{"push_id":781960295,"size":1,"distinct_size":1,"ref":"refs/heads/Rebase","head":"299ab895cda60d911c3b4578e105d40e5e221687","before":"3b7cf0d33980771abbaae6c3e8ace554c837fe7b","commits":[{"sha":"299ab895cda60d911c3b4578e105d40e5e221687","author":{"email":"f9fffc6cf9caff1f011c6952dbe35113c227f490@gmail.com","name":"Beeko"},"message":"Linux 3.0.45 to 3.0.46\n\nmn10300: only add -mmem-funcs to KBUILD_CFLAGS if gcc supports it\n\ncommit 9957423f035c2071f6d1c5d2f095cdafbeb25ad7 upstream.\n\nIt seems the current (gcc 4.6.3) no longer provides this so make it\nconditional.\n\nAs reported by Tony before, the mn10300 architecture cross-compiles with\ngcc-4.6.3 if -mmem-funcs is not added to KBUILD_CFLAGS.\n\nReported-by: Tony Breeds <tony@bakeyournoodle.com>\nSigned-off-by: Geert Uytterhoeven <geert@linux-m68k.org>\nCc: David Howells <dhowells@redhat.com>\nCc: Koichi Yasutake <yasutake.koichi@jp.panasonic.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nkbuild: make: fix if_changed when command contains backslashes\n\ncommit c353acba28fb3fa1fd05fd6b85a9fc7938330f9c upstream.\n\nThe call if_changed mechanism does not work when the command contains\nbackslashes.  This basically is an issue with lzo and bzip2 compressed\nkernels.  The compressed binaries do not contain the uncompressed image\nsize, so these use size_append to append the size.  This results in\nbackslashes in the executed command.  With this if_changed always\ndetects a change in the command and rebuilds the compressed image even\nif nothing has changed.\n\nFix this by escaping backslashes in make-cmd\n\nSigned-off-by: Sascha Hauer <s.hauer@pengutronix.de>\nSigned-off-by: Jan Luebbe <jlu@pengutronix.de>\nCc: Sam Ravnborg <sam@ravnborg.org>\nCc: Bernhard Walle <bernhard@bwalle.de>\nCc: Michal Marek <mmarek@suse.cz>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nmedia: rc: ite-cir: Initialise ite_dev::rdev earlier\n\ncommit 4b961180ef275035b1538317ffd0e21e80e63e77 upstream.\n\nite_dev::rdev is currently initialised in ite_probe() after\nrc_register_device() returns.  If a newly registered device is opened\nquickly enough, we may enable interrupts and try to use ite_dev::rdev\nbefore it has been initialised.  Move it up to the earliest point we\ncan, right after calling rc_allocate_device().\n\nReported-and-tested-by: YunQiang Su <wzssyqa@gmail.com>\n\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nACPI: run _OSC after ACPI_FULL_INITIALIZATION\n\ncommit fc54ab72959edbf229b65ac74b2f122d799ca002 upstream.\n\nThe _OSC method may exist in module level code,\nso it must be called after ACPI_FULL_INITIALIZATION\n\nOn some new platforms with Zero-Power-Optical-Disk-Drive (ZPODD)\nsupport, this fix is necessary to save power.\n\nSigned-off-by: Lin Ming <ming.m.lin@intel.com>\nTested-by: Aaron Lu <aaron.lu@intel.com>\nSigned-off-by: Len Brown <len.brown@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nPCI: acpiphp: check whether _ADR evaluation succeeded\n\ncommit dfb117b3e50c52c7b3416db4a4569224b8db80bb upstream.\n\nCheck whether we evaluated _ADR successfully.  Previously we ignored\nfailure, so we would have used garbage data from the stack as the device\nand function number.\n\nWe return AE_OK so that we ignore only this slot and continue looking\nfor other slots.\n\nFound by Coverity (CID 113981).\n\nSigned-off-by: Bjorn Helgaas <bhelgaas@google.com>\n[bwh: Backported to 2.6.32/3.0: adjust context]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nlib/gcd.c: prevent possible div by 0\n\ncommit e96875677fb2b7cb739c5d7769824dff7260d31d upstream.\n\nAccount for all properties when a and/or b are 0:\ngcd(0, 0) = 0\ngcd(a, 0) = a\ngcd(0, b) = b\n\nFixes no known problems in current kernels.\n\nSigned-off-by: Davidlohr Bueso <dave@gnu.org>\nCc: Eric Dumazet <eric.dumazet@gmail.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nkernel/sys.c: call disable_nonboot_cpus() in kernel_restart()\n\ncommit f96972f2dc6365421cf2366ebd61ee4cf060c8d5 upstream.\n\nAs kernel_power_off() calls disable_nonboot_cpus(), we may also want to\nhave kernel_restart() call disable_nonboot_cpus().  Doing so can help\nmachines that require boot cpu be the last alive cpu during reboot to\nsurvive with kernel restart.\n\nThis fixes one reboot issue seen on imx6q (Cortex-A9 Quad).  The machine\nrequires that the restart routine be run on the primary cpu rather than\nsecondary ones.  Otherwise, the secondary core running the restart\nroutine will fail to come to online after reboot.\n\nSigned-off-by: Shawn Guo <shawn.guo@linaro.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\ndrivers/scsi/atp870u.c: fix bad use of udelay\n\ncommit 0f6d93aa9d96cc9022b51bd10d462b03296be146 upstream.\n\nThe ACARD driver calls udelay() with a value > 2000, which leads to to\nthe following compilation error on ARM:\n\n  ERROR: \"__bad_udelay\" [drivers/scsi/atp870u.ko] undefined!\n  make[1]: *** [__modpost] Error 1\n\nThis is because udelay is defined on ARM, roughly speaking, as\n\n\t#define udelay(n) ((n) > 2000 ? __bad_udelay() : \\\n\t\t__const_udelay((n) * ((2199023U*HZ)>>11)))\n\nThe argument to __const_udelay is the number of jiffies to wait divided\nby 4, but this does not work unless the multiplication does not\noverflow, and that is what the build error is designed to prevent.  The\nintended behavior can be achieved by using mdelay to call udelay\nmultiple times in a loop.\n\n[jrnieder@gmail.com: adding context]\nSigned-off-by: Martin Michlmayr <tbm@cyrius.com>\nSigned-off-by: Jonathan Nieder <jrnieder@gmail.com>\nCc: James Bottomley <James.Bottomley@HansenPartnership.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nworkqueue: add missing smp_wmb() in process_one_work()\n\ncommit 959d1af8cffc8fd38ed53e8be1cf4ab8782f9c00 upstream.\n\nWORK_STRUCT_PENDING is used to claim ownership of a work item and\nprocess_one_work() releases it before starting execution.  When\nsomeone else grabs PENDING, all pre-release updates to the work item\nshould be visible and all updates made by the new owner should happen\nafterwards.\n\nGrabbing PENDING uses test_and_set_bit() and thus has a full barrier;\nhowever, clearing doesn't have a matching wmb.  Given the preceding\nspin_unlock and use of clear_bit, I don't believe this can be a\nproblem on an actual machine and there hasn't been any related report\nbut it still is theretically possible for clear_pending to permeate\nupwards and happen before work->entry update.\n\nAdd an explicit smp_wmb() before work_clear_pending().\n\nSigned-off-by: Tejun Heo <tj@kernel.org>\nCc: Oleg Nesterov <oleg@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nxfrm: Workaround incompatibility of ESN and async crypto\n\n[ Upstream commit 3b59df46a449ec9975146d71318c4777ad086744 ]\n\nESN for esp is defined in RFC 4303. This RFC assumes that the\nsequence number counters are always up to date. However,\nthis is not true if an async crypto algorithm is employed.\n\nIf the sequence number counters are not up to date on sequence\nnumber check, we may incorrectly update the upper 32 bit of\nthe sequence number. This leads to a DOS.\n\nWe workaround this by comparing the upper sequence number,\n(used for authentication) with the upper sequence number\ncomputed after the async processing. We drop the packet\nif these numbers are different.\n\nTo do this, we introduce a recheck function that does this\ncheck in the ESN case.\n\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>\nAcked-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nxfrm_user: return error pointer instead of NULL\n\n[ Upstream commit 864745d291b5ba80ea0bd0edcbe67273de368836 ]\n\nWhen dump_one_state() returns an error, e.g. because of a too small\nbuffer to dump the whole xfrm state, xfrm_state_netlink() returns NULL\ninstead of an error pointer. But its callers expect an error pointer\nand therefore continue to operate on a NULL skbuff.