannot know whether iput() will block or not unless inode->i_nlink has a\nnon-zero count.  We can prevent evict() from being called in iput() by\nimplementing sop->drop_inode(), but it's not preferable to leave inodes\nwith i_nlink == 0 for long periods because it even defers file\ntruncation and inode deallocation.  So, this instead resolves the\ndeadlock by calling iput() asynchronously with a workqueue for inodes\nwith i_nlink == 0.\n\nSigned-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>\nCc: Al Viro <viro@zeniv.linux.org.uk>\nTested-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nDrivers: hv: vmbus: incorrect device name is printed when child device is unregistered\n\ncommit 84672369ffb98a51d4ddf74c20a23636da3ad615 upstream.\n\nWhenever a device is unregistered in vmbus_device_unregister (drivers/hv/vmbus_drv.c), the device name in the log message may contain garbage as the memory has already been freed by the time pr_info is called. Log example:\n [ 3149.170475] hv_vmbus: child device àõsèè0_5 unregistered\n\nBy logging the message just before calling device_unregister, the correct device name is printed:\n[ 3145.034652] hv_vmbus: child device vmbus_0_5 unregistered\n\nAlso changing register & unregister messages to debug to avoid unnecessarily cluttering the kernel log.\n\nSigned-off-by: Fernando M Soto <fsoto@bluecatnetworks.com>\nSigned-off-by: K. Y. Srinivasan <kys@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nCc: Joseph Salisbury <joseph.salisbury@canonical.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\npagemap: do not leak physical addresses to non-privileged userspace\n\ncommit ab676b7d6fbf4b294bf198fb27ade5b0e865c7ce upstream.\n\nAs pointed by recent post[1] on exploiting DRAM physical imperfection,\n/proc/PID/pagemap exposes sensitive information which can be used to do\nattacks.\n\nThis disallows anybody without CAP_SYS_ADMIN to read the pagemap.\n\n[1] http://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html\n\n[ Eventually we might want to do anything more finegrained, but for now\n  this is the simple model.   - Linus ]\n\nSigned-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>\nAcked-by: Konstantin Khlebnikov <khlebnikov@openvz.org>\nAcked-by: Andy Lutomirski <luto@amacapital.net>\nCc: Pavel Emelyanov <xemul@parallels.com>\nCc: Andrew Morton <akpm@linux-foundation.org>\nCc: Mark Seaborn <mseaborn@chromium.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n[mancha: Backported to 3.10]\nSigned-off-by: mancha security <mancha1@zoho.com>\n\njfs: fix readdir regression\n\nUpstream commit 44512449, \"jfs: fix readdir cookie incompatibility\nwith NFSv4\", was backported incorrectly into the stable trees which\nused the filldir callback (rather than dir_emit). The position is\nbeing incorrectly passed to filldir for the . and .. entries.\n\nThe still-maintained stable trees that need to be fixed are 3.2.y,\n3.4.y and 3.10.y.\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=94741\n\nSigned-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>\nCc: jfs-discussion@lists.sourceforge.net\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nipvs: rerouting to local clients is not needed anymore\n\ncommit 579eb62ac35845686a7c4286c0a820b4eb1f96aa upstream.\n\ncommit f5a41847acc5 (\"ipvs: move ip_route_me_harder for ICMP\")\nfrom 2.6.37 introduced ip_route_me_harder() call for responses to\nlocal clients, so that we can provide valid rt_src after SNAT.\nIt was used by TCP to provide valid daddr for ip_send_reply().\nAfter commit 0a5ebb8000c5 (\"ipv4: Pass explicit daddr arg to\nip_send_reply().\" from 3.0 this rerouting is not needed anymore\nand should be avoided, especially in LOCAL_IN.\n\nFixes 3.12.33 crash in xfrm reported by Florian Wiessner:\n\"3.12.33 - BUG xfrm_selector_match+0x25/0x2f6\"\n\nReported-by: Smart Weblications GmbH - Florian Wiessner <f.wiessner@smart-weblications.de>\nTested-by: Smart Weblications GmbH - Florian Wiessner <f.wiessner@smart-weblications.de>\nSigned-off-by: Julian Anastasov <ja@ssi.bg>\nSigned-off-by: Simon Horman <horms@verge.net.au>\n[Julian: Backported to 3.4]\nSigned-off-by: Julian Anastasov <ja@ssi.bg>\nAcked-by: Simon Horman <horms@verge.net.au>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nstaging: comedi: cb_pcidas64: fix incorrect AI range code handling\n\ncommit be8e89087ec2d2c8a1ad1e3db64bf4efdfc3c298 upstream.\n\nThe hardware range code values and list of valid ranges for the AI\nsubdevice is incorrect for several supported boards.  The hardware range\ncode values for all boards except PCI-DAS4020/12 is determined by\ncalling `ai_range_bits_6xxx()` based on the maximum voltage of the range\nand whether it is bipolar or unipolar, however it only returns the\ncorrect hardware range code for the PCI-DAS60xx boards.  For\nPCI-DAS6402/16 (and /12) it returns the wrong code for the unipolar\nranges.  For PCI-DAS64/Mx/16 it returns the wrong code for all the\nranges and the comedi range table is incorrect.\n\nChange `ai_range_bits_6xxx()` to use a look-up table pointed to by new\nmember `ai_range_codes` of `struct pcidas64_board` to map the comedi\nrange table indices to the hardware range codes.  Use a new comedi range\ntable for the PCI-DAS64/Mx/16 boards (and the commented out variants).\n\nSigned-off-by: Ian Abbott <abbotti@mev.co.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n[Ian: Backported to 3.4]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nsched/rt: Reduce rq lock contention by eliminating locking of non-feasible target\n\ncommit 80e3d87b2c5582db0ab5e39610ce3707d97ba409 upstream.\n\nThis patch adds checks that prevens futile attempts to move rt tasks\nto a CPU with active tasks of equal or higher priority.\n\nThis reduces run queue lock contention and improves the performance of\na well known OLTP benchmark by 0.7%.\n\nSigned-off-by: Tim Chen <tim.c.chen@linux.intel.com>\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nCc: Shawn Bohrer <sbohrer@rgmadvisors.com>\nCc: Suruchi Kadu <suruchi.a.kadu@intel.com>\nCc: Doug Nelson<doug.nelson@intel.com>\nCc: Steven Rostedt <rostedt@goodmis.org>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nLink: http://lkml.kernel.org/r/1421430374.2399.27.camel@schen9-desk2.jf.intel.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nnet:socket: set msg_namelen to 0 if msg_name is passed as NULL in msghdr struct from userland.