{"push_id":790935018,"size":21,"distinct_size":21,"ref":"refs/heads/sitara-ti-linux-3.14.y","head":"1e0f9d1e577e1d7b9f6b9a6880eb6482314a02b6","before":"d3f59f6e6867d4b846e6ea50bb375c638fa3daf1","commits":[{"sha":"9ab6ec258094da5f24e149243cf1464d610ce985","author":{"email":"521f5e275cfb2d7a088db6fd2470049d61870456@redhat.com","name":"Herton R. Krzesinski"},"message":"ipc,sem: fix use after free on IPC_RMID after a task using same semaphore set exits\n\ncommit 602b8593d2b4138c10e922eeaafe306f6b51817b upstream.\n\nThe current semaphore code allows a potential use after free: in\nexit_sem we may free the task's sem_undo_list while there is still\nanother task looping through the same semaphore set and cleaning the\nsem_undo list at freeary function (the task called IPC_RMID for the same\nsemaphore set).\n\nFor example, with a test program [1] running which keeps forking a lot\nof processes (which then do a semop call with SEM_UNDO flag), and with\nthe parent right after removing the semaphore set with IPC_RMID, and a\nkernel built with CONFIG_SLAB, CONFIG_SLAB_DEBUG and\nCONFIG_DEBUG_SPINLOCK, you can easily see something like the following\nin the kernel log:\n\n   Slab corruption (Not tainted): kmalloc-64 start=ffff88003b45c1c0, len=64\n   000: 6b 6b 6b 6b 6b 6b 6b 6b 00 6b 6b 6b 6b 6b 6b 6b  kkkkkkkk.kkkkkkk\n   010: ff ff ff ff 6b 6b 6b 6b ff ff ff ff ff ff ff ff  ....kkkk........\n   Prev obj: start=ffff88003b45c180, len=64\n   000: 00 00 00 00 ad 4e ad de ff ff ff ff 5a 5a 5a 5a  .....N......ZZZZ\n   010: ff ff ff ff ff ff ff ff c0 fb 01 37 00 88 ff ff  ...........7....\n   Next obj: start=ffff88003b45c200, len=64\n   000: 00 00 00 00 ad 4e ad de ff ff ff ff 5a 5a 5a 5a  .....N......ZZZZ\n   010: ff ff ff ff ff ff ff ff 68 29 a7 3c 00 88 ff ff  ........h).<....\n   BUG: spinlock wrong CPU on CPU#2, test/18028\n   general protection fault: 0000 [#1] SMP\n   Modules linked in: 8021q mrp garp stp llc nf_conntrack_ipv4 nf_defrag_ipv4 ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables binfmt_misc ppdev input_leds joydev parport_pc parport floppy serio_raw virtio_balloon virtio_rng virtio_console virtio_net iosf_mbi crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcspkr qxl ttm drm_kms_helper drm snd_hda_codec_generic i2c_piix4 snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer snd soundcore crc32c_intel virtio_pci virtio_ring virtio pata_acpi ata_generic [last unloaded: speedstep_lib]\n   CPU: 2 PID: 18028 Comm: test Not tainted 4.2.0-rc5+ #1\n   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014\n   RIP: spin_dump+0x53/0xc0\n   Call Trace:\n     spin_bug+0x30/0x40\n     do_raw_spin_unlock+0x71/0xa0\n     _raw_spin_unlock+0xe/0x10\n     freeary+0x82/0x2a0\n     ? _raw_spin_lock+0xe/0x10\n     semctl_down.clone.0+0xce/0x160\n     ? __do_page_fault+0x19a/0x430\n     ? __audit_syscall_entry+0xa8/0x100\n     SyS_semctl+0x236/0x2c0\n     ? syscall_trace_leave+0xde/0x130\n     entry_SYSCALL_64_fastpath+0x12/0x71\n   Code: 8b 80 88 03 00 00 48 8d 88 60 05 00 00 48 c7 c7 a0 2c a4 81 31 c0 65 8b 15 eb 40 f3 7e e8 08 31 68 00 4d 85 e4 44 8b 4b 08 74 5e <45> 8b 84 24 88 03 00 00 49 8d 8c 24 60 05 00 00 8b 53 04 48 89\n   RIP  [<ffffffff810d6053>] spin_dump+0x53/0xc0\n    RSP <ffff88003750fd68>\n   ---[ end trace 783ebb76612867a0 ]---\n   NMI watchdog: BUG: soft lockup - CPU#3 stuck for 22s! [test:18053]\n   Modules linked in: 8021q mrp garp stp llc nf_conntrack_ipv4 nf_defrag_ipv4 ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables binfmt_misc ppdev input_leds joydev parport_pc parport floppy serio_raw virtio_balloon virtio_rng virtio_console virtio_net iosf_mbi crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcspkr qxl ttm drm_kms_helper drm snd_hda_codec_generic i2c_piix4 snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer snd soundcore crc32c_intel virtio_pci virtio_ring virtio pata_acpi ata_generic [last unloaded: speedstep_lib]\n   CPU: 3 PID: 18053 Comm: test Tainted: G      D         4.2.0-rc5+ #1\n   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014\n   RIP: native_read_tsc+0x0/0x20\n   Call Trace:\n     ? delay_tsc+0x40/0x70\n     __delay+0xf/0x20\n     do_raw_spin_lock+0x96/0x140\n     _raw_spin_lock+0xe/0x10\n     sem_lock_and_putref+0x11/0x70\n     SYSC_semtimedop+0x7bf/0x960\n     ? handle_mm_fault+0xbf6/0x1880\n     ? dequeue_task_fair+0x79/0x4a0\n     ? __do_page_fault+0x19a/0x430\n     ? kfree_debugcheck+0x16/0x40\n     ? __do_page_fault+0x19a/0x430\n     ? __audit_syscall_entry+0xa8/0x100\n     ? do_audit_syscall_entry+0x66/0x70\n     ? syscall_trace_enter_phase1+0x139/0x160\n     SyS_semtimedop+0xe/0x10\n     SyS_semop+0x10/0x20\n     entry_SYSCALL_64_fastpath+0x12/0x71\n   Code: 47 10 83 e8 01 85 c0 89 47 10 75 08 65 48 89 3d 1f 74 ff 7e c9 c3 0f 1f 44 00 00 55 48 89 e5 e8 87 17 04 00 66 90 c9 c3 0f 1f 00 <55> 48 89 e5 0f 31 89 c1 48 89 d0 48 c1 e0 20 89 c9 48 09 c8 c9\n   Kernel panic - not syncing: softlockup: hung tasks\n\nI wasn't able to trigger any badness on a recent kernel without the\nproper config debugs enabled, however I have softlockup reports on some\nkernel versions, in the semaphore code, which are similar as above (the\nscenario is seen on some servers running IBM DB2 which uses semaphore\nsyscalls).\n\nThe patch here fixes the race against freeary, by acquiring or waiting\non the sem_undo_list lock as necessary (exit_sem can race with freeary,\nwhile freeary sets un->semid to -1 and removes the same sem_undo from\nlist_proc or when it removes the last sem_undo).\n\nAfter the patch I'm unable to reproduce the problem using the test case\n[1].\n\n[1] Test case used below:\n\n    #include <stdio.h>\n    #include <sys/types.h>\n    #include <sys/ipc.h>\n    #include <sys/sem.h>\n    #include <sys/wait.h>\n    #include <stdlib.h>\n    #include <time.h>\n    #include <unistd.h>\n    #include <errno.h>\n\n    #define NSEM 1\n    #define NSET 5\n\n    int sid[NSET];\n\n    void thread()\n    {\n            struct sembuf op;\n            int s;\n            uid_t pid = getuid();\n\n            s = rand() % NSET;\n            op.sem_num = pid % NSEM;\n            op.sem_op = 1;\n            op.sem_flg = SEM_UNDO;\n\n            semop(sid[s], &op, 1);\n            exit(EXIT_SUCCESS);\n    }\n\n    void create_set()\n    {\n            int i, j;\n            pid_t p;\n            union {\n                    int val;\n                    struct semid_ds *buf;\n                    unsigned short int *array;\n                    struct seminfo *__buf;\n            } un;\n\n            /* Create and initialize semaphore set */\n            for (i = 0; i < NSET; i++) {\n                    sid[i] = semget(IPC_PRIVATE , NSEM, 0644 | IPC_CREAT);\n                    if (sid[i] < 0) {\n                            perror(\"semget\");\n                            exit(EXIT_FAILURE);\n                    }\n            }\n            un.val = 0;\n            for (i = 0; i < NSET; i++) {\n                    for (j = 0; j < NSEM; j++) {\n                            if (semctl(sid[i], j, SETVAL, un) < 0)\n                                    perror(\"semctl\");\n                    }\n            }\n\n            /* Launch threads that operate on semaphore set */\n            for (i = 0; i < NSEM * NSET * NSET; i++) {\n                    p = fork();\n                    if (p < 0)\n                            perror(\"fork\");\n                    if (p == 0)\n                            thread();\n            }\n\n            /* Free semaphore set */\n            for (i = 0; i < NSET; i++) {\n                    if (semctl(sid[i], NSEM, IPC_RMID))\n                            perror(\"IPC_RMID\");\n            }\n\n            /* Wait for forked processes to exit */\n            while (wait(NULL)) {\n                    if (errno == ECHILD)\n                            break;\n            };\n    }\n\n    int main(int argc, char **argv)\n    {\n            pid_t p;\n\n            srand(time(NULL));\n\n            while (1) {\n                    p = fork();\n                    if (p < 0) {\n                            perror(\"fork\");\n                            exit(EXIT_FAILURE);\n                    }\n                    if (p == 0) {\n                            create_set();\n                            goto end;\n                    }\n\n                    /* Wait for forked processes to exit */\n                    while (wait(NULL)) {\n                            if (errno == ECHILD)\n                                    break;\n                    };\n            }\n    end:\n            return 0;\n    }\n\n[akpm@linux-foundation.org: use normal comment layout]\nSigned-off-by: Herton R. Krzesinski <herton@redhat.com>\nAcked-by: Manfred Spraul <manfred@colorfullife.com>\nCc: Davidlohr Bueso <dave@stgolabs.net>\nCc: Rafael Aquini <aquini@redhat.com>\nCC: Aristeu Rozanski <aris@redhat.com>\nCc: David Jeffery <djeffery@redhat.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>","distinct":true,"url":"https://api.github.com/repos/fcooper/sitara-ti-linux-kernel/commits/9ab6ec258094da5f24e149243cf1464d610ce985"},{"sha":"502b83be8213615aa9cec0b24b71035a36b4f017","author":{"email":"e4eddfaff1fc5d7affa656f47ee4d83207ccac30@colorfullife.com","name":"Manfred Spraul"},"message":"ipc/sem.c: update/correct memory barriers\n\ncommit 3ed1f8a99d70ea1cd1508910eb107d0edcae5009 upstream.\n\nsem_lock() did not properly pair memory barriers:\n\n!spin_is_locked() and spin_unlock_wait() are both only control barriers.\nThe code needs an acquire barrier, otherwise the cpu might perform read\noperations before the lock test.\n\nAs no primitive exists inside <include/spinlock.h> and since it seems\nnoone wants another primitive, the code creates a local primitive within\nipc/sem.c.\n\nWith regards to -stable:\n\nThe change of sem_wait_array() is a bugfix, the change to sem_lock() is a\nnop (just a preprocessor redefinition to improve the readability).  The\nbugfix is necessary for all kernels that use sem_wait_array() (i.e.:\nstarting from 3.10).\n\nSigned-off-by: Manfred Spraul <manfred@colorfullife.com>\nReported-by: Oleg Nesterov <oleg@redhat.com>\nAcked-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nCc: \"Paul E. McKenney\" <paulmck@linux.vnet.ibm.com>\nCc: Kirill Tkhai <ktkhai@parallels.com>\nCc: Ingo Molnar <mingo@redhat.com>\nCc: Josh Poimboeuf <jpoimboe@redhat.com>\nCc: Davidlohr Bueso <dave@stgolabs.net>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/fcooper/sitara-ti-linux-kernel/commits/502b83be8213615aa9cec0b24b71035a36b4f017"},{"sha":"97091ac3ccdb83bc3df7a39dd0d6830c7e451c67","author":{"email":"bdcdf23be75b976d8e1ad9f82e6b264941889f50@hotmail.com","name":"Wanpeng Li"},"message":"mm/hwpoison: fix page refcount of unknown non LRU page\n\ncommit 4f32be677b124a49459e2603321c7a5605ceb9f8 upstream.