\n\nThis could lead to a privilege escalation (execution of user code in\nkernel context) if the attacker has CAP_NET_ADMIN and is able to map\naddress 0.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nAcked-by: Steffen Klassert <steffen.klassert@secunet.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nxfrm_user: return error pointer instead of NULL #2\n\n[ Upstream commit c25463722509fef0ed630b271576a8c9a70236f3 ]\n\nWhen dump_one_policy() returns an error, e.g. because of a too small\nbuffer to dump the whole xfrm policy, xfrm_policy_netlink() returns\nNULL instead of an error pointer. But its caller expects an error\npointer and therefore continues to operate on a NULL skbuff.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nAcked-by: Steffen Klassert <steffen.klassert@secunet.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nxfrm: fix a read lock imbalance in make_blackhole\n\n[ Upstream commit 433a19548061bb5457b6ab77ed7ea58ca6e43ddb ]\n\nif xfrm_policy_get_afinfo returns 0, it has already released the read\nlock, xfrm_policy_put_afinfo should not be called again.\n\nSigned-off-by: Li RongQing <roy.qing.li@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nxfrm_user: fix info leak in copy_to_user_auth()\n\n[ Upstream commit 4c87308bdea31a7b4828a51f6156e6f721a1fcc9 ]\n\ncopy_to_user_auth() fails to initialize the remainder of alg_name and\ntherefore discloses up to 54 bytes of heap memory via netlink to\nuserland.\n\nUse strncpy() instead of strcpy() to fill the trailing bytes of alg_name\nwith null bytes.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nAcked-by: Steffen Klassert <steffen.klassert@secunet.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nxfrm_user: fix info leak in copy_to_user_state()\n\n[ Upstream commit f778a636713a435d3a922c60b1622a91136560c1 ]\n\nThe memory reserved to dump the xfrm state includes the padding bytes of\nstruct xfrm_usersa_info added by the compiler for alignment (7 for\namd64, 3 for i386). Add an explicit memset(0) before filling the buffer\nto avoid the info leak.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nAcked-by: Steffen Klassert <steffen.klassert@secunet.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nxfrm_user: fix info leak in copy_to_user_policy()\n\n[ Upstream commit 7b789836f434c87168eab067cfbed1ec4783dffd ]\n\nThe memory reserved to dump the xfrm policy includes multiple padding\nbytes added by the compiler for alignment (padding bytes in struct\nxfrm_selector and struct xfrm_userpolicy_info). Add an explicit\nmemset(0) before filling the buffer to avoid the heap info leak.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nAcked-by: Steffen Klassert <steffen.klassert@secunet.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nxfrm_user: fix info leak in copy_to_user_tmpl()\n\n[ Upstream commit 1f86840f897717f86d523a13e99a447e6a5d2fa5 ]\n\nThe memory used for the template copy is a local stack variable. As\nstruct xfrm_user_tmpl contains multiple holes added by the compiler for\nalignment, not initializing the memory will lead to leaking stack bytes\nto userland. Add an explicit memset(0) to avoid the info leak.\n\nInitial version of the patch by Brad Spengler.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nCc: Brad Spengler <spender@grsecurity.net>\nAcked-by: Steffen Klassert <steffen.klassert@secunet.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nxfrm_user: don't copy esn replay window twice for new states\n\n[ Upstream commit e3ac104d41a97b42316915020ba228c505447d21 ]\n\nThe ESN replay window was already fully initialized in\nxfrm_alloc_replay_state_esn(). No need to copy it again.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nCc: Steffen Klassert <steffen.klassert@secunet.com>\nAcked-by: Steffen Klassert <steffen.klassert@secunet.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nxfrm_user: ensure user supplied esn replay window is valid\n\n[ Upstream commit ecd7918745234e423dd87fcc0c077da557909720 ]\n\nThe current code fails to ensure that the netlink message actually\ncontains as many bytes as the header indicates. If a user creates a new\nstate or updates an existing one but does not supply the bytes for the\nwhole ESN replay window, the kernel copies random heap bytes into the\nreplay bitmap, the ones happen to follow the XFRMA_REPLAY_ESN_VAL\nnetlink attribute. This leads to following issues:\n\n1. The replay window has random bits set confusing the replay handling\n   code later on.\n\n2. A malicious user could use this flaw to leak up to ~3.5kB of heap\n   memory when she has access to the XFRM netlink interface (requires\n   CAP_NET_ADMIN).\n\nKnown users of the ESN replay window are strongSwan and Steffen's\niproute2 patch (<http://patchwork.ozlabs.org/patch/85962/>). The latter\nuses the interface with a bitmap supplied while the former does not.\nstrongSwan is therefore prone to run into issue 1.\n\nTo fix both issues without breaking existing userland allow using the\nXFRMA_REPLAY_ESN_VAL netlink attribute with either an empty bitmap or a\nfully specified one. For the former case we initialize the in-kernel\nbitmap with zero, for the latter we copy the user supplied bitmap. For\nstate updates the full bitmap must be supplied.\n\nTo prevent overflows in the bitmap length calculation the maximum size\nof bmp_len is limited to 128 by this patch -- resulting in a maximum\nreplay window of 4096 packets. This should be sufficient for all real\nlife scenarios (RFC 4303 recommends a default replay window size of 64).\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nCc: Steffen Klassert <steffen.klassert@secunet.com>\nCc: Martin Willi <martin@revosec.ch>\nCc: Ben Hutchings <bhutchings@solarflare.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nnet: ethernet: davinci_cpdma: decrease the desc count when cleaning up the remaining packets\n\n[ Upstream commit ffb5ba90017505a19e238e986e6d33f09e4df765 ]\n\nchan->count is used by rx channel. If the desc count is not updated by\nthe clean up loop in cpdma_chan_stop, the value written to the rxfree\nregister in cpdma_chan_start will be incorrect.\n\nSigned-off-by: Tao Hou <hotforest@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nixp4xx_hss: fix build failure due to missing linux/module.h inclusion\n\n[ Upstream commit 0b836ddde177bdd5790ade83772860940bd481ea ]\n\nCommit 36a1211970193ce215de50ed1e4e1272bc814df1 (netprio_cgroup.h:\ndont include module.h from other includes) made the following build\nerror on ixp4xx_hss pop up:\n\n  CC [M]  drivers/net/wan/ixp4xx_hss.o\n drivers/net/wan/ixp4xx_hss.c:1412:20: error: expected ';', ',' or ')'\n before string constant\n drivers/net/wan/ixp4xx_hss.c:1413:25: error: expected ';', ',' or ')'\n before string constant\n drivers/net/wan/ixp4xx_hss.c:1414:21: error: expected ';', ',' or ')'\n before string constant\n drivers/net/wan/ixp4xx_hss.c:1415:19: error: expected ';', ',' or ')'\n before string constant\n make[8]: *** [drivers/net/wan/ixp4xx_hss.o] Error 1\n\nThis was previously hidden because ixp4xx_hss includes linux/hdlc.h which\nincludes linux/netdevice.h which includes linux/netprio_cgroup.h which\nused to include linux/module.h. The real issue was actually present since\nthe initial commit that added this driver since it uses macros from\nlinux/module.h without including this file.\n\nSigned-off-by: Florian Fainelli <florian@openwrt.