\n\ncommit 6a2a2b3ae0759843b22c929881cc184b00cc63ff upstream.\n\nLinux manpage for recvmsg and sendmsg calls does not explicitly mention setting msg_namelen to 0 when\nmsg_name passed set as NULL. When developers don't set msg_namelen member in msghdr, it might contain garbage\nvalue which will fail the validation check and sendmsg and recvmsg calls from kernel will return EINVAL. This will\nbreak old binaries and any code for which there is no access to source code.\nTo fix this, we set msg_namelen to 0 when msg_name is passed as NULL from userland.\n\nSigned-off-by: Ani Sinha <ani@arista.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nCc: Michal Marek <mmarek@suse.cz>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nfsnotify: next_i is freed during fsnotify_unmount_inodes.\n\ncommit 6424babfd68dd8a83d9c60a5242d27038856599f upstream.\n\nDuring file system stress testing on 3.10 and 3.12 based kernels, the\numount command occasionally hung in fsnotify_unmount_inodes in the\nsection of code:\n\n                spin_lock(&inode->i_lock);\n                if (inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW)) {\n                        spin_unlock(&inode->i_lock);\n                        continue;\n                }\n\nAs this section of code holds the global inode_sb_list_lock, eventually\nthe system hangs trying to acquire the lock.\n\nMultiple crash dumps showed:\n\nThe inode->i_state == 0x60 and i_count == 0 and i_sb_list would point\nback at itself.  As this is not the value of list upon entry to the\nfunction, the kernel never exits the loop.\n\nTo help narrow down problem, the call to list_del_init in\ninode_sb_list_del was changed to list_del.  This poisons the pointers in\nthe i_sb_list and causes a kernel to panic if it transverse a freed\ninode.\n\nSubsequent stress testing paniced in fsnotify_unmount_inodes at the\nbottom of the list_for_each_entry_safe loop showing next_i had become\nfree.\n\nWe believe the root cause of the problem is that next_i is being freed\nduring the window of time that the list_for_each_entry_safe loop\ntemporarily releases inode_sb_list_lock to call fsnotify and\nfsnotify_inode_delete.\n\nThe code in fsnotify_unmount_inodes attempts to prevent the freeing of\ninode and next_i by calling __iget.  However, the code doesn't do the\n__iget call on next_i\n\n\tif i_count == 0 or\n\tif i_state & (I_FREEING | I_WILL_FREE)\n\nThe patch addresses this issue by advancing next_i in the above two cases\nuntil we either find a next_i which we can __iget or we reach the end of\nthe list.  This makes the handling of next_i more closely match the\nhandling of the variable \"inode.\"\n\nThe time to reproduce the hang is highly variable (from hours to days.) We\nran the stress test on a 3.10 kernel with the proposed patch for a week\nwithout failure.\n\nDuring list_for_each_entry_safe, next_i is becoming free causing\nthe loop to never terminate.  Advance next_i in those cases where\n__iget is not done.\n\nSigned-off-by: Jerry Hoemann <jerry.hoemann@hp.com>\nCc: Jeff Kirsher <jeffrey.t.kirsher@intel.com>\nCc: Ken Helias <kenhelias@firemail.de>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Jan Kara <jack@suse.cz>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nx86, cpu, amd: Add workaround for family 16h, erratum 793\n\ncommit 3b56496865f9f7d9bcb2f93b44c63f274f08e3b6 upstream.\n\nThis adds the workaround for erratum 793 as a precaution in case not\nevery BIOS implements it.  This addresses CVE-2013-6885.\n\nErratum text:\n\n[Revision Guide for AMD Family 16h Models 00h-0Fh Processors,\ndocument 51810 Rev. 3.04 November 2013]\n\n793 Specific Combination of Writes to Write Combined Memory Types and\nLocked Instructions May Cause Core Hang\n\nDescription\n\nUnder a highly specific and detailed set of internal timing\nconditions, a locked instruction may trigger a timing sequence whereby\nthe write to a write combined memory type is not flushed, causing the\nlocked instruction to stall indefinitely.\n\nPotential Effect on System\n\nProcessor core hang.\n\nSuggested Workaround\n\nBIOS should set MSR\nC001_1020[15] = 1b.\n\nFix Planned\n\nNo fix planned\n\n[ hpa: updated description, fixed typo in MSR name ]\n\nSigned-off-by: Borislav Petkov <bp@suse.de>\nLink: http://lkml.kernel.org/r/20140114230711.GS29865@pd.tnic\nTested-by: Aravind Gopalakrishnan <aravind.gopalakrishnan@amd.com>\nSigned-off-by: H. Peter Anvin <hpa@linux.intel.com>\n[bwh: Backported to 3.2:\n - Adjust filename\n - Venkatesh Srinivas pointed out we should use {rd,wr}msrl_safe() to\n   avoid crashing on KVM.  This was fixed upstream by commit 8f86a7373a1c\n   (\"x86, AMD: Convert to the new bit access MSR accessors\") but that's too\n   much trouble to backport.  Here we must use {rd,wr}msrl_amd_safe().]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nCc: Moritz Muehlenhoff <jmm@debian.org>\nCc: Venkatesh Srinivas <venkateshs@google.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\ns390/3215: fix tty output containing tabs\n\ncommit e512d56c799517f33b301d81e9a5e0ebf30c2d1e upstream.\n\ngit commit 37f81fa1f63ad38e16125526bb2769ae0ea8d332\n\"n_tty: do O_ONLCR translation as a single write\"\nsurfaced a bug in the 3215 device driver. In combination this\nbroke tab expansion for tty ouput.\n\nThe cause is an asymmetry in the behaviour of tty3215_ops->write\nvs tty3215_ops->put_char. The put_char function scans for '\\t'\nbut the write function does not.\n\nAs the driver has logic for the '\\t' expansion remove XTABS\nfrom c_oflag of the initial termios as well.\n\nReported-by: Stephen Powell <zlinuxman@wowway.com>\nSigned-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>\nCc: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nntp: Fixup adjtimex freq validation on 32-bit systems\n\ncommit 29183a70b0b828500816bd794b3fe192fce89f73 upstream.\n\nAdditional validation of adjtimex freq values to avoid\npotential multiplication overflows were added in commit\n5e5aeb4367b (time: adjtimex: Validate the ADJ_FREQUENCY values)\n\nUnfortunately the patch used LONG_MAX/MIN instead of\nLLONG_MAX/MIN, which was fine on 64-bit systems, but being\nmuch smaller on 32-bit systems caused false positives\nresulting in most direct frequency adjustments to fail w/\nEINVAL.\n\nntpd only does direct frequency adjustments at startup, so\nthe issue was not as easily observed there, but other time\nsync applications like ptpd and chrony were more effected by\nthe bug.