\n\nAfter trying to drain pages from pagevec/pageset, we try to get reference\ncount of the page again, however, the reference count of the page is not\nreduced if the page is still not on LRU list.\n\nFix it by adding the put_page() to drop the page reference which is from\n__get_any_page().\n\nSigned-off-by: Wanpeng Li <wanpeng.li@hotmail.com>\nAcked-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/fcooper/sitara-ti-linux-kernel/commits/97091ac3ccdb83bc3df7a39dd0d6830c7e451c67"},{"sha":"ee1591864c92da6d0d9862e572d3dc32741039c6","author":{"email":"f1431bf4ea962ea2009f7275289c2e0b23d8aceb@oracle.com","name":"Bob Liu"},"message":"xen-blkfront: don't add indirect pages to list when !feature_persistent\n\ncommit 7b0767502b5db11cb1f0daef2d01f6d71b1192dc upstream.\n\nWe should consider info->feature_persistent when adding indirect page to list\ninfo->indirect_pages, else the BUG_ON() in blkif_free() would be triggered.\n\nWhen we are using persistent grants the indirect_pages list\nshould always be empty because blkfront has pre-allocated enough\npersistent pages to fill all requests on the ring.\n\nAcked-by: Roger Pau Monné <roger.pau@citrix.com>\nSigned-off-by: Bob Liu <bob.liu@oracle.com>\nSigned-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/fcooper/sitara-ti-linux-kernel/commits/ee1591864c92da6d0d9862e572d3dc32741039c6"},{"sha":"cf766f632368c773fec1936d941322bbc2e1484b","author":{"email":"3fddac958924aef220f202ca567388ddab3f14a8@infradead.org","name":"Peter Zijlstra"},"message":"perf: Fix fasync handling on inherited events\n\ncommit fed66e2cdd4f127a43fd11b8d92a99bdd429528c upstream.\n\nVince reported that the fasync signal stuff doesn't work proper for\ninherited events. So fix that.\n\nInstalling fasync allocates memory and sets filp->f_flags |= FASYNC,\nwhich upon the demise of the file descriptor ensures the allocation is\nfreed and state is updated.\n\nNow for perf, we can have the events stick around for a while after the\noriginal FD is dead because of references from child events. So we\ncannot copy the fasync pointer around. We can however consistently use\nthe parent's fasync, as that will be updated.\n\nReported-and-Tested-by: Vince Weaver <vincent.weaver@maine.edu>\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nCc: Arnaldo Carvalho deMelo <acme@kernel.org>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: eranian@google.com\nLink: http://lkml.kernel.org/r/1434011521.1495.71.camel@twins\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/fcooper/sitara-ti-linux-kernel/commits/cf766f632368c773fec1936d941322bbc2e1484b"},{"sha":"5862cc57bf06425230531950e2f6858244ad626f","author":{"email":"3fddac958924aef220f202ca567388ddab3f14a8@infradead.org","name":"Peter Zijlstra"},"message":"perf: Fix PERF_EVENT_IOC_PERIOD migration race\n\ncommit c7999c6f3fed9e383d3131474588f282ae6d56b9 upstream.\n\nI ran the perf fuzzer, which triggered some WARN()s which are due to\ntrying to stop/restart an event on the wrong CPU.\n\nUse the normal IPI pattern to ensure we run the code on the correct CPU.\n\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nCc: Vince Weaver <vincent.weaver@maine.edu>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nFixes: bad7192b842c (\"perf: Fix PERF_EVENT_IOC_PERIOD to force-reset the period\")\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/fcooper/sitara-ti-linux-kernel/commits/5862cc57bf06425230531950e2f6858244ad626f"},{"sha":"e7a778e90f8b15160b6b47e600dfcb162e5dc62b","author":{"email":"61d5fad70554ae22d57a37634e04f12f58acc678@redhat.com","name":"Joe Thornber"},"message":"dm thin metadata: delete btrees when releasing metadata snapshot\n\ncommit 7f518ad0a212e2a6fd68630e176af1de395070a7 upstream.