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nnetxen: check for root bus in netxen_mask_aer_correctable\n\n[ Upstream commit e4d1aa40e363ed3e0486aeeeb0d173f7f822737e ]\n\nAdd a check if pdev->bus->self == NULL (root bus). When attaching\na netxen NIC to a VM it can be on the root bus and the guest would\ncrash in netxen_mask_aer_correctable() because of a NULL pointer\ndereference if CONFIG_PCIEAER is present.\n\nSigned-off-by: Nikolay Aleksandrov <nikolay@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nnet-sched: sch_cbq: avoid infinite loop\n\n[ Upstream commit bdfc87f7d1e253e0a61e2fc6a75ea9d76f7fc03a ]\n\nIts possible to setup a bad cbq configuration leading to\nan infinite loop in cbq_classify()\n\nDEV_OUT=eth0\nICMP=\"match ip protocol 1 0xff\"\nU32=\"protocol ip u32\"\nDST=\"match ip dst\"\ntc qdisc add dev $DEV_OUT root handle 1: cbq avpkt 1000 \\\n\tbandwidth 100mbit\ntc class add dev $DEV_OUT parent 1: classid 1:1 cbq \\\n\trate 512kbit allot 1500 prio 5 bounded isolated\ntc filter add dev $DEV_OUT parent 1: prio 3 $U32 \\\n\t$ICMP $DST 192.168.3.234 flowid 1:\n\nReported-by: Denys Fedoryschenko <denys@visp.net.lb>\nTested-by: Denys Fedoryschenko <denys@visp.net.lb>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\npkt_sched: fix virtual-start-time update in QFQ\n\n[ Upstream commit 71261956973ba9e0637848a5adb4a5819b4bae83 ]\n\nIf the old timestamps of a class, say cl, are stale when the class\nbecomes active, then QFQ may assign to cl a much higher start time\nthan the maximum value allowed. This may happen when QFQ assigns to\nthe start time of cl the finish time of a group whose classes are\ncharacterized by a higher value of the ratio\nmax_class_pkt/weight_of_the_class with respect to that of\ncl. Inserting a class with a too high start time into the bucket list\ncorrupts the data structure and may eventually lead to crashes.\nThis patch limits the maximum start time assigned to a class.\n\nSigned-off-by: Paolo Valente <paolo.valente@unimore.it>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nsierra_net: Endianess bug fix.\n\n[ Upstream commit 2120c52da6fe741454a60644018ad2a6abd957ac ]\n\nI discovered I couldn't get sierra_net to work on a powerpc.  Turns out\nthe firmware attribute check assumes the system is little endian and\nhence fails because the attributes is a 16 bit value.\n\nSigned-off-by: Len Sorensen <lsorense@csclub.uwaterloo.ca>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n8021q: fix mac_len recomputation in vlan_untag()\n\n[ Upstream commit 5316cf9a5197eb80b2800e1acadde287924ca975 ]\n\nskb_reset_mac_len() relies on the value of the skb->network_header pointer,\ntherefore we must wait for such pointer to be recalculated before computing\nthe new mac_len value.\n\nSigned-off-by: Antonio Quartulli <ordex@autistici.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nipv6: release reference of ip6_null_entry's dst entry in __ip6_del_rt\n\n[ Upstream commit 6825a26c2dc21eb4f8df9c06d3786ddec97cf53b ]\n\nas we hold dst_entry before we call __ip6_del_rt,\nso we should alse call dst_release not only return\n-ENOENT when the rt6_info is ip6_null_entry.\n\nand we already hold the dst entry, so I think it's\nsafe to call dst_release out of the write-read lock.\n\nSigned-off-by: Gao feng <gaofeng@cn.fujitsu.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\ntcp: flush DMA queue before sk_wait_data if rcv_wnd is zero\n\n[ Upstream commit 15c041759bfcd9ab0a4e43f1c16e2644977d0467 ]\n\nIf recv() syscall is called for a TCP socket so that\n  - IOAT DMA is used\n  - MSG_WAITALL flag is used\n  - requested length is bigger than sk_rcvbuf\n  - enough data has already arrived to bring rcv_wnd to zero\nthen when tcp_recvmsg() gets to calling sk_wait_data(), receive\nwindow can be still zero while sk_async_wait_queue exhausts\nenough space to keep it zero. As this queue isn't cleaned until\nthe tcp_service_net_dma() call, sk_wait_data() cannot receive\nany data and blocks forever.\n\nIf zero receive window and non-empty sk_async_wait_queue is\ndetected before calling sk_wait_data(), process the queue first.\n\nSigned-off-by: Michal Kubecek <mkubecek@suse.cz>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nsctp: Don't charge for data in sndbuf again when transmitting packet\n\n[ Upstream commit 4c3a5bdae293f75cdf729c6c00124e8489af2276 ]\n\nSCTP charges wmem_alloc via sctp_set_owner_w() in sctp_sendmsg() and via\nskb_set_owner_w() in sctp_packet_transmit(). If a sender runs out of\nsndbuf it will sleep in sctp_wait_for_sndbuf() and expects to be waken up\nby __sctp_write_space().\n\nBuffer space charged via sctp_set_owner_w() is released in sctp_wfree()\nwhich calls __sctp_write_space() directly.\n\nBuffer space charged via skb_set_owner_w() is released via sock_wfree()\nwhich calls sk->sk_write_space() _if_ SOCK_USE_WRITE_QUEUE is not set.\nsctp_endpoint_init() sets SOCK_USE_WRITE_QUEUE on all sockets.\n\nTherefore if sctp_packet_transmit() manages to queue up more than sndbuf\nbytes, sctp_wait_for_sndbuf() will never be woken up again unless it is\ninterrupted by a signal.\n\nThis could be fixed by clearing the SOCK_USE_WRITE_QUEUE flag but ...\n\nCharging for the data twice does not make sense in the first place, it\nleads to overcharging sndbuf by a factor 2. Therefore this patch only\ncharges a single byte in wmem_alloc when transmitting an SCTP packet to\nensure that the socket stays alive until the packet has been released.\n\nThis means that control chunks are no longer accounted for in wmem_alloc\nwhich I believe is not a problem as skb->truesize will typically lead\nto overcharging anyway and thus compensates for any control overhead.\n\nSigned-off-by: Thomas Graf <tgraf@suug.ch>\nCC: Vlad Yasevich <vyasevic@redhat.com>\nCC: Neil Horman <nhorman@tuxdriver.com>\nCC: David Miller <davem@davemloft.net>\nAcked-by: Vlad Yasevich <vyasevich@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\npppoe: drop PPPOX_ZOMBIEs in pppoe_release\n\n[ Upstream commit 2b018d57ff18e5405823e5cb59651a5b4d946d7b ]\n\nWhen PPPOE is running over a virtual ethernet interface (e.g., a\nbonding interface) and the user tries to delete the interface in case\nthe PPPOE state is ZOMBIE, the kernel will loop forever while\nunregistering net_device for the reference count is not decreased to\nzero which should have been done with dev_put().\n\nSigned-off-by: Xiaodong Xu <stid.smth@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nnet: small bug on rxhash calculation\n\n[ Upstream commit 6862234238e84648c305526af2edd98badcad1e0 ]\n\nIn the current rxhash calculation function, while the\nsorting of the ports/addrs is coherent (you get the\nsame rxhash for packets sharing the same 4-tuple, in\nboth directions), ports and addrs are sorted\nindependently. This implies packets from a connection\nbetween the same addresses but crossed ports hash to\nthe same rxhash.\n\nFor example, traffic between A=S:l and B=L:s is hashed\n(in both directions) from {L, S, {s, l}}. The same\nrxhash is obtained for packets between C=S:s and D=L:l.\n\nThis patch ensures that you either swap both addrs and ports,\nor you swap none. Traffic between A and B, and traffic\nbetween C and D, get their rxhash from different sources\n({L, S, {l, s}} for A<->B, and {L, S, {s, l}} for C<->D)\n\nThe patch is co-written with Eric Dumazet <edumazet@google.com>\n\nSigned-off-by: Chema Gonzalez <chema@google.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nnet: guard tcp_set_keepalive() to tcp sockets\n\n[ Upstream commit 3e10986d1d698140747fcfc2761ec9cb64c1d582 ]\n\nIts possible to use RAW sockets to get a crash in\ntcp_set_keepalive() / sk_reset_timer()\n\nFix is to make sure socket is a SOCK_STREAM one.\n\nReported-by: Dave Jones <davej@redhat.