summaryrefslogtreecommitdiff
path: root/drivers/md (follow)
Commit message (Collapse)AuthorAge
...
| * | | Merge 4.4.242 into android-4.4-pGreg Kroah-Hartman2020-11-10
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.242 SUNRPC: ECONNREFUSED should cause a rebind. scripts/setlocalversion: make git describe output more reliable powerpc/powernv/opal-dump : Use IRQ_HANDLED instead of numbers in interrupt handler efivarfs: Replace invalid slashes with exclamation marks in dentries. ravb: Fix bit fields checking in ravb_hwtstamp_get() tipc: fix memory leak caused by tipc_buf_append() mtd: lpddr: Fix bad logic in print_drs_error ata: sata_rcar: Fix DMA boundary mask fscrypt: return -EXDEV for incompatible rename or link into encrypted dir f2fs crypto: avoid unneeded memory allocation in ->readdir powerpc/powernv/smp: Fix spurious DBG() warning sparc64: remove mm_cpumask clearing to fix kthread_use_mm race f2fs: fix to check segment boundary during SIT page readahead um: change sigio_spinlock to a mutex xfs: fix realtime bitmap/summary file truncation when growing rt volume video: fbdev: pvr2fb: initialize variables ath10k: fix VHT NSS calculation when STBC is enabled mmc: via-sdmmc: Fix data race bug printk: reduce LOG_BUF_SHIFT range for H8300 kgdb: Make "kgdbcon" work properly with "kgdb_earlycon" USB: adutux: fix debugging drivers/net/wan/hdlc_fr: Correctly handle special skb->protocol values power: supply: test_power: add missing newlines when printing parameters by sysfs md/bitmap: md_bitmap_get_counter returns wrong blocks clk: ti: clockdomain: fix static checker warning net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid drivers: watchdog: rdc321x_wdt: Fix race condition bugs ext4: Detect already used quota file early gfs2: add validation checks for size of superblock memory: emif: Remove bogus debugfs error handling ARM: dts: s5pv210: move PMU node out of clock controller ARM: dts: s5pv210: remove dedicated 'audio-subsystem' node md/raid5: fix oops during stripe resizing leds: bcm6328, bcm6358: use devres LED registering function NFS: fix nfs_path in case of a rename retry ACPI / extlog: Check for RDMSR failure ACPI: video: use ACPI backlight for HP 635 Notebook acpi-cpufreq: Honor _PSD table setting on new AMD CPUs w1: mxc_w1: Fix timeout resolution problem leading to bus error scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove() btrfs: reschedule if necessary when logging directory items vt: keyboard, simplify vt_kdgkbsent vt: keyboard, extend func_buf_lock to readers dmaengine: dma-jz4780: Fix race in jz4780_dma_tx_status iio:gyro:itg3200: Fix timestamp alignment and prevent data leak. powerpc/powernv/elog: Fix race while processing OPAL error log event. ubifs: dent: Fix some potential memory leaks while iterating entries ubi: check kthread_should_stop() after the setting of task state ia64: fix build error with !COREDUMP ceph: promote to unsigned long long before shifting libceph: clear con->out_msg on Policy::stateful_server faults 9P: Cast to loff_t before multiplying ring-buffer: Return 0 on success from ring_buffer_resize() vringh: fix __vringh_iov() when riov and wiov are different tty: make FONTX ioctl use the tty pointer they were actually passed arm64: berlin: Select DW_APB_TIMER_OF cachefiles: Handle readpage error correctly hil/parisc: Disable HIL driver when it gets stuck ARM: samsung: fix PM debug build with DEBUG_LL but !MMU ARM: s3c24xx: fix missing system reset device property: Keep secondary firmware node secondary by type device property: Don't clear secondary pointer for shared primary firmware node staging: comedi: cb_pcidas: Allow 2-channel commands for AO subdevice xen/events: don't use chip_data for legacy IRQs tipc: fix use-after-free in tipc_bcast_get_mode gianfar: Replace skb_realloc_headroom with skb_cow_head for PTP gianfar: Account for Tx PTP timestamp in the skb headroom Fonts: Replace discarded const qualifier ALSA: usb-audio: Add implicit feedback quirk for Qu-16 ftrace: Fix recursion check for NMI test ftrace: Handle tracing when switching between context ARM: dts: sun4i-a10: fix cpu_alert temperature x86/kexec: Use up-to-dated screen_info copy to fill boot params of: Fix reserved-memory overlap detection scsi: core: Don't start concurrent async scan on same host vsock: use ns_capable_noaudit() on socket create vt: Disable KD_FONT_OP_COPY fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent serial: 8250_mtk: Fix uart_get_baud_rate warning serial: txx9: add missing platform_driver_unregister() on error in serial_txx9_init USB: serial: cyberjack: fix write-URB completion race USB: serial: option: add LE910Cx compositions 0x1203, 0x1230, 0x1231 USB: serial: option: add Telit FN980 composition 0x1055 USB: Add NO_LPM quirk for Kingston flash drive ARC: stack unwinding: avoid indefinite looping Revert "ARC: entry: fix potential EFA clobber when TIF_SYSCALL_TRACE" Linux 4.4.242 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I9c6408c403a91272e8255725dc8de294e522dc90
| | * | md/raid5: fix oops during stripe resizingSong Liu2020-11-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit b44c018cdf748b96b676ba09fdbc5b34fc443ada upstream. KoWei reported crash during raid5 reshape: [ 1032.252932] Oops: 0002 [#1] SMP PTI [...] [ 1032.252943] RIP: 0010:memcpy_erms+0x6/0x10 [...] [ 1032.252947] RSP: 0018:ffffba1ac0c03b78 EFLAGS: 00010286 [ 1032.252949] RAX: 0000784ac0000000 RBX: ffff91bec3d09740 RCX: 0000000000001000 [ 1032.252951] RDX: 0000000000001000 RSI: ffff91be6781c000 RDI: 0000784ac0000000 [ 1032.252953] RBP: ffffba1ac0c03bd8 R08: 0000000000001000 R09: ffffba1ac0c03bf8 [ 1032.252954] R10: 0000000000000000 R11: 0000000000000000 R12: ffffba1ac0c03bf8 [ 1032.252955] R13: 0000000000001000 R14: 0000000000000000 R15: 0000000000000000 [ 1032.252958] FS: 0000000000000000(0000) GS:ffff91becf500000(0000) knlGS:0000000000000000 [ 1032.252959] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1032.252961] CR2: 0000784ac0000000 CR3: 000000031780a002 CR4: 00000000001606e0 [ 1032.252962] Call Trace: [ 1032.252969] ? async_memcpy+0x179/0x1000 [async_memcpy] [ 1032.252977] ? raid5_release_stripe+0x8e/0x110 [raid456] [ 1032.252982] handle_stripe_expansion+0x15a/0x1f0 [raid456] [ 1032.252988] handle_stripe+0x592/0x1270 [raid456] [ 1032.252993] handle_active_stripes.isra.0+0x3cb/0x5a0 [raid456] [ 1032.252999] raid5d+0x35c/0x550 [raid456] [ 1032.253002] ? schedule+0x42/0xb0 [ 1032.253006] ? schedule_timeout+0x10e/0x160 [ 1032.253011] md_thread+0x97/0x160 [ 1032.253015] ? wait_woken+0x80/0x80 [ 1032.253019] kthread+0x104/0x140 [ 1032.253022] ? md_start_sync+0x60/0x60 [ 1032.253024] ? kthread_park+0x90/0x90 [ 1032.253027] ret_from_fork+0x35/0x40 This is because cache_size_mutex was unlocked too early in resize_stripes, which races with grow_one_stripe() that grow_one_stripe() allocates a stripe with wrong pool_size. Fix this issue by unlocking cache_size_mutex after updating pool_size. Cc: <stable@vger.kernel.org> # v4.4+ Reported-by: KoWei Sung <winders@amazon.com> Signed-off-by: Song Liu <songliubraving@fb.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * | md/bitmap: md_bitmap_get_counter returns wrong blocksZhao Heming2020-11-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit d837f7277f56e70d82b3a4a037d744854e62f387 ] md_bitmap_get_counter() has code: ``` if (bitmap->bp[page].hijacked || bitmap->bp[page].map == NULL) csize = ((sector_t)1) << (bitmap->chunkshift + PAGE_COUNTER_SHIFT - 1); ``` The minus 1 is wrong, this branch should report 2048 bits of space. With "-1" action, this only report 1024 bit of space. This bug code returns wrong blocks, but it doesn't inflence bitmap logic: 1. Most callers focus this function return value (the counter of offset), not the parameter blocks. 2. The bug is only triggered when hijacked is true or map is NULL. the hijacked true condition is very rare. the "map == null" only true when array is creating or resizing. 3. Even the caller gets wrong blocks, current code makes caller just to call md_bitmap_get_counter() one more time. Signed-off-by: Zhao Heming <heming.zhao@suse.com> Signed-off-by: Song Liu <songliubraving@fb.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
* | | | Merge branch 'android-4.4-p' of ↵Michael Bestas2020-10-23
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://android.googlesource.com/kernel/common into lineage-17.1-caf-msm8998 This brings LA.UM.8.4.r1-06000-8x98.0 up to date with https://android.googlesource.com/kernel/common/ android-4.4-p at commit: 7a9986e91f909 UPSTREAM: binder: fix UAF when releasing todo list Conflicts: fs/eventpoll.c Change-Id: I77260d03cb539d7e7eefcea360aee2d59bb9e0cb
| * | | Merge 4.4.238 into android-4.4-pGreg Kroah-Hartman2020-10-01
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.238 af_key: pfkey_dump needs parameter validation KVM: fix memory leak in kvm_io_bus_unregister_dev() kprobes: fix kill kprobe which has been marked as gone ftrace: Setup correct FTRACE_FL_REGS flags for module RDMA/ucma: ucma_context reference leak in error path mtd: Fix comparison in map_word_andequal() hdlc_ppp: add range checks in ppp_cp_parse_cr() tipc: use skb_unshare() instead in tipc_buf_append() net: add __must_check to skb_put_padto() ip: fix tos reflection in ack and reset packets serial: 8250: Avoid error message on reprobe scsi: aacraid: fix illegal IO beyond last LBA m68k: q40: Fix info-leak in rtc_ioctl gma/gma500: fix a memory disclosure bug due to uninitialized bytes ASoC: kirkwood: fix IRQ error handling PM / devfreq: tegra30: Fix integer overflow on CPU's freq max out mtd: cfi_cmdset_0002: don't free cfi->cfiq in error path of cfi_amdstd_setup() mfd: mfd-core: Protect against NULL call-back function pointer tracing: Adding NULL checks for trace_array descriptor pointer bcache: fix a lost wake-up problem caused by mca_cannibalize_lock xfs: fix attr leaf header freemap.size underflow kernel/sys.c: avoid copying possible padding bytes in copy_to_user neigh_stat_seq_next() should increase position index rt_cpu_seq_next should increase position index seqlock: Require WRITE_ONCE surrounding raw_seqcount_barrier ACPI: EC: Reference count query handlers under lock tracing: Set kernel_stack's caller size properly ar5523: Add USB ID of SMCWUSBT-G2 wireless adapter Bluetooth: Fix refcount use-after-free issue mm: pagewalk: fix termination condition in walk_pte_range() Bluetooth: prefetch channel before killing sock skbuff: fix a data race in skb_queue_len() audit: CONFIG_CHANGE don't log internal bookkeeping as an event selinux: sel_avc_get_stat_idx should increase position index scsi: lpfc: Fix RQ buffer leakage when no IOCBs available drm/omap: fix possible object reference leak dmaengine: tegra-apb: Prevent race conditions on channel's freeing media: go7007: Fix URB type for interrupt handling Bluetooth: guard against controllers sending zero'd events drm/amdgpu: increase atombios cmd timeout Bluetooth: L2CAP: handle l2cap config request during open state media: tda10071: fix unsigned sign extension overflow tpm: ibmvtpm: Wait for buffer to be set before proceeding tracing: Use address-of operator on section symbols serial: 8250_omap: Fix sleeping function called from invalid context during probe SUNRPC: Fix a potential buffer overflow in 'svc_print_xprts()' ubifs: Fix out-of-bounds memory access caused by abnormal value of node_len ALSA: usb-audio: Fix case when USB MIDI interface has more than one extra endpoint descriptor mm/filemap.c: clear page error before actual read mm/mmap.c: initialize align_offset explicitly for vm_unmapped_area KVM: Remove CREATE_IRQCHIP/SET_PIT2 race bdev: Reduce time holding bd_mutex in sync in blkdev_close() drivers: char: tlclk.c: Avoid data race between init and interrupt handler dt-bindings: sound: wm8994: Correct required supplies based on actual implementaion atm: fix a memory leak of vcc->user_back phy: samsung: s5pv210-usb2: Add delay after reset Bluetooth: Handle Inquiry Cancel error after Inquiry Complete USB: EHCI: ehci-mv: fix error handling in mv_ehci_probe() tty: serial: samsung: Correct clock selection logic ALSA: hda: Fix potential race in unsol event handler fuse: don't check refcount after stealing page USB: EHCI: ehci-mv: fix less than zero comparison of an unsigned int e1000: Do not perform reset in reset_task if we are already down printk: handle blank console arguments passed in. vfio/pci: fix memory leaks of eventfd ctx perf kcore_copy: Fix module map when there are no modules loaded mtd: rawnand: omap_elm: Fix runtime PM imbalance on error ceph: fix potential race in ceph_check_caps mtd: parser: cmdline: Support MTD names containing one or more colons x86/speculation/mds: Mark mds_user_clear_cpu_buffers() __always_inline vfio/pci: Clear error and request eventfd ctx after releasing vfio/pci: fix racy on error and request eventfd ctx s390/init: add missing __init annotations mwifiex: Increase AES key storage size to 256 bits batman-adv: bla: fix type misuse for backbone_gw hash indexing atm: eni: fix the missed pci_disable_device() for eni_init_one() batman-adv: mcast/TT: fix wrongly dropped or rerouted packets ALSA: asihpi: fix iounmap in error handler MIPS: Add the missing 'CPU_1074K' into __get_cpu_type() tty: vt, consw->con_scrolldelta cleanup kprobes: Fix to check probe enabled before disarm_kprobe_ftrace() lib/string.c: implement stpcpy ata: define AC_ERR_OK ata: make qc_prep return ata_completion_errors ata: sata_mv, avoid trigerrable BUG_ON Linux 4.4.238 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Icad47fa33334613e04af31218b3db45ddff7872a
| | * | bcache: fix a lost wake-up problem caused by mca_cannibalize_lockGuoju Fang2020-10-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 34cf78bf34d48dddddfeeadb44f9841d7864997a ] This patch fix a lost wake-up problem caused by the race between mca_cannibalize_lock and bch_cannibalize_unlock. Consider two processes, A and B. Process A is executing mca_cannibalize_lock, while process B takes c->btree_cache_alloc_lock and is executing bch_cannibalize_unlock. The problem happens that after process A executes cmpxchg and will execute prepare_to_wait. In this timeslice process B executes wake_up, but after that process A executes prepare_to_wait and set the state to TASK_INTERRUPTIBLE. Then process A goes to sleep but no one will wake up it. This problem may cause bcache device to dead. Signed-off-by: Guoju Fang <fangguoju@gmail.com> Signed-off-by: Coly Li <colyli@suse.de> Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Sasha Levin <sashal@kernel.org>
* | | | Merge branch 'android-4.4-p' of ↵Michael Bestas2020-09-19
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://android.googlesource.com/kernel/common into lineage-17.1-caf-msm8998 This brings LA.UM.8.4.r1-05900-8x98.0 up to date with https://android.googlesource.com/kernel/common/ android-4.4-p at commit: 5fd2d19eeb976 Merge 4.4.236 into android-4.4-p Conflicts: drivers/scsi/ufs/ufshcd.c Change-Id: I22282a0d571bdb72f50d3fc1e2cee4443de1f7f4
| * | | Merge 4.4.236 into android-4.4-pGreg Kroah-Hartman2020-09-12