\n\nThe device details and mapping trees were just being decremented\nbefore.  Now btree_del() is called to do a deep delete.\n\nSigned-off-by: Joe Thornber <ejt@redhat.com>\nSigned-off-by: Mike Snitzer <snitzer@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/fcooper/sitara-ti-linux-kernel/commits/e7a778e90f8b15160b6b47e600dfcb162e5dc62b"},{"sha":"89651211b61e5dc14f3b7fc3bfba37b661f2a3a1","author":{"email":"320bca71fc381a4a025636043ca86e734e31cf8b@nod.at","name":"Richard Weinberger"},"message":"localmodconfig: Use Kbuild files too\n\ncommit c0ddc8c745b7f89c50385fd7aa03c78dc543fa7a upstream.\n\nIn kbuild it is allowed to define objects in files named \"Makefile\"\nand \"Kbuild\".\nCurrently localmodconfig reads objects only from \"Makefile\"s and misses\nmodules like nouveau.\n\nLink: http://lkml.kernel.org/r/1437948415-16290-1-git-send-email-richard@nod.at\n\nReported-and-tested-by: Leonidas Spyropoulos <artafinde@gmail.com>\nSigned-off-by: Richard Weinberger <richard@nod.at>\nSigned-off-by: Steven Rostedt <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/fcooper/sitara-ti-linux-kernel/commits/89651211b61e5dc14f3b7fc3bfba37b661f2a3a1"},{"sha":"8fe179e3b6beb7d5be271327e49e1a59721741dd","author":{"email":"17b9e1c64588c7fa6419b4d29dc1f4426279ba01@walle.cc","name":"Michael Walle"},"message":"EDAC, ppc4xx: Access mci->csrows array elements properly\n\ncommit 5c16179b550b9fd8114637a56b153c9768ea06a5 upstream.\n\nThe commit\n\n  de3910eb79ac (\"edac: change the mem allocation scheme to\n\t\t make Documentation/kobject.txt happy\")\n\nchanged the memory allocation for the csrows member. But ppc4xx_edac was\nforgotten in the patch. Fix it.\n\nSigned-off-by: Michael Walle <michael@walle.cc>\nCc: linux-edac <linux-edac@vger.kernel.org>\nCc: Mauro Carvalho Chehab <mchehab@osg.samsung.com>\nLink: http://lkml.kernel.org/r/1437469253-8611-1-git-send-email-michael@walle.cc\nSigned-off-by: Borislav Petkov <bp@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/fcooper/sitara-ti-linux-kernel/commits/8fe179e3b6beb7d5be271327e49e1a59721741dd"},{"sha":"09e7286048339b30934fd3d1faece01a63dd770a","author":{"email":"08dc22c6156113f2deff178e35e3ed9b24d6af9e@amd.com","name":"Alex Deucher"},"message":"drm/radeon: add new OLAND pci id\n\ncommit e037239e5e7b61007763984aa35a8329596d8c88 upstream.\n\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/fcooper/sitara-ti-linux-kernel/commits/09e7286048339b30934fd3d1faece01a63dd770a"},{"sha":"d2aacf48b4fd843b24fe2ab45c16814329069a7a","author":{"email":"a26490dfbee4be3d38287ad6448444504f58193c@vmware.com","name":"Thomas Hellstrom"},"message":"drm/vmwgfx: Fix execbuf locking issues\n\ncommit 3e04e2fe6d87807d27521ad6ebb9e7919d628f25 upstream.\n\nThis addresses two issues that cause problems with viewperf maya-03 in\nsituation with memory pressure.\n\nThe first issue causes attempts to unreserve buffers if batched\nreservation fails due to, for example, a signal pending. While previously\nthe ttm_eu api was resistant against this type of error, it is no longer\nand the lockdep code will complain about attempting to unreserve buffers\nthat are not reserved. The issue is resolved by avoid calling\nttm_eu_backoff_reservation in the buffer reserve error path.\n\nThe second issue is that the binding_mutex may be held when user-space\nfence objects are created and hence during memory reclaims. This may cause\nrecursive attempts to grab the binding mutex. The issue is resolved by not\nholding the binding mutex across fence creation and submission.