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nipv4: raw: fix icmp_filter()\n\n[ Upstream commit ab43ed8b7490cb387782423ecf74aeee7237e591 ]\n\nicmp_filter() should not modify its input, or else its caller\nwould need to recompute ip_hdr() if skb->head is reallocated.\n\nUse skb_header_pointer() instead of pskb_may_pull() and\nchange the prototype to make clear both sk and skb are const.\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nipv6: raw: fix icmpv6_filter()\n\n[ Upstream commit 1b05c4b50edbddbdde715c4a7350629819f6655e ]\n\nicmpv6_filter() should not modify its input, or else its caller\nwould need to recompute ipv6_hdr() if skb->head is reallocated.\n\nUse skb_header_pointer() instead of pskb_may_pull() and\nchange the prototype to make clear both sk and skb are const.\n\nAlso, if icmpv6 header cannot be found, do not deliver the packet,\nas we do in IPv4.\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nipv6: mip6: fix mip6_mh_filter()\n\n[ Upstream commit 96af69ea2a83d292238bdba20e4508ee967cf8cb ]\n\nmip6_mh_filter() should not modify its input, or else its caller\nwould need to recompute ipv6_hdr() if skb->head is reallocated.\n\nUse skb_header_pointer() instead of pskb_may_pull()\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nl2tp: fix a typo in l2tp_eth_dev_recv()\n\n[ Upstream commit c0cc88a7627c333de50b07b7c60b1d49d9d2e6cc ]\n\nWhile investigating l2tp bug, I hit a bug in eth_type_trans(),\nbecause not enough bytes were pulled in skb head.\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nnetrom: copy_datagram_iovec can fail\n\n[ Upstream commit 6cf5c951175abcec4da470c50565cc0afe6cd11d ]\n\nCheck for an error from this and if so bail properly.\n\nSigned-off-by: Alan Cox <alan@linux.intel.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nnet: do not disable sg for packets requiring no checksum\n\n[ Upstream commit c0d680e577ff171e7b37dbdb1b1bf5451e851f04 ]\n\nA change in a series of VLAN-related changes appears to have\ninadvertently disabled the use of the scatter gather feature of\nnetwork cards for transmission of non-IP ethernet protocols like ATA\nover Ethernet (AoE).  Below is a reference to the commit that\nintroduces a \"harmonize_features\" function that turns off scatter\ngather when the NIC does not support hardware checksumming for the\nethernet protocol of an sk buff.\n\n  commit f01a5236bd4b140198fbcc550f085e8361fd73fa\n  Author: Jesse Gross <jesse@nicira.com>\n  Date:   Sun Jan 9 06:23:31 2011 +0000\n\n      net offloading: Generalize netif_get_vlan_features().\n\nThe can_checksum_protocol function is not equipped to consider a\nprotocol that does not require checksumming.  Calling it for a\nprotocol that requires no checksum is inappropriate.\n\nThe patch below has harmonize_features call can_checksum_protocol when\nthe protocol needs a checksum, so that the network layer is not forced\nto perform unnecessary skb linearization on the transmission of AoE\npackets.  Unnecessary linearization results in decreased performance\nand increased memory pressure, as reported here:\n\n  http://www.spinics.net/lists/linux-mm/msg15184.html\n\nThe problem has probably not been widely experienced yet, because\nonly recently has the kernel.org-distributed aoe driver acquired the\nability to use payloads of over a page in size, with the patchset\nrecently included in the mm tree:\n\n  https://lkml.org/lkml/2012/8/28/140\n\nThe coraid.com-distributed aoe driver already could use payloads of\ngreater than a page in size, but its users generally do not use the\nnewest kernels.\n\nSigned-off-by: Ed Cashin <ecashin@coraid.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\naoe: assert AoE packets marked as requiring no checksum\n\n[ Upstream commit 8babe8cc6570ed896b7b596337eb8fe730c3ff45 ]\n\nIn order for the network layer to see that AoE requires\nno checksumming in a generic way, the packets must be\nmarked as requiring no checksum, so we make this requirement\nexplicit with the assertion.\n\nSigned-off-by: Ed Cashin <ecashin@coraid.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\ntg3: Fix TSO CAP for 5704 devs w / ASF enabled\n\n[ Upstream commit cf9ecf4b631f649a964fa611f1a5e8874f2a76db ]\n\nOn the earliest TSO capable devices, TSO was accomplished through\nfirmware.  The TSO cannot coexist with ASF management firmware though.\nThe tg3 driver determines whether or not ASF is enabled by calling\ntg3_get_eeprom_hw_cfg(), which checks a particular bit of NIC memory.\nCommit dabc5c670d3f86d15ee4f42ab38ec5bd2682487d, entitled \"tg3: Move\nTSO_CAPABLE assignment\", accidentally moved the code that determines\nTSO capabilities earlier than the call to tg3_get_eeprom_hw_cfg().  As a\nconsequence, the driver was attempting to determine TSO capabilities\nbefore it had all the data it needed to make the decision.\n\nThis patch fixes the problem by revisiting and reevaluating the decision\nafter tg3_get_eeprom_hw_cfg() is called.\n\nSigned-off-by: Matt Carlson <mcarlson@broadcom.com>\nSigned-off-by: Michael Chan <mchan@broadcom.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSCSI: zfcp: Make trace record tags unique\n\ncommit 0100998dbfe6dfcd90a6e912ca7ed6f255d48f25 upstream.\n\nDuplicate fssrh_2 from a54ca0f62f953898b05549391ac2a8a4dad6482b\n\"[SCSI] zfcp: Redesign of the debug tracing for HBA records.\"\ncomplicates distinction of generic status read response from\nlocal link up.\nDuplicate fsscth1 from 2c55b750a884b86dea8b4cc5f15e1484cc47a25c\n\"[SCSI] zfcp: Redesign of the debug tracing for SAN records.\"\ncomplicates distinction of good common transport response from\ninvalid port handle.\n\nSigned-off-by: Steffen Maier <maier@linux.vnet.ibm.com>\nReviewed-by: Martin Peschke <mpeschke@linux.vnet.ibm.com>\nSigned-off-by: James Bottomley <JBottomley@Parallels.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSCSI: zfcp: Do not wakeup while suspended\n\ncommit cb45214960bc989af8b911ebd77da541c797717d upstream.\n\nIf the mapping of FCP device bus ID and corresponding subchannel\nis modified while the Linux image is suspended, the resume of FCP\ndevices can fail. During resume, zfcp gets callbacks from cio regarding\nthe modified subchannels but they can be arbitrarily mixed with the\nrestore/resume callback. Since the cio callbacks would trigger\nadapter recovery, zfcp could wakeup before the resume callback.\nTherefore, ignore the cio callbacks regarding subchannels while\nbeing suspended. We can safely do so, since zfcp does not deal itself\nwith subchannels. For problem determination purposes, we still trace the\nignored callback events.\n\nThe following kernel messages could be seen on resume:\n\nkernel: <WWPN>: parent <FCP device bus ID> should not be sleeping\n\nAs part of adapter reopen recovery, zfcp performs auto port scanning\nwhich can erroneously try to register new remote ports with\nscsi_transport_fc and the device core code complains about the parent\n(adapter) still sleeping.\n\nkernel: zfcp.3dff9c: <FCP device bus ID>:\\\n Setting up the QDIO connection to the FCP adapter failed\n<last kernel message repeated 3 more times>\nkernel: zfcp.574d43: <FCP device bus ID>:\\\n ERP cannot recover an error on the FCP device\n\nIn such cases, the adapter gave up recovery and remained blocked along\nwith its child objects: remote ports and LUNs/scsi devices. Even the\nadapter shutdown as part of giving up recovery failed because the ccw\ndevice state remained disconnected. Later, the corresponding remote\nports ran into dev_loss_tmo. As a result, the LUNs were erroneously\nnot available again after resume.\n\nEven a manually triggered adapter recovery (e.g. sysfs attribute\nfailed, or device offline/online via sysfs) could not recover the\nadapter due to the remaining disconnected state of the corresponding\nccw device.