1. 16 Apr, 2017 5 commits
  2. 15 Apr, 2017 9 commits
    • Linus Torvalds's avatar
      Merge branch 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm · d5ff0814
      Linus Torvalds authored
      Pull nvdimm fixes from Dan Williams:
       "A small crop of lockdep, sleeping while atomic, and other fixes /
        band-aids in advance of the full-blown reworks targeting the next
        merge window. The largest change here is "libnvdimm: fix blk free
        space accounting" which deletes a pile of buggy code that better
        testing would have caught before merging. The next change that is
        borderline too big for a late rc is switching the device-dax locking
        from rcu to srcu, I couldn't think of a smaller way to make that fix.
      
        The __copy_user_nocache fix will have a full replacement in 4.12 to
        move those pmem special case considerations into the pmem driver. The
        "libnvdimm: band aid btt vs clear poison locking" commit admits that
        our error clearing support for btt went in broken, so we just disable
        it in 4.11 and -stable. A replacement / full fix is in the pipeline
        for 4.12
      
        Some of these would have been caught earlier had DEBUG_ATOMIC_SLEEP
        been enabled on my development station. I wonder if we should have:
      
            config DEBUG_ATOMIC_SLEEP
              default PROVE_LOCKING
      
        ...since I mistakenly thought I got both with PROVE_LOCKING=y.
      
        These have received a build success notification from the 0day robot,
        and some have appeared in a -next release with no reported issues"
      
      * 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
        x86, pmem: fix broken __copy_user_nocache cache-bypass assumptions
        device-dax: switch to srcu, fix rcu_read_lock() vs pte allocation
        libnvdimm: band aid btt vs clear poison locking
        libnvdimm: fix reconfig_mutex, mmap_sem, and jbd2_handle lockdep splat
        libnvdimm: fix blk free space accounting
        acpi, nfit, libnvdimm: fix interleave set cookie calculation (64-bit comparison)
      d5ff0814
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 403a39f8
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "This is seven small fixes which are all for user visible issues that
        fortunately only occur in rare circumstances.
      
        The most serious is the sr one in which QEMU can cause us to read
        beyond the end of a buffer (I don't think it's exploitable, but just
        in case).
      
        The next is the sd capacity fix which means all non 512 byte sector
        drives greater than 2TB fail to be correctly sized.
      
        The rest are either in new drivers (qedf) or on error legs"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: ipr: do not set DID_PASSTHROUGH on CHECK CONDITION
        scsi: aacraid: fix PCI error recovery path
        scsi: sd: Fix capacity calculation with 32-bit sector_t
        scsi: qla2xxx: Add fix to read correct register value for ISP82xx.
        scsi: qedf: Fix crash due to unsolicited FIP VLAN response.
        scsi: sr: Sanity check returned mode data
        scsi: sd: Consider max_xfer_blocks if opt_xfer_blocks is unusable
      403a39f8
    • Linus Torvalds's avatar
      Merge branch 'parisc-4.11-4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux · be84a46c
      Linus Torvalds authored
      Pull parisc fix from Helge Deller:
       "Mikulas Patocka fixed a few bugs in our new pa_memcpy() assembler
        function, e.g. one bug made the kernel unbootable if source and
        destination address are the same"
      
      * 'parisc-4.11-4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
        parisc: fix bugs in pa_memcpy
      be84a46c
    • Martin Brandenburg's avatar
      orangefs: free superblock when mount fails · 1ec1688c
      Martin Brandenburg authored
      Otherwise lockdep says:
      
      [ 1337.483798] ================================================
      [ 1337.483999] [ BUG: lock held when returning to user space! ]
      [ 1337.484252] 4.11.0-rc6 #19 Not tainted
      [ 1337.484423] ------------------------------------------------
      [ 1337.484626] mount/14766 is leaving the kernel with locks still held!
      [ 1337.484841] 1 lock held by mount/14766:
      [ 1337.485017]  #0:  (&type->s_umount_key#33/1){+.+.+.}, at: [<ffffffff8124171f>] sget_userns+0x2af/0x520
      
      Caught by xfstests generic/413 which tried to mount with the unsupported
      mount option dax.  Then xfstests generic/422 ran sync which deadlocks.
      Signed-off-by: default avatarMartin Brandenburg <martin@omnibond.com>
      Acked-by: default avatarMike Marshall <hubcap@omnibond.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      1ec1688c
    • Linus Torvalds's avatar
      vfs: don't do RCU lookup of empty pathnames · c0eb027e
      Linus Torvalds authored
      Normal pathname lookup doesn't allow empty pathnames, but using
      AT_EMPTY_PATH (with name_to_handle_at() or fstatat(), for example) you
      can trigger an empty pathname lookup.
      