\n\nSee bugs:\n\n  https://bugzilla.kernel.org/show_bug.cgi?id=92481\n  https://bugzilla.redhat.com/show_bug.cgi?id=1188074\n\nThis patch changes the checks to use LLONG_MAX for\nclarity, and additionally the checks are disabled\non 32-bit systems since LLONG_MAX/PPM_SCALE is always\nlarger then the 32-bit long freq value, so multiplication\noverflows aren't possible there.\n\nReported-by: Josh Boyer <jwboyer@fedoraproject.org>\nReported-by: George Joseph <george.joseph@fairview5.com>\nTested-by: George Joseph <george.joseph@fairview5.com>\nSigned-off-by: John Stultz <john.stultz@linaro.org>\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Sasha Levin <sasha.levin@oracle.com>\nLink: http://lkml.kernel.org/r/1423553436-29747-1-git-send-email-john.stultz@linaro.org\n[ Prettified the changelog and the comments a bit. ]\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nspi: dw: revisit FIFO size detection again\n\ncommit 9d239d353c319f9ff884c287ce47feb7cdf60ddc upstream.\n\nThe commit d297933cc7fc (spi: dw: Fix detecting FIFO depth) tries to fix the\nlogic of the FIFO detection based on the description on the comments. However,\nthere is a slight difference between numbers in TX Level and TX FIFO size.\n\nSo, by specification the FIFO size would be in a range 2-256 bytes. From TX\nLevel prospective it means we can set threshold in the range 0-(FIFO size - 1)\nbytes. Hence there are currently two issues:\n  a) FIFO size 2 bytes is actually skipped since TX Level is 1 bit and could be\n     either 0 or 1 byte;\n  b) FIFO size is incorrectly decreased by 1 which already done by meaning of\n     TX Level register.\n\nThis patch fixes it eventually right.\n\nFixes: d297933cc7fc (spi: dw: Fix detecting FIFO depth)\nReviewed-by: Axel Lin <axel.lin@ingics.com>\nSigned-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nnilfs2: fix deadlock of segment constructor during recovery\n\ncommit 283ee1482f349d6c0c09dfb725db5880afc56813 upstream.\n\nAccording to a report from Yuxuan Shui, nilfs2 in kernel 3.19 got stuck\nduring recovery at mount time.  The code path that caused the deadlock was\nas follows:\n\n  nilfs_fill_super()\n    load_nilfs()\n      nilfs_salvage_orphan_logs()\n        * Do roll-forwarding, attach segment constructor for recovery,\n          and kick it.\n\n        nilfs_segctor_thread()\n          nilfs_segctor_thread_construct()\n           * A lock is held with nilfs_transaction_lock()\n             nilfs_segctor_do_construct()\n               nilfs_segctor_drop_written_files()\n                 iput()\n                   iput_final()\n                     write_inode_now()\n                       writeback_single_inode()\n                         __writeback_single_inode()\n                           do_writepages()\n                             nilfs_writepage()\n                               nilfs_construct_dsync_segment()\n                                 nilfs_transaction_lock() --> deadlock\n\nThis can happen if commit 7ef3ff2fea8b (\"nilfs2: fix deadlock of segment\nconstructor over I_SYNC flag\") is applied and roll-forward recovery was\nperformed at mount time.  The roll-forward recovery can happen if datasync\nwrite is done and the file system crashes immediately after that.  For\ninstance, we can reproduce the issue with the following steps:\n\n < nilfs2 is mounted on /nilfs (device: /dev/sdb1) >\n # dd if=/dev/zero of=/nilfs/test bs=4k count=1 && sync\n # dd if=/dev/zero of=/nilfs/test conv=notrunc oflag=dsync bs=4k\n count=1 && reboot -nfh\n < the system will immediately reboot >\n # mount -t nilfs2 /dev/sdb1 /nilfs\n\nThe deadlock occurs because iput() can run segment constructor through\nwriteback_single_inode() if MS_ACTIVE flag is not set on sb->s_flags.  The\nabove commit changed segment constructor so that it calls iput()\nasynchronously for inodes with i_nlink == 0, but that change was\nimperfect.\n\nThis fixes the another deadlock by deferring iput() in segment constructor\neven for the case that mount is not finished, that is, for the case that\nMS_ACTIVE flag is not set.\n\nSigned-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>\nReported-by: Yuxuan Shui <yshuiv7@gmail.com>\nTested-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>\nCc: Al Viro <viro@zeniv.linux.org.uk>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nnet: compat: Update get_compat_msghdr() to match copy_msghdr_from_user() behaviour\n\ncommit 91edd096e224941131f896b86838b1e59553696a upstream.\n\nCommit db31c55a6fb2 (net: clamp ->msg_namelen instead of returning an\nerror) introduced the clamping of msg_namelen when the unsigned value\nwas larger than sizeof(struct sockaddr_storage). This caused a\nmsg_namelen of -1 to be valid. The native code was subsequently fixed by\ncommit dbb490b96584 (net: socket: error on a negative msg_namelen).\n\nIn addition, the native code sets msg_namelen to 0 when msg_name is\nNULL. This was done in commit (6a2a2b3ae075 net:socket: set msg_namelen\nto 0 if msg_name is passed as NULL in msghdr struct from userland) and\nsubsequently updated by 08adb7dabd48 (fold verify_iovec() into\ncopy_msghdr_from_user()).\n\nThis patch brings the get_compat_msghdr() in line with\ncopy_msghdr_from_user().\n\nFixes: db31c55a6fb2 (net: clamp ->msg_namelen instead of returning an error)\nCc: David S. Miller <davem@davemloft.net>\nCc: Dan Carpenter <dan.carpenter@oracle.com>\nSigned-off-by: Catalin Marinas <catalin.marinas@arm.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n[lizf: Backported to 3.4: s/uaddr/tmp1/]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nmm: fix anon_vma->degree underflow in anon_vma endless growing prevention\n\ncommit 3fe89b3e2a7bbf3e97657104b9b33a9d81b950b3 upstream.\n\nI have constantly stumbled upon \"kernel BUG at mm/rmap.c:399!\" after\nupgrading to 3.19 and had no luck with 4.0-rc1 neither.\n\nSo, after looking into new logic introduced by commit 7a3ef208e662 (\"mm:\nprevent endless growth of anon_vma hierarchy\"), I found chances are that\nunlink_anon_vmas() is called without incrementing dst->anon_vma->degree\nin anon_vma_clone() due to allocation failure.  If dst->anon_vma is not\nNULL in error path, its degree will be incorrectly decremented in\nunlink_anon_vmas() and eventually underflow when exiting as a result of\nanother call to unlink_anon_vmas().  That's how \"kernel BUG at\nmm/rmap.c:399!