{"push_id":841615173,"size":18,"distinct_size":18,"ref":"refs/heads/linux-3.10.y","head":"d17332ebfb5f2010ae5d3332a52df361f28ae4a8","before":"61ce1520149bb1cfdc9a2946a1b6a33119742881","commits":[{"sha":"9bbb3d0d1d76d867a8425756e22b1af6d9654a1c","author":{"email":"c600dc1dfcd5dfaa88c69d8339e7002b7cd99cd3@fe80.eu","name":"Alexander Couzens"},"message":"l2tp: protect tunnel->del_work by ref_count\n\n[ Upstream commit 06a15f51cf3618e32a73871ee6a547ef7fd902b5 ]\n\nThere is a small chance that tunnel_free() is called before tunnel->del_work scheduled\nresulting in a zero pointer dereference.\n\nSigned-off-by: Alexander Couzens <lynxis@fe80.eu>\nAcked-by: James Chapman <jchapman@katalix.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/9bbb3d0d1d76d867a8425756e22b1af6d9654a1c"},{"sha":"f9b8d11b312f8caaa9dfcf15fc7ab60d9167a6d0","author":{"email":"aa17ba42a0685b214660ffb377dc7569a94d48c9@bytheb.org","name":"Aaron Conole"},"message":"af_unix: Convert the unix_sk macro to an inline function for type safety\n\n[ Upstream commit 4613012db1d911f80897f9446a49de817b2c4c47 ]\n\nAs suggested by Eric Dumazet this change replaces the\n#define with a static inline function to enjoy\ncomplaints by the compiler when misusing the API.\n\nSigned-off-by: Aaron Conole <aconole@bytheb.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/f9b8d11b312f8caaa9dfcf15fc7ab60d9167a6d0"},{"sha":"1f21dc672d811af15694c6e9c68d275691f91343","author":{"email":"aa17ba42a0685b214660ffb377dc7569a94d48c9@bytheb.org","name":"Aaron Conole"},"message":"af_unix: return data from multiple SKBs on recv() with MSG_PEEK flag\n\n[ Upstream commit 9f389e35674f5b086edd70ed524ca0f287259725 ]\n\nAF_UNIX sockets now return multiple skbs from recv() when MSG_PEEK flag\nis set.\n\nThis is referenced in kernel bugzilla #12323 @\nhttps://bugzilla.kernel.org/show_bug.cgi?id=12323\n\nAs described both in the BZ and lkml thread @\nhttp://lkml.org/lkml/2008/1/8/444 calling recv() with MSG_PEEK on an\nAF_UNIX socket only reads a single skb, where the desired effect is\nto return as much skb data has been queued, until hitting the recv\nbuffer size (whichever comes first).\n\nThe modified MSG_PEEK path will now move to the next skb in the tree\nand jump to the again: label, rather than following the natural loop\nstructure. This requires duplicating some of the loop head actions.\n\nThis was tested using the python socketpair python code attached to\nthe bugzilla issue.\n\nSigned-off-by: Aaron Conole <aconole@bytheb.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/1f21dc672d811af15694c6e9c68d275691f91343"},{"sha":"275ceb01d2bbf8013c907087e9fea084fd3c55c9","author":{"email":"95dcc1879f3489c0d5163907cdd946775296b2dd@nicira.com","name":"Pravin B Shelar"},"message":"skbuff: Fix skb checksum flag on skb pull\n\n[ Upstream commit 6ae459bdaaeebc632b16e54dcbabb490c6931d61 ]\n\nVXLAN device can receive skb with checksum partial. But the checksum\noffset could be in outer header which is pulled on receive. This results\nin negative checksum offset for the skb. Such skb can cause the assert\nfailure in skb_checksum_help(). Following patch fixes the bug by setting\nchecksum-none while pulling outer header.