      And not only is the RCU lookup in that case entirely unnecessary
      (because we'll obviously immediately finalize the end result), it is
      actively wrong.
      
      Why? An empth path is a special case that will return the original
      'dirfd' dentry - and that dentry may not actually be RCU-free'd,
      resulting in a potential use-after-free if we were to initialize the
      path lazily under the RCU read lock and depend on complete_walk()
      finalizing the dentry.
      
      Found by syzkaller and KASAN.
      Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
      Reported-by: default avatarVegard Nossum <vegard.nossum@gmail.com>
      Acked-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      c0eb027e
    • Mikulas Patocka's avatar
      parisc: fix bugs in pa_memcpy · 409c1b25
      Mikulas Patocka authored
      The patch 554bfece ("parisc: Fix access
      fault handling in pa_memcpy()") reimplements the pa_memcpy function.
      Unfortunatelly, it makes the kernel unbootable. The crash happens in the
      function ide_complete_cmd where memcpy is called with the same source
      and destination address.
      
      This patch fixes a few bugs in pa_memcpy:
      
      * When jumping to .Lcopy_loop_16 for the first time, don't skip the
        instruction "ldi 31,t0" (this bug made the kernel unbootable)
      * Use the COND macro when comparing length, so that the comparison is
        64-bit (a theoretical issue, in case the length is greater than
        0xffffffff)
      * Don't use the COND macro after the "extru" instruction (the PA-RISC
        specification says that the upper 32-bits of extru result are undefined,
        although they are set to zero in practice)
      * Fix exception addresses in .Lcopy16_fault and .Lcopy8_fault
      * Rename .Lcopy_loop_4 to .Lcopy_loop_8 (so that it is consistent with
        .Lcopy8_fault)
      
      Cc: <stable@vger.kernel.org> # v4.9+
      Fixes: 554bfece ("parisc: Fix access fault handling in pa_memcpy()")
      Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      409c1b25
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input · 1bf4b126
      Linus Torvalds authored
      Pull input fixes from Dmitry Torokhov:
       "Just a small update to xpad driver to recognize yet another gamepad,
        and another change making sure userio.h is exported"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
        Input: xpad - add support for Razer Wildcat gamepad
        uapi: add missing install of userio.h
      1bf4b126
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 7e703ecc
      Linus Torvalds authored
      Pull networking fixes from David Miller:
       "Things seem to be settling down as far as networking is concerned,
        let's hope this trend continues...
      
         1) Add iov_iter_revert() and use it to fix the behavior of
            skb_copy_datagram_msg() et al., from Al Viro.
      
         2) Fix the protocol used in the synthetic SKB we cons up for the
            purposes of doing a simulated route lookup for RTM_GETROUTE
            requests. From Florian Larysch.
      
         3) Don't add noop_qdisc to the per-device qdisc hashes, from Cong
            Wang.
      
         4) Don't call netdev_change_features with the team lock held, from
            Xin Long.
      
         5) Revert TCP F-RTO extension to catch more spurious timeouts because
            it interacts very badly with some middle-boxes. From Yuchung
            Cheng.
      
         6) Fix the loss of error values in l2tp {s,g}etsockopt calls, from
            Guillaume Nault.
      
         7) ctnetlink uses bit positions where it should be using bit masks,
            fix from Liping Zhang.
      
         8) Missing RCU locking in netfilter helper code, from Gao Feng.
      
         9) Avoid double frees and use-after-frees in tcp_disconnect(), from
            Eric Dumazet.
      
        10) Don't do a changelink before we register the netdevice in
            bridging, from Ido Schimmel.
      
        11) Lock the ipv6 device address list properly, from Rabin Vincent"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (29 commits)
        netfilter: ipt_CLUSTERIP: Fix wrong conntrack netns refcnt usage
        netfilter: nft_hash: do not dump the auto generated seed
        drivers: net: usb: qmi_wwan: add QMI_QUIRK_SET_DTR for Telit PID 0x1201
        ipv6: Fix idev->addr_list corruption
        net: xdp: don't export dev_change_xdp_fd()
        bridge: netlink: register netdevice before executing changelink
        bridge: implement missing ndo_uninit()
        bpf: reference may_access_skb() from __bpf_prog_run()
        tcp: clear saved_syn in tcp_disconnect()
        netfilter: nf_ct_expect: use proper RCU list traversal/update APIs
        netfilter: ctnetlink: skip dumping expect when nfct_help(ct) is NULL
        netfilter: make it safer during the inet6_dev->addr_list traversal
        netfilter: ctnetlink: make it safer when checking the ct helper name
        netfilter: helper: Add the rcu lock when call __nf_conntrack_helper_find
        netfilter: ctnetlink: using bit to represent the ct event
        netfilter: xt_TCPMSS: add more sanity tests on tcph->doff
        net: tcp: Increase TCP_MIB_OUTRSTS even though fail to alloc skb
        l2tp: don't mask errors in pppol2tp_getsockopt()
        l2tp: don't mask errors in pppol2tp_setsockopt()
        tcp: restrict F-RTO to work-around broken middle-boxes
        ...
      7e703ecc
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 91174391
      Linus Torvalds authored
      Pull x86 fixes from Thomas Gleixner:
       "A set of small fixes for x86:
      