\" is triggered for me.\n\nThis patch fixes the underflow by dropping dst->anon_vma when allocation\nfails.  It's safe to do so regardless of original value of dst->anon_vma\nbecause dst->anon_vma doesn't have valid meaning if anon_vma_clone()\nfails.  Besides, callers don't care dst->anon_vma in such case neither.\n\nAlso suggested by Michal Hocko, we can clean up vma_adjust() a bit as\nanon_vma_clone() now does the work.\n\n[akpm@linux-foundation.org: tweak comment]\nFixes: 7a3ef208e662 (\"mm: prevent endless growth of anon_vma hierarchy\")\nSigned-off-by: Leon Yu <chianglungyu@gmail.com>\nSigned-off-by: Konstantin Khlebnikov <koct9i@gmail.com>\nReviewed-by: Michal Hocko <mhocko@suse.cz>\nAcked-by: Rik van Riel <riel@redhat.com>\nAcked-by: David Rientjes <rientjes@google.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nlib/checksum.c: fix build for generic csum_tcpudp_nofold\n\ncommit 9ce357795ef208faa0d59894d9d119a7434e37f3 upstream.\n\nFixed commit added from64to32 under _#ifndef do_csum_ but used it\nunder _#ifndef csum_tcpudp_nofold_, breaking some builds (Fengguang's\nrobot reported TILEGX's). Move from64to32 under the latter.\n\nFixes: 150ae0e94634 (\"lib/checksum.c: fix carry in csum_tcpudp_nofold\")\nReported-by: kbuild test robot <fengguang.wu@intel.com>\nSigned-off-by: Karl Beldan <karl.beldan@rivierawaves.com>\nCc: Eric Dumazet <edumazet@google.com>\nCc: David S. Miller <davem@davemloft.net>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nPCI: Handle read-only BARs on AMD CS553x devices\n\ncommit 06cf35f903aa6da0cc8d9f81e9bcd1f7e1b534bb upstream.\n\nSome AMD CS553x devices have read-only BARs because of a firmware or\nhardware defect.  There's a workaround in quirk_cs5536_vsa(), but it no\nlonger works after 36e8164882ca (\"PCI: Restore detection of read-only\nBARs\").  Prior to 36e8164882ca, we filled in res->start; afterwards we\nleave it zeroed out.  The quirk only updated the size, so the driver tried\nto use a region starting at zero, which didn't work.\n\nExpand quirk_cs5536_vsa() to read the base addresses from the BARs and\nhard-code the sizes.\n\nOn Nix's system BAR 2's read-only value is 0x6200.  Prior to 36e8164882ca,\nwe interpret that as a 512-byte BAR based on the lowest-order bit set.  Per\ndatasheet sec 5.6.1, that BAR (MFGPT) requires only 64 bytes; use that to\navoid clearing any address bits if a platform uses only 64-byte alignment.\n\n[bhelgaas: changelog, reduce BAR 2 size to 64]\nFixes: 36e8164882ca (\"PCI: Restore detection of read-only BARs\")\nLink: https://bugzilla.kernel.org/show_bug.cgi?id=85991#c4\nLink: http://support.amd.com/TechDocs/31506_cs5535_databook.pdf\nLink: http://support.amd.com/TechDocs/33238G_cs5536_db.pdf\nReported-and-tested-by: Nix <nix@esperi.org.uk>\nSigned-off-by: Myron Stowe <myron.stowe@redhat.com>\nSigned-off-by: Bjorn Helgaas <bhelgaas@google.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","distinct":true,"url":"https://api.github.com/repos/jgcaaprom/android_kernel_oneplus_msm8974/commits/a456902935fa4c91bac562281928db91ded18838"},{"sha":"44c36de33f79d322582de9a83e3c42d6bbd82a1d","author":{"email":"b71cb89e0280c07ae5269139c6fbbabd15b1b3dd@gmail.com","name":"katinatez"},"message":"Merge branch 'cm-12.1' of https://github.com/CyanogenMod/android_kernel_oneplus_msm8974 into HEAD","distinct":true,"url":"https://api.github.com/repos/jgcaaprom/android_kernel_oneplus_msm8974/commits/44c36de33f79d322582de9a83e3c42d6bbd82a1d"},{"sha":"966cecd3d79143fc953654cb398bdeb75481ad0d","author":{"email":"b71cb89e0280c07ae5269139c6fbbabd15b1b3dd@gmail.com","name":"katinatez"},"message":"Revert \"fs: f2fs: bring up to date with Jaegeuk's branch\"\n\nThis reverts commit 2fb4adfbcd7c8f94d8a7217168930212d204cc40.","distinct":true,"url":"https://api.github.com/repos/jgcaaprom/android_kernel_oneplus_msm8974/commits/966cecd3d79143fc953654cb398bdeb75481ad0d"},{"sha":"6607fbd579ac6ea0bc76ed0a6ef1c5c648bb7ba9","author":{"email":"602733bbf830274d69620a4044352b6860a52d50@gmail.com","name":"DerRomtester"},"message":"f2fs: support 3.4\n\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\nSigned-off-by: DerRomtester <dieb.stefan.96@gmail.com>","distinct":true,"url":"https://api.github.com/repos/jgcaaprom/android_kernel_oneplus_msm8974/commits/6607fbd579ac6ea0bc76ed0a6ef1c5c648bb7ba9"},{"sha":"99cf084e3ecc040c4848e9e7ac2cd2322891da96","author":{"email":"71255387a32c360dfbe6dfb7aaeb123bf1dc8cb6@kernel.org","name":"Jaegeuk Kim"},"message":"f2fs: merge upstream git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git\n\nf2fs: relocate Kconfig from misc filesystems\n\nThe f2fs has been shipped on many smartphone devices during a couple of years.\nSo, it is worth to relocate Kconfig into main page from misc filesystems for\ndevelopers to choose it more easily.\n\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: fix extent cache memory leak\n\nextent tree/node slab cache is created during f2fs insmod,\nhow, it isn't destroyed during f2fs rmmod, this patch fix\nit by destroy extent tree/node slab cache once rmmod f2fs.\n\nSigned-off-by: Wanpeng Li <wanpeng.li@linux.intel.com>\nReviewed-by: Chao Yu <chao2.yu@samsung.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: reduce searching region of segmap when set free section\n\nIn __set_free we will check whether all segment are free in one section\nwhen free one segment, in order to set section to free status. But the\nsearching region of segmap is from start segno to last segno of main\narea, it's not necessary. So let's just only check all segment bitmap\nof target section.\n\nSigned-off-by: Wanpeng Li <wanpeng.li@linux.intel.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: set the correct place of initializing *res_page\n\nThe function 'find_in_inline_dir()' contain 'res_page'\nas an argument. So, we should initiaize 'res_page' before\nthis function.\n\nSigned-off-by: Yuan Zhong <yuan.mark.zhong@samsung.com>\nReviewed-by: Chao Yu <chao2.yu@samsung.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: remove unnecessary condition judgment\n\nRemove the unnecessary condition judgment, because\n'max_slots' has been initialized to '0' at the beginging\nof the function, as following:\nif (max_slots)\n       *max_slots = 0;\n\nSigned-off-by: Yuan Zhong <yuan.mark.zhong@samsung.com>\nReviewed-by: Chao Yu <chao2.yu@samsung.