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.236 HID: core: Correctly handle ReportSize being zero HID: core: Sanitize event code and type when mapping input perf record/stat: Explicitly call out event modifiers in the documentation mm, page_alloc: remove unnecessary variable from free_pcppages_bulk hwmon: (applesmc) check status earlier. ceph: don't allow setlease on cephfs s390: don't trace preemption in percpu macros xen/xenbus: Fix granting of vmalloc'd memory dmaengine: of-dma: Fix of_dma_router_xlate's of_dma_xlate handling batman-adv: Avoid uninitialized chaddr when handling DHCP batman-adv: bla: use netif_rx_ni when not in interrupt context dmaengine: at_hdmac: check return value of of_find_device_by_node() in at_dma_xlate() netfilter: nf_tables: incorrect enum nft_list_attributes definition netfilter: nf_tables: fix destination register zeroing dmaengine: pl330: Fix burst length if burst size is smaller than bus width bnxt_en: Check for zero dir entries in NVRAM. fix regression in "epoll: Keep a reference on files added to the check list" tg3: Fix soft lockup when tg3_reset_task() fails. iommu/vt-d: Serialize IOMMU GCMD register modifications thermal: ti-soc-thermal: Fix bogus thermal shutdowns for omap4430 include/linux/log2.h: add missing () around n in roundup_pow_of_two() btrfs: drop path before adding new uuid tree entry btrfs: Remove redundant extent_buffer_get in get_old_root btrfs: Remove extraneous extent_buffer_get from tree_mod_log_rewind btrfs: set the lockdep class for log tree extent buffers uaccess: Add non-pagefault user-space read functions uaccess: Add non-pagefault user-space write function btrfs: fix potential deadlock in the search ioctl net: qmi_wwan: MDM9x30 specific power management net: qmi_wwan: support "raw IP" mode net: qmi_wwan: should hold RTNL while changing netdev type net: qmi_wwan: ignore bogus CDC Union descriptors Add Dell Wireless 5809e Gobi 4G HSPA+ Mobile Broadband Card (rev3) to qmi_wwan qmi_wwan: Added support for Gemalto's Cinterion PHxx WWAN interface qmi_wwan: add support for Quectel EC21 and EC25 NET: usb: qmi_wwan: add support for Telit LE922A PID 0x1040 drivers: net: usb: qmi_wwan: add QMI_QUIRK_SET_DTR for Telit PID 0x1201 usb: qmi_wwan: add D-Link DWM-222 A2 device ID net: usb: qmi_wwan: add Telit ME910 support net: usb: qmi_wwan: add Telit 0x1050 composition ALSA: ca0106: fix error code handling ALSA: pcm: oss: Remove superfluous WARN_ON() for mulaw sanity check dm cache metadata: Avoid returning cmd->bm wild pointer on error dm thin metadata: Avoid returning cmd->bm wild pointer on error net: refactor bind_bucket fastreuse into helper net: initialize fastreuse on inet_inherit_port checkpatch: fix the usage of capture group ( ... ) mm/hugetlb: fix a race between hugetlb sysctl handlers cfg80211: regulatory: reject invalid hints net: usb: Fix uninit-was-stored issue in asix_read_phy_addr() ALSA: firewire-digi00x: add support for console models of Digi00x series ALSA: firewire-digi00x: exclude Avid Adrenaline from detection ALSA; firewire-tascam: exclude Tascam FE-8 from detection fs/affs: use octal for permissions affs: fix basic permission bits to actually work ravb: Fixed to be able to unload modules net: ethernet: mlx4: Fix memory allocation in mlx4_buddy_init() bnxt_en: Failure to update PHY is not fatal condition. bnxt: don't enable NAPI until rings are ready net: usb: dm9601: Add USB ID of Keenetic Plus DSL sctp: not disable bh in the whole sctp_get_port_local() net: disable netpoll on fresh napis Linux 4.4.236 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I45da24ccdf864c8774a1265a5d81685e04add060
| | * | dm thin metadata: Avoid returning cmd->bm wild pointer on errorYe Bin2020-09-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 219403d7e56f9b716ad80ab87db85d29547ee73e upstream. Maybe __create_persistent_data_objects() caller will use PTR_ERR as a pointer, it will lead to some strange things. Signed-off-by: Ye Bin <yebin10@huawei.com> Cc: stable@vger.kernel.org Signed-off-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * | dm cache metadata: Avoid returning cmd->bm wild pointer on errorYe Bin2020-09-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit d16ff19e69ab57e08bf908faaacbceaf660249de upstream. Maybe __create_persistent_data_objects() caller will use PTR_ERR as a pointer, it will lead to some strange things. Signed-off-by: Ye Bin <yebin10@huawei.com> Cc: stable@vger.kernel.org Signed-off-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | | Merge branch 'android-4.4-p' of ↵Michael Bestas2020-08-23
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://android.googlesource.com/kernel/common into lineage-17.1-caf-msm8998 This brings LA.UM.8.4.r1-05900-8x98.0 up to date with https://android.googlesource.com/kernel/common/ android-4.4-p at commit: 59f04f292e871 ANDROID: fix a bug in quota2 Conflicts: Makefile fs/ext4/inode.c fs/f2fs/dir.c Change-Id: Ic71b44a02908cf633d96114f0ff745cf1e1186de
| * | | Merge 4.4.233 into android-4.4-pGreg Kroah-Hartman2020-08-21
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.233 xfs: don't call xfs_da_shrink_inode with NULL bp net: phy: mdio-bcm-unimac: fix potential NULL dereference in unimac_mdio_probe() media: rc: prevent memory leak in cx23888_ir_probe ath9k_htc: release allocated buffer if timed out ath9k: release allocated buffer if timed out nfs: Move call to security_inode_listsecurity into nfs_listxattr PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl() drm: hold gem reference until object is no longer accessed f2fs: check memory boundary by insane namelen f2fs: check if file namelen exceeds max value ARM: 8986/1: hw_breakpoint: Don't invoke overflow handler on uaccess watchpoints fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins. rds: Prevent kernel-infoleak in rds_notify_queue_get() net/x25: Fix x25_neigh refcnt leak when x25 disconnect net/x25: Fix null-ptr-deref in x25_disconnect sh: Fix validation of system call number net: lan78xx: add missing endpoint sanity check net: lan78xx: fix transfer-buffer memory leak mlxsw: core: Increase scope of RCU read-side critical section mac80211: mesh: Free ie data when leaving mesh nfc: s3fwrn5: add missing release on skb in s3fwrn5_recv_frame net: ethernet: ravb: exit if re-initialization fails in tx timeout Revert "i2c: cadence: Fix the hold bit setting" xen-netfront: fix potential deadlock in xennet_remove() x86/i8259: Use printk_deferred() to prevent deadlock random32: update the net random state on interrupt and activity ARM: percpu.h: fix build error random: fix circular include dependency on arm64 after addition of percpu.h random32: remove net_rand_state from the latent entropy gcc plugin random32: move the pseudo-random 32-bit definitions to prandom.h ext4: fix direct I/O read error USB: serial: qcserial: add EM7305 QDL product ID ALSA: seq: oss: Serialize ioctls Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt() Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_evt() Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_with_rssi_evt() vgacon: Fix for missing check in scrollback handling mtd: properly check all write ioctls for permissions net/9p: validate fds in p9_fd_open drm/nouveau/fbcon: fix module unload when fbcon init has failed for some reason cfg80211: check vendor command doit pointer before use igb: reinit_locked() should be called with rtnl_lock atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent tools lib traceevent: Fix memory leak in process_dynamic_array_len binder: Prevent context manager from incrementing ref 0 ipv4: Silence suspicious RCU usage warning ipv6: fix memory leaks on IPV6_ADDRFORM path Revert "vxlan: fix tos value before xmit" net: lan78xx: replace bogus endpoint lookup usb: hso: check for return value in hso_serial_common_create() vxlan: Ensure FDB dump is performed under RCU Smack: fix use-after-free in smk_write_relabel_self() tracepoint: Mark __tracepoint_string's __used udp: drop corrupt packets earlier to avoid data corruption gpio: fix oops resulting from calling of_get_named_gpio(NULL, ...) EDAC: Fix reference count leaks m68k: mac: Don't send IOP message until channel is idle m68k: mac: Fix IOP status/control register writes ARM: at91: pm: add missing put_device() call in at91_pm_sram_init() ARM: socfpga: PM: add missing put_device() call in socfpga_setup_ocram_self_refresh() drm/tilcdc: fix leak & null ref in panel_connector_get_modes Bluetooth: add a mutex lock to avoid UAF in do_enale_set fs/btrfs: Add cond_resched() for try_release_extent_mapping() stalls drm/radeon: Fix reference count leaks caused by pm_runtime_get_sync video: fbdev: neofb: fix memory leak in neo_scan_monitor() drm/nouveau: fix multiple instances of reference count leaks drm/debugfs: fix plain echo to connector "force" attribute mm/mmap.c: Add cond_resched() for exit_mmap() CPU stalls brcmfmac: To fix Bss Info flag definition Bug iwlegacy: Check the return value of pcie_capability_read_*() usb: gadget: net2280: fix memory leak on probe error handling paths bdc: Fix bug causing crash after multiple disconnects dyndbg: fix a BUG_ON in ddebug_describe_flags bcache: fix super block seq numbers comparision in register_cache_set() ACPICA: Do not increment operation_region reference counts for field units agp/intel: Fix a memory leak on module initialisation failure video: fbdev: sm712fb: fix an issue about iounmap for a wrong address console: newport_con: fix an issue about leak related system resources iio: improve IIO_CONCENTRATION channel type description leds: lm355x: avoid enum conversion warning media: omap3isp: Add missed v4l2_ctrl_handler_free() for preview_init_entities() scsi: cumana_2: Fix different dev_id between request_irq() and free_irq() cxl: Fix kobject memleak drm/radeon: fix array out-of-bounds read and write issues scsi: powertec: Fix different dev_id between request_irq() and free_irq() scsi: eesox: Fix different dev_id between request_irq() and free_irq() media: firewire: Using uninitialized values in node_probe() media: exynos4-is: Add missed check for pinctrl_lookup_state() drm: panel: simple: Fix bpc for LG LB070WV8 panel mwifiex: Prevent memory corruption handling keys powerpc/vdso: Fix vdso cpu truncation PCI/ASPM: Add missing newline in sysfs 'policy' usb: dwc2: Fix error path in gadget registration scsi: mesh: Fix panic after host or bus reset Smack: fix another vsscanf out of bounds Smack: prevent underflow in smk_set_cipso() power: supply: check if calc_soc succeeded in pm860x_init_battery s390/qeth: don't process empty bridge port events wl1251: fix always return 0 error net: spider_net: Fix the size used in a 'dma_free_coherent()' call dlm: Fix kobject memleak pinctrl-single: fix pcs_parse_pinconf() return value drivers/net/wan/lapbether: Added needed_headroom and a skb->len check net/nfc/rawsock.c: add CAP_NET_RAW check. net: Set fput_needed iff FDPUT_FPUT is set ALSA: usb-audio: Creative USB X-Fi Pro SB1095 volume knob support ALSA: usb-audio: fix overeager device match for MacroSilicon MS2109 ALSA: usb-audio: add quirk for Pioneer DDJ-RB crypto: qat - fix double free in qat_uclo_create_batch_init_list fs/minix: check return value of sb_getblk() fs/minix: don't allow getting deleted inodes fs/minix: reject too-large maximum file size ALSA: usb-audio: work around streaming quirk for MacroSilicon MS2109 9p: Fix memory leak in v9fs_mount parisc: mask out enable and reserved bits from sba imask ARM: 8992/1: Fix unwind_frame for clang-built kernels xen/balloon: fix accounting in alloc_xenballooned_pages error path xen/balloon: make the balloon wait interruptible PCI: hotplug: ACPI: Fix context refcounting in acpiphp_grab_context() btrfs: only search for left_info if there is no right_info in try_merge_free_space btrfs: fix memory leaks after failure to lookup checksums during inode logging powerpc: Fix circular dependency between percpu.h and mmu.h net: ethernet: stmmac: Disable hardware multicast filter net: stmmac: dwmac1000: provide multicast filter fallback md/raid5: Fix Force reconstruct-write io stuck in degraded raid5 bcache: allocate meta data pages as compound pages mac80211: fix misplaced while instead of if MIPS: CPU#0 is not hotpluggable ext2: fix missing percpu_counter_inc ocfs2: change slot number type s16 to u16 kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler pseries: Fix 64 bit logical memory block panic USB: serial: ftdi_sio: make process-packet buffer unsigned USB: serial: ftdi_sio: clean up receive processing iommu/omap: Check for failure of a call to omap_iommu_dump_ctx iommu/vt-d: Enforce PASID devTLB field mask i2c: rcar: slave: only send STOP event when we have been addressed clk: clk-atlas6: fix return value check in atlas6_clk_init() Input: sentelic - fix error return when fsp_reg_write fails drm/vmwgfx: Fix two list_for_each loop exit tests nfs: Fix getxattr kernel panic and memory overflow fs/ufs: avoid potential u32 multiplication overflow mfd: dln2: Run event handler loop under spinlock ALSA: echoaudio: Fix potential Oops in snd_echo_resume() sh: landisk: Add missing initialization of sh_io_port_base ipv6: check skb->protocol before lookup for nexthop Linux 4.4.233 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Iec7dcf69361bcc247996f3de2e20ba64ed0ce3a8
| | * | bcache: allocate meta data pages as compound pagesColy Li2020-08-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 5fe48867856367142d91a82f2cbf7a57a24cbb70 upstream. There are some meta data of bcache are allocated by multiple pages, and they are used as bio bv_page for I/Os to the cache device. for example cache_set->uuids, cache->disk_buckets, journal_write->data, bset_tree->data. For such meta data memory, all the allocated pages should be treated as a single memory block. Then the memory management and underlying I/O code can treat them more clearly. This patch adds __GFP_COMP flag to all the location allocating >0 order pages for the above mentioned meta data. Then their pages are treated as compound pages now. Signed-off-by: Coly Li <colyli@suse.de> Cc: stable@vger.kernel.org Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * | md/raid5: Fix Force reconstruct-write io stuck in degraded raid5ChangSyun Peng2020-08-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit a1c6ae3d9f3dd6aa5981a332a6f700cf1c25edef upstream. In degraded raid5, we need to read parity to do reconstruct-write when data disks fail. However, we can not read parity from handle_stripe_dirtying() in force reconstruct-write mode. Reproducible Steps: 1. Create degraded raid5 mdadm -C /dev/md2 --assume-clean -l5 -n3 /dev/sda2 /dev/sdb2 missing 2. Set rmw_level to 0 echo 0 > /sys/block/md2/md/rmw_level 3. IO to raid5 Now some io may be stuck in raid5. We can use handle_stripe_fill() to read the parity in this situation. Cc: <stable@vger.kernel.org> # v4.4+ Reviewed-by: Alex Wu <alexwu@synology.com> Reviewed-by: BingJing Chang <bingjingc@synology.com> Reviewed-by: Danny Shih <dannyshih@synology.com> Signed-off-by: ChangSyun Peng <allenpeng@synology.com> Signed-off-by: Song Liu <songliubraving@fb.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * | bcache: fix super block seq numbers comparision in register_cache_set()Coly Li2020-08-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 117f636ea695270fe492d0c0c9dfadc7a662af47 ] In register_cache_set(), c is pointer to struct cache_set, and ca is pointer to struct cache, if ca->sb.seq > c->sb.seq, it means this registering cache has up to date version and other members, the in- memory version and other members should be updated to the newer value. But current implementation makes a cache set only has a single cache device, so the above assumption works well except for a special case. The execption is when a cache device new created and both ca->sb.seq and c->sb.seq are 0, because the super block is never flushed out yet. In the location for the following if() check, 2156 if (ca->sb.seq > c->sb.seq) { 2157 c->sb.version = ca->sb.version; 2158 memcpy(c->sb.set_uuid, ca->sb.set_uuid, 16); 2159 c->sb.flags = ca->sb.flags; 2160 c->sb.seq = ca->sb.seq; 2161 pr_debug("set version = %llu\n", c->sb.version); 2162 } c->sb.version is not initialized yet and valued 0. When ca->sb.seq is 0, the if() check will fail (because both values are 0), and the cache set version, set_uuid, flags and seq won't be updated. The above problem is hiden for current code, because the bucket size is compatible among different super block version. And the next time when running cache set again, ca->sb.seq will be larger than 0 and cache set super block version will be updated properly. But if the large bucket feature is enabled, sb->bucket_size is the low 16bits of the bucket size. For a power of 2 value, when the actual bucket size exceeds 16bit width, sb->bucket_size will always be 0. Then read_super_common() will fail because the if() check to is_power_of_2(sb->bucket_size) is false. This is how the long time hidden bug is triggered. This patch modifies the if() check to the following way, 2156 if (ca->sb.seq > c->sb.seq || c->sb.seq == 0) { Then cache set's version, set_uuid, flags and seq will always be updated corectly including for a new created cache device. Signed-off-by: Coly Li <colyli@suse.de> Reviewed-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Sasha Levin <sashal@kernel.org>
* | | | Merge branch 'android-4.4-p' of ↵Michael Bestas2020-07-24
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://android.googlesource.com/kernel/common into lineage-17.1-caf-msm8998 This brings LA.UM.8.4.r1-05700-8x98.0 up to date with https://android.googlesource.com/kernel/common/ android-4.4-p at commit: 8476df741c780 BACKPORT: xtables: extend matches and targets with .usersize Conflicts: drivers/usb/gadget/function/f_uac1.c net/netlink/genetlink.c sound/core/compress_offload.c Change-Id: Id7b2fdf3942f1986edec869dcd965df632cc1c5f
| * | | Merge 4.4.229 into android-4.4-pGreg Kroah-Hartman2020-07-01