         - fix locking in RDT to prevent memory leaks and freeing in use
           memory
      
         - prevent setting invalid values for vdso32_enabled which cause
           inconsistencies for user space resulting in application crashes.
      
         - plug a race in the vdso32 code between fork and sysctl which causes
           inconsistencies for user space resulting in application crashes.
      
         - make MPX signal delivery work in compat mode
      
         - make the dmesg output of traps and faults readable again"
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/intel_rdt: Fix locking in rdtgroup_schemata_write()
        x86/debug: Fix the printk() debug output of signal_fault(), do_trap() and do_general_protection()
        x86/vdso: Plug race between mapping and ELF header setup
        x86/vdso: Ensure vdso32_enabled gets set to valid values only
        x86/signals: Fix lower/upper bound reporting in compat siginfo
      91174391
  3. 14 Apr, 2017 26 commits
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 07c7016d
      Linus Torvalds authored
      Pull perf fixes from Thomas Gleixner:
       "Two small fixes for perf:
      
         - the move to support cross arch annotation introduced per arch
           initialization requirements, fullfill them for s/390 (Christian
           Borntraeger)
      
         - add the missing initialization to the LBR entries to avoid exposing
           random or stale data"
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf/x86: Avoid exposing wrong/stale data in intel_pmu_lbr_read_32()
        perf annotate s390: Fix perf annotate error -95 (4.10 regression)
      07c7016d
    • Linus Torvalds's avatar
      Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · d295917a
      Linus Torvalds authored
      Pull irq fixes from Thomas Gleixner:
       "The irq department provides:
      
         - two fixes for the CPU affinity spread infrastructure to prevent
           unbalanced spreading in corner cases which leads to horrible
           performance, because interrupts are rather aggregated than spread
      
         - add a missing spinlock initializer in the imx-gpcv2 init code"
      
      * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        irqchip/irq-imx-gpcv2: Fix spinlock initialization
        irq/affinity: Fix extra vecs calculation
        irq/affinity: Fix CPU spread for unbalanced nodes
      d295917a
    • Linus Torvalds's avatar
      Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · f399ecb4
      Linus Torvalds authored
      Pull EFI fixes from Thomas Gleixner:
       "Three fixes from EFI land:
      
         - prevent accessing a Graphic Output Device (GOP) which the kernel
           does not know to handle
      
         - prevent PCI reconfiguration to modify a BAR which covers the
           framebuffer because that's already in use through the EFI GOP
           interface
      
         - avoid reserving EFI runtime regions as this results in bogus memory
           mappings"
      
      * 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/efi: Don't try to reserve runtime regions
        efi/fb: Avoid reconfiguration of BAR that covers the framebuffer
        efi/libstub: Skip GOP with PIXEL_BLT_ONLY format
      f399ecb4
    • Linus Torvalds's avatar
      Merge branch 'for-linus-4.11' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs · 4b31ac48
      Linus Torvalds authored
      Pull btrfs fixes from Chris Mason:
       "Dave Sterba collected a few more fixes for the last rc.
      
        These aren't marked for stable, but I'm putting them in with a batch
        were testing/sending by hand for this release"
      
      * 'for-linus-4.11' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
        Btrfs: fix potential use-after-free for cloned bio
        Btrfs: fix segmentation fault when doing dio read
        Btrfs: fix invalid dereference in btrfs_retry_endio
        btrfs: drop the nossd flag when remounting with -o ssd
      4b31ac48
    • Linus Torvalds's avatar
      Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6 · 5466f4df
      Linus Torvalds authored
      Pull more CIFS fixes from Steve French:
       "As promised, here is the remaining set of cifs/smb3 fixes for stable
        (and a fix for one regression) now that they have had additional
        review and testing"
      
      * 'for-next' of git://git.samba.org/sfrench/cifs-2.6:
        CIFS: Fix SMB3 mount without specifying a security mechanism
        CIFS: store results of cifs_reopen_file to avoid infinite wait
        CIFS: remove bad_network_name flag
        CIFS: reconnect thread reschedule itself
        CIFS: handle guest access errors to Windows shares
        CIFS: Fix null pointer deref during read resp processing
      5466f4df
    • Steven Rostedt (VMware)'s avatar
      ftrace: Fix removing of second function probe · 82cc4fc2
      Steven Rostedt (VMware) authored
      When two function probes are added to set_ftrace_filter, and then one of
      them is removed, the update to the function locations is not performed, and
      the record keeping of the function states are corrupted, and causes an
      ftrace_bug() to occur.
      