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: cleanup statement about max orphan inodes calc\n\nThrough each macro, we can read the meaning easily.\n\nSigned-off-by: Changman Lee <cm224.lee@samsung.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: fix unlocked nat set cache operation\n\nnm_i->nat_tree_lock is used to sync both the operations of nat entry\ncache tree and nat set cache tree, however, it isn't held when flush\nnat entries during checkpoint which lead to potential race, this patch\nfix it by holding the lock when gang lookup nat set cache and delete\nitem from nat set cache.\n\nSigned-off-by: Wanpeng Li <wanpeng.li@linux.intel.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: fix to calculate max length of contiguous free slots correctly\n\nWhen lookuping for creating, we will try to record the level of current dentry\nhash table if current dentry has enough contiguous slots for storing name of new\nfile which will be created later, this can save our lookup time when add a link\ninto parent dir.\n\nBut currently in find_target_dentry, our current length of contiguous free slots\nis not calculated correctly. This make us leaving some holes in dentry block\noccasionally, it wastes our space of dentry block.\n\nLet's refactor the lookup flow for max slots as following to fix this issue:\na) increase max_len if current slot is free;\nb) update max_slots with max_len if max_len is larger than max_slots;\nc) reset max_len to zero if current slot is not free.\n\nSigned-off-by: Chao Yu <chao2.yu@samsung.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: fix reference leaks in f2fs_acl_create\n\nOur f2fs_acl_create is copied and modified from posix_acl_create to avoid\ndeadlock bug when inline_dentry feature is enabled.\n\nNow, we got reference leaks in posix_acl_create, and this has been fixed in\ncommit fed0b588be2f (\"posix_acl: fix reference leaks in posix_acl_create\")\nby Omar Sandoval.\nhttps://lkml.org/lkml/2015/2/9/5\n\nLet's fix this issue in f2fs_acl_create too.\n\nSigned-off-by: Chao Yu <chao2.yu@samsung.com>\nReviewed-by: Changman Lee <cm224.lee@ssamsung.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nConflicts:\n\tfs/f2fs/acl.c\n\nf2fs: fix to truncate inline data past EOF\n\nPreviously if inode is with inline data, we will try to invalid partial inline\ndata in page #0 when we truncate size of inode in truncate_partial_data_page().\nAnd then we set page #0 to dirty, after this we can synchronize inode page with\npage #0 at ->writepage().\n\nBut sometimes we will fail to operate page #0 in truncate_partial_data_page()\ndue to below reason:\na) if offset is zero, we will skip setting page #0 to dirty.\nb) if page #0 is not uptodate, we will fail to update it as it has no mapping\ndata.\n\nSo with following operations, we will meet recent data which should be\ntruncated.\n\n1.write inline data to file\n2.sync first data page to inode page\n3.truncate file size to 0\n4.truncate file size to max_inline_size\n5.echo 1 > /proc/sys/vm/drop_caches\n6.read file --> meet original inline data which is remained in inode page.\n\nThis patch renames truncate_inline_data() to truncate_inline_inode() for code\nreadability, then use truncate_inline_inode() to truncate inline data in inode\npage in truncate_blocks() and truncate page #0 in truncate_partial_data_page()\nfor fixing.\n\nv2:\n o truncate partially #0 page in truncate_partial_data_page to avoid keeping\n   old data in #0 page.\n\nSigned-off-by: Chao Yu <chao2.yu@samsung.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: fix to check current blkaddr in __allocate_data_blocks\n\nIn __allocate_data_blocks, we should check current blkaddr which is located at\nofs_in_node of dnode page instead of checking first blkaddr all the time.\nOtherwise we can only allocate one blkaddr in each dnode page. Fix it.\n\nSigned-off-by: Chao Yu <chao2.yu@samsung.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: fix to cover sentry_lock for block allocation\n\nIn the following call stack, f2fs changes the bitmap for dirty segments and # of\ndirty sentries without grabbing sit_i->sentry_lock.\nThis can result in mismatch on bitmap and # of dirty sentries, since if there\nare some direct_io operations.\n\nIn allocate_data_block,\n - __allocate_new_segments\n  - mutex_lock(&curseg->curseg_mutex);\n  - s_ops->allocate_segment\n   - new_curseg/change_curseg\n    - reset_curseg\n     - __set_sit_entry_type\n      - __mark_sit_entry_dirty\n       - set_bit(dirty_sentries_bitmap)\n       - dirty_sentries++;\n\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: set SBI_NEED_FSCK when encountering exception in recovery\n\nThis patch tries to set SBI_NEED_FSCK flag into sbi only when we fail to recover\nin fill_super, so we could skip fscking image when we fail to fill super for\nother reason.\n\nSigned-off-by: Chao Yu <chao2.yu@samsung.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: set buffer_new when new blocks are allocated\n\nThis patch modifies to call set_buffer_new, if new blocks are allocated.\n\nReviewed-by: Chao Yu <chao2.yu@samsung.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: enhance multi-threads performance\n\nPreviously, f2fs_write_data_pages has a mutex, sbi->writepages, to serialize\ndata writes to maximize write bandwidth, while sacrificing multi-threads\nperformance.\nPractically, however, multi-threads environment is much more important for\nusers. So this patch tries to remove the mutex.\n\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: avoid wrong f2fs_bug_on when truncating inline_data\n\nThis patch removes wrong f2fs_bug_on in truncate_inline_inode.\n\nWhen there is no space, it can happen a corner case where i_isze is over\nMAX_INLINE_SIZE while its inode is still inline_data.\n\nThe scenario is\n 1. write small data into file #A.\n 2. fill the whole partition to 100%.\n 3. truncate 4096 on file #A.\n 4. write data at 8192 offset.\n  --> f2fs_write_begin\n    -> -ENOSPC = f2fs_convert_inline_page\n    -> f2fs_write_failed\n      -> truncate_blocks\n        -> truncate_inline_inode\n\t  BUG_ON, since i_size is 4096.\n\nReviewed-by: Chao Yu <chao2.yu@samsung.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: avoid punch_hole overhead when releasing volatile data\n\nThis patch is to avoid some punch_hole overhead when releasing volatile data.\nIf volatile data was not written yet, we just can make the first page as zero.