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.229 s390: fix syscall_get_error for compat processes clk: sunxi: Fix incorrect usage of round_down() i2c: piix4: Detect secondary SMBus controller on AMD AM4 chipsets clk: qcom: msm8916: Fix the address location of pll->config_reg ALSA: isa/wavefront: prevent out of bounds write in ioctl scsi: qla2xxx: Fix issue with adapter's stopping state i2c: pxa: clear all master action bits in i2c_pxa_stop_message() usblp: poison URBs upon disconnect ps3disk: use the default segment boundary vfio/pci: fix memory leaks in alloc_perm_bits() mfd: wm8994: Fix driver operation if loaded as modules scsi: lpfc: Fix lpfc_nodelist leak when processing unsolicited event nfsd: Fix svc_xprt refcnt leak when setup callback client failed powerpc/crashkernel: Take "mem=" option into account yam: fix possible memory leak in yam_init_driver mksysmap: Fix the mismatch of '.L' symbols in System.map scsi: sr: Fix sr_probe() missing deallocate of device minor scsi: ibmvscsi: Don't send host info in adapter info MAD after LPM ALSA: usb-audio: Improve frames size computation s390/qdio: put thinint indicator after early error tty: hvc: Fix data abort due to race in hvc_open staging: sm750fb: add missing case while setting FB_VISUAL i2c: pxa: fix i2c_pxa_scream_blue_murder() debug output serial: amba-pl011: Make sure we initialize the port.lock spinlock drivers: base: Fix NULL pointer exception in __platform_driver_probe() if a driver developer is foolish PCI/ASPM: Allow ASPM on links to PCIe-to-PCI/PCI-X Bridges power: supply: smb347-charger: IRQSTAT_D is volatile scsi: mpt3sas: Fix double free warnings dlm: remove BUG() before panic() clk: ti: composite: fix memory leak tty: n_gsm: Fix SOF skipping tty: n_gsm: Fix waking up upper tty layer when room available powerpc/pseries/ras: Fix FWNMI_VALID off by one powerpc/ps3: Fix kexec shutdown hang vfio-pci: Mask cap zero usb/ohci-platform: Fix a warning when hibernating USB: host: ehci-mxc: Add error handling in ehci_mxc_drv_probe() tty: n_gsm: Fix bogus i++ in gsm_data_kick clk: samsung: exynos5433: Add IGNORE_UNUSED flag to sclk_i2s1 watchdog: da9062: No need to ping manually before setting timeout usb: dwc2: gadget: move gadget resume after the core is in L0 state USB: gadget: udc: s3c2410_udc: Remove pointless NULL check in s3c2410_udc_nuke usb: gadget: lpc32xx_udc: don't dereference ep pointer before null check usb: gadget: fix potential double-free in m66592_probe. net: sunrpc: Fix off-by-one issues in 'rpc_ntop6' ASoC: fsl_asrc_dma: Fix dma_chan leak when config DMA channel failed openrisc: Fix issue with argument clobbering for clone/fork gfs2: Allow lock_nolock mount to specify jid=X scsi: iscsi: Fix reference count leak in iscsi_boot_create_kobj lib/zlib: remove outdated and incorrect pre-increment optimization include/linux/bitops.h: avoid clang shift-count-overflow warnings elfnote: mark all .note sections SHF_ALLOC selftests/net: in timestamping, strncpy needs to preserve null byte scsi: acornscsi: Fix an error handling path in acornscsi_probe() usb/xhci-plat: Set PM runtime as active on resume usb/ehci-platform: Set PM runtime as active on resume perf report: Fix NULL pointer dereference in hists__fprintf_nr_sample_events() bcache: fix potential deadlock problem in btree_gc_coalesce block: Fix use-after-free in blkdev_get() libata: Use per port sync for detach drm: encoder_slave: fix refcouting error for modules drm/dp_mst: Reformat drm_dp_check_act_status() a bit drm/qxl: Use correct notify port address when creating cursor ring selinux: fix double free ext4: fix partial cluster initialization when splitting extent drm/dp_mst: Increase ACT retry timeout to 3s sparc64: fix misuses of access_process_vm() in genregs32_[sg]et() block: nr_sects_write(): Disable preemption on seqcount write crypto: algboss - don't wait during notifier callback kprobes: Fix to protect kick_kprobe_optimizer() by kprobe_mutex powerpc/kprobes: Fixes for kprobe_lookup_name() on BE x86/kprobes: Avoid kretprobe recursion bug kretprobe: Prevent triggering kretprobe from within kprobe_flush_task e1000e: Do not wake up the system via WOL if device wakeup is disabled sched/rt, net: Use CONFIG_PREEMPTION.patch net: core: device_rename: Use rwsem instead of a seqcount net: Revert "pkt_sched: fq: use proper locking in fq_dump_stats()" scsi: scsi_devinfo: handle non-terminated strings l2tp: Allow duplicate session creation with UDP net: sched: export __netdev_watchdog_up() fix a braino in "sparc32: fix register window handling in genregs32_[gs]et()" net: fix memleak in register_netdevice() net: usb: ax88179_178a: fix packet alignment padding tg3: driver sleeps indefinitely when EEH errors exceed eeh_max_freezes ip_tunnel: fix use-after-free in ip_tunnel_lookup() tcp_cubic: fix spurious HYSTART_DELAY exit upon drop in min RTT ip6_gre: fix use-after-free in ip6gre_tunnel_lookup() tcp: grow window for OOO packets only for SACK flows sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket net: Fix the arp error in some cases net: Do not clear the sock TX queue in sk_set_socket() net: core: reduce recursion limit value mld: fix memory leak in ipv6_mc_destroy_dev() USB: ohci-sm501: Add missed iounmap() in remove usb: dwc2: Postponed gadget registration to the udc class driver usb: add USB_QUIRK_DELAY_INIT for Logitech C922 PCI: Disable MSI for HiSilicon Hip06/Hip07 Root Ports USB: ehci: reopen solution for Synopsys HC bug usb: host: ehci-exynos: Fix error check in exynos_ehci_probe() ALSA: usb-audio: add quirk for Denon DCD-1500RE xhci: Fix incorrect EP_STATE_MASK xhci: Fix enumeration issue when setting max packet size for FS devices. cdc-acm: Add DISABLE_ECHO quirk for Microchip/SMSC chip ALSA: usb-audio: uac1: Invalidate ctl on interrupt ALSA: usb-audio: allow clock source validity interrupts ALSA: usb-audio: Clean up mixer element list traverse ALSA: usb-audio: Fix OOB access of mixer element list xhci: Poll for U0 after disabling USB2 LPM cifs/smb3: Fix data inconsistent when punch hole cifs/smb3: Fix data inconsistent when zero file range efi/esrt: Fix reference count leak in esre_create_sysfs_entry. RDMA/mad: Fix possible memory leak in ib_mad_post_receive_mads() ARM: imx5: add missing put_device() call in imx_suspend_alloc_ocram() usb: gadget: udc: Potential Oops in error handling code netfilter: ipset: fix unaligned atomic access sched/core: Fix PI boosting between RT and DEADLINE tasks net: alx: fix race condition in alx_remove kbuild: improve cc-option to clean up all temporary files blktrace: break out of blktrace setup on concurrent calls ACPI: sysfs: Fix pm_profile_attr type KVM: X86: Fix MSR range of APIC registers in X2APIC mode mm/slab: use memzero_explicit() in kzfree() ocfs2: load global_inode_alloc ocfs2: fix value of OCFS2_INVALID_SLOT ocfs2: fix panic on nfs server over ocfs2 arm64: perf: Report the PC value in REGS_ABI_32 mode tracing: Fix event trigger to accept redundant spaces drm/radeon: fix fb_div check in ni_init_smc_spll_table() sunrpc: fixed rollback in rpc_gssd_dummy_populate() SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment() pNFS/flexfiles: Fix list corruption if the mirror count changes NFSv4 fix CLOSE not waiting for direct IO compeletion PCI: Disable MSI for HiSilicon Hip06/Hip07 only in Root Port mode ALSA: usb-audio: Fix invalid NULL check in snd_emuusb_set_samplerate() Linux 4.4.229 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ic510bbcf5c6e701c747c612876e3ce141757a34a
| | * | bcache: fix potential deadlock problem in btree_gc_coalesceZhiqiang Liu2020-06-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit be23e837333a914df3f24bf0b32e87b0331ab8d1 ] coccicheck reports: drivers/md//bcache/btree.c:1538:1-7: preceding lock on line 1417 In btree_gc_coalesce func, if the coalescing process fails, we will goto to out_nocoalesce tag directly without releasing new_nodes[i]->write_lock. Then, it will cause a deadlock when trying to acquire new_nodes[i]-> write_lock for freeing new_nodes[i] before return. btree_gc_coalesce func details as follows: if alloc new_nodes[i] fails: goto out_nocoalesce; // obtain new_nodes[i]->write_lock mutex_lock(&new_nodes[i]->write_lock) // main coalescing process for (i = nodes - 1; i > 0; --i) [snipped] if coalescing process fails: // Here, directly goto out_nocoalesce // tag will cause a deadlock goto out_nocoalesce; [snipped] // release new_nodes[i]->write_lock mutex_unlock(&new_nodes[i]->write_lock) // coalesing succ, return return; out_nocoalesce: btree_node_free(new_nodes[i]) // free new_nodes[i] // obtain new_nodes[i]->write_lock mutex_lock(&new_nodes[i]->write_lock); // set flag for reuse clear_bit(BTREE_NODE_dirty, &ew_nodes[i]->flags); // release new_nodes[i]->write_lock mutex_unlock(&new_nodes[i]->write_lock); To fix the problem, we add a new tag 'out_unlock_nocoalesce' for releasing new_nodes[i]->write_lock before out_nocoalesce tag. If coalescing process fails, we will go to out_unlock_nocoalesce tag for releasing new_nodes[i]->write_lock before free new_nodes[i] in out_nocoalesce tag. (Coly Li helps to clean up commit log format.) Fixes: 2a285686c109816 ("bcache: btree locking rework") Signed-off-by: Zhiqiang Liu <liuzhiqiang26@huawei.com> Signed-off-by: Coly Li <colyli@suse.de> Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Sasha Levin <sashal@kernel.org>
| * | | Merge 4.4.228 into android-4.4-pGreg Kroah-Hartman2020-06-20
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.228 ipv6: fix IPV6_ADDRFORM operation logic vxlan: Avoid infinite loop when suppressing NS messages with invalid options scsi: return correct blkprep status code in case scsi_init_io() fails. net: phy: marvell: Limit 88m1101 autoneg errata to 88E1145 as well. pwm: fsl-ftm: Use flat regmap cache igb: improve handling of disconnected adapters ARM: 8977/1: ptrace: Fix mask for thumb breakpoint hook sched/fair: Don't NUMA balance for kthreads ath9k_htc: Silence undersized packet warnings x86_64: Fix jiffies ODR violation x86/speculation: Prevent rogue cross-process SSBD shutdown x86/reboot/quirks: Add MacBook6,1 reboot quirk efi/efivars: Add missing kobject_put() in sysfs entry creation error path ALSA: es1688: Add the missed snd_card_free() ALSA: usb-audio: Fix inconsistent card PM state after resume ACPI: sysfs: Fix reference count leak in acpi_sysfs_add_hotplug_profile() ACPI: PM: Avoid using power resources if there are none for D0 cgroup, blkcg: Prepare some symbols for module and !CONFIG_CGROUP usages nilfs2: fix null pointer dereference at nilfs_segctor_do_construct() spi: bcm2835aux: Fix controller unregister order ALSA: pcm: disallow linking stream to itself x86/speculation: Change misspelled STIPB to STIBP x86/speculation: Add support for STIBP always-on preferred mode x86/speculation: Avoid force-disabling IBPB based on STIBP and enhanced IBRS. x86/speculation: PR_SPEC_FORCE_DISABLE enforcement for indirect branches. spi: dw: fix possible race condition spi: dw: Fix controller unregister order spi: No need to assign dummy value in spi_unregister_controller() spi: Fix controller unregister order spi: pxa2xx: Fix controller unregister order spi: bcm2835: Fix controller unregister order ovl: initialize error in ovl_copy_xattr proc: Use new_inode not new_inode_pseudo video: fbdev: w100fb: Fix a potential double free. KVM: nSVM: leave ASID aside in copy_vmcb_control_area KVM: nVMX: Consult only the "basic" exit reason when routing nested exit KVM: arm64: Make vcpu_cp1x() work on Big Endian hosts ath9k: Fix use-after-free Read in ath9k_wmi_ctrl_rx ath9k: Fix use-after-free Write in ath9k_htc_rx_msg ath9x: Fix stack-out-of-bounds Write in ath9k_hif_usb_rx_cb ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb Smack: slab-out-of-bounds in vsscanf mm/slub: fix a memory leak in sysfs_slab_add() fat: don't allow to mount if the FAT length == 0 can: kvaser_usb: kvaser_usb_leaf: Fix some info-leaks to USB devices spi: dw: Zero DMA Tx and Rx configurations on stack Bluetooth: Add SCO fallback for invalid LMP parameters error kgdb: Prevent infinite recursive entries to the debugger spi: dw: Enable interrupts in accordance with DMA xfer mode clocksource: dw_apb_timer_of: Fix missing clockevent timers btrfs: do not ignore error from btrfs_next_leaf() when inserting checksums ARM: 8978/1: mm: make act_mm() respect THREAD_SIZE net: vmxnet3: fix possible buffer overflow caused by bad DMA value in vmxnet3_get_rss() staging: android: ion: use vmap instead of vm_map_ram e1000: Distribute switch variables for initialization media: dvb: return -EREMOTEIO on i2c transfer failure. MIPS: Make sparse_init() using top-down allocation netfilter: nft_nat: return EOPNOTSUPP if type or flags are not supported lib/mpi: Fix 64-bit MIPS build with Clang net: lpc-enet: fix error return code in lpc_mii_init() net: allwinner: Fix use correct return type for ndo_start_xmit() powerpc/spufs: fix copy_to_user while atomic mips: cm: Fix an invalid error code of INTVN_*_ERR kgdb: Fix spurious true from in_dbg_master() md: don't flush workqueue unconditionally in md_open mwifiex: Fix memory corruption in dump_station mips: Add udelay lpj numbers adjustment x86/mm: Stop printing BRK addresses m68k: mac: Don't call via_flush_cache() on Mac IIfx macvlan: Skip loopback packets in RX handler PCI: Don't disable decoding when mmio_always_on is set MIPS: Fix IRQ tracing when call handle_fpe() and handle_msa_fpe() ixgbe: fix signed-integer-overflow warning spi: dw: Return any value retrieved from the dma_transfer callback cpuidle: Fix three reference count leaks ima: Fix ima digest hash table key calculation ext4: fix EXT_MAX_EXTENT/INDEX to check for zeroed eh_max Btrfs: fix unreplayable log after snapshot delete + parent dir fsync btrfs: send: emit file capabilities after chown btrfs: fix error handling when submitting direct I/O bio ima: Directly assign the ima_default_policy pointer to ima_rules PCI: Program MPS for RCiEP devices e1000e: Relax condition to trigger reset for ME workaround carl9170: remove P2P_GO support media: go7007: fix a miss of snd_card_free b43legacy: Fix case where channel status is corrupted b43: Fix connection problem with WPA3 b43_legacy: Fix connection problem with WPA3 igb: Report speed and duplex as unknown when device is runtime suspended power: vexpress: add suppress_bind_attrs to true pinctrl: samsung: Save/restore eint_mask over suspend for EINT_TYPE GPIOs sparc32: fix register window handling in genregs32_[gs]et() kernel/cpu_pm: Fix uninitted local in cpu_pm ARM: tegra: Correct PL310 Auxiliary Control Register initialization drivers/macintosh: Fix memleak in windfarm_pm112 driver kbuild: force to build vmlinux if CONFIG_MODVERSION=y sunrpc: svcauth_gss_register_pseudoflavor must reject duplicate registrations. sunrpc: clean up properly in gss_mech_unregister() w1: omap-hdq: cleanup to add missing newline for some dev_dbg perf probe: Do not show the skipped events perf symbols: Fix debuginfo search for Ubuntu Linux 4.4.228 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ice915aaa684101ec7e774ccf43bfb533f84b4740