\n\nSigned-off-by: Steffen Maier <maier@linux.vnet.ibm.com>\nSigned-off-by: James Bottomley <JBottomley@Parallels.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSCSI: zfcp: remove invalid reference to list iterator variable\n\ncommit ca579c9f136af4274ccfd1bcaee7f38a29a0e2e9 upstream.\n\nIf list_for_each_entry, etc complete a traversal of the list, the iterator\nvariable ends up pointing to an address at an offset from the list head,\nand not a meaningful structure.  Thus this value should not be used after\nthe end of the iterator.  Replace port->adapter->scsi_host by\nadapter->scsi_host.\n\nThis problem was found using Coccinelle (http://coccinelle.lip6.fr/).\n\nOversight in upsteam commit of v2.6.37\na1ca48319a9aa1c5b57ce142f538e76050bb8972\n\"[SCSI] zfcp: Move ACL/CFDC code to zfcp_cfdc.c\"\nwhich merged the content of zfcp_erp_port_access_changed().\n\nSigned-off-by: Julia Lawall <Julia.Lawall@lip6.fr>\nSigned-off-by: Steffen Maier <maier@linux.vnet.ibm.com>\nReviewed-by: Martin Peschke <mpeschke@linux.vnet.ibm.com>\nSigned-off-by: James Bottomley <JBottomley@Parallels.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSCSI: zfcp: restore refcount check on port_remove\n\ncommit d99b601b63386f3395dc26a699ae703a273d9982 upstream.\n\nUpstream commit f3450c7b917201bb49d67032e9f60d5125675d6a\n\"[SCSI] zfcp: Replace local reference counting with common kref\"\naccidentally dropped a reference count check before tearing down\nzfcp_ports that are potentially in use by zfcp_units.\nEven remote ports in use can be removed causing\nunreachable garbage objects zfcp_ports with zfcp_units.\nThus units won't come back even after a manual port_rescan.\nThe kref of zfcp_port->dev.kobj is already used by the driver core.\nWe cannot re-use it to track the number of zfcp_units.\nRe-introduce our own counter for units per port\nand check on port_remove.\n\nSigned-off-by: Steffen Maier <maier@linux.vnet.ibm.com>\nReviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>\nSigned-off-by: James Bottomley <JBottomley@Parallels.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSCSI: zfcp: only access zfcp_scsi_dev for valid scsi_device\n\ncommit d436de8ce25f53a8a880a931886821f632247943 upstream.\n\n__scsi_remove_device (e.g. due to dev_loss_tmo) calls\nzfcp_scsi_slave_destroy which in turn sends a close LUN FSF request to\nthe adapter. After 30 seconds without response,\nzfcp_erp_timeout_handler kicks the ERP thread failing the close LUN\nERP action. zfcp_erp_wait in zfcp_erp_lun_shutdown_wait and thus\nzfcp_scsi_slave_destroy returns and then scsi_device is no longer\nvalid. Sometime later the response to the close LUN FSF request may\nfinally come in. However, commit\nb62a8d9b45b971a67a0f8413338c230e3117dff5\n\"[SCSI] zfcp: Use SCSI device data zfcp_scsi_dev instead of zfcp_unit\"\nintroduced a number of attempts to unconditionally access struct\nzfcp_scsi_dev through struct scsi_device causing a use-after-free.\nThis leads to an Oops due to kernel page fault in one of:\nzfcp_fsf_abort_fcp_command_handler, zfcp_fsf_open_lun_handler,\nzfcp_fsf_close_lun_handler, zfcp_fsf_req_trace,\nzfcp_fsf_fcp_handler_common.\nMove dereferencing of zfcp private data zfcp_scsi_dev allocated in\nscsi_device via scsi_transport_reserve_device after the check for\npotentially aborted FSF request and thus no longer valid scsi_device.\nOnly then assign sdev_to_zfcp(sdev) to the local auto variable struct\nzfcp_scsi_dev *zfcp_sdev.\n\nSigned-off-by: Martin Peschke <mpeschke@linux.vnet.ibm.com>\nSigned-off-by: Steffen Maier <maier@linux.vnet.ibm.com>\nSigned-off-by: James Bottomley <JBottomley@Parallels.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nPCI: Check P2P bridge for invalid secondary/subordinate range\n\ncommit 1965f66e7db08d1ebccd24a59043eba826cc1ce8 upstream.\n\nFor bridges with \"secondary > subordinate\", i.e., invalid bus number\napertures, we don't enumerate anything behind the bridge unless the\nuser specified \"pci=assign-busses\".\n\nThis patch makes us automatically try to reassign the downstream bus\nnumbers in this case (just for that bridge, not for all bridges as\n\"pci=assign-busses\" does).\n\nWe don't discover all the devices on the Intel DP43BF motherboard\nwithout this change (or \"pci=assign-busses\") because its BIOS configures\na bridge as:\n\n    pci 0000:00:1e.0: PCI bridge to [bus 20-08] (subtractive decode)\n\n[bhelgaas: changelog, change message to dev_info]\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=18412\nBugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=625754\nReported-by: Brian C. Huffman <bhuffman@graze.net>\nReported-by: VL <vl.homutov@gmail.com>\nTested-by: VL <vl.homutov@gmail.com>\nSigned-off-by: Yinghai Lu <yinghai@kernel.org>\nSigned-off-by: Bjorn Helgaas <bhelgaas@google.com>\next4: online defrag is not supported for journaled files\n\ncommit f066055a3449f0e5b0ae4f3ceab4445bead47638 upstream.\n\nProper block swap for inodes with full journaling enabled is\ntruly non obvious task. In order to be on a safe side let's\nexplicitly disable it for now.\n\nSigned-off-by: Dmitry Monakhov <dmonakhov@openvz.org>\nSigned-off-by: \"Theodore Ts'o\" <tytso@mit.edu>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\next4: always set i_op in ext4_mknod()\n\ncommit 6a08f447facb4f9e29fcc30fb68060bb5a0d21c2 upstream.\n\next4_special_inode_operations have their own ifdef CONFIG_EXT4_FS_XATTR\nto mask those methods. And ext4_iget also always sets it, so there is\nan inconsistency.\n\nSigned-off-by: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>\nSigned-off-by: \"Theodore Ts'o\" <tytso@mit.edu>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\next4: fix fdatasync() for files with only i_size changes\n\ncommit b71fc079b5d8f42b2a52743c8d2f1d35d655b1c5 upstream.\n\nCode tracking when transaction needs to be committed on fdatasync(2) forgets\nto handle a situation when only inode's i_size is changed. Thus in such\nsituations fdatasync(2) doesn't force transaction with new i_size to disk\nand that can result in wrong i_size after a crash.\n\nFix the issue by updating inode's i_datasync_tid whenever its size is\nupdated.\n\nReported-by: Kristian Nielsen <knielsen@knielsen-hq.org>\nSigned-off-by: Jan Kara <jack@suse.cz>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nASoC: wm9712: Fix name of Capture Switch\n\ncommit 689185b78ba6fbe0042f662a468b5565909dff7a upstream.\n\nHelp UIs associate it with the matching gain control.\n\nSigned-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nmm: fix invalidate_complete_page2() lock ordering\n\ncommit ec4d9f626d5908b6052c2973f37992f1db52e967 upstream.\n\nIn fuzzing with trinity, lockdep protested \"possible irq lock inversion\ndependency detected\" when isolate_lru_page() reenabled interrupts while\nstill holding the supposedly irq-safe tree_lock:\n\ninvalidate_inode_pages2\n  invalidate_complete_page2\n    spin_lock_irq(&mapping->tree_lock)\n    clear_page_mlock\n      isolate_lru_page\n        spin_unlock_irq(&zone->lru_lock)\n\nisolate_lru_page() is correct to enable interrupts unconditionally:\ninvalidate_complete_page2() is incorrect to call clear_page_mlock() while\nholding tree_lock, which is supposed to nest inside lru_lock.\n\nBoth truncate_complete_page() and invalidate_complete_page() call\nclear_page_mlock() before taking tree_lock to remove page from radix_tree.\n I guess invalidate_complete_page2() preferred to test PageDirty (again)\nunder tree_lock before committing to the munlock; but since the page has\nalready been unmapped, its state is already somewhat inconsistent, and no\nworse if clear_page_mlock() moved up.