      This is easily reproducable by adding two probes, removing one, and then
      adding it back again.
      
       # cd /sys/kernel/debug/tracing
       # echo schedule:traceoff > set_ftrace_filter
       # echo do_IRQ:traceoff > set_ftrace_filter
       # echo \!do_IRQ:traceoff > /debug/tracing/set_ftrace_filter
       # echo do_IRQ:traceoff > set_ftrace_filter
      
      Causes:
       ------------[ cut here ]------------
       WARNING: CPU: 2 PID: 1098 at kernel/trace/ftrace.c:2369 ftrace_get_addr_curr+0x143/0x220
       Modules linked in: [...]
       CPU: 2 PID: 1098 Comm: bash Not tainted 4.10.0-test+ #405
       Hardware name: Hewlett-Packard HP Compaq Pro 6300 SFF/339A, BIOS K01 v02.05 05/07/2012
       Call Trace:
        dump_stack+0x68/0x9f
        __warn+0x111/0x130
        ? trace_irq_work_interrupt+0xa0/0xa0
        warn_slowpath_null+0x1d/0x20
        ftrace_get_addr_curr+0x143/0x220
        ? __fentry__+0x10/0x10
        ftrace_replace_code+0xe3/0x4f0
        ? ftrace_int3_handler+0x90/0x90
        ? printk+0x99/0xb5
        ? 0xffffffff81000000
        ftrace_modify_all_code+0x97/0x110
        arch_ftrace_update_code+0x10/0x20
        ftrace_run_update_code+0x1c/0x60
        ftrace_run_modify_code.isra.48.constprop.62+0x8e/0xd0
        register_ftrace_function_probe+0x4b6/0x590
        ? ftrace_startup+0x310/0x310
        ? debug_lockdep_rcu_enabled.part.4+0x1a/0x30
        ? update_stack_state+0x88/0x110
        ? ftrace_regex_write.isra.43.part.44+0x1d3/0x320
        ? preempt_count_sub+0x18/0xd0
        ? mutex_lock_nested+0x104/0x800
        ? ftrace_regex_write.isra.43.part.44+0x1d3/0x320
        ? __unwind_start+0x1c0/0x1c0
        ? _mutex_lock_nest_lock+0x800/0x800
        ftrace_trace_probe_callback.isra.3+0xc0/0x130
        ? func_set_flag+0xe0/0xe0
        ? __lock_acquire+0x642/0x1790
        ? __might_fault+0x1e/0x20
        ? trace_get_user+0x398/0x470
        ? strcmp+0x35/0x60
        ftrace_trace_onoff_callback+0x48/0x70
        ftrace_regex_write.isra.43.part.44+0x251/0x320
        ? match_records+0x420/0x420
        ftrace_filter_write+0x2b/0x30
        __vfs_write+0xd7/0x330
        ? do_loop_readv_writev+0x120/0x120
        ? locks_remove_posix+0x90/0x2f0
        ? do_lock_file_wait+0x160/0x160
        ? __lock_is_held+0x93/0x100
        ? rcu_read_lock_sched_held+0x5c/0xb0
        ? preempt_count_sub+0x18/0xd0
        ? __sb_start_write+0x10a/0x230
        ? vfs_write+0x222/0x240
        vfs_write+0xef/0x240
        SyS_write+0xab/0x130
        ? SyS_read+0x130/0x130
        ? trace_hardirqs_on_caller+0x182/0x280
        ? trace_hardirqs_on_thunk+0x1a/0x1c
        entry_SYSCALL_64_fastpath+0x18/0xad
       RIP: 0033:0x7fe61c157c30
       RSP: 002b:00007ffe87890258 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
       RAX: ffffffffffffffda RBX: ffffffff8114a410 RCX: 00007fe61c157c30
       RDX: 0000000000000010 RSI: 000055814798f5e0 RDI: 0000000000000001
       RBP: ffff8800c9027f98 R08: 00007fe61c422740 R09: 00007fe61ca53700
       R10: 0000000000000073 R11: 0000000000000246 R12: 0000558147a36400
       R13: 00007ffe8788f160 R14: 0000000000000024 R15: 00007ffe8788f15c
        ? trace_hardirqs_off_caller+0xc0/0x110
       ---[ end trace 99fa09b3d9869c2c ]---
       Bad trampoline accounting at: ffffffff81cc3b00 (do_IRQ+0x0/0x150)
      
      Cc: stable@vger.kernel.org
      Fixes: 59df055f ("ftrace: trace different functions with a different tracer")
      Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
      82cc4fc2
    • Ming Lei's avatar
      block: fix bio_will_gap() for first bvec with offset · 5a8d75a1
      Ming Lei authored
      Commit 729204ef("block: relax check on sg gap") allows us to merge
      bios, if both are physically contiguous.  This change can merge a huge
      number of small bios, through mkfs for example, mkfs.ntfs running time
      can be decreased to ~1/10.
      