| | * | md: don't flush workqueue unconditionally in md_openGuoqing Jiang2020-06-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit f6766ff6afff70e2aaf39e1511e16d471de7c3ae ] We need to check mddev->del_work before flush workqueu since the purpose of flush is to ensure the previous md is disappeared. Otherwise the similar deadlock appeared if LOCKDEP is enabled, it is due to md_open holds the bdev->bd_mutex before flush workqueue. kernel: [ 154.522645] ====================================================== kernel: [ 154.522647] WARNING: possible circular locking dependency detected kernel: [ 154.522650] 5.6.0-rc7-lp151.27-default #25 Tainted: G O kernel: [ 154.522651] ------------------------------------------------------ kernel: [ 154.522653] mdadm/2482 is trying to acquire lock: kernel: [ 154.522655] ffff888078529128 ((wq_completion)md_misc){+.+.}, at: flush_workqueue+0x84/0x4b0 kernel: [ 154.522673] kernel: [ 154.522673] but task is already holding lock: kernel: [ 154.522675] ffff88804efa9338 (&bdev->bd_mutex){+.+.}, at: __blkdev_get+0x79/0x590 kernel: [ 154.522691] kernel: [ 154.522691] which lock already depends on the new lock. kernel: [ 154.522691] kernel: [ 154.522694] kernel: [ 154.522694] the existing dependency chain (in reverse order) is: kernel: [ 154.522696] kernel: [ 154.522696] -> #4 (&bdev->bd_mutex){+.+.}: kernel: [ 154.522704] __mutex_lock+0x87/0x950 kernel: [ 154.522706] __blkdev_get+0x79/0x590 kernel: [ 154.522708] blkdev_get+0x65/0x140 kernel: [ 154.522709] blkdev_get_by_dev+0x2f/0x40 kernel: [ 154.522716] lock_rdev+0x3d/0x90 [md_mod] kernel: [ 154.522719] md_import_device+0xd6/0x1b0 [md_mod] kernel: [ 154.522723] new_dev_store+0x15e/0x210 [md_mod] kernel: [ 154.522728] md_attr_store+0x7a/0xc0 [md_mod] kernel: [ 154.522732] kernfs_fop_write+0x117/0x1b0 kernel: [ 154.522735] vfs_write+0xad/0x1a0 kernel: [ 154.522737] ksys_write+0xa4/0xe0 kernel: [ 154.522745] do_syscall_64+0x64/0x2b0 kernel: [ 154.522748] entry_SYSCALL_64_after_hwframe+0x49/0xbe kernel: [ 154.522749] kernel: [ 154.522749] -> #3 (&mddev->reconfig_mutex){+.+.}: kernel: [ 154.522752] __mutex_lock+0x87/0x950 kernel: [ 154.522756] new_dev_store+0xc9/0x210 [md_mod] kernel: [ 154.522759] md_attr_store+0x7a/0xc0 [md_mod] kernel: [ 154.522761] kernfs_fop_write+0x117/0x1b0 kernel: [ 154.522763] vfs_write+0xad/0x1a0 kernel: [ 154.522765] ksys_write+0xa4/0xe0 kernel: [ 154.522767] do_syscall_64+0x64/0x2b0 kernel: [ 154.522769] entry_SYSCALL_64_after_hwframe+0x49/0xbe kernel: [ 154.522770] kernel: [ 154.522770] -> #2 (kn->count#253){++++}: kernel: [ 154.522775] __kernfs_remove+0x253/0x2c0 kernel: [ 154.522778] kernfs_remove+0x1f/0x30 kernel: [ 154.522780] kobject_del+0x28/0x60 kernel: [ 154.522783] mddev_delayed_delete+0x24/0x30 [md_mod] kernel: [ 154.522786] process_one_work+0x2a7/0x5f0 kernel: [ 154.522788] worker_thread+0x2d/0x3d0 kernel: [ 154.522793] kthread+0x117/0x130 kernel: [ 154.522795] ret_from_fork+0x3a/0x50 kernel: [ 154.522796] kernel: [ 154.522796] -> #1 ((work_completion)(&mddev->del_work)){+.+.}: kernel: [ 154.522800] process_one_work+0x27e/0x5f0 kernel: [ 154.522802] worker_thread+0x2d/0x3d0 kernel: [ 154.522804] kthread+0x117/0x130 kernel: [ 154.522806] ret_from_fork+0x3a/0x50 kernel: [ 154.522807] kernel: [ 154.522807] -> #0 ((wq_completion)md_misc){+.+.}: kernel: [ 154.522813] __lock_acquire+0x1392/0x1690 kernel: [ 154.522816] lock_acquire+0xb4/0x1a0 kernel: [ 154.522818] flush_workqueue+0xab/0x4b0 kernel: [ 154.522821] md_open+0xb6/0xc0 [md_mod] kernel: [ 154.522823] __blkdev_get+0xea/0x590 kernel: [ 154.522825] blkdev_get+0x65/0x140 kernel: [ 154.522828] do_dentry_open+0x1d1/0x380 kernel: [ 154.522831] path_openat+0x567/0xcc0 kernel: [ 154.522834] do_filp_open+0x9b/0x110 kernel: [ 154.522836] do_sys_openat2+0x201/0x2a0 kernel: [ 154.522838] do_sys_open+0x57/0x80 kernel: [ 154.522840] do_syscall_64+0x64/0x2b0 kernel: [ 154.522842] entry_SYSCALL_64_after_hwframe+0x49/0xbe kernel: [ 154.522844] kernel: [ 154.522844] other info that might help us debug this: kernel: [ 154.522844] kernel: [ 154.522846] Chain exists of: kernel: [ 154.522846] (wq_completion)md_misc --> &mddev->reconfig_mutex --> &bdev->bd_mutex kernel: [ 154.522846] kernel: [ 154.522850] Possible unsafe locking scenario: kernel: [ 154.522850] kernel: [ 154.522852] CPU0 CPU1 kernel: [ 154.522853] ---- ---- kernel: [ 154.522854] lock(&bdev->bd_mutex); kernel: [ 154.522856] lock(&mddev->reconfig_mutex); kernel: [ 154.522858] lock(&bdev->bd_mutex); kernel: [ 154.522860] lock((wq_completion)md_misc); kernel: [ 154.522861] kernel: [ 154.522861] *** DEADLOCK *** kernel: [ 154.522861] kernel: [ 154.522864] 1 lock held by mdadm/2482: kernel: [ 154.522865] #0: ffff88804efa9338 (&bdev->bd_mutex){+.+.}, at: __blkdev_get+0x79/0x590 kernel: [ 154.522868] kernel: [ 154.522868] stack backtrace: kernel: [ 154.522873] CPU: 1 PID: 2482 Comm: mdadm Tainted: G O 5.6.0-rc7-lp151.27-default #25 kernel: [ 154.522875] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 kernel: [ 154.522878] Call Trace: kernel: [ 154.522881] dump_stack+0x8f/0xcb kernel: [ 154.522884] check_noncircular+0x194/0x1b0 kernel: [ 154.522888] ? __lock_acquire+0x1392/0x1690 kernel: [ 154.522890] __lock_acquire+0x1392/0x1690 kernel: [ 154.522893] lock_acquire+0xb4/0x1a0 kernel: [ 154.522895] ? flush_workqueue+0x84/0x4b0 kernel: [ 154.522898] flush_workqueue+0xab/0x4b0 kernel: [ 154.522900] ? flush_workqueue+0x84/0x4b0 kernel: [ 154.522905] ? md_open+0xb6/0xc0 [md_mod] kernel: [ 154.522908] md_open+0xb6/0xc0 [md_mod] kernel: [ 154.522910] __blkdev_get+0xea/0x590 kernel: [ 154.522912] ? bd_acquire+0xc0/0xc0 kernel: [ 154.522914] blkdev_get+0x65/0x140 kernel: [ 154.522916] ? bd_acquire+0xc0/0xc0 kernel: [ 154.522918] do_dentry_open+0x1d1/0x380 kernel: [ 154.522921] path_openat+0x567/0xcc0 kernel: [ 154.522923] ? __lock_acquire+0x380/0x1690 kernel: [ 154.522926] do_filp_open+0x9b/0x110 kernel: [ 154.522929] ? __alloc_fd+0xe5/0x1f0 kernel: [ 154.522935] ? kmem_cache_alloc+0x28c/0x630 kernel: [ 154.522939] ? do_sys_openat2+0x201/0x2a0 kernel: [ 154.522941] do_sys_openat2+0x201/0x2a0 kernel: [ 154.522944] do_sys_open+0x57/0x80 kernel: [ 154.522946] do_syscall_64+0x64/0x2b0 kernel: [ 154.522948] entry_SYSCALL_64_after_hwframe+0x49/0xbe kernel: [ 154.522951] RIP: 0033:0x7f98d279d9ae And md_alloc also flushed the same workqueue, but the thing is different here. Because all the paths call md_alloc don't hold bdev->bd_mutex, and the flush is necessary to avoid race condition, so leave it as it is. Signed-off-by: Guoqing Jiang <guoqing.jiang@cloud.ionos.com> Signed-off-by: Song Liu <songliubraving@fb.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
* | | | Merge branch 'android-4.4-p' of ↵Michael Bestas2020-06-04
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://android.googlesource.com/kernel/common into lineage-17.1-caf-msm8998 This brings LA.UM.8.4.r1-05500-8x98.0 up to date with https://android.googlesource.com/kernel/common/ android-4.4-p at commit: 60fca75727065 Merge 4.4.226 into android-4.4-p Conflicts: drivers/base/firmware_class.c drivers/gpu/drm/msm/msm_gem.c drivers/mmc/host/sdhci.c drivers/net/wireless/ath/ath10k/core.c kernel/trace/blktrace.c net/socket.c sound/core/rawmidi.c sound/usb/mixer.c Change-Id: Ic8599e865656da72a9405c45f27091ec1ddc168c
| * | | Merge 4.4.223 into android-4.4-pGreg Kroah-Hartman2020-05-11
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.223 mwifiex: fix PCIe register information for 8997 chipset drm/qxl: qxl_release use after free drm/qxl: qxl_release leak in qxl_draw_dirty_fb() staging: rtl8192u: Fix crash due to pointers being "confusing" usb: gadget: f_acm: Fix configfs attr name usb: gadged: pch_udc: get rid of redundant assignments usb: gadget: pch_udc: reorder spin_[un]lock to avoid deadlock usb: gadget: udc: core: don't starve DMA resources MIPS: Fix macro typo MIPS: ptrace: Drop cp0_tcstatus from regoffset_table[] MIPS: BMIPS: Fix PRID_IMP_BMIPS5000 masking for BMIPS5200 MIPS: smp-cps: Stop printing EJTAG exceptions to UART MIPS: scall: Handle seccomp filters which redirect syscalls MIPS: BMIPS: BMIPS5000 has I cache filing from D cache MIPS: BMIPS: Clear MIPS_CACHE_ALIASES earlier MIPS: BMIPS: local_r4k___flush_cache_all needs to blast S-cache MIPS: BMIPS: Pretty print BMIPS5200 processor name MIPS: Fix HTW config on XPA kernel without LPA enabled MIPS: BMIPS: Adjust mips-hpt-frequency for BCM7435 MIPS: math-emu: Fix BC1{EQ,NE}Z emulation MIPS: Fix BC1{EQ,NE}Z return offset calculation MIPS: perf: Fix I6400 event numbers MIPS: KVM: Fix translation of MFC0 ErrCtl MIPS: SMP: Update cpu_foreign_map on CPU disable MIPS: c-r4k: Fix protected_writeback_scache_line for EVA MIPS: Octeon: Off by one in octeon_irq_gpio_map() bpf, mips: fix off-by-one in ctx offset allocation MIPS: RM7000: Double locking bug in rm7k_tc_disable() MIPS: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO mips/panic: replace smp_send_stop() with kdump friendly version in panic path ARM: dts: armadillo800eva Correct extal1 frequency to 24 MHz ARM: imx: select SRC for i.MX7 ARM: dts: kirkwood: gpio pin fixes for linkstation ls-wxl/wsxl ARM: dts: kirkwood: gpio pin fixes for linkstation ls-wvl/vl ARM: dts: kirkwood: gpio-leds fixes for linkstation ls-wxl/wsxl ARM: dts: kirkwood: gpio-leds fixes for linkstation ls-wvl/vl ARM: dts: orion5x: gpio pin fixes for linkstation lswtgl ARM: dts: orion5x: fix the missing mtd flash on linkstation lswtgl ARM: dts: kirkwood: use unique machine name for ds112 ARM: dts: kirkwood: add kirkwood-ds112.dtb to Makefile ARM: OMAP2+: hwmod: fix _idle() hwmod state sanity check sequence perf/x86: Fix filter_events() bug with event mappings x86/LDT: Print the real LDT base address x86/apic/uv: Silence a shift wrapping warning ALSA: fm801: explicitly free IRQ line ALSA: fm801: propagate TUNER_ONLY bit when autodetected ALSA: fm801: detect FM-only card earlier netfilter: nfnetlink: use original skbuff when acking batches xfrm: fix crash in XFRM_MSG_GETSA netlink handler mwifiex: fix IBSS data path issue. mwifiex: add missing check for PCIe8997 chipset iwlwifi: set max firmware version of 7265 to 17 Bluetooth: btmrvl: fix hung task warning dump dccp: limit sk_filter trim to payload net/mlx4_core: Do not BUG_ON during reset when PCI is offline mlxsw: pci: Correctly determine if descriptor queue is full PCI: Supply CPU physical address (not bus address) to iomem_is_exclusive() net/mlx4_core: Implement pci_resume callback alpha/PCI: Call iomem_is_exclusive() for IORESOURCE_MEM, but not IORESOURCE_IO vfio/pci: Allow VPD short read brcmfmac: add eth_type_trans back for PCIe full dongle mlxsw: Treat local port 64 as valid IB/mlx4: Initialize hop_limit when creating address handle ovs/gre,geneve: fix error path when creating an iface GRE: Disable segmentation offloads w/ CSUM and we are encapsulated via FOU powerpc/pci/of: Parse unassigned resources firmware: actually return NULL on failed request_firmware_nowait() c8sectpfe: Rework firmware loading mechanism net/mlx5: Avoid passing dma address 0 to firmware IB/mlx5: Fix RC transport send queue overhead computation net/mlx5: Make command timeout way shorter IB/mlx5: Fix FW version diaplay in sysfs net/mlx5e: Fix MLX5E_100BASE_T define net/mlx5: Fix the size of modify QP mailbox net/mlx5: Fix masking of reserved bits in XRCD number net/mlx5e: Fix blue flame quota logic net/mlx5: use mlx5_buf_alloc_node instead of mlx5_buf_alloc in mlx5_wq_ll_create net/mlx5: Avoid calling sleeping function by the health poll thread net/mlx5: Fix wait_vital for VFs and remove fixed sleep net/mlx5: Fix potential deadlock in command mode change net/mlx5: Add timeout handle to commands with callback net/mlx5: Fix pci error recovery flow net/mlx5e: Copy all L2 headers into inline segment net_sched: keep backlog updated with qlen sch_drr: update backlog as well sch_hfsc: always keep backlog updated sch_prio: update backlog as well sch_qfq: keep backlog updated with qlen sch_sfb: keep backlog updated with qlen sch_tbf: update backlog as well btrfs: cleaner_kthread() doesn't need explicit freeze irda: Free skb on irda_accept error path. phy: fix device reference leaks bonding: prevent out of bound accesses mtd: nand: fix ONFI parameter page layout ath10k: free cached fw bin contents when get board id fails xprtrdma: checking for NULL instead of IS_ERR() xprtrdma: Fix additional uses of spin_lock_irqsave(rb_lock) xprtrdma: xprt_rdma_free() must not release backchannel reqs xprtrdma: rpcrdma_bc_receive_call() should init rq_private_buf.len RDMA/cxgb3: device driver frees DMA memory with different size mlxsw: spectrum: Don't forward packets when STP state is DISABLED mlxsw: spectrum: Disable learning according to STP state mlxsw: spectrum: Don't count internal TX header bytes to stats mlxsw: spectrum: Indicate support for autonegotiation mlxsw: spectrum: Fix misuse of hard_header_len net: tcp_memcontrol: properly detect ancestor socket pressure tcp: do not set rtt_min to 1 RDS:TCP: Synchronize rds_tcp_accept_one with rds_send_xmit when resetting t_sock net: ipv6: tcp reset, icmp need to consider L3 domain batman-adv: Fix lockdep annotation of batadv_tlv_container_remove batman-adv: replace WARN with rate limited output on non-existing VLAN tty: serial: msm: Support more bauds serial: samsung: Fix possible out of bounds access on non-DT platform Drivers: hv: utils: use memdup_user in hvt_op_write isa: Call isa_bus_init before dependent ISA bus drivers register Btrfs: clean up an error code in btrfs_init_space_info() Input: gpio-keys - fix check for disabling unsupported keys Input: edt-ft5x06 - fix setting gain, offset, and threshold via device tree net/xfrm_input: fix possible NULL deref of tunnel.ip6->parms.i_key xfrm_user: propagate sec ctx allocation errors xfrm: Fix memory leak of aead algorithm name mac80211: fix mgmt-tx abort cookie and leak mac80211: TDLS: always downgrade invalid chandefs mac80211: TDLS: change BW calculation for WIDER_BW peers mac80211: Fix BW upgrade for TDLS peers NFS: Fix an LOCK/OPEN race when unlinking an open file net: get rid of an signed integer overflow in ip_idents_reserve() mtd: nand: denali: add missing nand_release() call in denali_remove() ASoC: Intel: pass correct parameter in sst_alloc_stream_mrfld() ASoC: tegra_alc5632: check return value ASoC: fsl_ssi: mark SACNT register volatile Revert "ACPI / LPSS: allow to use specific PM domain during ->probe()" mmc: sdhci: restore behavior when setting VDD via external regulator mmc: sd: limit SD card power limit according to cards capabilities mmc: debugfs: correct wrong voltage value mmc: block: return error on failed mmc_blk_get() clk: rockchip: Revert "clk: rockchip: reset init state before mmc card initialization" mmc: dw_mmc: rockchip: Set the drive phase properly mmc: moxart: fix wait_for_completion_interruptible_timeout return variable type mmc: sdhci: Fix regression setting power on Trats2 board perf tools: Fix perf regs mask generation powerpc/tm: Fix stack pointer corruption in __tm_recheckpoint() powerpc/book3s: Fix MCE console messages for unrecoverable MCE. sctp: fix the transports round robin issue when init is retransmitted sunrpc: Update RPCBIND_MAXNETIDLEN NFC: nci: memory leak in nci_core_conn_create() net: phy: Avoid polling PHY with PHY_IGNORE_INTERRUPTS net: phy: Fix phy_mac_interrupt() net: phy: bcm7xxx: Fix shadow mode 2 disabling of_mdio: fix node leak in of_phy_register_fixed_link error path phy: micrel: Fix finding PHY properties in MAC node for KSZ9031. net: dsa: slave: fix of-node leak and phy priority drivers: net: cpsw: don't ignore phy-mode if phy-handle is used iommu/dma: Respect IOMMU aperture when allocating mdio-sun4i: oops in error handling in probe iio:ad7797: Use correct attribute_group selftests/ipc: Fix test failure seen after initial test run wimax/i2400m: Fix potential urb refcnt leak cifs: protect updating server->dstaddr with a spinlock scripts/config: allow colons in option strings for sed lib/mpi: Fix building for powerpc with clang net: bcmgenet: suppress warnings on failed Rx SKB allocations net: systemport: suppress warnings on failed Rx SKB allocations rc: allow rc modules to be loaded if rc-main is not a module lirc_imon: do not leave imon_probe() with mutex held am437x-vpfe: fix an uninitialized variable bug cx23885: uninitialized variable in cx23885_av_work_handler() ath9k_htc: check for underflow in ath9k_htc_rx_msg() VFIO: platform: reset: fix a warning message condition net: moxa: fix an error code mfd: lp8788-irq: Uninitialized variable in irq handler ethernet: micrel: fix some error codes power: ipaq-micro-battery: freeing the wrong variable i40e: fix an uninitialized variable bug qede: uninitialized variable in qede_start_xmit() qlcnic: potential NULL dereference in qlcnic_83xx_get_minidump_template() qlcnic: use the correct ring in qlcnic_83xx_process_rcv_ring_diag() target: Fix a memory leak in target_dev_lba_map_store() memory/tegra: Add number of TLB lines for Tegra124 pinctrl: bcm2835: Fix memory leak in error path be2net: Don't leak iomapped memory on removal. ipv4: Fix memory leak in exception case for splitting tries flow_dissector: Check for IP fragmentation even if not using IPv4 address ipv4: fix checksum annotation in udp4_csum_init ipv4: do not abuse GFP_ATOMIC in inet_netconf_notify_devconf() ipv4: accept u8 in IP_TOS ancillary data net: vrf: Fix dev refcnt leak due to IPv6 prefix route ipv6: fix checksum annotation in udp6_csum_init ipv6: do not abuse GFP_ATOMIC in inet6_netconf_notify_devconf() ipv6: add missing netconf notif when 'all' is updated net: ipv6: Fix processing of RAs in presence of VRF netfilter: nf_tables: fix a wrong check to skip the inactive rules netfilter: nft_dynset: fix panic if NFT_SET_HASH is not enabled netfilter: nf_tables: destroy the set if fail to add transaction netfilter: nft_dup: do not use sreg_dev if the user doesn't specify it udp: restore UDPlite many-cast delivery clk: st: avoid uninitialized variable use clk: gpio: handle error codes for of_clk_get_parent_count() clk: ti: omap3+: dpll: use non-locking version of clk_get_rate clk: multiplier: Prevent the multiplier from under / over flowing clk: imx: clk-pllv3: fix incorrect handle of enet powerdown bit clk: xgene: Don't call __pa on ioremaped address cls_bpf: reset class and reuse major in da arm64: bpf: jit JMP_JSET_{X,K} bpf, trace: check event type in bpf_perf_event_read bpf: fix map not being uncharged during map creation failure net/mlx4_core: Fix potential corruption in