\n\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: add some tracepoints to debug volatile and atomic writes\n\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: enable fast symlink by utilizing inline data\n\nFast symlink can utilize inline data flow to avoid using any\ni_addr region, since we need to handle many cases such as\ntruncation, roll-forward recovery, and fsck/dump tools.\n\nSigned-off-by: Wanpeng Li <wanpeng.li@linux.intel.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: split set_data_blkaddr from f2fs_update_extent_cache\n\nSplit __set_data_blkaddr from f2fs_update_extent_cache for readability.\n\nAdditionally rename __set_data_blkaddr to set_data_blkaddr for exporting.\n\nSigned-off-by: Chao Yu <chao2.yu@samsung.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: introduce __{find,grab}_extent_tree\n\nThis patch introduces __{find,grab}_extent_tree for reusing by following\npatches.\n\nSigned-off-by: Chao Yu <chao2.yu@samsung.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: initialize extent tree with on-disk extent info of inode\n\nWith normal extent info cache, we records largest extent mapping between logical\nblock and physical block into extent info, and we persist extent info in on-disk\ninode.\n\nWhen we enable extent tree cache, if extent info of on-disk inode is exist, and\nthe extent is not a small fragmented mapping extent. We'd better to load the\nextent info into extent tree cache when inode is loaded. By this way we can have\nmore chance to hit extent tree cache rather than taking more time to read dnode\npage for block address.\n\nSigned-off-by: Chao Yu <chao2.yu@samsung.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: preserve extent info for extent cache\n\nThis patch tries to preserve last extent info in extent tree cache into on-disk\ninode, so this can help us to reuse the last extent info next time for\nperformance.\n\nSigned-off-by: Chao Yu <chao2.yu@samsung.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: enable inline data by default\n\nEnable inline_data feature by default since it brings us better\nperformance and space utilization and now has already stable.\nAdd another option noinline_data to disable it during mount.\n\nSuggested-by: Jaegeuk Kim <jaegeuk@kernel.org>\nSuggested-by: Chao Yu <chao2.yu@samsung.com>\nSigned-off-by: Wanpeng Li <wanpeng.li@linux.intel.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: preallocate fallocated blocks for direct IO\n\nNormally, due to DIO_SKIP_HOLES flag is set by default, blockdev_direct_IO in\nf2fs_direct_IO tries to skip DIO in holes when writing inside i_size, this\nmakes us falling back to buffered IO which shows lower performance.\n\nSo in commit 59b802e5a453 (\"f2fs: allocate data blocks in advance for\nf2fs_direct_IO\"), we improve perfromance by allocating data blocks in advance\nif we meet holes no matter in i_size or not, since with it we can avoid falling\nback to buffered IO.\n\nBut we forget to consider for unwritten fallocated block in this commit.\nThis patch tries to fix it for fallocate case, this helps to improve\nperformance.\n\nTest result:\nStorage info: sandisk ultra 64G micro sd card.\n\ntouch /mnt/f2fs/file\ntruncate -s 67108864 /mnt/f2fs/file\nfallocate -o 0 -l 67108864 /mnt/f2fs/file\ntime dd if=/dev/zero of=/mnt/f2fs/file bs=1M count=64 conv=notrunc oflag=direct\n\nTime before applying the patch:\n67108864 bytes (67 MB) copied, 36.16 s, 1.9 MB/s\nreal    0m36.162s\nuser    0m0.000s\nsys     0m0.180s\n\nTime after applying the patch:\n67108864 bytes (67 MB) copied, 27.7776 s, 2.4 MB/s\nreal    0m27.780s\nuser    0m0.000s\nsys     0m0.036s\n\nSigned-off-by: Chao Yu <chao2.yu@samsung.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: avoid NULL pointer dereference in f2fs_xattr_advise_get\n\nWe will encounter oops by executing below command.\ngetfattr -n system.advise /mnt/f2fs/file\nKilled\n\nmessage log:\nBUG: unable to handle kernel NULL pointer dereference at   (null)\nIP: [<f8b54d69>] f2fs_xattr_advise_get+0x29/0x40 [f2fs]\n*pdpt = 00000000319b7001 *pde = 0000000000000000\nOops: 0002 [#1] SMP\nModules linked in: f2fs(O) snd_intel8x0 snd_ac97_codec ac97_bus snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi snd_seq joydev\nsnd_seq_device snd_timer bnep snd rfcomm microcode bluetooth soundcore i2c_piix4 mac_hid serio_raw parport_pc ppdev lp parport\nbinfmt_misc hid_generic psmouse usbhid hid e1000 [last unloaded: f2fs]\nCPU: 3 PID: 3134 Comm: getfattr Tainted: G           O    4.0.0-rc1 #6\nHardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006\ntask: f3a71b60 ti: f19a6000 task.ti: f19a6000\nEIP: 0060:[<f8b54d69>] EFLAGS: 00010246 CPU: 3\nEIP is at f2fs_xattr_advise_get+0x29/0x40 [f2fs]\nEAX: 00000000 EBX: f19a7e71 ECX: 00000000 EDX: f8b5b467\nESI: 00000000 EDI: f2008570 EBP: f19a7e14 ESP: f19a7e08\n DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068\nCR0: 80050033 CR2: 00000000 CR3: 319b8000 CR4: 000007f0\nStack:\n f8b5a634 c0cbb580 00000000 f19a7e34 c1193850 00000000 00000007 f19a7e71\n f19a7e64 c0cbb580 c1193810 f19a7e50 c1193c00 00000000 00000000 00000000\n c0cbb580 00000000 f19a7f70 c1194097 00000000 00000000 00000000 74737973\nCall Trace:\n [<c1193850>] generic_getxattr+0x40/0x50\n [<c1193810>] ? xattr_resolve_name+0x80/0x80\n [<c1193c00>] vfs_getxattr+0x70/0xa0\n [<c1194097>] getxattr+0x87/0x190\n [<c11801d7>] ? path_lookupat+0x57/0x5f0\n [<c11819d2>] ? putname+0x32/0x50\n [<c116653a>] ? kmem_cache_alloc+0x2a/0x130\n [<c11819d2>] ? putname+0x32/0x50\n [<c11819d2>] ? putname+0x32/0x50\n [<c11819d2>] ? putname+0x32/0x50\n [<c11827f9>] ? user_path_at_empty+0x49/0x70\n [<c118283f>] ? user_path_at+0x1f/0x30\n [<c11941e7>] path_getxattr+0x47/0x80\n [<c11948e7>] SyS_getxattr+0x27/0x30\n [<c163f748>] sysenter_do_call+0x12/0x12\nCode: 66 90 55 89 e5 57 56 53 66 66 66 66 90 8b 78 20 89 d3 ba 67 b4 b5 f8 89 d8 89 ce e8 42 7c 7b c8 85 c0 75 16 0f b6 87 44 01 00\n00 <88> 06 b8 01 00 00 00 5b 5e 5f 5d c3 8d 76 00 b8 ea ff ff ff eb\nEIP: [<f8b54d69>] f2fs_xattr_advise_get+0x29/0x40 [f2fs] SS:ESP 0068:f19a7e08\nCR2: 0000000000000000\n---[ end trace 860260654f1f416a ]---\n\nThe reason is that in getfattr there are two steps which is indicated by strace info:\n1) try to lookup and get size of specified xattr.\n2) get value of the extented attribute.