1. 11 Feb, 2017 5 commits
    • Linus Torvalds's avatar
      Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 4e4f74a7
      Linus Torvalds authored
      Pull lockdep fix from Ingo Molnar:
       "This fixes an ugly lockdep stack trace output regression. (But also
        affects other stacktrace users such as kmemleak, KASAN, etc)"
      
      * 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        stacktrace, lockdep: Fix address, newline ugliness
      4e4f74a7
    • Linus Torvalds's avatar
      Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 21a7061c
      Linus Torvalds authored
      Pull irq fixes from Ingo Molnar:
       "Two last minute ARM irqchip driver fixes"
      
      * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        irqchip/mxs: Enable SKIP_SET_WAKE and MASK_ON_SUSPEND
        irqchip/keystone: Fix "scheduling while atomic" on rt
      21a7061c
    • Linus Torvalds's avatar
      Merge branch 'for-linus-4.10' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs · 2b95550a
      Linus Torvalds authored
      Pull btrfs fixes from Chris Mason:
       "This has two last minute fixes. The highest priority here is a
        regression fix for the decompression code, but we also fixed up a
        problem with the 32-bit compat ioctls.
      
        The decompression bug could hand back the wrong data on big reads when
        zlib was used. I have a larger cleanup to make the math here less
        error prone, but at this stage in the release Omar's patch is the best
        choice"
      
      * 'for-linus-4.10' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
        btrfs: fix btrfs_decompress_buf2page()
        btrfs: fix btrfs_compat_ioctl failures on non-compat ioctls
      2b95550a
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 13ebfd06
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "Six fairly small fixes. None is a real show stopper, two automation
        detected problems: one memory leak, one use after free and four others
        each of which fixes something that has been a significant source of
        annoyance to someone"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: zfcp: fix use-after-free by not tracing WKA port open/close on failed send
        scsi: aacraid: Fix INTx/MSI-x issue with older controllers
        scsi: mpt3sas: disable ASPM for MPI2 controllers
        scsi: mpt3sas: Force request partial completion alignment
        scsi: qla2xxx: Avoid that issuing a LIP triggers a kernel crash
        scsi: qla2xxx: Fix a recently introduced memory leak
      13ebfd06
    • Omar Sandoval's avatar
      Btrfs: fix btrfs_decompress_buf2page() · 6e78b3f7
      Omar Sandoval authored
      If btrfs_decompress_buf2page() is handed a bio with its page in the
      middle of the working buffer, then we adjust the offset into the working
      buffer. After we copy into the bio, we advance the iterator by the
      number of bytes we copied. Then, we have some logic to handle the case
      of discontiguous pages and adjust the offset into the working buffer
      again. However, if we didn't advance the bio to a new page, we may enter
      this case in error, essentially repeating the adjustment that we already
      made when we entered the function. The end result is bogus data in the
      bio.
      
      Previously, we only checked for this case when we advanced to a new
      page, but the conversion to bio iterators changed that. This restores
      the old, correct behavior.
      
      A case I saw when testing with zlib was:
      
          buf_start = 42769
          total_out = 46865
          working_bytes = total_out - buf_start = 4096
          start_byte = 45056
      
      The condition (total_out > start_byte && buf_start < start_byte) is
      true, so we adjust the offset:
      
          buf_offset = start_byte - buf_start = 2287
          working_bytes -= buf_offset = 1809
          current_buf_start = buf_start = 42769
      
      Then, we copy
      
          bytes = min(bvec.bv_len, PAGE_SIZE - buf_offset, working_bytes) = 1809
          buf_offset += bytes = 4096
          working_bytes -= bytes = 0
          current_buf_start += bytes = 44578
      
      After bio_advance(), we are still in the same page, so start_byte is the
      same. Then, we check (total_out > start_byte && current_buf_start < start_byte),
      which is true! So, we adjust the values again:
      
          buf_offset = start_byte - buf_start = 2287
          working_bytes = total_out - start_byte = 1809
          current_buf_start = buf_start + buf_offset = 45056
      
      But note that working_bytes was already zero before this, so we should
      have stopped copying.
      
      Fixes: 974b1adc ("btrfs: use bio iterators for the decompression handlers")
      Reported-by: default avatarPat Erley <pat-lkml@erley.org>
      Reviewed-by: default avatarChris Mason <clm@fb.com>
      Signed-off-by: default avatarOmar Sandoval <osandov@fb.com>
      Signed-off-by: default avatarChris Mason <clm@fb.com>
      Reviewed-by: default avatarLiu Bo <bo.li.liu@oracle.com>
      Tested-by: default avatarLiu Bo <bo.li.liu@oracle.com>
      6e78b3f7
  2. 10 Feb, 2017 20 commits
  3. 09 Feb, 2017 15 commits