counters database net/mlx4_core: Fix access to uninitialized index net/mlx4_en: Fix the return value of a failure in VLAN VID add/kill net/mlx4_core: Check device state before unregistering it net/mlx4_core: Fix the resource-type enum in res tracker to conform to FW spec net/mlx4_en: Process all completions in RX rings after port goes up net/mlx4_core: Do not access comm channel if it has not yet been initialized net/mlx4_en: Fix potential deadlock in port statistics flow net/mlx4: Fix uninitialized fields in rule when adding promiscuous mode to device managed flow steering net/mlx4_core: Fix QUERY FUNC CAP flags mlxsw: switchx2: Fix misuse of hard_header_len mlxsw: switchx2: Fix ethernet port initialization sched/fair: Fix calc_cfs_shares() fixed point arithmetics width confusion net_sched: flower: Avoid dissection of unmasked keys pkt_sched: fq: use proper locking in fq_dump_stats() sched/preempt: Fix preempt_count manipulations power: bq27xxx: fix reading for bq27000 and bq27010 power: bq27xxx: fix register numbers of bq27500 power: test_power: correctly handle empty writes power: bq27xxx_battery: Fix bq27541 AveragePower register address power_supply: tps65217-charger: Fix NULL deref during property export net: vrf: Fix dst reference counting net: Don't delete routes in different VRFs vti6: fix input path ipv4: Fix table id reference in fib_sync_down_addr mlx4: do not call napi_schedule() without care xprtrdma: Fix backchannel allocation of extra rpcrdma_reps ALSA: fm801: Initialize chip after IRQ handler is registered bonding: fix length of actor system MIPS: perf: Remove incorrect odd/even counter handling for I6400 Revert "cpufreq: Drop rwsem lock around CPUFREQ_GOV_POLICY_EXIT" net: dsa: mv88e6xxx: unlock DSA and CPU ports gfs2: fix flock panic issue blk-mq: fix undefined behaviour in order_to_size() dm: fix second blk_delay_queue() parameter to be in msec units not jiffies dmaengine: edma: Add probe callback to edma_tptc_driver openvswitch: update checksum in {push,pop}_mpls cxgb4/cxgb4vf: Fixes regression in perf when tx vlan offload is disabled net: bcmgenet: fix skb_len in bcmgenet_xmit_single() net: bcmgenet: device stats are unsigned long ovs/gre: fix rtnl notifications on iface deletion gre: do not assign header_ops in collect metadata mode gre: build header correctly for collect metadata tunnels gre: reject GUE and FOU in collect metadata mode sfc: fix potential stack corruption from running past stat bitmask sfc: clear napi_hash state when copying channels net: bcmsysport: Device stats are unsigned long cxgbi: fix uninitialized flowi6 net: macb: add missing free_netdev() on error in macb_probe() macvtap: segmented packet is consumed tipc: fix the error handling in tipc_udp_enable() net: icmp6_send should use dst dev to determine L3 domain et131x: Fix logical vs bitwise check in et131x_tx_timeout() net: ethernet: stmmac: dwmac-sti: fix probe error path rtnl: reset calcit fptr in rtnl_unregister() net: ethernet: stmmac: dwmac-rk: fix probe error path fq_codel: return non zero qlen in class dumps net: ethernet: stmmac: dwmac-generic: fix probe error path ovs/geneve: fix rtnl notifications on iface deletion bnxt: add a missing rcu synchronization qdisc: fix a module refcount leak in qdisc_create_dflt() net: axienet: Fix return value check in axienet_probe() bnxt_en: Remove locking around txr->dev_state net: ethernet: davinci_emac: Fix devioctl while in fixed link net: ethernet: mvneta: Remove IFF_UNICAST_FLT which is not implemented net: ethernet: ti: cpsw: fix device and of_node leaks net: ethernet: ti: cpsw: fix secondary-emac probe error path net: hns: fix device reference leaks net: bridge: don't increment tx_dropped in br_do_proxy_arp net: dsa: mv88e6xxx: enable SA learning on DSA ports net: ehea: avoid null pointer dereference l2tp: fix use-after-free during module unload hwrng: exynos - Disable runtime PM on driver unbind net: icmp_route_lookup should use rt dev to determine L3 domain net: mvneta: fix trivial cut-off issue in mvneta_ethtool_update_stats net: macb: replace macb_writel() call by queue_writel() to update queue ISR ravb: Add missing free_irq() call to ravb_close() mvpp2: use correct size for memset net: vxlan: lwt: Fix vxlan local traffic. net: ethoc: Fix early error paths ovs/vxlan: fix rtnl notifications on iface deletion net: mv643xx_eth: fix packet corruption with TSO and tiny unaligned packets. regulator: core: Rely on regulator_dev_release to free constraints net: dsa: mv88e6xxx: fix port VLAN maps at803x: fix reset handling cxl: Fix DAR check & use REGION_ID instead of opencoding net: ethernet: davinci_emac: Fix platform_data overwrite ata: sata_dwc_460ex: remove incorrect locking pinctrl: tegra: Correctly check the supported configuration brcmfmac: add fallback for devices that do not report per-chain values brcmfmac: restore stopping netdev queue when bus clogs up bridge: Fix problems around fdb entries pointing to the bridge device bna: add missing per queue ethtool stat net: skbuff: Remove errornous length validation in skb_vlan_pop() net: ep93xx_eth: Do not crash unloading module macvlan: Fix potential use-after free for broadcasts sctp: Fix SHUTDOWN CTSN Ack in the peer restart case ALSA: hda: Match both PCI ID and SSID for driver blacklist mac80211: add ieee80211_is_any_nullfunc() Linux 4.4.223 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ie7caca39501fe5e82b947964cc474ed1c786d756
| | * | dm: fix second blk_delay_queue() parameter to be in msec units not jiffiesTahsin Erdogan2020-05-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit bd9f55ea1cf6e14eb054b06ea877d2d1fa339514 upstream. Commit d548b34b062 ("dm: reduce the queue delay used in dm_request_fn from 100ms to 10ms") always intended the value to be 10 msecs -- it just expressed it in jiffies because earlier commit 7eaceaccab ("block: remove per-queue plugging") did. Signed-off-by: Tahsin Erdogan <tahsin@google.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Fixes: d548b34b062 ("dm: reduce the queue delay used in dm_request_fn from 100ms to 10ms") Cc: stable@vger.kernel.org # 4.1+ -- stable@ backports must be applied to drivers/md/dm.c Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | | Merge branch 'android-4.4-p' of ↵Michael Bestas2020-05-14
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://android.googlesource.com/kernel/common into lineage-17.1-caf-msm8998 This brings LA.UM.8.4.r1-05400-8x98.0 up to date with https://android.googlesource.com/kernel/common/ android-4.4-p at commit: 96b09cba55905 UPSTREAM: net: socket: set sock->sk to NULL after calling proto_ops::release() Conflicts: drivers/scsi/ufs/ufshcd.c drivers/usb/gadget/composite.c drivers/usb/gadget/function/f_fs.c Change-Id: I3e79c0d20e3eb3246a50c9a1e815cdf030a4232e
| * | | Revert "ANDROID: dm verity: add minimum prefetch size"Sami Tolvanen2020-05-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit ace74ccf82cfb2b73ce1df2e698d20c2fbc559dd. Bug: 71728490 Change-Id: Iebcb0cd9982f36c4bd2552811f9147325a291db0 Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
| * | | Merge 4.4.220 into android-4.4-pGreg Kroah-Hartman2020-04-24
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.220 bus: sunxi-rsb: Return correct data when mixing 16-bit and 8-bit reads net: vxge: fix wrong __VA_ARGS__ usage qlcnic: Fix bad kzalloc null test i2c: st: fix missing struct parameter description irqchip/versatile-fpga: Handle chained IRQs properly selftests/x86/ptrace_syscall_32: Fix no-vDSO segfault libata: Remove extra scsi_host_put() in ata_scsi_add_hosts() gfs2: Don't demote a glock until its revokes are written x86/boot: Use unsigned comparison for addresses locking/lockdep: Avoid recursion in lockdep_count_{for,back}ward_deps() btrfs: remove a BUG_ON() from merge_reloc_roots() btrfs: track reloc roots based on their commit root bytenr misc: rtsx: set correct pcr_ops for rts522A ASoC: fix regwmask ASoC: dapm: connect virtual mux with default value ASoC: dpcm: allow start or stop during pause for backend ASoC: topology: use name_prefix for new kcontrol usb: gadget: f_fs: Fix use after free issue as part of queue failure usb: gadget: composite: Inform controller driver of self-powered ALSA: usb-audio: Add mixer workaround for TRX40 and co ALSA: hda: Add driver blacklist ALSA: hda: Fix potential access overflow in beep helper ALSA: ice1724: Fix invalid access for enumerated ctl items ALSA: pcm: oss: Fix regression by buffer overflow fix acpi/x86: ignore unspecified bit positions in the ACPI global lock field thermal: devfreq_cooling: inline all stubs for CONFIG_DEVFREQ_THERMAL=n KEYS: reaching the keys quotas correctly irqchip/versatile-fpga: Apply clear-mask earlier MIPS: OCTEON: irq: Fix potential NULL pointer dereference ath9k: Handle txpower changes even when TPC is disabled signal: Extend exec_id to 64bits x86/entry/32: Add missing ASM_CLAC to general_protection entry KVM: x86: Allocate new rmap and large page tracking when moving memslot crypto: mxs-dcp - fix scatterlist linearization for hash futex: futex_wake_op, do not fail on invalid op xen-netfront: Rework the fix for Rx stall during OOM and network stress ALSA: hda: Initialize power_state field properly Btrfs: incremental send, fix invalid memory access IB/ipoib: Fix lockdep issue found on ipoib_ib_dev_heavy_flush scsi: zfcp: fix missing erp_lock in port recovery trigger for point-to-point arm64: armv8_deprecated: Fix undef_hook mask for thumb setend ext4: fix a data race at inode->i_blocks ocfs2: no need try to truncate file beyond i_size s390/diag: fix display of diagnose call statistics Input: i8042 - add Acer Aspire 5738z to nomux list kmod: make request_module() return an error when autoloading is disabled hfsplus: fix crash and filesystem corruption when deleting files libata: Return correct status in sata_pmp_eh_recover_pm() when ATA_DFLAG_DETACH is set powerpc/64/tm: Don't let userspace set regs->trap via sigreturn Btrfs: fix crash during unmount due to race with delayed inode workers drm/dp_mst: Fix clearing payload state on topology disable ipmi: fix hung processes in __get_guid() powerpc/fsl_booke: Avoid creating duplicate tlb1 entry misc: echo: Remove unnecessary parentheses and simplify check for zero mfd: dln2: Fix sanity checking for endpoints net: ipv4: devinet: Fix crash when add/del multicast IP with autojoin net: ipv6: do not consider routes via gateways for anycast address check scsi: ufs: Fix ufshcd_hold() caused scheduling while atomic jbd2: improve comments about freeing data buffers whose page mapping is NULL ext4: fix incorrect group count in ext4_fill_super error message ext4: fix incorrect inodes per group in error message ASoC: Intel: mrfld: fix incorrect check on p->sink ASoC: Intel: mrfld: return error codes when an error occurs ALSA: usb-audio: Don't override ignore_ctl_error value from the map mac80211_hwsim: Use kstrndup() in place of kasprintf() ext4: do not zeroout extents beyond i_disksize dm flakey: check for null arg_name in parse_features() kvm: x86: Host feature SSBD doesn't imply guest feature SPEC_CTRL_SSBD x86/mitigations: Clear CPU buffers on the SYSCALL fast path tracing: Fix the race between registering 'snapshot' event trigger and triggering 'snapshot' operation scsi: sg: add sg_remove_request in sg_common_write ALSA: hda: Don't release card at firmware loading error video: fbdev: sis: Remove unnecessary parentheses and commented code drm: NULL pointer dereference [null-pointer-deref] (CWE 476) problem wil6210: increase firmware ready timeout wil6210: fix temperature debugfs scsi: ufs: ufs-qcom: remove broken hci version quirk wil6210: rate limit wil_rx_refill error rtc: pm8xxx: Fix issue in RTC write path soc: qcom: smem: Use le32_to_cpu for comparison of: fix missing kobject init for !SYSFS && OF_DYNAMIC config of: unittest: kmemleak in of_unittest_platform_populate() clk: at91: usb: continue if clk_hw_round_rate() return zero clk: tegra: Fix Tegra PMC clock out parents NFS: direct.c: Fix memory leak of dreq when nfs_get_lock_context fails ext4: do not commit super on read-only bdev percpu_counter: fix a data race at vm_committed_as compiler.h: fix error in BUILD_BUG_ON() reporting NFS: Fix memory leaks in nfs_pageio_stop_mirroring() ext2: fix empty body warnings when -Wextra is used iommu/amd: Fix the configuration of GCR3 table root pointer fbdev: potential information leak in do_fb_ioctl() tty: evh_bytechan: Fix out of bounds accesses locktorture: Print ratio of acquisitions, not failures mtd: lpddr: Fix a double free in probe() mtd: phram: fix a double free issue in error path x86/CPU: Add native CPUID variants returning a single datum x86/microcode/intel: replace sync_core() with native_cpuid_reg(eax) x86/vdso: Fix lsl operand order Linux 4.4.220 Change-Id: Ic931642c95ad95eb2755c3c20f6802e04283e68b Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * | dm flakey: check for null arg_name in parse_features()Goldwyn Rodrigues2020-04-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 7690e25302dc7d0cd42b349e746fe44b44a94f2b ] One can crash dm-flakey by specifying more feature arguments than the number of features supplied. Checking for null in arg_name avoids this. dmsetup create flakey-test --table "0 66076080 flakey /dev/sdb9 0 0 180 2 drop_writes" Signed-off-by: Goldwyn Rodrigues <rgoldwyn@suse.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
* | | | Merge branch 'android-4.4-p' of ↵Michael Bestas2020-04-14
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://android.googlesource.com/kernel/common into lineage-17.1-caf-msm8998 This brings LA.UM.8.4.r1-05300-8x98.0 up to date with https://android.googlesource.com/kernel/common/ android-4.4-p at commit: f9991115f0793 Merge 4.4.219 into android-4.4-p Conflicts: drivers/clk/qcom/clk-rcg2.c drivers/scsi/sd.c drivers/usb/gadget/function/f_fs.c drivers/usb/gadget/function/u_serial.c Change-Id: Ifed3db0ddda828c1697e57e9f73c1b73354bebf7
| * | | Merge 4.4.216 into android-4.4-pGreg Kroah-Hartman2020-03-11
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.216 iwlwifi: pcie: fix rb_allocator workqueue allocation ext4: fix potential race between online resizing and write operations ext4: fix potential race between s_flex_groups online resizing and access ext4: fix potential race between s_group_info online resizing and access ipmi:ssif: Handle a possible NULL pointer reference mac80211: consider more elements in parsing CRC cfg80211: check wiphy driver existence for drvinfo report cifs: Fix mode output in debugging statements cfg80211: add missing policy for NL80211_ATTR_STATUS_CODE sysrq: Restore original console_loglevel when sysrq disabled sysrq: Remove duplicated sysrq message net: fib_rules: Correctly set table field when table number exceeds 8 bits net: phy: restore mdio regs in the iproc mdio driver ipv6: Fix nlmsg_flags when splitting a multipath route ipv6: Fix route replacement with dev-only route sctp: move the format error check out of __sctp_sf_do_9_1_abort nfc: pn544: Fix occasional HW initialization failure net: sched: correct flower port blocking ext4: potential crash on allocation error in ext4_alloc_flex_bg_array() audit: fix error handling in audit_data_to_entry() HID: core: fix off-by-one memset in hid_report_raw_event() HID: core: increase HID report buffer size to 8KiB HID: hiddev: Fix race in in hiddev_disconnect() MIPS: VPE: Fix a double free and a memory leak in 'release_vpe()' i2c: jz4780: silence log flood on txabrt ecryptfs: Fix up bad backport of fe2e082f5da5b4a0a92ae32978f81507ef37ec66 include/linux/bitops.h: introduce BITS_PER_TYPE net: netlink: cap max groups which will be considered in netlink_bind() namei: only return -ECHILD from follow_dotdot_rcu() KVM: Check for a bad hva before dropping into the ghc slow path slip: stop double free sl->dev in slip_open mm: make page ref count overflow check tighter and more explicit mm: add 'try_get_page()' helper function mm, gup: remove broken VM_BUG_ON_PAGE compound check for hugepages mm, gup: ensure real head page is ref-counted when using hugepages mm: prevent get_user_pages() from overflowing page refcount pipe: add pipe_buf_get() helper fs: prevent page refcount overflow in pipe_buf_get audit: always check the netlink payload length in audit_receive_msg() serial: ar933x_uart: set UART_CS_{RX,TX}_READY_ORIDE usb: gadget: ffs: ffs_aio_cancel(): Save/restore IRQ flags usb: gadget: serial: fix Tx stall after buffer overflow drm: msm: Fix return type of dsi_mgr_connector_mode_valid for kCFI drm/msm/dsi: save pll state before dsi host is powered off net: ks8851-ml: Remove 8-bit bus accessors net: ks8851-ml: Fix 16-bit data access net: ks8851-ml: Fix 16-bit