\n\nFollowing is the kernel panic msg from old kernel hitting the bug.\n\n------------[ cut here ]------------\nkernel BUG at net/core/dev.c:1906!\nRIP: 0010:[<ffffffff81518034>] skb_checksum_help+0x144/0x150\nCall Trace:\n<IRQ>\n[<ffffffffa0164c28>] queue_userspace_packet+0x408/0x470 [openvswitch]\n[<ffffffffa016614d>] ovs_dp_upcall+0x5d/0x60 [openvswitch]\n[<ffffffffa0166236>] ovs_dp_process_packet_with_key+0xe6/0x100 [openvswitch]\n[<ffffffffa016629b>] ovs_dp_process_received_packet+0x4b/0x80 [openvswitch]\n[<ffffffffa016c51a>] ovs_vport_receive+0x2a/0x30 [openvswitch]\n[<ffffffffa0171383>] vxlan_rcv+0x53/0x60 [openvswitch]\n[<ffffffffa01734cb>] vxlan_udp_encap_recv+0x8b/0xf0 [openvswitch]\n[<ffffffff8157addc>] udp_queue_rcv_skb+0x2dc/0x3b0\n[<ffffffff8157b56f>] __udp4_lib_rcv+0x1cf/0x6c0\n[<ffffffff8157ba7a>] udp_rcv+0x1a/0x20\n[<ffffffff8154fdbd>] ip_local_deliver_finish+0xdd/0x280\n[<ffffffff81550128>] ip_local_deliver+0x88/0x90\n[<ffffffff8154fa7d>] ip_rcv_finish+0x10d/0x370\n[<ffffffff81550365>] ip_rcv+0x235/0x300\n[<ffffffff8151ba1d>] __netif_receive_skb+0x55d/0x620\n[<ffffffff8151c360>] netif_receive_skb+0x80/0x90\n[<ffffffff81459935>] virtnet_poll+0x555/0x6f0\n[<ffffffff8151cd04>] net_rx_action+0x134/0x290\n[<ffffffff810683d8>] __do_softirq+0xa8/0x210\n[<ffffffff8162fe6c>] call_softirq+0x1c/0x30\n[<ffffffff810161a5>] do_softirq+0x65/0xa0\n[<ffffffff810687be>] irq_exit+0x8e/0xb0\n[<ffffffff81630733>] do_IRQ+0x63/0xe0\n[<ffffffff81625f2e>] common_interrupt+0x6e/0x6e\n\nReported-by: Anupam Chanda <achanda@vmware.com>\nSigned-off-by: Pravin B Shelar <pshelar@nicira.com>\nAcked-by: Tom Herbert <tom@herbertland.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/275ceb01d2bbf8013c907087e9fea084fd3c55c9"},{"sha":"f03a8061b5c46dbc6fac58d7933de35ef91841f0","author":{"email":"95dcc1879f3489c0d5163907cdd946775296b2dd@nicira.com","name":"Pravin B Shelar"},"message":"skbuff: Fix skb checksum partial check.\n\n[ Upstream commit 31b33dfb0a144469dd805514c9e63f4993729a48 ]\n\nEarlier patch 6ae459bda tried to detect void ckecksum partial\nskb by comparing pull length to checksum offset. But it does\nnot work for all cases since checksum-offset depends on\nupdates to skb->data.\n\nFollowing patch fixes it by validating checksum start offset\nafter skb-data pointer is updated. Negative value of checksum\noffset start means there is no need to checksum.\n\nFixes: 6ae459bda (\"skbuff: Fix skb checksum flag on skb pull\")\nReported-by: Andrew Vagin <avagin@odin.com>\nSigned-off-by: Pravin B Shelar <pshelar@nicira.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/f03a8061b5c46dbc6fac58d7933de35ef91841f0"},{"sha":"dec23a559fd24701c59f322b669bae73820b257d","author":{"email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com","name":"Eric Dumazet"},"message":"net: add pfmemalloc check in sk_add_backlog()\n\n[ Upstream commit c7c49b8fde26b74277188bdc6c9dca38db6fa35b ]\n\nGreg reported crashes hitting the following check in __sk_backlog_rcv()\n\n\tBUG_ON(!sock_flag(sk, SOCK_MEMALLOC));\n\nThe pfmemalloc bit is currently checked in sk_filter().