\n\nSigned-off-by: Thomas Hellstrom <thellstrom@vmware.com>\nReviewed-by: Sinclair Yeh <syeh@vmware.com>\nSigned-off-by: Dave Airlie <airlied@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/fcooper/sitara-ti-linux-kernel/commits/d2aacf48b4fd843b24fe2ab45c16814329069a7a"},{"sha":"cdef3013688a1f48c440db395b564a66c11f5f72","author":{"email":"28563a2d387a4f8f033bf7abbf80937064dfbe0c@sandisk.com","name":"Bart Van Assche"},"message":"libfc: Fix fc_exch_recv_req() error path\n\ncommit f6979adeaab578f8ca14fdd32b06ddee0d9d3314 upstream.\n\nDue to patch \"libfc: Do not invoke the response handler after\nfc_exch_done()\" (commit ID 7030fd62) the lport_recv() call\nin fc_exch_recv_req() is passed a dangling pointer. Avoid this\nby moving the fc_frame_free() call from fc_invoke_resp() to its\ncallers. This patch fixes the following crash:\n\ngeneral protection fault: 0000 [#3] PREEMPT SMP\nRIP: fc_lport_recv_req+0x72/0x280 [libfc]\nCall Trace:\n fc_exch_recv+0x642/0xde0 [libfc]\n fcoe_percpu_receive_thread+0x46a/0x5ed [fcoe]\n kthread+0x10a/0x120\n ret_from_fork+0x42/0x70\n\nSigned-off-by: Bart Van Assche <bart.vanassche@sandisk.com>\nSigned-off-by: Vasu Dev <vasu.dev@intel.com>\nSigned-off-by: James Bottomley <JBottomley@Odin.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/fcooper/sitara-ti-linux-kernel/commits/cdef3013688a1f48c440db395b564a66c11f5f72"},{"sha":"56568d1f973b5167f2941cf05ff92ae48070f09f","author":{"email":"28563a2d387a4f8f033bf7abbf80937064dfbe0c@sandisk.com","name":"Bart Van Assche"},"message":"libfc: Fix fc_fcp_cleanup_each_cmd()\n\ncommit 8f2777f53e3d5ad8ef2a176a4463a5c8e1a16431 upstream.\n\nSince fc_fcp_cleanup_cmd() can sleep this function must not\nbe called while holding a spinlock. This patch avoids that\nfc_fcp_cleanup_each_cmd() triggers the following bug:\n\nBUG: scheduling while atomic: sg_reset/1512/0x00000202\n1 lock held by sg_reset/1512:\n #0:  (&(&fsp->scsi_pkt_lock)->rlock){+.-...}, at: [<ffffffffc0225cd5>] fc_fcp_cleanup_each_cmd.isra.21+0xa5/0x150 [libfc]\nPreemption disabled at:[<ffffffffc0225cd5>] fc_fcp_cleanup_each_cmd.isra.21+0xa5/0x150 [libfc]\nCall Trace:\n [<ffffffff816c612c>] dump_stack+0x4f/0x7b\n [<ffffffff810828bc>] __schedule_bug+0x6c/0xd0\n [<ffffffff816c87aa>] __schedule+0x71a/0xa10\n [<ffffffff816c8ad2>] schedule+0x32/0x80\n [<ffffffffc0217eac>] fc_seq_set_resp+0xac/0x100 [libfc]\n [<ffffffffc0218b11>] fc_exch_done+0x41/0x60 [libfc]\n [<ffffffffc0225cff>] fc_fcp_cleanup_each_cmd.isra.21+0xcf/0x150 [libfc]\n [<ffffffffc0225f43>] fc_eh_device_reset+0x1c3/0x270 [libfc]\n [<ffffffff814a2cc9>] scsi_try_bus_device_reset+0x29/0x60\n [<ffffffff814a3908>] scsi_ioctl_reset+0x258/0x2d0\n [<ffffffff814a2650>] scsi_ioctl+0x150/0x440\n [<ffffffff814b3a9d>] sd_ioctl+0xad/0x120\n [<ffffffff8132f266>] blkdev_ioctl+0x1b6/0x810\n [<ffffffff811da608>] block_ioctl+0x38/0x40\n [<ffffffff811b4e08>] do_vfs_ioctl+0x2f8/0x530\n [<ffffffff811b50c1>] SyS_ioctl+0x81/0xa0\n [<ffffffff816cf8b2>] system_call_fastpath+0x16/0x7a\n\nSigned-off-by: Bart Van Assche <bart.vanassche@sandisk.com>\nSigned-off-by: Vasu Dev <vasu.dev@intel.com>\nSigned-off-by: James Bottomley <JBottomley@Odin.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/fcooper/sitara-ti-linux-kernel/commits/56568d1f973b5167f2941cf05ff92ae48070f09f"},{"sha":"0d57510d39d0b4d54b686a1df2e8e099ca588dcc","author":{"email":"ba324ca7b1c77fc20bb970d5aff6eea9377918a5@roeck-us.net","name":"Guenter Roeck"},"message":"regmap: regcache-rbtree: Clean new present bits on present bitmap resize\n\ncommit 8ef9724bf9718af81cfc5132253372f79c71b7e2 upstream.\n\nWhen inserting a new register into a block, the present bit map size is\nincreased using krealloc. krealloc does not clear the additionally\nallocated memory, leaving it filled with random values. Result is that\nsome registers are considered cached even though this is not the case.