IO operation watchdog: da9062: do not ping the hw during stop() s390/cio: cio_ignore_proc_seq_next should increase position index cifs: don't leak -EAGAIN for stat() during reconnect usb: storage: Add quirk for Samsung Fit flash usb: quirks: add NO_LPM quirk for Logitech Screen Share usb: core: hub: do error out if usb_autopm_get_interface() fails usb: core: port: do error out if usb_autopm_get_interface() fails vgacon: Fix a UAF in vgacon_invert_region fat: fix uninit-memory access for partial initialized inode vt: selection, close sel_buffer race vt: selection, push console lock down vt: selection, push sel_lock up dmaengine: tegra-apb: Fix use-after-free dmaengine: tegra-apb: Prevent race conditions of tasklet vs free list ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path ASoC: dapm: Correct DAPM handling of active widgets during shutdown RDMA/iwcm: Fix iwcm work deallocation RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen() ARM: imx: build v7_cpu_resume() unconditionally hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT() dmaengine: coh901318: Fix a double lock bug in dma_tc_handle() powerpc: fix hardware PMU exception bug on PowerVM compatibility mode systems dm cache: fix a crash due to incorrect work item cancelling crypto: algif_skcipher - use ZERO_OR_NULL_PTR in skcipher_recvmsg_async Linux 4.4.216 Change-Id: I9b747fb2a39b1137ee4ec9c5bb2c1aac2419e97b Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * | dm cache: fix a crash due to incorrect work item cancellingMikulas Patocka2020-03-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 7cdf6a0aae1cccf5167f3f04ecddcf648b78e289 upstream. The crash can be reproduced by running the lvm2 testsuite test lvconvert-thin-external-cache.sh for several minutes, e.g.: while :; do make check T=shell/lvconvert-thin-external-cache.sh; done The crash happens in this call chain: do_waker -> policy_tick -> smq_tick -> end_hotspot_period -> clear_bitset -> memset -> __memset -- which accesses an invalid pointer in the vmalloc area. The work entry on the workqueue is executed even after the bitmap was freed. The problem is that cancel_delayed_work doesn't wait for the running work item to finish, so the work item can continue running and re-submitting itself even after cache_postsuspend. In order to make sure that the work item won't be running, we must use cancel_delayed_work_sync. Also, change flush_workqueue to drain_workqueue, so that if some work item submits itself or another work item, we are properly waiting for both of them. Fixes: c6b4fcbad044 ("dm: add cache target") Cc: stable@vger.kernel.org # v3.9 Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | | Merge branch 'android-4.4-p' of ↵Michael Bestas2020-03-08
|\| | | | |_|/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://android.googlesource.com/kernel/common into lineage-17.1-caf-msm8998 This brings LA.UM.8.4.r1-05200-8x98.0 up to date with https://android.googlesource.com/kernel/common/ android-4.4-p at commit: 4db1ebdd40ec0 FROMLIST: HID: nintendo: add nintendo switch controller driver Conflicts: arch/arm64/boot/Makefile arch/arm64/kernel/psci.c arch/x86/configs/x86_64_cuttlefish_defconfig drivers/md/dm.c drivers/of/Kconfig drivers/thermal/thermal_core.c fs/proc/meminfo.c kernel/locking/spinlock_debug.c kernel/time/hrtimer.c net/wireless/util.c Change-Id: I5b5163497b7c6ab8487ffbb2d036e4cda01ed670
| * | Merge 4.4.215 into android-4.4-pGreg Kroah-Hartman2020-02-28
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.215 x86/vdso: Use RDPID in preference to LSL when available KVM: x86: emulate RDPID ALSA: hda: Use scnprintf() for printing texts for sysfs/procfs ecryptfs: fix a memory leak bug in parse_tag_1_packet() ecryptfs: fix a memory leak bug in ecryptfs_init_messaging() ALSA: usb-audio: Apply sample rate quirk for Audioengine D1 ubifs: Fix deadlock in concurrent bulk-read and writepage ext4: fix checksum errors with indexed dirs Btrfs: fix race between using extent maps and merging them btrfs: log message when rw remount is attempted with unclean tree-log padata: Remove broken queue flushing s390/time: Fix clk type in get_tod_clock hwmon: (pmbus/ltc2978) Fix PMBus polling of MFR_COMMON definitions. jbd2: move the clearing of b_modified flag to the journal_unmap_buffer() jbd2: do not clear the BH_Mapped flag when forgetting a metadata buffer btrfs: print message when tree-log replay starts scsi: qla2xxx: fix a potential NULL pointer dereference Revert "KVM: VMX: Add non-canonical check on writes to RTIT address MSRs" drm/gma500: Fixup fbdev stolen size usage evaluation brcmfmac: Fix use after free in brcmf_sdio_readframes() gianfar: Fix TX timestamping with a stacked DSA driver pinctrl: sh-pfc: sh7264: Fix CAN function GPIOs media: i2c: mt9v032: fix enum mbus codes and frame sizes media: sti: bdisp: fix a possible sleep-in-atomic-context bug in bdisp_device_run() efi/x86: Map the entire EFI vendor string before copying it MIPS: Loongson: Fix potential NULL dereference in loongson3_platform_init() uio: fix a sleep-in-atomic-context bug in uio_dmem_genirq_irqcontrol() usb: gadget: udc: fix possible sleep-in-atomic-context bugs in gr_probe() nfs: NFS_SWAP should depend on SWAP jbd2: clear JBD2_ABORT flag before journal_reset to update log tail info when load journal tracing: Fix very unlikely race of registering two stat tracers ext4, jbd2: ensure panic when aborting with zero errno kconfig: fix broken dependency in randconfig-generated .config clk: qcom: rcg2: Don't crash if our parent can't be found; return an error drm/amdgpu: remove 4 set but not used variable in amdgpu_atombios_get_connector_info_from_object_table regulator: rk808: Lower log level on optional GPIOs being not available NFC: port100: Convert cpu_to_le16(le16_to_cpu(E1) + E2) to use le16_add_cpu(). reiserfs: Fix spurious unlock in reiserfs_fill_super() error handling ALSA: usx2y: Adjust indentation in snd_usX2Y_hwdep_dsp_status b43legacy: Fix -Wcast-function-type ipw2x00: Fix -Wcast-function-type iwlegacy: Fix -Wcast-function-type rtlwifi: rtl_pci: Fix -Wcast-function-type orinoco: avoid assertion in case of NULL pointer ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1 scsi: aic7xxx: Adjust indentation in ahc_find_syncrate ARM: dts: r8a7779: Add device node for ARM global timer x86/vdso: Provide missing include file pinctrl: sh-pfc: sh7269: Fix CAN function GPIOs ALSA: sh: Fix compile warning wrt const tools lib api fs: Fix gcc9 stringop-truncation compilation error usbip: Fix unsafe unaligned pointer usage soc/tegra: fuse: Correct straps' address for older Tegra124 device trees rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls Input: edt-ft5x06 - work around first register access error wan: ixp4xx_hss: fix compile-testing on 64-bit ASoC: atmel: fix build error with CONFIG_SND_ATMEL_SOC_DMA=m PCI: Don't disable bridge BARs when assigning bus resources driver core: Print device when resources present in really_probe() drm/nouveau: Fix copy-paste error in nouveau_fence_wait_uevent_handler drm/vmwgfx: prevent memory leak in vmw_cmdbuf_res_add iommu/arm-smmu-v3: Use WRITE_ONCE() when changing validity of an STE scsi: iscsi: Don't destroy session if there are outstanding connections cmd64x: potential buffer overflow in cmd64x_program_timings() ide: serverworks: potential overflow in svwks_set_pio_mode() remoteproc: Initialize rproc_class before use s390/ftrace: generate traced function stack frame ALSA: hda - Add docking station support for Lenovo Thinkpad T420s jbd2: switch to use jbd2_journal_abort() when failed to submit the commit record ARM: 8951/1: Fix Kexec compilation issue. hostap: Adjust indentation in prism2_hostapd_add_sta iwlegacy: ensure loop counter addr does not wrap and cause an infinite loop drm/nouveau/disp/nv50-: prevent oops when no channel method map provided trigger_next should increase position index radeon: insert 10ms sleep in dce5_crtc_load_lut ocfs2: fix a NULL pointer dereference when call ocfs2_update_inode_fsync_trans() lib/scatterlist.c: adjust indentation in __sg_alloc_table reiserfs: prevent NULL pointer dereference in reiserfs_insert_item() bcache: explicity type cast in bset_bkey_last() irqchip/gic-v3-its: Reference to its_invall_cmd descriptor when building INVALL microblaze: Prevent the overflow of the start brd: check and limit max_part par selinux: ensure we cleanup the internal AVC counters on error in avc_update() enic: prevent waking up stopped tx queues over watchdog reset floppy: check FDC index for errors before assigning it staging: android: ashmem: Disallow ashmem memory from being remapped staging: vt6656: fix sign of rx_dbm to bb_pre_ed_rssi. usb: uas: fix a plug & unplug racing USB: Fix novation SourceControl XL after suspend USB: hub: Don't record a connect-change event during reset-resume staging: rtl8188eu: Fix potential security hole staging: rtl8188eu: Fix potential overuse of kernel memory x86/mce/amd: Fix kobject lifetime tty: serial: imx: setup the correct sg entry for tx dma Revert "ipc,sem: remove uneeded sem_undo_list lock usage in exit_sem()" xhci: apply XHCI_PME_STUCK_QUIRK to Intel Comet Lake platforms VT_RESIZEX: get rid of field-by-field copyin vt: vt_ioctl: fix race in VT_RESIZEX KVM: nVMX: Don't emulate instructions in guest mode netfilter: xt_bpf: add overflow checks ext4: fix a data race in EXT4_I(inode)->i_disksize ext4: add cond_resched() to __ext4_find_entry() KVM: nVMX: Refactor IO bitmap checks into helper function KVM: nVMX: Check IO instruction VM-exit conditions KVM: apic: avoid calculating pending eoi from an uninitialized val Btrfs: fix btrfs_wait_ordered_range() so that it waits for all ordered extents scsi: Revert "RDMA/isert: Fix a recently introduced regression related to logout" scsi: Revert "target: iscsi: Wait for all commands to finish before freeing a session" ecryptfs: replace BUG_ON with error handling code ALSA: rawmidi: Avoid bit fields for state flags ALSA: seq: Avoid concurrent access to queue flags ALSA: seq: Fix concurrent access to queue current tick/time xen: Enable interrupts when calling _cond_resched() Linux 4.4.215 Change-Id: I32c4136741a79ab940022d590d5ace780290acbb Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * bcache: explicity type cast in bset_bkey_last()Coly Li2020-02-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 7c02b0055f774ed9afb6e1c7724f33bf148ffdc0 ] In bset.h, macro bset_bkey_last() is defined as, bkey_idx((struct bkey *) (i)->d, (i)->keys) Parameter i can be variable type of data structure, the macro always works once the type of struct i has member 'd' and 'keys'. bset_bkey_last() is also used in macro csum_set() to calculate the checksum of a on-disk data structure. When csum_set() is used to calculate checksum of on-disk bcache super block, the parameter 'i' data type is struct cache_sb_disk. Inside struct cache_sb_disk (also in struct cache_sb) the member keys is __u16 type. But bkey_idx() expects unsigned int (a 32bit width), so there is problem when sending parameters via stack to call bkey_idx(). Sparse tool from Intel 0day kbuild system reports this incompatible problem. bkey_idx() is part of user space API, so the simplest fix is to cast the (i)->keys to unsigned int type in macro bset_bkey_last(). Reported-by: kbuild test robot <lkp@intel.com> Signed-off-by: Coly Li <colyli@suse.de> Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Sasha Levin <sashal@kernel.org>
| * | Merge 4.4.214 into android-4.4-pGreg Kroah-Hartman2020-02-17
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.214 media: iguanair: fix endpoint sanity check x86/cpu: Update cached HLE state on write to TSX_CTRL_CPUID_CLEAR sparc32: fix struct ipc64_perm type definition ASoC: qcom: Fix of-node refcount unbalance to link->codec_of_node cls_rsvp: fix rsvp_policy net: hsr: fix possible NULL deref in hsr_handle_frame() net_sched: fix an OOB access in cls_tcindex tcp: clear tp->total_retrans in tcp_disconnect() tcp: clear tp->segs_{in|out} in tcp_disconnect() media: uvcvideo: Avoid cyclic entity chains due to malformed USB descriptors mfd: dln2: More sanity checking for endpoints brcmfmac: Fix memory leak in brcmf_usbdev_qinit usb: gadget: legacy: set max_speed to super-speed usb: gadget: f_ncm: Use atomic_t to track in-flight request usb: gadget: f_ecm: Use atomic_t to track in-flight request ALSA: dummy: Fix PCM format loop in proc output lib/test_kasan.c: fix memory leak in kmalloc_oob_krealloc_more() powerpc/pseries: Advance pfn if section is not present in lmb_is_removable() mmc: spi: Toggle SPI polarity, do not hardcode it PCI: keystone: Fix link training retries initiation crypto: api - Check spawn->alg under lock in crypto_drop_spawn scsi: qla2xxx: Fix mtcp dump collection failure power: supply: ltc2941-battery-gauge: fix use-after-free Revert "ovl: modify ovl_permission() to do checks on two inodes" of: Add OF_DMA_DEFAULT_COHERENT & select it on powerpc dm space map common: fix to ensure new block isn't already in use crypto: pcrypt - Do not clear MAY_SLEEP flag in original request crypto: api - Fix race condition in crypto_spawn_alg crypto: picoxcell - adjust the position of tasklet_init and fix missed tasklet_kill btrfs: set trans->drity in btrfs_commit_transaction ARM: tegra: Enable PLLP bypass during Tegra124 LP1 mwifiex: fix unbalanced locking in mwifiex_process_country_ie() sunrpc: expiry_time should be seconds not timeval KVM: x86: Refactor prefix decoding to prevent Spectre-v1/L1TF attacks KVM: x86: Protect DR-based index computations from Spectre-v1/L1TF attacks KVM: x86: Protect kvm_hv_msr_[get|set]_crash_data() from Spectre-v1/L1TF attacks KVM: x86: Protect ioapic_write_indirect() from Spectre-v1/L1TF attacks KVM: x86: Protect MSR-based index computations in pmu.h from Spectre-v1/L1TF attacks KVM: x86: Protect ioapic_read_indirect() from Spectre-v1/L1TF attacks KVM: x86: Protect MSR-based index computations from Spectre-v1/L1TF attacks in x86.c KVM: x86: Protect x86_decode_insn from Spectre-v1/L1TF attacks KVM: x86: Protect MSR-based index computations in fixed_msr_to_seg_unit() from Spectre-v1/L1TF attacks KVM: PPC: Book3S HV: Uninit vCPU if vcore creation fails KVM: PPC: Book3S PR: Free shared page if mmu initialization fails KVM: x86: Free wbinvd_dirty_mask if vCPU creation fails scsi: qla2xxx: Fix the endianness of the qla82xx_get_fw_size() return type scsi: csiostor: Adjust indentation in csio_device_reset scsi: qla4xxx: Adjust indentation in qla4xxx_mem_free ext2: Adjust indentation in ext2_fill_super powerpc/44x: Adjust indentation in ibm4xx_denali_fixup_memsize NFC: pn544: Adjust indentation in pn544_hci_check_presence ppp: Adjust indentation into ppp_async_input net: smc911x: Adjust indentation in smc911x_phy_configure net: tulip: Adjust indentation in {dmfe, uli526x}_init_module mfd: da9062: Fix watchdog compatible string mfd: rn5t618: Mark ADC control register volatile net: systemport: Avoid RBUF stuck in Wake-on-LAN mode bonding/alb: properly access headers in bond_alb_xmit() NFS: Fix memory leaks and corruption in readdir NFS: Fix bool initialization/comparison NFS: Directory page cache pages need to be locked when read Btrfs: fix assertion failure on fsync with NO_HOLES enabled btrfs: remove trivial locking wrappers of tree mod log Btrfs: fix race between adding and putting tree mod seq elements and nodes drm: atmel-hlcdc: enable clock before configuring timing engine KVM: x86: drop picdev_in_range() KVM: x86: Refactor picdev_write() to prevent Spectre-v1/L1TF attacks KVM: x86: Protect pmu_intel.c from Spectre-v1/L1TF attacks KVM: x86: Protect kvm_lapic_reg_write() from Spectre-v1/L1TF attacks btrfs: flush write bio if we loop in extent_write_cache_pages KVM: x86/mmu: Apply max PA check for MMIO sptes to 32-bit KVM KVM: VMX: Add non-canonical check on writes to RTIT address MSRs KVM: nVMX: vmread should not set rflags to specify success in case of #PF cifs: fail i/o on soft mounts if sessionsetup errors out clocksource: Prevent double add_timer_on() for watchdog_timer perf/core: Fix mlock accounting in perf_mmap() ASoC: pcm: update FE/BE trigger order based on the command scsi: ufs: Fix ufshcd_probe_hba() reture value in case ufshcd_scsi_add_wlus() fails rtc: hym8563: Return -EINVAL if the time is known to be invalid ARC: [plat-axs10x]: Add missing multicast filter number to GMAC node ARM: dts: at91: sama5d3: fix maximum peripheral clock rates ARM: dts: at91: sama5d3: define clock rate range for tcb1 powerpc/pseries: Allow not having ibm, hypertas-functions::hcall-multi-tce for DDW pinctrl: sh-pfc: r8a7778: Fix duplicate SDSELF_B and SD1_CLK_B mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status() mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv() libertas: don't exit from lbs_ibss_join_existing() with RCU read lock held libertas: make lbs_ibss_join_existing() return error code on rates overflow dm: fix potential for q->make_request_fn NULL pointer Linux 4.4.214 Change-Id: I4c59fc6feb5cc34402bc8bbaf29f3d1debfe6951 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * dm: fix potential for q->make_request_fn NULL pointerMike Snitzer2020-02-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 47ace7e012b9f7ad71d43ac9063d335ea3d6820b upstream. Move blk_queue_make_request() to dm.c:alloc_dev() so that q->make_request_fn is never NULL during the lifetime of a DM device (even one that is created without a DM table). Otherwise generic_make_request() will crash simply by doing: dmsetup create -n test mount /dev/dm-N /mnt While at it, move ->congested_data initialization out of dm.c:alloc_dev() and into the bio-based specific init method. Reported-by: Stefan Bader <stefan.bader@canonical.com> BugLink: https://bugs.launchpad.net/bugs/1860231 Fixes: ff36ab34583a ("dm: remove request-based logic from make_request_fn wrapper") Depends-on: c12c9a3c3860c ("dm: various cleanups to md->queue initialization code") Cc: stable@vger.kernel.org Signed-off-by: Mike Snitzer <snitzer@redhat.com> [smb: adjusted for context and dm_init_md_queue() exitsting in older kernels, and congested_data embedded in backing_dev_info, and dm_init_normal_md_queue() was called dm_init_old_md_queue()] Signed-off-by: Stefan Bader <stefan.bader@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * dm space map common: fix to ensure new block isn't already in useJoe Thornber2020-02-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 4feaef830de7ffdd8352e1fe14ad3bf13c9688f8 upstream. The space-maps track the reference counts for disk blocks allocated by both the thin-provisioning and cache targets. There are variants for tracking metadata blocks and data blocks. Transactionality is implemented by never touching blocks from the previous transaction, so we can rollback in the event of a crash. When allocating a new block we need to ensure the block is free (has reference count of 0) in both the current and previous transaction. Prior to this fix we were doing this by searching for a free block in the previous transaction, and relying on a 'begin' counter to track where the last allocation in the current transaction was. This 'begin' field was not being updated in all code paths (eg, increment of a data block reference count due to breaking sharing of a neighbour block in the same btree leaf). This fix keeps the 'begin' field, but now it's just a hint to speed up the search. Instead the current transaction is searched for a free block, and then the old transaction is double checked to ensure it's free. Much simpler. This fixes reports of sm_disk_new_block()'s BUG_ON() triggering when DM thin-provisioning's snapshots are heavily used. Reported-by: Eric Wheeler <dm-devel@lists.ewheeler.net> Cc: stable@vger.kernel.org Signed-off-by: Joe Thornber <ejt@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | Merge 4.4.212 into android-4.4-pGreg Kroah-Hartman2020-01-29
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.212 xfs: Sanity check flags of Q_XQUOTARM call powerpc/archrandom: fix arch_get_random_seed_int() mt7601u: fix bbp version check in mt7601u_wait_bbp_ready drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset() ALSA: hda: fix unused variable warning ALSA: usb-audio: update quirk for B&W PX to remove microphone staging: comedi: ni_mio_common: protect register write overflow pcrypt: use format specifier in kobject_add exportfs: fix 'passing zero to ERR_PTR()' warning drm/dp_mst: Skip validating ports during destruction, just ref pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii group pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1 group pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b group pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field pinctrl: sh-pfc: sh7734: Add missing IPSR11 field pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value Input: nomadik-ske-keypad - fix a loop timeout test clk: highbank: fix refcount leak in hb_clk_init() clk: qoriq: fix refcount leak in clockgen_init() clk: socfpga: fix refcount leak clk: samsung: exynos4: fix refcount leak in exynos4_get_xom() clk: imx6q: fix refcount leak in imx6q_clocks_init() clk: imx6sx: fix refcount leak in imx6sx_clocks_init() clk: imx7d: fix refcount leak in imx7d_clocks_init() clk: vf610: fix refcount leak in vf610_clocks_init() clk: armada-370: fix refcount leak in a370_clk_init() clk: kirkwood: fix refcount leak in kirkwood_clk_init() clk: armada-xp: fix refcount leak in axp_clk_init() IB/usnic: Fix out of bounds index check in query pkey RDMA/ocrdma: Fix out of bounds index check in query pkey media: s5p-jpeg: Correct step and max values for V4L2_CID_JPEG_RESTART_INTERVAL crypto: tgr192 - fix unaligned memory access ASoC: imx-sgtl5000: put of nodes if finding codec fails rtc: cmos: ignore bogus century byte tty: ipwireless: Fix potential NULL pointer dereference rtc: ds1672: fix unintended sign extension rtc: 88pm860x: fix unintended sign extension rtc: 88pm80x: fix unintended sign extension rtc: pm8xxx: fix unintended sign extension fbdev: chipsfb: remove set but not used variable 'size' pinctrl: sh-pfc: emev2: Add missing pinmux functions pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups block: don't use bio->bi_vcnt to figure out segment number vfio_pci: Enable memory accesses before calling pci_map_rom cdc-wdm: pass return value of recover_from_urb_loss drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON drm/nouveau/pmu: don't print reply values if exec is false ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of() fs/nfs: Fix nfs_parse_devname to not modify it's argument clocksource/drivers/sun5i: Fail gracefully when clock rate is unavailable ARM: 8847/1: pm: fix HYP/SVC mode mismatch when MCPM is used regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA nios2: ksyms: Add missing symbol exports scsi: megaraid_sas: reduce module load time xen, cpu_hotplug: Prevent an out of bounds access net: sh_eth: fix a missing check of of_get_phy_mode media: ivtv: update *pos correctly in ivtv_read_pos() media: cx18: update *pos correctly in cx18_read_pos() media: wl128x: Fix an error code in fm_download_firmware() media: cx23885: check allocation return jfs: fix bogus variable self-initialization m68k: mac: Fix VIA timer counter accesses ARM: OMAP2+: Fix potentially uninitialized return value for _setup_reset() media: davinci-isif: avoid uninitialized variable use spi: tegra114: clear packed bit for unpacked mode spi: tegra114: fix for unpacked mode transfers soc/fsl/qe: Fix an error code in qe_pin_request() spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios ehea: Fix a copy-paste err in ehea_init_port_res scsi: qla2xxx: Unregister chrdev if module initialization fails ARM: pxa: ssp: Fix "WARNING: invalid free of devm_ allocated data" hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses tipc: set sysctl_tipc_rmem and named_timeout right range powerpc: vdso: Make vdso32 installation conditional in vdso_install media: ov2659: fix unbalanced mutex_lock/unlock 6lowpan: Off by one handling ->nexthdr dmaengine: axi-dmac: Don't check the number of frames for alignment ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk() packet: in recvmsg msg_name return at least sizeof sockaddr_ll ASoC: fix valid stream condition IB/mlx5: Add missing XRC options to QP optional params mask iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU media: omap_vout: potential buffer overflow in vidioc_dqbuf() media: davinci/vpbe: array underflow in vpbe_enum_outputs() platform/x86: alienware-wmi: printing the wrong error code netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule ARM: riscpc: fix lack of keyboard interrupts after irq conversion kdb: do a sanity check on the cpu in kdb_per_cpu() backlight: lm3630a: Return 0 on success in update_status functions thermal: cpu_cooling: Actually trace CPU load in thermal_power_cpu_get_power spi: spi-fsl-spi: call spi_finalize_current_message() at the end misc: sgi-xp: Properly initialize buf in xpc_get_rsvd_page_pa iommu: Use right function to get group for device signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig inet: frags: call inet_frags_fini() after unregister_pernet_subsys() media: vivid: fix incorrect assignment operation when setting video mode powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild drm/msm/mdp5: Fix mdp5_cfg_init error return net/af_iucv: always register net_device notifier ASoC: ti: davinci-mcasp: Fix slot mask settings when using multiple AXRs rtc: pcf8563: Clear event flags and disable interrupts before requesting irq drm/msm/a3xx: remove TPL1 regs from snapshot iommu/amd: Make iommu_disable safer mfd: intel-lpss: Release IDA resources devres: allow const resource arguments net: pasemi: fix an use-after-free in pasemi_mac_phy_init() scsi: libfc: fix null pointer dereference on a null lport libertas_tf: Use correct channel range in lbtf_geo_init usb: host: xhci-hub: fix extra endianness conversion mic: avoid statically declaring a 'struct device'. x86/kgbd: Use NMI_VECTOR not APIC_DM_NMI ALSA: aoa: onyx: always initialize register read value cifs: fix rmmod regression in cifs.ko caused by force_sig changes crypto: caam - free resources in case caam_rng registration failed ext4: set error return correctly when ext4_htree_store_dirent fails ASoC: es8328: Fix copy-paste error in es8328_right_line_controls ASoC: cs4349: Use PM ops 'cs4349_runtime_pm' ASoC: wm8737: Fix copy-paste error in wm8737_snd_controls signal: Allow cifs and drbd to receive their terminating signals dmaengine: dw: platform: Switch to acpi_dma_controller_register() mac80211: minstrel_ht: fix per-group max throughput rate initialization mips: avoid explicit UB in assignment of mips_io_port_base ahci: Do not export local variable ahci_em_messages Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()" power: supply: Init device wakeup after device_add() x86, perf: Fix the dependency of the x86 insn decoder selftest bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA iio: dac: ad5380: fix incorrect assignment to val ath9k: dynack: fix possible deadlock in ath_dynack_node_{de}init net: sonic: return NETDEV_TX_OK if failed to map buffer Btrfs: fix hang when loading existing inode cache off disk hwmon: (shtc1) fix shtc1 and shtw1 id mask net: sonic: replace dev_kfree_skb in sonic_send_packet net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names' iommu/amd: Wait for completion of IOTLB flush in attach_device net: hisilicon: Fix signedness bug in hix5hd2_dev_probe() net: broadcom/bcmsysport: Fix signedness in bcm_sysport_probe() net: ethernet: stmmac: Fix signedness bug in ipq806x_gmac_of_parse() mac80211: accept deauth frames in IBSS mode llc: fix another potential sk_buff leak in llc_ui_sendmsg() llc: fix sk_buff refcounting in llc_conn_state_process() net: stmmac: fix length of PTP clock's name string drm/msm/dsi: Implement reset correctly dmaengine: imx-sdma: fix size check for sdma script_number net: qca_spi: Move reset_count to struct qcaspi media: ov6650: Fix incorrect use of JPEG colorspace media: ov6650: Fix some format attributes not under control media: ov6650: Fix .get_fmt() V4L2_SUBDEV_FORMAT_TRY support MIPS: Loongson: Fix return value of loongson_hwmon_init net: neigh: use long type to store jiffies delta packet: fix data-race in fanout_flow_is_huge() dmaengine: ti: edma: fix missed failure handling drm/radeon: fix bad DMA from INTERRUPT_CNTL2 arm64: dts: juno: Fix UART frequency m68k: Call timer_interrupt() with interrupts disabled can, slip: Protect tty->disc_data in write_wakeup and close with RCU firestream: fix memory leaks net: cxgb3_main: Add CAP_NET_ADMIN check to CHELSIO_GET_MEM net, ip_tunnel: fix namespaces move net_sched: fix datalen for ematch net: usb: lan78xx: Add .ndo_features_check hwmon: (adt7475) Make volt2reg return same reg as reg2volt input Input: keyspan-remote - fix control-message timeouts ARM: 8950/1: ftrace/recordmcount: filter relocation types mmc: sdhci: fix minimum clock rate for v3 controller Input: sur40 - fix interface sanity checks Input: gtco - fix endpoint sanity check Input: aiptek - fix endpoint sanity check hwmon: (nct7802) Fix voltage limits to wrong registers scsi: RDMA/isert: Fix a recently introduced regression related to logout tracing: xen: Ordered comparison of function pointers do_last(): fetch directory ->i_mode and ->i_uid before it's too late iio: buffer: align the size of scan bytes to size of the largest element scsi: iscsi: Avoid potential deadlock in iscsi_if_rx func md: Avoid namespace collision with bitmap API bitmap: Add bitmap_alloc(), bitmap_zalloc() and bitmap_free() netfilter: ipset: use bitmap infrastructure completely net/x25: fix nonblocking connect libertas: Fix two buffer overflows at parsing bss descriptor Linux 4.4.212 Change-Id: Ic427b213b19cb47b394a4ddc4ed48c7278376c71 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * md: Avoid namespace collision with bitmap APIAndy Shevchenko2020-01-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit e64e4018d572710c44f42c923d4ac059f0a23320 upstream. bitmap API (include/linux/bitmap.h) has 'bitmap' prefix for its methods. On the other hand MD bitmap API is special case. Adding 'md' prefix to it to avoid name space collision. No functional changes intended. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Acked-by: Shaohua Li <shli@kernel.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> [only take the bitmap_free change for stable - gregkh] Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | Merge 4.4.211 into android-4.4-pGreg Kroah-Hartman2020-01-23
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.211 hidraw: Return EPOLLOUT from hidraw_poll HID: hidraw: Fix returning EPOLLOUT from hidraw_poll HID: hidraw, uhid: Always report EPOLLOUT rsi: add fix for crash during assertions cfg80211/mac80211: make ieee80211_send_layer2_update a public function mac80211: Do not send Layer 2 Update frame before authorization media: usb:zr364xx:Fix KASAN:null-ptr-deref Read in zr364xx_vidioc_querycap p54usb: Fix race between disconnect and firmware loading ALSA: line6: Fix write on zero-sized buffer ALSA: line6: Fix memory leak at line6_init_pcm() error path mm/page_alloc.c: calculate 'available' memory in a separate function xen: let alloc_xenballooned_pages() fail if not enough memory free wimax: i2400: fix memory leak wimax: i2400: Fix memory leak in i2400m_op_rfkill_sw_toggle ext4: fix use-after-free race with debug_want_extra_isize ext4: add more paranoia checking in ext4_expand_extra_isize handling dccp: Fix memleak in __feat_register_sp rtc: mt6397: fix alarm register overwrite iommu: Remove device link to group on failure gpio: Fix error message on out-of-range GPIO in lookup table hsr: reset network header when supervision frame is created cifs: Adjust indentation in smb2_open_file RDMA/srpt: Report the SCSI residual to the initiator scsi: enclosure: Fix stale device oops with hot replug scsi: sd: Clear sdkp->protection_type if disk is reformatted without PI platform/x86: asus-wmi: Fix keyboard brightness cannot be set to 0 iio: imu: adis16480: assign bias value only if operation succeeded mei: fix modalias documentation clk: samsung: exynos5420: Preserve CPU clocks configuration during suspend/resume compat_ioctl: handle SIOCOUTQNSD tty: serial: imx: use the sg count from dma_map_sg tty: serial: pch_uart: correct usage of dma_unmap_sg media: exynos4-is: Fix recursive locking in isp_video_release() spi: atmel: fix handling of cs_change set on non-last xfer rtlwifi: Remove unnecessary NULL check in rtl_regd_init rtc: msm6242: Fix reading of 10-hour digit rseq/selftests: Turn off timeout setting hexagon: work around compiler crash ocfs2: call journal flush to mark journal as empty after journal recovery when mount ALSA: seq: Fix racy access for queue timer in proc read Fix built-in early-load Intel microcode alignment block: fix an integer overflow in logical block size USB: serial: simple: Add Motorola Solutions TETRA MTP3xxx and MTP85xx USB: serial: opticon: fix control-message timeouts USB: serial: suppress driver bind attributes USB: serial: ch341: handle unbound port at reset_resume USB: serial: io_edgeport: add missing active-port sanity check USB: serial: quatech2: handle unbound ports scsi: mptfusion: Fix double fetch bug in ioctl usb: core: hub: Improved device recognition on remote