\n\nThis works correctly for TCP, because sk_filter() is ran in\ntcp_v[46]_rcv() before hitting the prequeue or backlog checks.\n\nFor UDP or other protocols, this does not work, because the sk_filter()\nis ran from sock_queue_rcv_skb(), which might be called _after_ backlog\nqueuing if socket is owned by user by the time packet is processed by\nsoftirq handler.\n\nFixes: b4b9e35585089 (\"netvm: set PF_MEMALLOC as appropriate during SKB processing\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Greg Thelen <gthelen@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/dec23a559fd24701c59f322b669bae73820b257d"},{"sha":"9db7ed146a62e3c66a8a7263fdf4adb5c48d16ca","author":{"email":"c9cf31cb6c9821bed82e940f06145b026ca536b5@alphalink.fr","name":"Guillaume Nault"},"message":"ppp: don't override sk->sk_state in pppoe_flush_dev()\n\n[ Upstream commit e6740165b8f7f06d8caee0fceab3fb9d790a6fed ]\n\nSince commit 2b018d57ff18 (\"pppoe: drop PPPOX_ZOMBIEs in pppoe_release\"),\npppoe_release() calls dev_put(po->pppoe_dev) if sk is in the\nPPPOX_ZOMBIE state. But pppoe_flush_dev() can set sk->sk_state to\nPPPOX_ZOMBIE _and_ reset po->pppoe_dev to NULL. This leads to the\nfollowing oops:\n\n[  570.140800] BUG: unable to handle kernel NULL pointer dereference at 00000000000004e0\n[  570.142931] IP: [<ffffffffa018c701>] pppoe_release+0x50/0x101 [pppoe]\n[  570.144601] PGD 3d119067 PUD 3dbc1067 PMD 0\n[  570.144601] Oops: 0000 [#1] SMP\n[  570.144601] Modules linked in: l2tp_ppp l2tp_netlink l2tp_core ip6_udp_tunnel udp_tunnel pppoe pppox ppp_generic slhc loop crc32c_intel ghash_clmulni_intel jitterentropy_rng sha256_generic hmac drbg ansi_cprng aesni_intel aes_x86_64 ablk_helper cryptd lrw gf128mul glue_helper acpi_cpufreq evdev serio_raw processor button ext4 crc16 mbcache jbd2 virtio_net virtio_blk virtio_pci virtio_ring virtio\n[  570.144601] CPU: 1 PID: 15738 Comm: ppp-apitest Not tainted 4.2.0 #1\n[  570.144601] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Debian-1.8.2-1 04/01/2014\n[  570.144601] task: ffff88003d30d600 ti: ffff880036b60000 task.ti: ffff880036b60000\n[  570.144601] RIP: 0010:[<ffffffffa018c701>]  [<ffffffffa018c701>] pppoe_release+0x50/0x101 [pppoe]\n[  570.144601] RSP: 0018:ffff880036b63e08  EFLAGS: 00010202\n[  570.144601] RAX: 0000000000000000 RBX: ffff880034340000 RCX: 0000000000000206\n[  570.144601] RDX: 0000000000000006 RSI: ffff88003d30dd20 RDI: ffff88003d30dd20\n[  570.144601] RBP: ffff880036b63e28 R08: 0000000000000001 R09: 0000000000000000\n[  570.144601] R10: 00007ffee9b50420 R11: ffff880034340078 R12: ffff8800387ec780\n[  570.144601] R13: ffff8800387ec7b0 R14: ffff88003e222aa0 R15: ffff8800387ec7b0\n[  570.144601] FS:  00007f5672f48700(0000) GS:ffff88003fc80000(0000) knlGS:0000000000000000\n[  570.144601] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  570.144601] CR2: 00000000000004e0 CR3: 0000000037f7e000 CR4: 00000000000406a0\n[  570.144601] Stack:\n[  570.144601]  ffffffffa018f240 ffff8800387ec780 ffffffffa018f240 ffff8800387ec7b0\n[  570.144601]  ffff880036b63e48 