\n\nReported-by: Sasha Levin <levinsasha928@gmail.com>\nDeciphered-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Hugh Dickins <hughd@google.com>\nAcked-by: Mel Gorman <mel@csn.ul.ie>\nCc: Rik van Riel <riel@redhat.com>\nCc: Johannes Weiner <hannes@cmpxchg.org>\nCc: Michel Lespinasse <walken@google.com>\nCc: Ying Han <yinghan@google.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nmm: thp: fix pmd_present for split_huge_page and PROT_NONE with THP\n\ncommit 027ef6c87853b0a9df53175063028edb4950d476 upstream.\n\nIn many places !pmd_present has been converted to pmd_none.  For pmds\nthat's equivalent and pmd_none is quicker so using pmd_none is better.\n\nHowever (unless we delete pmd_present) we should provide an accurate\npmd_present too.  This will avoid the risk of code thinking the pmd is non\npresent because it's under __split_huge_page_map, see the pmd_mknotpresent\nthere and the comment above it.\n\nIf the page has been mprotected as PROT_NONE, it would also lead to a\npmd_present false negative in the same way as the race with\nsplit_huge_page.\n\nBecause the PSE bit stays on at all times (both during split_huge_page and\nwhen the _PAGE_PROTNONE bit get set), we could only check for the PSE bit,\nbut checking the PROTNONE bit too is still good to remember pmd_present\nmust always keep PROT_NONE into account.\n\nThis explains a not reproducible BUG_ON that was seldom reported on the\nlists.\n\nThe same issue is in pmd_large, it would go wrong with both PROT_NONE and\nif it races with split_huge_page.\n\nSigned-off-by: Andrea Arcangeli <aarcange@redhat.com>\nAcked-by: Rik van Riel <riel@redhat.com>\nCc: Johannes Weiner <jweiner@redhat.com>\nCc: Hugh Dickins <hughd@google.com>\nCc: Mel Gorman <mgorman@suse.de>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nALSA: aloop - add locking to timer access\n\ncommit d4f1e48bd11e3df6a26811f7a1f06c4225d92f7d upstream.\n\nWhen the loopback timer handler is running, calling del_timer() (for STOP\ntrigger) will not wait for the handler to complete before deactivating the\ntimer. The timer gets rescheduled in the handler as usual. Then a subsequent\nSTART trigger will try to start the timer using add_timer() with a timer pending\nleading to a kernel panic.\n\nSerialize the calls to add_timer() and del_timer() using a spin lock to avoid\nthis.\n\nSigned-off-by: Omair Mohammed Abdullah <omair.m.abdullah@linux.intel.com>\nSigned-off-by: Vinod Koul <vinod.koul@linux.intel.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nALSA: usb - disable broken hw volume for Tenx TP6911\n\ncommit c10514394ef9e8de93a4ad8c8904d71dcd82c122 upstream.\n\nWhile going through Ubuntu bugs, I discovered this patch being\nposted and a confirmation that the patch works as expected.\n\nFinding out how the hw volume really works would be preferrable\nto just disabling the broken one, but this would be better than\nnothing.\n\nCredit: sndfnsdfin (qawsnews)\nBugLink: https://bugs.launchpad.net/bugs/559939\nSigned-off-by: David Henningsson <david.henningsson@canonical.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nALSA: USB: Support for (original) Xbox Communicator\n\ncommit c05fce586d4da2dfe0309bef3795a8586e967bc3 upstream.\n\nAdded support for Xbox Communicator to USB quirks.\n\nSigned-off-by: Marko Friedemann <mfr@bmx-chemnitz.de>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\ndrm/radeon: only adjust default clocks on NI GPUs\n\ncommit 2e3b3b105ab3bb5b6a37198da4f193cd13781d13 upstream.\n\nSI asics store voltage information differently so we\ndon't have a way to deal with it properly yet.\n\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\ndrm/radeon: Add MSI quirk for gateway RS690\n\ncommit 3a6d59df80897cc87812b6826d70085905bed013 upstream.\n\nFixes another system on:\nhttps://bugs.freedesktop.org/show_bug.cgi?id=37679\n\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\ndrm/radeon: force MSIs on RS690 asics\n\ncommit fb6ca6d154cdcd53e7f27f8dbba513830372699b upstream.\n\nThere are so many quirks, lets just try and force\nthis for all RS690s.  See:\nhttps://bugs.freedesktop.org/show_bug.cgi?id=37679\n\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nrcu: Fix day-one dyntick-idle stall-warning bug\n\ncommit a10d206ef1a83121ab7430cb196e0376a7145b22 upstream.\n\nEach grace period is supposed to have at least one callback waiting\nfor that grace period to complete.  However, if CONFIG_NO_HZ=n, an\nextra callback-free grace period is no big problem -- it will chew up\na tiny bit of CPU time, but it will complete normally.  In contrast,\nCONFIG_NO_HZ=y kernels have the potential for all the CPUs to go to\nsleep indefinitely, in turn indefinitely delaying completion of the\ncallback-free grace period.  Given that nothing is waiting on this grace\nperiod, this is also not a problem.\n\nThat is, unless RCU CPU stall warnings are also enabled, as they are\nin recent kernels.  In this case, if a CPU wakes up after at least one\nminute of inactivity, an RCU CPU stall warning will result.  The reason\nthat no one noticed until quite recently is that most systems have enough\nOS noise that they will never remain absolutely idle for a full minute.\nBut there are some embedded systems with cut-down userspace configurations\nthat consistently get into this situation.\n\nAll this begs the question of exactly how a callback-free grace period\ngets started in the first place.  This can happen due to the fact that\nCPUs do not necessarily agree on which grace period is in progress.\nIf a CPU still believes that the grace period that just completed is\nstill ongoing, it will believe that it has callbacks that need to wait for\nanother grace period, never mind the fact that the grace period that they\nwere waiting for just completed.  This CPU can therefore erroneously\ndecide to start a new grace period.  Note that this can happen in\nTREE_RCU and TREE_PREEMPT_RCU even on a single-CPU system:  Deadlock\nconsiderations mean that the CPU that detected the end of the grace\nperiod is not necessarily officially informed of this fact for some time.\n\nOnce this CPU notices that the earlier grace period completed, it will\ninvoke its callbacks.  It then won't have any callbacks left.  If no\nother CPU has any callbacks, we now have a callback-free grace period.\n\nThis commit therefore makes CPUs check more carefully before starting a\nnew grace period.  This new check relies on an array of tail pointers\ninto each CPU's list of callbacks.  If the CPU is up to date on which\ngrace periods have completed, it checks to see if any callbacks follow\nthe RCU_DONE_TAIL segment, otherwise it checks to see if any callbacks\nfollow the RCU_WAIT_TAIL segment.  The reason that this works is that\nthe RCU_WAIT_TAIL segment will be promoted to the RCU_DONE_TAIL segment\nas soon as the CPU is officially notified that the old grace period\nhas ended.\n\nThis change is to cpu_needs_another_gp(), which is called in a number\nof places.  The only one that really matters is in rcu_start_gp(), where\nthe root rcu_node structure's ->lock is held, which prevents any\nother CPU from starting or completing a grace period, so that the\ncomparison that determines whether the CPU is missing the completion\nof a grace period is stable.\n\nReported-by: Becky Bruce <bgillbruce@gmail.com>\nReported-by: Subodh Nijsure <snijsure@grid-net.com>\nReported-by: Paul Walmsley <paul@pwsan.com>\nSigned-off-by: Paul E. McKenney <paul.mckenney@linaro.org>\nSigned-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>\nTested-by: Paul Walmsley <paul@pwsan.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nr8169: fix wake on lan setting for non-8111E.\n\ncommit d4ed95d796e5126bba51466dc07e287cebc8bd19 upstream.\n\nOnly 8111E needs enable RxConfig bit 0 ~ 3 when suspending or\nshutdowning for wake on lan.