\n\nFix the problem by clearing the additionally allocated memory. Also, if\nthe bitmap size does not increase, do not reallocate the bitmap at all\nto reduce overhead.\n\nFixes: 3f4ff561bc88 (\"regmap: rbtree: Make cache_present bitmap per node\")\nSigned-off-by: Guenter Roeck <linux@roeck-us.net>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/fcooper/sitara-ti-linux-kernel/commits/0d57510d39d0b4d54b686a1df2e8e099ca588dcc"},{"sha":"66df6a5db4d2cc9b6a371c83c7141742a41b8372","author":{"email":"6135224f23789828bd8d3b771a2745286516a2b5@freescale.com","name":"Horia Geant?"},"message":"crypto: caam - fix memory corruption in ahash_final_ctx\n\ncommit b310c178e6d897f82abb9da3af1cd7c02b09f592 upstream.\n\nWhen doing pointer operation for accessing the HW S/G table,\na value representing number of entries (and not number of bytes)\nmust be used.\n\nFixes: 045e36780f115 (\"crypto: caam - ahash hmac support\")\nSigned-off-by: Horia Geant? <horia.geanta@freescale.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/fcooper/sitara-ti-linux-kernel/commits/66df6a5db4d2cc9b6a371c83c7141742a41b8372"},{"sha":"8cb907d70199b25095729b39a1cc93692764ea19","author":{"email":"32f7bf5a1f07a8b363256f1773dbeada59d65244@opteya.com","name":"Yann Droneaud"},"message":"arm64/mm: Remove hack in mmap randomize layout\n\ncommit d6c763afab142a85e4770b4bc2a5f40f256d5c5d upstream.\n\nSince commit 8a0a9bd4db63 ('random: make get_random_int() more\nrandom'), get_random_int() returns a random value for each call,\nso comment and hack introduced in mmap_rnd() as part of commit\n1d18c47c735e ('arm64: MMU fault handling and page table management')\nare incorrects.\n\nCommit 1d18c47c735e seems to use the same hack introduced by\ncommit a5adc91a4b44 ('powerpc: Ensure random space between stack\nand mmaps'), latter copied in commit 5a0efea09f42 ('sparc64: Sharpen\naddress space randomization calculations.').\n\nBut both architectures were cleaned up as part of commit\nfa8cbaaf5a68 ('powerpc+sparc64/mm: Remove hack in mmap randomize\nlayout') as hack is no more needed since commit 8a0a9bd4db63.\n\nSo the present patch removes the comment and the hack around\nget_random_int() on AArch64's mmap_rnd().\n\nCc: David S. Miller <davem@davemloft.net>\nCc: Anton Blanchard <anton@samba.org>\nCc: Benjamin Herrenschmidt <benh@kernel.crashing.org>\nAcked-by: Will Deacon <will.deacon@arm.com>\nAcked-by: Dan McGee <dpmcgee@gmail.com>\nSigned-off-by: Yann Droneaud <ydroneaud@opteya.com>\nSigned-off-by: Will Deacon <will.deacon@arm.com>\nCc: Matthias Brugger <mbrugger@suse.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/fcooper/sitara-ti-linux-kernel/commits/8cb907d70199b25095729b39a1cc93692764ea19"},{"sha":"6a353c14370d6dd846ecbcf6051b743e47be8dbd","author":{"email":"75ea6bb7bfc1186f92d26164de5f9268c9a45b59@rowland.harvard.edu","name":"Alan Stern"},"message":"SCSI: Fix NULL pointer dereference in runtime PM\n\ncommit 49718f0fb8c9af192b33d8af3a2826db04025371 upstream.\n\nThe routines in scsi_rpm.c assume that if a runtime-PM callback is\ninvoked for a SCSI device, it can only mean that the device's driver\nhas asked the block layer to handle the runtime power management (by\ncalling blk_pm_runtime_init(), which among other things sets q->dev).\n\nHowever, this assumption turns out to be wrong for things like the ses\ndriver.  Normally ses devices are not allowed to do runtime PM, but\nuserspace can override this setting.  If this happens, the kernel gets\na NULL pointer dereference when blk_post_runtime_resume() tries to use\nthe uninitialized q->dev pointer.