      But if one rq starts with a non-aligned buffer (the 1st bvec's bv_offset
      is non-zero) and if we allow the merge, it is quite difficult to respect
      sg gap limit, especially the max segment size, or we risk having an
      unaligned virtual boundary.  This patch tries to avoid the issue by
      disallowing a merge, if the req starts with an unaligned buffer.
      
      Also add comments to explain why the merged segment can't end in
      unaligned virt boundary.
      
      Fixes: 729204ef ("block: relax check on sg gap")
      Tested-by: default avatarJohannes Thumshirn <jthumshirn@suse.de>
      Reviewed-by: default avatarJohannes Thumshirn <jthumshirn@suse.de>
      Signed-off-by: default avatarMing Lei <ming.lei@redhat.com>
      
      Rewrote parts of the commit message and comments.
      Signed-off-by: default avatarJens Axboe <axboe@fb.com>
      5a8d75a1
    • Linus Torvalds's avatar
      Merge tag 'fbdev-v4.11-rc6' of git://github.com/bzolnier/linux · 82f1faa8
      Linus Torvalds authored
      Pull fbdev fixes from Bartlomiej Zolnierkiewicz:
      
       - fix probing time checks in omapfb driver (regression fix)
      
       - fix optional VBAT support in ssd1307fb driver (regression fix)
      
       - fix connecting to backend in xen-fbfront driver
      
      * tag 'fbdev-v4.11-rc6' of git://github.com/bzolnier/linux:
        fbdev: omapfb: delete check_required_callbacks()
        xen, fbfront: fix connecting to backend
        fbdev/ssd1307fb: fix optional VBAT support
      82f1faa8
    • Linus Torvalds's avatar
      Merge tag 'pm-4.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · e16d8b6e
      Linus Torvalds authored
      Pull power management fixes from Rafael Wysocki:
       "These fix a cpufreq core regression related to CPU online/offline and
        several issues in the turbostat and cpupower utilities.
      
        Specifics:
      
         - Allow CPUs to be put back online even if the cpufreq driver is
           unable to work with them (eg. due to missing information from
           platform firmware), which was the previous behavior expected by
           users, but changed in the 4.9 time frame (Chen Yu).
      
         - Fix a few minor issues in the turbostat utility, introduced mostly
           during the recent update of it (Len Brown, Doug Smythies).
      
         - Fix a cpupower utility bug causing it to report incorrect values
           for turbo frequencies in some cases (Ben Hutchings)"
      
      * tag 'pm-4.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        cpupower: Fix turbo frequency reporting for pre-Sandy Bridge cores
        cpufreq: Bring CPUs up even if cpufreq_online() failed
        tools/power turbostat: update version number
        tools/power turbostat: fix impossibly large CPU%c1 value
        tools/power turbostat: turbostat.8 add missing column definitions
        tools/power turbostat: update HWP dump to decimal from hex
        tools/power turbostat: enable package THERM_INTERRUPT dump
        tools/power turbostat: show missing Core and GFX power on SKL and KBL
        tools/power turbostat: bugfix: GFXMHz column not changing
      e16d8b6e
    • Linus Torvalds's avatar
      Merge tag 'acpi-4.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 321ae379
      Linus Torvalds authored
      Pull ACPI fixes from Rafael Wysocki:
      
       "These revert a recent ACPICA commit that turned out to be problematic
        and fix a device enumeration breakage from the 4.8 cycle.
      
        Specifics:
      
         - Revert a recent ACPICA commit targeted at catching firmware bugs
           which promptly did that and caused functional problems to appear
           (Rafael Wysocki).
      
         - Fix a device enumeration problem introduced in the 4.8 time frame
           which caused the ACPI docking station driver to report incorrect
           status via sysfs among other things (Rafael Wysocki)"
      
      * tag 'acpi-4.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        Revert "ACPICA: Resources: Not a valid resource if buffer length too long"
        ACPI / scan: Set the visited flag for all enumerated devices
      321ae379
    • Linus Torvalds's avatar
      Merge tag 'devmem-v4.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux · 1882e562
      Linus Torvalds authored
      Pull CONFIG_STRICT_DEVMEM fix from Kees Cook:
       "Fixes /dev/mem to read back zeros for System RAM areas in the 1MB
        exception area on x86 to avoid exposing RAM or tripping hardened
        usercopy"
      
      * tag 'devmem-v4.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
        mm: Tighten x86 /dev/mem with zeroing reads
      1882e562
    • Linus Torvalds's avatar
      Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost · 78739333
      Linus Torvalds authored
      Pull virtio fixes from Michael S. Tsirkin:
       "virtio oops fixes
      
        The virtio pci rework using shared interrupts caused a lot of issues.
        We tried to fix them but run out of time. Revert for now, and revisit
        the issue for the next kernel.
      