\n\nSigned-off-by: Hayes Wang <hayeswang@realtek.com>\nAcked-by: Francois Romieu <romieu@fr.zoreil.com>\nAcked-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nr8169: don't enable rx when shutdown.\n\ncommit aaa89c08d9ffa3739c93d65d98b73ec2aa2e93a5 upstream.\n\nOnly 8111b needs to enable rx when shutdowning with WoL.\n\nSigned-off-by: Hayes Wang <hayeswang@realtek.com>\nAcked-by: Francois Romieu <romieu@fr.zoreil.com>\nAcked-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nr8169: remove erroneous processing of always set bit.\n\ncommit e03f33af79f0772156e1a1a1e36bdddf8012b2e4 upstream.\n\nWhen set, RxFOVF (resp. RxBOVF) is always 1 (resp. 0).\n\nSigned-off-by: Francois Romieu <romieu@fr.zoreil.com>\nCc: Hayes <hayeswang@realtek.com>\nAcked-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nr8169: jumbo fixes.\n\ncommit d58d46b5d85139d18eb939aa7279c160bab70484 upstream.\n\n- fix features : jumbo frames and checksumming can not be used at the\n  same time.\n\n- introduce hw_jumbo_{enable / disable} helpers. Their content has been\n  creatively extracted from Realtek's own drivers. As an illustration,\n  it would be nice to know how/if the MaxTxPacketSize register operates\n  when the device can work with a 9k jumbo frame as its documentation\n  (8168c) can not be applied beyond ~7k.\n\n- rtl_tx_performance_tweak is moved forward. No change.\n\nSigned-off-by: Francois Romieu <romieu@fr.zoreil.com>\nAcked-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nr8169: expand received packet length indication.\n\ncommit deb9d93c89d311714a60809b28160e538e1cbb43 upstream.\n\n8168d and above allow jumbo frames beyond 8k. Bump the received\npacket length check before enabling jumbo frames on these chipsets.\n\nFrame length indication covers bits 0..13 of the first Rx descriptor\n32 bits for the 8169 and 8168. I only have authoritative documentation\nfor the allowed use of the extra (13) bit with the 8169 and 8168c.\nRealtek's drivers use the same mask for the 816x and the fast ethernet\nonly 810x.\n\nSigned-off-by: Francois Romieu <romieu@fr.zoreil.com>\nAcked-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nr8169: increase the delay parameter of pm_schedule_suspend\n\ncommit 10953db8e1a278742ef7e64a3d1491802bcfa98b upstream\nThe link down would occur when reseting PHY. And it would take about 2 ~ 5\nseconds from link down to link up. If the delay of pm_schedule_suspend is\nnot long enough, the device would enter runtime_suspend before link up.\nAfter link up, the device would wake up and reset PHY again. Then, you\nwould find the driver keep in a loop of runtime_suspend and rumtime_resume.\n\nSigned-off-by: Hayes Wang <hayeswang@realtek.com>\nAcked-by: Francois Romieu <romieu@fr.zoreil.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nr8169: Rx FIFO overflow fixes.\n\ncommit 811fd3010cf512f2e23e6c4c912aad54516dc706 upstream.\n\nRealtek has specified that the post 8168c gigabit chips and the post\n8105e fast ethernet chips recover automatically from a Rx FIFO overflow.\nThe driver does not need to clear the RxFIFOOver bit of IntrStatus and\nit should rather avoid messing it.\n\nThe implementation deserves some explanation:\n1. events outside of the intr_event bit mask are now ignored. It enforces\n   a no-processing policy for the events that either should not be there\n   or should be ignored.\n\n2. RxFIFOOver was already ignored in rtl_cfg_infos[RTL_CFG_1] for the\n   whole 8168 line of chips with two exceptions:\n   - RTL_GIGA_MAC_VER_22 since b5ba6d12bdac21bc0620a5089e0f24e362645efd\n     (\"use RxFIFO overflow workaround for 8168c chipset.\").\n     This one should now be correctly handled.\n   - RTL_GIGA_MAC_VER_11 (8168b) which requires a different Rx FIFO\n     overflow processing.\n\n   Though it does not conform to Realtek suggestion above, the updated\n   driver includes no change for RTL_GIGA_MAC_VER_12 and RTL_GIGA_MAC_VER_17.\n   Both are 8168b. RTL_GIGA_MAC_VER_12 is common and a bit old so I'd rather\n   wait for experimental evidence that the change suggested by Realtek really\n   helps or does not hurt in unexpected ways.\n\n   Removed case statements in rtl8169_interrupt are only 8168 relevant.\n\n3. RxFIFOOver is masked for post 8105e 810x chips, namely the sole 8105e\n   (RTL_GIGA_MAC_VER_30) itself.\n\nSigned-off-by: Francois Romieu <romieu@fr.zoreil.com>\nCc: hayeswang <hayeswang@realtek.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nReviewed-by: Jonathan Nieder <jrnieder@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nr8169: fix Config2 MSIEnable bit setting.\n\ncommit 2ca6cf06d988fea21e812a86be79353352677c9c upstream.\n\nThe MSIEnable bit is only available for the 8169.\n\nAvoid Config2 writes for the post-8169 8168 and 810x.\n\nReported-by: Su Kang Yin <cantona@cantona.net>\nSigned-off-by: Francois Romieu <romieu@fr.zoreil.com>\nCc: Hayes Wang <hayeswang@realtek.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nr8169: missing barriers.\n\ncommit 1e874e041fc7c222cbd85b20c4406070be1f687a upstream.\n\nSigned-off-by: Francois Romieu <romieu@fr.zoreil.com>\nCc: Hayes Wang <hayeswang@realtek.com>\nAcked-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nr8169: runtime resume before shutdown.\n\ncommit 2a15cd2ff488a9fdb55e5e34060f499853b27c77 upstream.\n\nWith runtime PM, if the ethernet cable is disconnected, the device is\ntransitioned to D3 state to conserve energy. If the system is shutdown\nin this state, any register accesses in rtl_shutdown are dropped on\nthe floor. As the device was programmed by .runtime_suspend() to wake\non link changes, it is thus brought back up as soon as the link recovers.\n\nResuming every suspended device through the driver core would slow things\ndown and it is not clear how many devices really need it now.\n\nOriginal report and D0 transition patch by Sameer Nanda. Patch has been\nchanged to comply with advices by Rafael J. Wysocki and the PM folks.\n\nReported-by: Sameer Nanda <snanda@chromium.org>\nSigned-off-by: Francois Romieu <romieu@fr.zoreil.com>\nCc: Rafael J. Wysocki <rjw@sisk.pl>\nCc: Hayes Wang <hayeswang@realtek.com>\nCc: Alan Stern <stern@rowland.harvard.edu>\nAcked-by: Rafael J. Wysocki <rjw@sisk.pl>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nr8169: Config1 is read-only on 8168c and later.\n\ncommit 851e60221926a53344b4227879858bef841b0477 upstream.\n\nSuggested by Hayes.\n\nSigned-off-by: Francois Romieu <romieu@fr.zoreil.com>\nCc: Hayes Wang <hayeswang@realtek.com>\nAcked-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nr8169: 8168c and later require bit 0x20 to be set in Config2 for PME signaling.\n\ncommit d387b427c973974dd619a33549c070ac5d0e089f upstream.\n\nThe new 84xx stopped flying below the radars.\n\nSigned-off-by: Francois Romieu <romieu@fr.zoreil.com>\nCc: Hayes Wang <hayeswang@realtek.com>\nAcked-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nr8169: fix unsigned int wraparound with TSO\n\ncommit 477206a018f902895bfcd069dd820bfe94c187b1 upstream.\n\nThe r8169 may get stuck or show bad behaviour after activating TSO :\nthe net_device is not stopped when it has no more TX descriptors.\nThis problem comes from TX_BUFS_AVAIL which may reach -1 when all\ntransmit descriptors are in use. The patch simply tries to keep positive\nvalues.\n\nTested with 8111d(onboard) on a D510MO, and with 8111e(onboard) on a\nZotac 890GXITX.\n\nSigned-off-by: Julien Ducourthial <jducourt@free.fr>\nAcked-by: Francois Romieu <romieu@fr.zoreil.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nr8169: call netif_napi_del at errpaths and at driver unload\n\ncommit ad1be8d345416a794dea39761a374032aa471a76 upstream.