ffffffff812caabe ffff880039e4e000 0000000000000008\n[  570.144601]  ffff880036b63e58 ffffffff812cabad ffff880036b63ea8 ffffffff811347f5\n[  570.144601] Call Trace:\n[  570.144601]  [<ffffffff812caabe>] sock_release+0x1a/0x75\n[  570.144601]  [<ffffffff812cabad>] sock_close+0xd/0x11\n[  570.144601]  [<ffffffff811347f5>] __fput+0xff/0x1a5\n[  570.144601]  [<ffffffff811348cb>] ____fput+0x9/0xb\n[  570.144601]  [<ffffffff81056682>] task_work_run+0x66/0x90\n[  570.144601]  [<ffffffff8100189e>] prepare_exit_to_usermode+0x8c/0xa7\n[  570.144601]  [<ffffffff81001a26>] syscall_return_slowpath+0x16d/0x19b\n[  570.144601]  [<ffffffff813babb1>] int_ret_from_sys_call+0x25/0x9f\n[  570.144601] Code: 48 8b 83 c8 01 00 00 a8 01 74 12 48 89 df e8 8b 27 14 e1 b8 f7 ff ff ff e9 b7 00 00 00 8a 43 12 a8 0b 74 1c 48 8b 83 a8 04 00 00 <48> 8b 80 e0 04 00 00 65 ff 08 48 c7 83 a8 04 00 00 00 00 00 00\n[  570.144601] RIP  [<ffffffffa018c701>] pppoe_release+0x50/0x101 [pppoe]\n[  570.144601]  RSP <ffff880036b63e08>\n[  570.144601] CR2: 00000000000004e0\n[  570.200518] ---[ end trace 46956baf17349563 ]---\n\npppoe_flush_dev() has no reason to override sk->sk_state with\nPPPOX_ZOMBIE. pppox_unbind_sock() already sets sk->sk_state to\nPPPOX_DEAD, which is the correct state given that sk is unbound and\npo->pppoe_dev is NULL.\n\nFixes: 2b018d57ff18 (\"pppoe: drop PPPOX_ZOMBIEs in pppoe_release\")\nTested-by: Oleksii Berezhniak <core@irc.lg.ua>\nSigned-off-by: Guillaume Nault <g.nault@alphalink.fr>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/9db7ed146a62e3c66a8a7263fdf4adb5c48d16ca"},{"sha":"c4fc18ccc48aaf9779633b0074036ba3c42f341c","author":{"email":"16a9a54ddf4259952e3c118c763138e83693d7fd@perches.com","name":"Joe Perches"},"message":"ethtool: Use kcalloc instead of kmalloc for ethtool_get_strings\n\n[ Upstream commit 077cb37fcf6f00a45f375161200b5ee0cd4e937b ]\n\nIt seems that kernel memory can leak into userspace by a\nkmalloc, ethtool_get_strings, then copy_to_user sequence.\n\nAvoid this by using kcalloc to zero fill the copied buffer.\n\nSigned-off-by: Joe Perches <joe@perches.com>\nAcked-by: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/c4fc18ccc48aaf9779633b0074036ba3c42f341c"},{"sha":"d54ee99a9dc2d78c7ab89f62a8316b6cf50795f5","author":{"email":"0da377d8fa8759ff6c7872258e01d126b3a80faa@fugro.nl","name":"Michel Stam"},"message":"asix: Don't reset PHY on if_up for ASIX 88772\n\n[ Upstream commit 3cc81d85ee01e5a0b7ea2f4190e2ed1165f53c31 ]\n\nI've noticed every time the interface is set to 'up,', the kernel\nreports that the link speed is set to 100 Mbps/Full Duplex, even\nwhen ethtool is used to set autonegotiation to 'off', half\nduplex, 10 Mbps.\nIt can be tested by:\n ifconfig eth0 down\n ethtool -s eth0 autoneg off speed 10 duplex half\n ifconfig eth0 up\n\nThen checking 'dmesg' for the link speed.