        Luckily we are able to do this without loosing automatic interrupt
        NUMA affinity which was the main motivator for the rework"
      
      * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
        virtio-pci: Remove affinity hint before freeing the interrupt
        Revert "virtio_pci: remove struct virtio_pci_vq_info"
        Revert "virtio_pci: use shared interrupts for virtqueues"
        Revert "virtio_pci: don't duplicate the msix_enable flag in struct pci_dev"
        Revert "virtio_pci: simplify MSI-X setup"
        Revert "virtio_pci: fix out of bound access for msix_names"
        MAINTAINERS: fix virtio file pattern
        virtio_console: fix uninitialized variable use
        virtio_net: clear MTU when out of range
        virtio: allow drivers to validate features
        virtio_net: enable big packets for large MTU values
      78739333
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · f4c13c8e
      David S. Miller authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter fixes for net
      
      The following patchset contains Netfilter fixes for your net tree,
      they are:
      
      1) Missing TCP header sanity check in TCPMSS target, from Eric Dumazet.
      
      2) Incorrect event message type for related conntracks created via
         ctnetlink, from Liping Zhang.
      
      3) Fix incorrect rcu locking when handling helpers from ctnetlink,
         from Gao feng.
      
      4) Fix missing rcu locking when updating helper, from Liping Zhang.
      
      5) Fix missing read_lock_bh when iterating over list of device addresses
         from TPROXY and redirect, also from Liping.
      
      6) Fix crash when trying to dump expectations from conntrack with no
         helper via ctnetlink, from Liping.
      
      7) Missing RCU protection to expecation list update given ctnetlink
         iterates over the list under rcu read lock side, from Liping too.
      
      8) Don't dump autogenerated seed in nft_hash to userspace, this is
         very confusing to the user, again from Liping.
      
      9) Fix wrong conntrack netns module refcount in ipt_CLUSTERIP,
         from Gao feng.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f4c13c8e
    • Aaro Koskinen's avatar
      fbdev: omapfb: delete check_required_callbacks() · e68d490d
      Aaro Koskinen authored
      Commit 561eb9d0 ("fbdev: omap/lcd: Make callbacks optional") made
      panel callbacks optional but forgot to update check_required_callbacks().
      As a result many (all?) OMAP systems using omapfb will crash at boot.
      Fix by deleting the whole function.
      
      Fixes: 561eb9d0 ("fbdev: omap/lcd: Make callbacks optional")
      Signed-off-by: default avatarAaro Koskinen <aaro.koskinen@iki.fi>
      Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
      Cc: Lars-Peter Clausen <lars@metafoo.de>
      Signed-off-by: default avatarBartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
      e68d490d
    • Rafael J. Wysocki's avatar
      Merge branches 'acpi-scan-fixes' and 'acpica-fixes' · f83e13f9
      Rafael J. Wysocki authored
      * acpi-scan-fixes:
        ACPI / scan: Set the visited flag for all enumerated devices
      
      * acpica-fixes:
        Revert "ACPICA: Resources: Not a valid resource if buffer length too long"
      f83e13f9
    • Rafael J. Wysocki's avatar
      Merge branches 'pm-cpufreq-fixes' and 'pm-tools-fixes' · 66803c94
      Rafael J. Wysocki authored
      * pm-cpufreq-fixes:
        cpufreq: Bring CPUs up even if cpufreq_online() failed
      
      * pm-tools-fixes:
        cpupower: Fix turbo frequency reporting for pre-Sandy Bridge cores
        tools/power turbostat: update version number
        tools/power turbostat: fix impossibly large CPU%c1 value
        tools/power turbostat: turbostat.8 add missing column definitions
        tools/power turbostat: update HWP dump to decimal from hex
        tools/power turbostat: enable package THERM_INTERRUPT dump
        tools/power turbostat: show missing Core and GFX power on SKL and KBL
        tools/power turbostat: bugfix: GFXMHz column not changing
      66803c94
    • Greg Kroah-Hartman's avatar
      Revert "tty: don't panic on OOM in tty_set_ldisc()" · a8983d01
      Greg Kroah-Hartman authored
      This reverts commit 5362544b as it is
      reported to cause a reproducable crash.
      