\n\nstrace info:\ngetxattr(\"/mnt/f2fs/file\", \"system.advise\", 0x0, 0) = 1\ngetxattr(\"/mnt/f2fs/file\", \"system.advise\", \"\\x00\", 256) = 1\n\nFor the first step, getfattr may pass a NULL pointer in @value and zero in @size\nas parameters for ->getxattr, but we access this @value pointer directly without\nchecking whether the pointer is valid or not in f2fs_xattr_advise_get, so the\noops occurs.\n\nThis patch fixes this issue by verifying @value pointer before using.\n\nSigned-off-by: Chao Yu <chao2.yu@samsung.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: persist system.advise into on-disk inode\n\nThis patch fixes to dirty inode for persisting i_advise of f2fs inode info into\non-disk inode if user sets system.advise through setxattr. Otherwise the new\nvalue will be lost.\n\nSigned-off-by: Chao Yu <chao2.yu@samsung.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: limit b_size of mapped bh in f2fs_map_bh\n\nMap bh over max size which caller defined is not needed, limit it in\nf2fs_map_bh.\n\nSigned-off-by: Chao Yu <chao2.yu@samsung.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: fix sparse warnings\n\nThis patch fixes the below warning.\n\nsparse warnings: (new ones prefixed by >>)\n\n>> fs/f2fs/inode.c:56:23: sparse: restricted __le32 degrades to integer\n>> fs/f2fs/inode.c:56:52: sparse: restricted __le32 degrades to integer\n\nReported-by: kbuild test robot <fengguang.wu@intel.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: fix mismatching lock and unlock pages for roll-forward recovery\n\nPreviously, inode page is not correctly locked and unlocked in pair during\nthe roll-forward recovery.\n\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: add F2FS_INLINE_DOTS to recover missing dot dentries\n\nIf f2fs was corrupted with missing dot dentries, it needs to recover them after\nfsck.f2fs detection.\n\nThe underlying precedure is:\n\n1. The fsck.f2fs remains F2FS_INLINE_DOTS flag in directory inode, if it detects\nmissing dot dentries.\n\n2. When f2fs looks up the corrupted directory, it triggers f2fs_add_link with\nproper inode numbers and their dot and dotdot names.\n\n3. Once f2fs recovers the directory without errors, it removes F2FS_INLINE_DOTS\nfinally.\n\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: assign parent's i_mode for empty dir\n\nWhen assigning i_mode for dotdot, it needs to assign parent's i_mode.\n\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: do not increase link count during recovery\n\nIf there are multiple fsynced dnodes having a dent flag, roll-forward routine\nsets FI_INC_LINK for their inode, and recovery_dentry increases its link count\naccordingly.\nThat results in normal file having a link count as 2, so we can't unlink those\nfiles.\n\nThis was added to handle several inode blocks having same inode number with\ndifferent directory paths.\nBut, current f2fs doesn't replay all of path changes and only recover its dentry\nfor the last fsynced inode block.\nSo, there is no reason to do this.\n\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: do not recover wrong data index\n\nDuring the roll-forward recovery, if we found a new data index written fsync\nlastly, we need to recover new block address.\nBut, if that address was corrupted, we should not recover that.\nOtherwise, f2fs gets kernel panic from:\n\n In check_index_in_prev_nodes(),\n\n    sentry = get_seg_entry(sbi, segno);\n             --------------------------> out-of-range segno.\n\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: change 0 to false for bool type\n\nin the f2fs_fill_super function, variable \"retry\" is bool type\ni think that it should be set as false.\n\nSigned-off-by: Taehee Yoo <ap420073@gmail.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: flush symlink path to avoid broken symlink after POR\n\nThis patch tries to avoid broken symlink case after POR in best effort.\nThis results in performance regression.\nBut, if f2fs has inline_data and the target path is under 3KB-sized long,\nthe page would be stored in its inode_block, so that there would be no\nperformance regression.\n\nNote that, if user wants to keep this file atomically, it needs to trigger\ndir->fsync.\nAnd, there is still a hole to produce broken symlink.\n\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: avoid abnormal behavior on broken symlink\n\nWhen f2fs_symlink was triggered and checkpoint was done before syncing its\nlink path, f2fs can get broken symlink like \"xxx -> \\0\\0\\0\".\nThis incurs abnormal path_walk by VFS.\n\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: pass checkpoint reason on roll-forward recovery\n\nThis patch adds CP_RECOVERY to remain recovery information for checkpoint.\nAnd, it makes sure writing checkpoint in this case.\n\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: support 3.4\n\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>","distinct":true,"url":"https://api.github.com/repos/jgcaaprom/android_kernel_oneplus_msm8974/commits/99cf084e3ecc040c4848e9e7ac2cd2322891da96"},{"sha":"f893c50adb086ecd22c952d94abeed2b1a6e811d","author":{"email":"9ce5770b3bb4b2a1d59be2d97e34379cd192299f@cyngn.com","name":"Steve Kondik"},"message":"synaptics: Update firmware to 14001227\n\nChange-Id: I53c1ae259f7a33809e0811f3c0e92d14f7535f78","distinct":false,"url":"https://api.github.com/repos/jgcaaprom/android_kernel_oneplus_msm8974/commits/f893c50adb086ecd22c952d94abeed2b1a6e811d"},{"sha":"fbacce3c0753e268787fc2d31b3d4532fc27a2e3","author":{"email":"bc6501c174fe21162c67cfc51ecb38b9a4d035f0@gmail.com","name":"Ethan Chen"},"message":"ARM: dts: A0001: Update Truly panel commands\n\nChange-Id: I3b9b109045a58c5de3e928ce8e7969e129ec9fd5","distinct":false,"url":"https://api.github.com/repos/jgcaaprom/android_kernel_oneplus_msm8974/commits/fbacce3c0753e268787fc2d31b3d4532fc27a2e3"},{"sha":"3fef468e56869eaf4457565c52093f4832eb8f3f","author":{"email":"9defb1d2166fe02be9724618510318ef57e74e91@gmail.com","name":"Michael Bestas"},"message":"msm8974-oppo: Update gpiomux config from oppo 4.4 source\n\nChange-Id: Ifd82909cc36653a626e574cd3f9f18d8a441821a","distinct":false,"url":"https://api.github.com/repos/jgcaaprom/android_kernel_oneplus_msm8974/commits/3fef468e56869eaf4457565c52093f4832eb8f3f"},{"sha":"1378e0710ec715fa406b74837d57b00315981437","author":{"email":"9defb1d2166fe02be9724618510318ef57e74e91@gmail.com","name":"Michael Bestas"},"message":"clock-8974: Update from oppo 4.4 source\n\nChange-Id: Ia5e8b41232bac0cf1547fde2be327d7e367a09ca","distinct":false,"url":"https://api.github.com/repos/jgcaaprom/android_kernel_oneplus_msm8974/commits/1378e0710ec715fa406b74837d57b00315981437"},{"sha":"d0415a478b524a66c4b2522c82d7044ec97656ce","author":{"email":"9defb1d2166fe02be9724618510318ef57e74e91@gmail.com","name":"Michael Bestas"},"message":"nfc: Remove p61 nfc driver\n\nChange-Id: I81a95374e6e7191446e45fbec4cc150f54b56d2f","distinct":false,"url":"https://api.github.com/repos/jgcaaprom/android_kernel_oneplus_msm8974/commits/d0415a478b524a66c4b2522c82d7044ec97656ce"},{"sha":"84de2708ef32b3f3cbe68699d7eaf3f31ffa6e19","author":{"email":"c71e9458af45a4becf0b01c74bfa17dea6eeaed7@codeaurora.org","name":"Alok Kediya"},"message":"msm: camera: isp: Validate input parameter for vfe_write and vfe_read\n\nValidate input parameters for read and write operations in vfe to\nensure operations are performed within vfe register boundary and\nwithin structure limits passed by caller.