\n\nSigned-off-by: Michel Stam <m.stam@fugro.nl>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/d54ee99a9dc2d78c7ab89f62a8316b6cf50795f5"},{"sha":"37673fd3fbdf5a72cc2c3b054daf64d0a8e721b8","author":{"email":"8e4aa0015eb43ed5ca66aaca3fb498609e1e427c@opensource.wolfsonmicro.com","name":"Charles Keepax"},"message":"asix: Do full reset during ax88772_bind\n\n[ Upstream commit 436c2a5036b6ffe813310df2cf327d3b69be0734 ]\n\ncommit 3cc81d85ee01 (\"asix: Don't reset PHY on if_up for ASIX 88772\")\ncauses the ethernet on Arndale to no longer function. This appears to\nbe because the Arndale ethernet requires a full reset before it will\nfunction correctly, however simply reverting the above patch causes\nproblems with ethtool settings getting reset.\n\nIt seems the problem is that the ethernet is not properly reset during\nbind, and indeed the code in ax88772_bind that resets the device is a\nvery small subset of the actual ax88772_reset function. This patch uses\nax88772_reset in place of the existing reset code in ax88772_bind which\nremoves some code duplication and fixes the ethernet on Arndale.\n\nIt is still possible that the original patch causes some issues with\nsuspend and resume but that seems like a separate issue and I haven't\nhad a chance to test that yet.\n\nSigned-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>\nTested-by: Riku Voipio <riku.voipio@linaro.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/37673fd3fbdf5a72cc2c3b054daf64d0a8e721b8"},{"sha":"31e29b7bfcbece0d538cb4feec0e57b02b729ab2","author":{"email":"0da414d9d963da4039c2a0525b1844228075aa58@linux-m68k.org","name":"Geert Uytterhoeven"},"message":"m68k/uaccess: Fix asm constraints for userspace access\n\ncommit 631d8b674f5f8235e9cb7e628b0fe9e5200e3158 upstream.\n\nWhen compiling a MMU kernel with CPU_HAS_ADDRESS_SPACES=n (e.g. \"MMU=y\nallnoconfig\": \"echo CONFIG_MMU=y > allno.config && make KCONFIG_ALLCONFIG=1\nallnoconfig\"), we use plain \"move\" instead of \"moves\", and I got:\n\n  CC      arch/m68k/lib/uaccess.o\n{standard input}: Assembler messages:\n{standard input}:47: Error: operands mismatch -- statement `move.b %a0,(%a1)' ignored\n\nThis happens because plain \"move\" doesn't support byte transfers between\nmemory and address registers, while \"moves\" does.\n\nFix the asm constraints for __generic_copy_from_user(),\n__generic_copy_to_user(), and __clear_user() to only use data registers\nwhen accessing userspace.\n\nAlso, relax the asm constraints for 16-bit userspace accesses in\n__put_user() and __get_user(), as both \"move\" and \"moves\" do support\nsuch transfers between memory and address registers.\n\nSigned-off-by: Geert Uytterhoeven <geert@linux-m68k.org>\nCc: Guenter Roeck <linux@roeck-us.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/31e29b7bfcbece0d538cb4feec0e57b02b729ab2"},{"sha":"29e5b4243743e13be5196622fd0267657dc2ccf5","author":{"email":"d1e82e2813f00e3d60e00aa92378ef41c34f031b@oracle.com","name":"Dave Kleikamp"},"message":"crypto: sparc - initialize blkcipher.ivsize\n\ncommit a66d7f724a96d6fd279bfbd2ee488def6b081bea upstream.\n\nSome of the crypto algorithms write to the initialization vector,\nbut no space has been allocated for it. This clobbers adjacent memory.