      Fixes: 5362544b ("tty: don't panic on OOM in tty_set_ldisc()")
      Reported-by: default avatarVegard Nossum <vegard.nossum@gmail.com>
      Cc: Dmitry Vyukov <dvyukov@google.com>
      Cc: <syzkaller@googlegroups.com>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: Jiri Slaby <jslaby@suse.com>
      Cc: Peter Hurley <peter@hurleysoftware.com>
      Cc: One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
      a8983d01
    • Tyler Baker's avatar
      irqchip/irq-imx-gpcv2: Fix spinlock initialization · 75eb5e1e
      Tyler Baker authored
      The raw_spinlock in the IMX GPCV2 interupt chip is not initialized before
      usage. That results in a lockdep splat:
      
        INFO: trying to register non-static key.
        the code is fine but needs lockdep annotation.
        turning off the locking correctness validator.
      
      Add the missing raw_spin_lock_init() to the setup code.
      
      Fixes: e324c4dc ("irqchip/imx-gpcv2: IMX GPCv2 driver for wakeup sources")
      Signed-off-by: default avatarTyler Baker <tyler.baker@linaro.org>
      Reviewed-by: default avatarFabio Estevam <fabio.estevam@nxp.com>
      Cc: jason@lakedaemon.net
      Cc: marc.zyngier@arm.com
      Cc: shawnguo@kernel.org
      Cc: andrew.smirnov@gmail.com
      Cc: linux-arm-kernel@lists.infradead.org
      Cc: stable@vger.kernel.org
      Link: http://lkml.kernel.org/r/20170413222731.5917-1-tyler.baker@linaro.orgSigned-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      75eb5e1e
    • Peter Zijlstra's avatar
      perf/x86: Avoid exposing wrong/stale data in intel_pmu_lbr_read_32() · f2200ac3
      Peter Zijlstra authored
      When the perf_branch_entry::{in_tx,abort,cycles} fields were added,
      intel_pmu_lbr_read_32() wasn't updated to initialize them.
      Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: linux-kernel@vger.kernel.org
      Cc: <stable@vger.kernel.org>
      Fixes: 135c5612 ("perf/x86/intel: Support Haswell/v4 LBR format")
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      f2200ac3
    • Linus Torvalds's avatar
      Merge branch 'akpm' (patches from Andrew) · a232591b
      Linus Torvalds authored
      Merge fixes from Andrew Morton:
       "11 fixes.
      
        The presence of 'thp: reduce indentation level in change_huge_pmd()'
        is unfortunate. But the patchset had been decently reviewed and tested
        before we decided it was needed in -stable and I felt it best not to
        churn things at the last minute"
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>:
        mailmap: add Martin Kepplinger's email
        zsmalloc: expand class bit
        zram: do not use copy_page with non-page aligned address
        zram: fix operator precedence to get offset
        hugetlbfs: fix offset overflow in hugetlbfs mmap
        thp: fix MADV_DONTNEED vs clear soft dirty race
        thp: fix MADV_DONTNEED vs. MADV_FREE race
        mm: drop unused pmdp_huge_get_and_clear_notify()
        thp: fix MADV_DONTNEED vs. numa balancing race
        thp: reduce indentation level in change_huge_pmd()
        z3fold: fix page locking in z3fold_alloc()
      a232591b
    • Martin Kepplinger's avatar
      mailmap: add Martin Kepplinger's email · 5714320d
      Martin Kepplinger authored
      Set the partly deprecated companies' email addresses as alias for the
      personal one.
      
      Link: http://lkml.kernel.org/r/1491984622-17321-1-git-send-email-martin.kepplinger@ginzinger.comSigned-off-by: default avatarMartin Kepplinger <martin.kepplinger@ginzinger.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      5714320d
    • Minchan Kim's avatar
      zsmalloc: expand class bit · 85d492f2
      Minchan Kim authored
      Now 64K page system, zsamlloc has 257 classes so 8 class bit is not
      enough.  With that, it corrupts the system when zsmalloc stores
      65536byte data(ie, index number 256) so that this patch increases class
      bit for simple fix for stable backport.  We should clean up this mess
      soon.
      
        index	size
        0	32
        1	288
        ..
        ..
        204	52256
        256	65536
      
      Fixes: 3783689a ("zsmalloc: introduce zspage structure")
      Link: http://lkml.kernel.org/r/1492042622-12074-3-git-send-email-minchan@kernel.orgSigned-off-by: default avatarMinchan Kim <minchan@kernel.org>
      Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      85d492f2
    • Minchan Kim's avatar
      zram: do not use copy_page with non-page aligned address · d72e9a7a
      Minchan Kim authored
      The copy_page is optimized memcpy for page-alinged address.  If it is
      used with non-page aligned address, it can corrupt memory which means
      system corruption.  With zram, it can happen with
      
      1. 64K architecture
      2. partial IO
      3. slub debug
      
      Partial IO need to allocate a page and zram allocates it via kmalloc.
      With slub debug, kmalloc(PAGE_SIZE) doesn't return page-size aligned
      address.  And finally, copy_page(mem, cmem) corrupts memory.
      