\n\nWhen register_netdev fails, the init'ed NAPIs by netif_napi_add must be\ndeleted with netif_napi_del, and also when driver unloads, it should\ndelete the NAPI before unregistering netdevice using unregister_netdev.\n\nSigned-off-by: Devendra Naga <devendra.aaru@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nrevert \"mm: mempolicy: Let vma_merge and vma_split handle vma->vm_policy linkages\"\n\ncommit 8d34694c1abf29df1f3c7317936b7e3e2e308d9b upstream.\n\nCommit 05f144a0d5c2 (\"mm: mempolicy: Let vma_merge and vma_split handle\nvma->vm_policy linkages\") removed vma->vm_policy updates code but it is\nthe purpose of mbind_range().  Now, mbind_range() is virtually a no-op\nand while it does not allow memory corruption it is not the right fix.\nThis patch is a revert.\n\n[mgorman@suse.de: Edited changelog]\nSigned-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>\nSigned-off-by: Mel Gorman <mgorman@suse.de>\nCc: Christoph Lameter <cl@linux.com>\nCc: Josh Boyer <jwboyer@gmail.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nmempolicy: remove mempolicy sharing\n\ncommit 869833f2c5c6e4dd09a5378cfc665ffb4615e5d2 upstream.\n\nDave Jones' system call fuzz testing tool \"trinity\" triggered the\nfollowing bug error with slab debugging enabled\n\n    =============================================================================\n    BUG numa_policy (Not tainted): Poison overwritten\n    -----------------------------------------------------------------------------\n\n    INFO: 0xffff880146498250-0xffff880146498250. First byte 0x6a instead of 0x6b\n    INFO: Allocated in mpol_new+0xa3/0x140 age=46310 cpu=6 pid=32154\n     __slab_alloc+0x3d3/0x445\n     kmem_cache_alloc+0x29d/0x2b0\n     mpol_new+0xa3/0x140\n     sys_mbind+0x142/0x620\n     system_call_fastpath+0x16/0x1b\n\n    INFO: Freed in __mpol_put+0x27/0x30 age=46268 cpu=6 pid=32154\n     __slab_free+0x2e/0x1de\n     kmem_cache_free+0x25a/0x260\n     __mpol_put+0x27/0x30\n     remove_vma+0x68/0x90\n     exit_mmap+0x118/0x140\n     mmput+0x73/0x110\n     exit_mm+0x108/0x130\n     do_exit+0x162/0xb90\n     do_group_exit+0x4f/0xc0\n     sys_exit_group+0x17/0x20\n     system_call_fastpath+0x16/0x1b\n\n    INFO: Slab 0xffffea0005192600 objects=27 used=27 fp=0x          (null) flags=0x20000000004080\n    INFO: Object 0xffff880146498250 @offset=592 fp=0xffff88014649b9d0\n\nThe problem is that the structure is being prematurely freed due to a\nreference count imbalance. In the following case mbind(addr, len) should\nreplace the memory policies of both vma1 and vma2 and thus they will\nbecome to share the same mempolicy and the new mempolicy will have the\nMPOL_F_SHARED flag.\n\n  +-------------------+-------------------+\n  |     vma1          |     vma2(shmem)   |\n  +-------------------+-------------------+\n  |                                       |\n addr                                 addr+len\n\nalloc_pages_vma() uses get_vma_policy() and mpol_cond_put() pair for\nmaintaining the mempolicy reference count.  The current rule is that\nget_vma_policy() only increments refcount for shmem VMA and\nmpol_conf_put() only decrements refcount if the policy has\nMPOL_F_SHARED.\n\nIn above case, vma1 is not shmem vma and vma->policy has MPOL_F_SHARED!\nThe reference count will be decreased even though was not increased\nwhenever alloc_page_vma() is called.  This has been broken since commit\n[52cd3b07: mempolicy: rework mempolicy Reference Counting] in 2008.\n\nThere is another serious bug with the sharing of memory policies.\nCurrently, mempolicy rebind logic (it is called from cpuset rebinding)\nignores a refcount of mempolicy and override it forcibly.  Thus, any\nmempolicy sharing may cause mempolicy corruption.  The bug was\nintroduced by commit [68860ec1: cpusets: automatic numa mempolicy\nrebinding].\n\nIdeally, the shared policy handling would be rewritten to either\nproperly handle COW of the policy structures or at least reference count\nMPOL_F_SHARED based exclusively on information within the policy.\nHowever, this patch takes the easier approach of disabling any policy\nsharing between VMAs.  Each new range allocated with sp_alloc will\nallocate a new policy, set the reference count to 1 and drop the\nreference count of the old policy.  This increases the memory footprint\nbut is not expected to be a major problem as mbind() is unlikely to be\nused for fine-grained ranges.  It is also inefficient because it means\nwe allocate a new policy even in cases where mbind_range() could use the\nnew_policy passed to it.  However, it is more straight-forward and the\nchange should be invisible to the user.\n\n[mgorman@suse.de: Edited changelog]\nReported-by: Dave Jones <davej@redhat.com>\nCc: Christoph Lameter <cl@linux.com>\nReviewed-by: Christoph Lameter <cl@linux.com>\nSigned-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>\nSigned-off-by: Mel Gorman <mgorman@suse.de>\nCc: Josh Boyer <jwboyer@gmail.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nmempolicy: fix a race in shared_policy_replace()\n\ncommit b22d127a39ddd10d93deee3d96e643657ad53a49 upstream.\n\nshared_policy_replace() use of sp_alloc() is unsafe.  1) sp_node cannot\nbe dereferenced if sp->lock is not held and 2) another thread can modify\nsp_node between spin_unlock for allocating a new sp node and next\nspin_lock.  The bug was introduced before 2.6.12-rc2.\n\nKosaki's original patch for this problem was to allocate an sp node and\npolicy within shared_policy_replace and initialise it when the lock is\nreacquired.  I was not keen on this approach because it partially\nduplicates sp_alloc().  As the paths were sp->lock is taken are not that\nperformance critical this patch converts sp->lock to sp->mutex so it can\nsleep when calling sp_alloc().\n\n[kosaki.motohiro@jp.fujitsu.com: Original patch]\nSigned-off-by: Mel Gorman <mgorman@suse.de>\nAcked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>\nReviewed-by: Christoph Lameter <cl@linux.com>\nCc: Josh Boyer <jwboyer@gmail.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nmempolicy: fix refcount leak in mpol_set_shared_policy()\n\ncommit 63f74ca21f1fad36d075e063f06dcc6d39fe86b2 upstream.\n\nWhen shared_policy_replace() fails to allocate new->policy is not freed\ncorrectly by mpol_set_shared_policy().  The problem is that shared\nmempolicy code directly call kmem_cache_free() in multiple places where\nit is easy to make a mistake.\n\nThis patch creates an sp_free wrapper function and uses it. The bug was\nintroduced pre-git age (IOW, before 2.6.12-rc2).\n\n[mgorman@suse.de: Editted changelog]\nSigned-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>\nSigned-off-by: Mel Gorman <mgorman@suse.de>\nReviewed-by: Christoph Lameter <cl@linux.com>\nCc: Josh Boyer <jwboyer@gmail.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nmempolicy: fix a memory corruption by refcount imbalance in alloc_pages_vma()\n\ncommit 00442ad04a5eac08a98255697c510e708f6082e2 upstream.\n\nCommit cc9a6c877661 (\"cpuset: mm: reduce large amounts of memory barrier\nrelated damage v3\") introduced a potential memory corruption.\nshmem_alloc_page() uses a pseudo vma and it has one significant unique\ncombination, vma->vm_ops=NULL and vma->policy->flags & MPOL_F_SHARED.\n\nget_vma_policy() does NOT increase a policy ref when vma->vm_ops=NULL\nand mpol_cond_put() DOES decrease a policy ref when a policy has\nMPOL_F_SHARED.  Therefore, when a cpuset update race occurs,\nalloc_pages_vma() falls in 'goto retry_cpuset' path, decrements the\nreference count and frees the policy prematurely.\n\nSigned-off-by: KOSAKI Motoh…","distinct":true,"url":"https://api.github.com/repos/Beeko/android_kernel_samsung_espresso10/commits/299ab895cda60d911c3b4578e105d40e5e221687"}]}