\n\nSigned-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/29e5b4243743e13be5196622fd0267657dc2ccf5"},{"sha":"2aafe811b0d734f1dc743ce23bc9bec94dec26cb","author":{"email":"f6aa0246ff943bfa8602cdf60d40c481b38ed232@arm.linux.org.uk","name":"Russell King"},"message":"crypto: ahash - ensure statesize is non-zero\n\ncommit 8996eafdcbad149ac0f772fb1649fbb75c482a6a upstream.\n\nUnlike shash algorithms, ahash drivers must implement export\nand import as their descriptors may contain hardware state and\ncannot be exported as is.  Unfortunately some ahash drivers did\nnot provide them and end up causing crashes with algif_hash.\n\nThis patch adds a check to prevent these drivers from registering\nahash algorithms until they are fixed.\n\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/2aafe811b0d734f1dc743ce23bc9bec94dec26cb"},{"sha":"49d851cea0996812449cbe2ceb886cbbf413085a","author":{"email":"66ab244bc42248f12645ba300439b5263f6a6fca@sang-engineering.com","name":"Wolfram Sang"},"message":"i2c: rcar: enable RuntimePM before registering to the core\n\ncommit 4f7effddf4549d57114289f273710f077c4c330a upstream.\n\nThe core may register clients attached to this master which may use\nfuntionality from the master. So, RuntimePM must be enabled before, otherwise\nthis will fail. While here, move drvdata, too.\n\nReported-by: Geert Uytterhoeven <geert+renesas@glider.be>\nSigned-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>\nSigned-off-by: Wolfram Sang <wsa@the-dreams.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/49d851cea0996812449cbe2ceb886cbbf413085a"},{"sha":"334c94072f03ff42ea823e81351f9baa933b4739","author":{"email":"c0c0c8857ed6ec93282de3ee9d47e224acf995af@fb.com","name":"Shaohua Li"},"message":"workqueue: make sure delayed work run in local cpu\n\ncommit 874bbfe600a660cba9c776b3957b1ce393151b76 upstream.\n\nMy system keeps crashing with below message. vmstat_update() schedules a delayed\nwork in current cpu and expects the work runs in the cpu.\nschedule_delayed_work() is expected to make delayed work run in local cpu. The\nproblem is timer can be migrated with NO_HZ. __queue_work() queues work in\ntimer handler, which could run in a different cpu other than where the delayed\nwork is scheduled. The end result is the delayed work runs in different cpu.\nThe patch makes __queue_delayed_work records local cpu earlier. Where the timer\nruns doesn't change where the work runs with the change.\n\n[   28.010131] ------------[ cut here ]------------\n[   28.010609] kernel BUG at ../mm/vmstat.c:1392!\n[   28.011099] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN\n[   28.011860] Modules linked in:\n[   28.012245] CPU: 0 PID: 289 Comm: kworker/0:3 Tainted: G        W4.3.0-rc3+ #634\n[   28.013065] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140709_153802- 04/01/2014\n[   28.014160] Workqueue: events vmstat_update\n[   28.014571] task: ffff880117682580 ti: ffff8800ba428000 task.ti: ffff8800ba428000\n[   28.015445] RIP: 0010:[<ffffffff8115f921>]  [<ffffffff8115f921>]vmstat_update+0x31/0x80\n[   28.016282] RSP: 0018:ffff8800ba42fd80  EFLAGS: 00010297\n[   28.016812] RAX: 0000000000000000 RBX: ffff88011a858dc0 RCX:0000000000000000\n[   28.017585] RDX: ffff880117682580 RSI: ffffffff81f14d8c RDI:ffffffff81f4df8d\n[   28.018366] RBP: ffff8800ba42fd90 R08: 0000000000000001 R09:0000000000000000\n[   28.019169] R10: 0000000000000000 R11: 0000000000000121 R12:ffff8800baa9f640\n[   28.019947] R13: ffff88011a81e340 R14: ffff88011a823700 R15:0000000000000000\n[   28.020071] FS:  0000000000000000(0000) GS:ffff88011a800000(0000)knlGS:0000000000000000\n[   28.020071] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n[   28.020071] CR2: 00007ff6144b01d0 CR3: 00000000b8e93000 CR4:00000000000006f0\n[   28.020071] Stack:\n[   28.020071]  ffff88011a858dc0 ffff8800baa9f640 ffff8800ba42fe00ffffffff8106bd88\n[   28.020071]  ffffffff8106bd0b 0000000000000096 0000000000000000ffffffff82f9b1e8\n[   28.020071]  ffffffff829f0b10 0000000000000000 ffffffff81f18460ffff88011a81e340\n[   28.020071] Call Trace:\n[   28.020071]  [<ffffffff8106bd88>] process_one_work+0x1c8/0x540\n[   28.020071]  [<ffffffff8106bd0b>] ? process_one_work+0x14b/0x540\n[   28.020071]  [<ffffffff8106c214>] worker_thread+0x114/0x460\n[   28.020071]  [<ffffffff8106c100>] ? process_one_work+0x540/0x540\n[   28.020071]  [<ffffffff81071bf8>] kthread+0xf8/0x110\n[   28.020071]  [<ffffffff81071b00>] ?kthread_create_on_node+0x200/0x200\n[   28.020071]  [<ffffffff81a6522f>] ret_from_fork+0x3f/0x70\n[   28.020071]  [<ffffffff81071b00>] ?kthread_create_on_node+0x200/0x200\n\nSigned-off-by: Shaohua Li <shli@fb.com>\nSigned-off-by: Tejun Heo <tj@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/334c94072f03ff42ea823e81351f9baa933b4739"},{"sha":"ad824a8286dd4db9c23e3e3febdd63d4c2c4ae9e","author":{"email":"85e533f2e78486213c4d69f71462342ec0c62734@redhat.com","name":"Mike Snitzer"},"message":"dm thin: fix missing pool reference count decrement in pool_ctr error path\n\ncommit ba30670f4d5292c4e7f7980bbd5071f7c4794cdd upstream.\n\nFixes: ac8c3f3df (\"dm thin: generate event when metadata threshold passed\")\nSigned-off-by: Mike Snitzer <snitzer@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/ad824a8286dd4db9c23e3e3febdd63d4c2c4ae9e"},{"sha":"f22714069f1bc94b91b463bdc00cc82782f0e363","author":{"email":"152d4c5bebf13a5b809d42b4d789cf9d887e6698@gmail.com","name":"Ilya Dryomov"},"message":"rbd: fix double free on rbd_dev->header_name\n\ncommit 3ebe138ac642a195c7f2efdb918f464734421fd6 upstream.\n\nIf rbd_dev_image_probe() in rbd_dev_probe_parent() fails, header_name\nis freed twice: once in rbd_dev_probe_parent() and then in its caller\nrbd_dev_image_probe() (rbd_dev_image_probe() is called recursively to\nhandle parent images).\n\nrbd_dev_probe_parent() is responsible for probing the parent, so it\nshouldn't muck with clone's fields.\n\nSigned-off-by: Ilya Dryomov <idryomov@gmail.com>\nReviewed-by: Alex Elder <elder@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/f22714069f1bc94b91b463bdc00cc82782f0e363"},{"sha":"d17332ebfb5f2010ae5d3332a52df361f28ae4a8","author":{"email":"4645f7897fd33786a2ee1264d590b3c400559d85@linuxfoundation.org","name":"Greg Kroah-Hartman"},"message":"Linux 3.10.92","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/d17332ebfb5f2010ae5d3332a52df361f28ae4a8"}]}