      So, this patch changes it to memcpy.
      
      Actuaully, we don't need to change zram_bvec_write part because zsmalloc
      returns page-aligned address in case of PAGE_SIZE class but it's not
      good to rely on the internal of zsmalloc.
      
      Note:
       When this patch is merged to stable, clear_page should be fixed, too.
       Unfortunately, recent zram removes it by "same page merge" feature so
       it's hard to backport this patch to -stable tree.
      
      I will handle it when I receive the mail from stable tree maintainer to
      merge this patch to backport.
      
      Fixes: 42e99bd9 ("zram: optimize memory operations with clear_page()/copy_page()")
      Link: http://lkml.kernel.org/r/1492042622-12074-2-git-send-email-minchan@kernel.orgSigned-off-by: default avatarMinchan Kim <minchan@kernel.org>
      Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      d72e9a7a
    • Minchan Kim's avatar
      zram: fix operator precedence to get offset · 4ca82dab
      Minchan Kim authored
      In zram_rw_page, the logic to get offset is wrong by operator precedence
      (i.e., "<<" is higher than "&").  With wrong offset, zram can corrupt
      the user's data.  This patch fixes it.
      
      Fixes: 8c7f0102 ("zram: implement rw_page operation of zram")
      Link: http://lkml.kernel.org/r/1492042622-12074-1-git-send-email-minchan@kernel.orgSigned-off-by: default avatarMinchan Kim <minchan@kernel.org>
      Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      4ca82dab
    • Mike Kravetz's avatar
      hugetlbfs: fix offset overflow in hugetlbfs mmap · 045c7a3f
      Mike Kravetz authored
      If mmap() maps a file, it can be passed an offset into the file at which
      the mapping is to start.  Offset could be a negative value when
      represented as a loff_t.  The offset plus length will be used to update
      the file size (i_size) which is also a loff_t.
      
      Validate the value of offset and offset + length to make sure they do
      not overflow and appear as negative.
      
      Found by syzcaller with commit ff8c0c53 ("mm/hugetlb.c: don't call
      region_abort if region_chg fails") applied.  Prior to this commit, the
      overflow would still occur but we would luckily return ENOMEM.
      
      To reproduce:
      
         mmap(0, 0x2000, 0, 0x40021, 0xffffffffffffffffULL, 0x8000000000000000ULL);
      
      Resulted in,
      
        kernel BUG at mm/hugetlb.c:742!
        Call Trace:
         hugetlbfs_evict_inode+0x80/0xa0
         evict+0x24a/0x620
         iput+0x48f/0x8c0
         dentry_unlink_inode+0x31f/0x4d0
         __dentry_kill+0x292/0x5e0
         dput+0x730/0x830
         __fput+0x438/0x720
         ____fput+0x1a/0x20
         task_work_run+0xfe/0x180
         exit_to_usermode_loop+0x133/0x150
         syscall_return_slowpath+0x184/0x1c0
         entry_SYSCALL_64_fastpath+0xab/0xad
      
      Fixes: ff8c0c53 ("mm/hugetlb.c: don't call region_abort if region_chg fails")
      Link: http://lkml.kernel.org/r/1491951118-30678-1-git-send-email-mike.kravetz@oracle.comReported-by: default avatarVegard Nossum <vegard.nossum@oracle.com>
      Signed-off-by: default avatarMike Kravetz <mike.kravetz@oracle.com>
      Acked-by: default avatarHillf Danton <hillf.zj@alibaba-inc.com>
      Cc: Dmitry Vyukov <dvyukov@google.com>
      Cc: Michal Hocko <mhocko@suse.com>
      Cc: "Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>
      Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
      Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      045c7a3f
    • Kirill A. Shutemov's avatar
      thp: fix MADV_DONTNEED vs clear soft dirty race · 5b7abeae
      Kirill A. Shutemov authored
      Yet another instance of the same race.
      
      Fix is identical to change_huge_pmd().
      
      See "thp: fix MADV_DONTNEED vs.  numa balancing race" for more details.
      
      Link: http://lkml.kernel.org/r/20170302151034.27829-5-kirill.shutemov@linux.intel.comSigned-off-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
      Cc: Andrea Arcangeli <aarcange@redhat.com>
      Cc: Hillf Danton <hillf.zj@alibaba-inc.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      5b7abeae