\n\nChange-Id: If3719de65b32773c2b6ff904da76a951dbfb11eb\nSigned-off-by: Alok Kediya <kediya@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/jgcaaprom/android_kernel_oneplus_msm8974/commits/84de2708ef32b3f3cbe68699d7eaf3f31ffa6e19"},{"sha":"8fba87622b70d9edb67efe089ed91e8831847bb6","author":{"email":"a6aa4b4fcb52deb1d756e7b1cea5d95872888fd9@codeaurora.org","name":"Aravind Kumar"},"message":"ASoC: wcd9xxx: Add check for buffer overflow\n\nCurrent code does not check if the indexes of array\ncodec_dai being accessed is within the maximum\nnumber of codec dais for a particular codec. The change\nadds this check and ensures that indexes outside the\nbounds of array are not accessed.\n\nCRs-Fixed: 628865\nChange-Id: Ibf81f91b35e43feddc6b03a1239b4d12e04a95da\nSigned-off-by: Aravind Kumar <akumark@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/jgcaaprom/android_kernel_oneplus_msm8974/commits/8fba87622b70d9edb67efe089ed91e8831847bb6"},{"sha":"eb9daa190f295da0ba79c7ffa96dc35c0d67a6b3","author":{"email":"fd4ced81890aa2d1f9e39e2a0e1ab4d14c3d9652@codeaurora.org","name":"Katish Paran"},"message":"diag: dci: Send mode reset command to the apps processor\n\nDiag driver was sending all mode commands to the apps processor while\nonly mode reset command was handled on the apps processor. This patch\nmakes an exception for mode reset command.\n\nChange-Id: I51e4971cbffcc8fedd68090cb5a15c4c67363c57\nSigned-off-by: Katish Paran <kparan@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/jgcaaprom/android_kernel_oneplus_msm8974/commits/eb9daa190f295da0ba79c7ffa96dc35c0d67a6b3"},{"sha":"46d5b04b8edc4ecdcf0d2d9b23e11f5ea174226d","author":{"email":"fd4ced81890aa2d1f9e39e2a0e1ab4d14c3d9652@codeaurora.org","name":"Katish Paran"},"message":"diag: dci: Mutex protect the list while traversal and node deletion\n\nOn receiving the response from peripherals for the sent command\nDCI traverses and deletes from the list. The list is not lock\nprotected while traversal or deletion. This patch resolves the\nsame.\n\nChange-Id: Ie93f3e035b35c4d39f1e19f9c42a48f4147fe145\nCRs-Fixed: 715663\nSigned-off-by: Katish Paran <kparan@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/jgcaaprom/android_kernel_oneplus_msm8974/commits/46d5b04b8edc4ecdcf0d2d9b23e11f5ea174226d"},{"sha":"97d3a2953abe62e1179981e095a284cb68e0b97d","author":{"email":"aa3210a89d655a9fa3f729366f4d5a1b8908c2e8@codeaurora.org","name":"Ravi Aravamudhan"},"message":"diag: Prevent suspend in Memory Device mode\n\nApps processor can goto suspend when receiving data from peripherals.\nThis can result in data being drop from Diag driver to the user\nspace clients in Memory Device mode. Make changes to acquire\nwakeup source object till the data is copied to user space.\n\nChange-Id: I7479c89707199557420bac18e1744a829477164c\nCRs-Fixed: 624445\nSigned-off-by: Ravi Aravamudhan <aravamud@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/jgcaaprom/android_kernel_oneplus_msm8974/commits/97d3a2953abe62e1179981e095a284cb68e0b97d"},{"sha":"e9bd121ef2ca9e65472227680986393d6b327b7c","author":{"email":"aa3210a89d655a9fa3f729366f4d5a1b8908c2e8@codeaurora.org","name":"Ravi Aravamudhan"},"message":"diag: Release wakeup sources properly\n\nThere is a possibility that diag driver doesn't release wakeup\nsource objects in some cases. This patch ensures that the\nwakeup source objects are released properly.\n\nChange-Id: Idd217cd6fc0b6a05d82e1b930ce26d651e33d8c2\nSigned-off-by: Ravi Aravamudhan <aravamud@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/jgcaaprom/android_kernel_oneplus_msm8974/commits/e9bd121ef2ca9e65472227680986393d6b327b7c"},{"sha":"d6347d3aafcc1daffa2972d460b053c04de66920","author":{"email":"aa3210a89d655a9fa3f729366f4d5a1b8908c2e8@codeaurora.org","name":"Ravi Aravamudhan"},"message":"diag: Update SSIDs, event ids and log codes\n\nThe SSIDs, event IDs and log codes have fallen out of date.\nBring the SSIDs, event IDs and log codes up to date.\n\nChange-Id: I8e6a2af8baba359f32a489ddc06f619de826f97b\nSigned-off-by: Ravi Aravamudhan <aravamud@codeaurora.org>\nSigned-off-by: c_prados <prados@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/jgcaaprom/android_kernel_oneplus_msm8974/commits/d6347d3aafcc1daffa2972d460b053c04de66920"},{"sha":"0032d6ca58ba901895c8dce170a3ae791fabeb37","author":{"email":"e90b702c9735d7d8a45d232c2bb099d9e00f5267@codeaurora.org","name":"Archana Sathyakumar"},"message":"rpm_log: Fix file_read error\n\nIssue:\ncat /d/rpm_log\nsh: cat: /d/rpm_log: Try again\n\nThe change was incorrect pushed without braces around if statement.\nReturn -EAGAIN only if the file permission is O_NON_BLOCK or there\nis nothing in the log buf.\n\nChange-Id: Id7a549c223aad86185da928b2592c8de02e87623\nSigned-off-by: Archana Sathyakumar <asathyak@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/jgcaaprom/android_kernel_oneplus_msm8974/commits/0032d6ca58ba901895c8dce170a3ae791fabeb37"},{"sha":"738c3ccd8ce4b8edb4cb86e6042b64ec8c032468","author":{"email":"818337a29cd9de0a36216deae1fd60ff7b0ab832@codeaurora.org","name":"Jeff Hugo"},"message":"msm: smp2p: Use correct macro structure\n\nSingle statement macros should not be wrapped in do-while blocks.\n\nRemove a do-while block from a single statement macro.\n\nChange-Id: Id74b129aaf3754527d9566ce75daad2ca8c7d3cd\nSigned-off-by: Jeffrey Hugo <jhugo@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/jgcaaprom/android_kernel_oneplus_msm8974/commits/738c3ccd8ce4b8edb4cb86e6042b64ec8c032468"}]}