\n\nThis patch fixes the problem by calling the block layer's runtime-PM\nroutines only if the device's driver really does have a runtime-PM\ncallback routine.  Since ses doesn't define any such callbacks, the\ncrash won't occur.\n\nThis fixes Bugzilla #101371.\n\nSigned-off-by: Alan Stern <stern@rowland.harvard.edu>\nReported-by: Stanisław Pitucha <viraptor@gmail.com>\nReported-by: Ilan Cohen <ilanco@gmail.com>\nTested-by: Ilan Cohen <ilanco@gmail.com>\nReviewed-by: Johannes Thumshirn <jthumshirn@suse.de>\nSigned-off-by: James Bottomley <JBottomley@Odin.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/fcooper/sitara-ti-linux-kernel/commits/6a353c14370d6dd846ecbcf6051b743e47be8dbd"},{"sha":"cd6777489103bb263083a27c704b74b80452a434","author":{"email":"a16cc0c82647c52d401177f8e50567df5499e36c@arm.com","name":"Marc Zyngier"},"message":"arm64: KVM: Fix host crash when injecting a fault into a 32bit guest\n\ncommit 126c69a0bd0e441bf6766a5d9bf20de011be9f68 upstream.\n\nWhen injecting a fault into a misbehaving 32bit guest, it seems\nrather idiotic to also inject a 64bit fault that is only going\nto corrupt the guest state. This leads to a situation where we\nperform an illegal exception return at EL2 causing the host\nto crash instead of killing the guest.\n\nJust fix the stupid bug that has been there from day 1.\n\nReported-by: Russell King <rmk+kernel@arm.linux.org.uk>\nTested-by: Russell King <rmk+kernel@arm.linux.org.uk>\nSigned-off-by: Marc Zyngier <marc.zyngier@arm.com>\nSigned-off-by: Will Deacon <will.deacon@arm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/fcooper/sitara-ti-linux-kernel/commits/cd6777489103bb263083a27c704b74b80452a434"},{"sha":"48f8f36a6c8018c2b36ea207aaf68ef5326c5075","author":{"email":"4645f7897fd33786a2ee1264d590b3c400559d85@linuxfoundation.org","name":"Greg Kroah-Hartman"},"message":"Linux 3.14.52","distinct":true,"url":"https://api.github.com/repos/fcooper/sitara-ti-linux-kernel/commits/48f8f36a6c8018c2b36ea207aaf68ef5326c5075"},{"sha":"6bbbdf074c2f925f5ca8b468999482904dc9aeaf","author":{"email":"e3b35f83d72b7ba6fb4ff25d26b632317d5f12dc@list.ti.com","name":"Texas Instruments Auto Merger"},"message":"Merge tag 'v3.14.52' of http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable into ti-linux-3.14.y\n\nThis is the 3.14.52 stable release\n\n* tag 'v3.14.52' of http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable:\n  Linux 3.14.52\n  arm64: KVM: Fix host crash when injecting a fault into a 32bit guest\n  SCSI: Fix NULL pointer dereference in runtime PM\n  arm64/mm: Remove hack in mmap randomize layout\n  crypto: caam - fix memory corruption in ahash_final_ctx\n  regmap: regcache-rbtree: Clean new present bits on present bitmap resize\n  libfc: Fix fc_fcp_cleanup_each_cmd()\n  libfc: Fix fc_exch_recv_req() error path\n  drm/vmwgfx: Fix execbuf locking issues\n  drm/radeon: add new OLAND pci id\n  EDAC, ppc4xx: Access mci->csrows array elements properly\n  localmodconfig: Use Kbuild files too\n  dm thin metadata: delete btrees when releasing metadata snapshot\n  perf: Fix PERF_EVENT_IOC_PERIOD migration race\n  perf: Fix fasync handling on inherited events\n  xen-blkfront: don't add indirect pages to list when !feature_persistent\n  mm/hwpoison: fix page refcount of unknown non LRU page\n  ipc/sem.c: update/correct memory barriers\n  ipc,sem: fix use after free on IPC_RMID after a task using same semaphore set exits\n\nSigned-off-by: Texas Instruments Auto Merger <lcpd_integration@list.ti.com>","distinct":true,"url":"https://api.github.com/repos/fcooper/sitara-ti-linux-kernel/commits/6bbbdf074c2f925f5ca8b468999482904dc9aeaf"}]}