wakeup x86/efistub: Disable paging at mixed mode entry mm/page-writeback.c: avoid potential division by zero in wb_min_max_ratio() net: stmmac: 16KB buffer must be 16 byte aligned net: stmmac: Enable 16KB buffer size USB: serial: io_edgeport: use irqsave() in USB's complete callback USB: serial: io_edgeport: handle unbound ports on URB completion USB: serial: keyspan: handle unbound ports scsi: fnic: use kernel's '%pM' format option to print MAC scsi: fnic: fix invalid stack access arm64: dts: agilex/stratix10: fix pmu interrupt numbers netfilter: fix a use-after-free in mtype_destroy() batman-adv: Fix DAT candidate selection on little endian systems macvlan: use skb_reset_mac_header() in macvlan_queue_xmit() r8152: add missing endpoint sanity check tcp: fix marked lost packets not being retransmitted net: usb: lan78xx: limit size of local TSO packets xen/blkfront: Adjust indentation in xlvbd_alloc_gendisk cw1200: Fix a signedness bug in cw1200_load_firmware() cfg80211: check for set_wiphy_params scsi: esas2r: unlock on error in esas2r_nvram_read_direct() scsi: qla4xxx: fix double free bug scsi: bnx2i: fix potential use after free scsi: target: core: Fix a pr_debug() argument scsi: core: scsi_trace: Use get_unaligned_be*() perf probe: Fix wrong address verification regulator: ab8500: Remove SYSCLKREQ from enum ab8505_regulator_id Linux 4.4.211 Change-Id: I1e1bbb74e69936896e235fdeb290ff550e61903e Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * block: fix an integer overflow in logical block sizeMikulas Patocka2020-01-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit ad6bf88a6c19a39fb3b0045d78ea880325dfcf15 upstream. Logical block size has type unsigned short. That means that it can be at most 32768. However, there are architectures that can run with 64k pages (for example arm64) and on these architectures, it may be possible to create block devices with 64k block size. For exmaple (run this on an architecture with 64k pages): Mount will fail with this error because it tries to read the superblock using 2-sector access: device-mapper: writecache: I/O is not aligned, sector 2, size 1024, block size 65536 EXT4-fs (dm-0): unable to read superblock This patch changes the logical block size from unsigned short to unsigned int to avoid the overflow. Cc: stable@vger.kernel.org Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Ming Lei <ming.lei@redhat.com> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | Merge 4.4.209 into android-4.4-pGreg Kroah-Hartman2020-01-12
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.209 PM / devfreq: Don't fail devfreq_dev_release if not in list RDMA/cma: add missed unregister_pernet_subsys in init failure scsi: lpfc: Fix memory leak on lpfc_bsg_write_ebuf_set func scsi: qla2xxx: Don't call qlt_async_event twice scsi: iscsi: qla4xxx: fix double free in probe scsi: libsas: stop discovering if oob mode is disconnected usb: gadget: fix wrong endpoint desc md: raid1: check rdev before reference in raid1_sync_request func s390/cpum_sf: Adjust sampling interval to avoid hitting sample limits s390/cpum_sf: Avoid SBD overflow condition in irq handler xen/balloon: fix ballooned page accounting without hotplug enabled xfs: fix mount failure crash on invalid iclog memory access taskstats: fix data-race Revert "perf report: Add warning when libunwind not compiled in" ALSA: ice1724: Fix sleep-in-atomic in Infrasonic Quartet support code MIPS: Avoid VDSO ABI breakage due to global register variable locks: print unsigned ino in /proc/locks dmaengine: Fix access to uninitialized dma_slave_caps compat_ioctl: block: handle Persistent Reservations gpiolib: fix up emulated open drain outputs ALSA: cs4236: fix error return comparison of an unsigned integer ftrace: Avoid potential division by zero in function profiler Bluetooth: btusb: fix PM leak in error case of setup Bluetooth: delete a stray unlock tty: serial: msm_serial: Fix lockup for sysrq and oops drm/mst: Fix MST sideband up-reply failure handling powerpc/pseries/hvconsole: Fix stack overread via udbg ath9k_htc: Modify byte order for an error message ath9k_htc: Discard undersized packets net: add annotations on hh->hh_len lockless accesses s390/smp: fix physical to logical CPU map for SMT locking/x86: Remove the unused atomic_inc_short() methd pstore/ram: Write new dumps to start of recycled zones locking/spinlock/debug: Fix various data races netfilter: ctnetlink: netns exit must wait for callbacks ARM: vexpress: Set-up shared OPP table instead of individual for each CPU netfilter: uapi: Avoid undefined left-shift in xt_sctp.h ARM: dts: am437x-gp/epos-evm: fix panel compatible powerpc: Ensure that swiotlb buffer is allocated from low memory bnx2x: Do not handle requests from VFs after parity bnx2x: Fix logic to get total no. of PFs per engine net: usb: lan78xx: Fix error message format specifier rfkill: Fix incorrect check to avoid NULL pointer dereference ASoC: wm8962: fix lambda value regulator: rn5t618: fix module aliases kconfig: don't crash on NULL expressions in expr_eq() parisc: Fix compiler warnings in debug_core.c llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and _test_c) net: stmmac: dwmac-sunxi: Allow all RGMII modes net: usb: lan78xx: fix possible skb leak pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM sctp: free cmd->obj.chunk for the unprocessed SCTP_CMD_REPLY tcp: fix "old stuff" D-SACK causing SACK to be treated as D-SACK vlan: vlan_changelink() should propagate errors vlan: fix memory leak in vlan_dev_set_egress_priority vxlan: fix tos value before xmit macvlan: do not assume mac_header is set in macvlan_broadcast() USB: core: fix check for duplicate endpoints USB: serial: option: add Telit ME910G1 0x110a composition Linux 4.4.209 Change-Id: Id229502365a315c24e126e98eab040cb6f40c1d5 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * md: raid1: check rdev before reference in raid1_sync_request funcZhiqiang Liu2020-01-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 028288df635f5a9addd48ac4677b720192747944 ] In raid1_sync_request func, rdev should be checked before reference. Signed-off-by: Zhiqiang Liu <liuzhiqiang26@huawei.com> Signed-off-by: Song Liu <songliubraving@fb.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
| * | Merge 4.4.208 into android-4.4-pGreg Kroah-Hartman2020-01-04
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.208 btrfs: do not leak reloc root if we fail to read the fs root btrfs: handle ENOENT in btrfs_uuid_tree_iterate ALSA: hda/ca0132 - Keep power on during processing DSP response ALSA: hda/ca0132 - Avoid endless loop drm: mst: Fix query_payload ack reply struct iio: light: bh1750: Resolve compiler warning and make code more readable spi: Add call to spi_slave_abort() function when spidev driver is released staging: rtl8188eu: fix possible null dereference rtlwifi: prevent memory leak in rtl_usb_probe IB/iser: bound protection_sg size by data_sg size media: am437x-vpfe: Setting STD to current value is not an error media: i2c: ov2659: fix s_stream return value media: i2c: ov2659: Fix missing 720p register config media: ov6650: Fix stored frame format not in sync with hardware tools/power/cpupower: Fix initializer override in hsw_ext_cstates usb: renesas_usbhs: add suspend event support in gadget mode hwrng: omap3-rom - Call clk_disable_unprepare() on exit only if not idled regulator: max8907: Fix the usage of uninitialized variable in max8907_regulator_probe() media: flexcop-usb: fix NULL-ptr deref in flexcop_usb_transfer_init() samples: pktgen: fix proc_cmd command result check logic mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ring media: ti-vpe: vpe: fix a v4l2-compliance warning about invalid pixel format media: ti-vpe: vpe: fix a v4l2-compliance failure about frame sequence number media: ti-vpe: vpe: Make sure YUYV is set as default format extcon: sm5502: Reset registers during initialization x86/mm: Use the correct function type for native_set_fixmap() perf report: Add warning when libunwind not compiled in iio: adc: max1027: Reset the device at probe time Bluetooth: hci_core: fix init for HCI_USER_CHANNEL drm/gma500: fix memory disclosures due to uninitialized bytes x86/ioapic: Prevent inconsistent state when moving an interrupt arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill() libata: Ensure ata_port probe has completed before detach pinctrl: sh-pfc: sh7734: Fix duplicate TCLK1_B bnx2x: Fix PF-VF communication over multi-cos queues. spi: img-spfi: fix potential double release rtlwifi: fix memory leak in rtl92c_set_fw_rsvdpagepkt() perf probe: Fix to find range-only function instance perf probe: Fix to list probe event with correct line number perf probe: Walk function lines in lexical blocks perf probe: Fix to probe an inline function which has no entry pc perf probe: Fix to show ranges of variables in functions without entry_pc perf probe: Fix to show inlined function callsite without entry_pc perf probe: Skip overlapped location on searching variables perf probe: Return a better scope DIE if there is no best scope perf probe: Fix to show calling lines of inlined functions perf probe: Skip end-of-sequence and non statement lines perf probe: Filter out instances except for inlined subroutine and subprogram ath10k: fix get invalid tx rate for Mesh metric media: pvrusb2: Fix oops on tear-down when radio support is not present media: si470x-i2c: add missed operations in remove EDAC/ghes: Fix grain calculation spi: pxa2xx: Add missed security checks ASoC: rt5677: Mark reg RT5677_PWR_ANLG2 as volatile parport: load lowlevel driver if ports not found cpufreq: Register drivers only after CPU devices have been registered x86/crash: Add a forward declaration of struct kimage spi: tegra20-slink: add missed clk_unprepare btrfs: don't prematurely free work in end_workqueue_fn() iwlwifi: check kasprintf() return value fbtft: Make sure string is NULL terminated crypto: sun4i-ss - Fix 64-bit size_t warnings on sun4i-ss-hash.c crypto: vmx - Avoid weird build failures libtraceevent: Fix memory leakage in copy_filter_type net: phy: initialise phydev speed and duplex sanely Revert "mmc: sdhci: Fix incorrect switch to HS mode" usb: xhci: Fix build warning seen with CONFIG_PM=n btrfs: do not call synchronize_srcu() in inode_tree_del btrfs: return error pointer from alloc_test_extent_buffer btrfs: abort transaction after failed inode updates in create_subvol Btrfs: fix removal logic of the tree mod log that leads to use-after-free issues ALSA: pcm: Avoid possible info leaks from PCM stream buffers af_packet: set defaule value for tmo fjes: fix missed check in fjes_acpi_add mod_devicetable: fix PHY module format net: hisilicon: Fix a BUG trigered by wrong bytes_compl net: nfc: nci: fix a possible sleep-in-atomic-context bug in nci_uart_tty_receive() net: qlogic: Fix error paths in ql_alloc_large_buffers() net: usb: lan78xx: Fix suspend/resume PHY register access error sctp: fully initialize v4 addr in some functions net: dst: Force 4-byte alignment of dst_metrics usbip: Fix error path of vhci_recv_ret_submit() USB: EHCI: Do not return -EPIPE when hub is disconnected platform/x86: hp-wmi: Make buffer for HPWMI_FEATURE2_QUERY 128 bytes staging: comedi: gsc_hpdi: check dma_alloc_coherent() return value ext4: check for directory entries too close to block end powerpc/irq: fix stack overflow verification mmc: sdhci-of-esdhc: fix P2020 errata handling perf probe: Fix to show function entry line as probe-able scsi: mpt3sas: Fix clear pending bit in ioctl status scsi: lpfc: Fix locking on mailbox command completion Input: atmel_mxt_ts - disable IRQ across suspend iommu/tegra-smmu: Fix page tables in > 4 GiB memory scsi: target: compare full CHAP_A Algorithm strings scsi: lpfc: Fix SLI3 hba in loop mode not discovering devices scsi: csiostor: Don't enable IRQs too early powerpc/pseries: Mark accumulate_stolen_time() as notrace dma-debug: add a schedule point in debug_dma_dump_mappings() clocksource/drivers/asm9260: Add a check for of_clk_get powerpc/security/book3s64: Report L1TF status in sysfs jbd2: Fix statistics for the number of logged blocks scsi: tracing: Fix handling of TRANSFER LENGTH == 0 for READ(6) and WRITE(6) scsi: lpfc: Fix duplicate unreg_rpi error in port offline flow clk: qcom: Allow constant ratio freq tables for rcg irqchip/irq-bcm7038-l1: Enable parent IRQ if necessary irqchip: ingenic: Error out if IRQ domain creation failed fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long scsi: lpfc: fix: Coverity: lpfc_cmpl_els_rsp(): Null pointer dereferences scsi: ufs: fix potential bug which ends in system hang powerpc/pseries/cmm: Implement release() function for sysfs device powerpc/security: Fix wrong message when RFI Flush is disable clk: pxa: fix one of the pxa RTC clocks bcache: at least try to shrink 1 node in bch_mca_scan() HID: Improve Windows Precision Touchpad detection. ext4: work around deleting a file with i_nlink == 0 safely scsi: pm80xx: Fix for SATA device discovery scsi: target: iscsi: Wait for all commands to finish before freeing a session gpio: mpc8xxx: Don't overwrite default irq_set_type callback scripts/kallsyms: fix definitely-lost memory leak cdrom: respect device capabilities during opening action perf regs: Make perf_reg_name() return "unknown" instead of NULL libfdt: define INT32_MAX and UINT32_MAX in libfdt_env.h s390/cpum_sf: Check for SDBT and SDB consistency ocfs2: fix passing zero to 'PTR_ERR' warning kernel: sysctl: make drop_caches write-only ALSA: hda - Downgrade error message for single-cmd fallback Make filldir[64]() verify the directory entry filename is valid filldir[64]: remove WARN_ON_ONCE() for bad directory entries net: davinci_cpdma: use dma_addr_t for DMA address netfilter: ebtables: compat: reject all padding in matches/watchers 6pack,mkiss: fix possible deadlock netfilter: bridge: make sure to pull arp header in br_nf_forward_arp() net: icmp: fix data-race in cmp_global_allow() hrtimer: Annotate lockless access to timer->state mmc: sdhci: Update the tuning failed messages to pr_debug level tcp: do not send empty skb from tcp_write_xmit() Linux 4.4.208 Change-Id: I1c710061be5b595f822b45a87d852b85512d7783 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * bcache: at least try to shrink 1 node in bch_mca_scan()Coly Li2020-01-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 9fcc34b1a6dd4b8e5337e2b6ef45e428897eca6b ] In bch_mca_scan(), the number of shrinking btree node is calculated by code like this, unsigned long nr = sc->nr_to_scan; nr /= c->btree_pages; nr = min_t(unsigned long, nr, mca_can_free(c)); variable sc->nr_to_scan is number of objects (here is bcache B+tree nodes' number) to shrink, and pointer variable sc is sent from memory management code as parametr of a callback. If sc->nr_to_scan is smaller than c->btree_pages, after the above calculation, variable 'nr' will be 0 and nothing will be shrunk. It is frequeently observed that only 1 or 2 is set to sc->nr_to_scan and make nr to be zero. Then bch_mca_scan() will do nothing more then acquiring and releasing mutex c->bucket_lock. This patch checkes whether nr is 0 after the above calculation, if 0 is the result then set 1 to variable 'n'. Then at least bch_mca_scan() will try to shrink a single B+tree node. Signed-off-by: Coly Li <colyli@suse.de> Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Sasha Levin <sashal@kernel.org>
| * | Merge 4.4.207 into android-4.4-pGreg Kroah-Hartman2019-12-21
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.207 x86/apic/32: Avoid bogus LDR warnings usb: gadget: u_serial: add missing port entry locking tty: serial: msm_serial: Fix flow control x86/PCI: Avoid AMD FCH XHCI USB PME# from D0 defect serial: serial_core: Perform NULL checks for break_ctl ops serial: ifx6x60: add missed pm_runtime_disable autofs: fix a leak in autofs_expire_indirect() NFC: nxp-nci: Fix NULL pointer dereference after I2C communication error Input: cyttsp4_core - fix use after free bug ALSA: pcm: Fix stream lock usage in snd_pcm_period_elapsed() rsxx: add missed destroy_workqueue calls in remove net: ep93xx_eth: fix mismatch of request_mem_region in remove serial: core: Allow processing sysrq at port unlock time iwlwifi: mvm: Send non offchannel traffic via AP sta ARM: 8813/1: Make aligned 2-byte getuser()/putuser() atomic on ARMv6+ extcon: max8997: Fix lack of path setting in USB device mode clk: rockchip: fix rk3188 sclk_smc gate data clk: rockchip: fix rk3188 sclk_mac_lbtest parameter ordering dlm: fix missing idr_destroy for recover_idr MIPS: SiByte: Enable ZONE_DMA32 for LittleSur scsi: zfcp: drop default switch case which might paper over missing case pinctrl: qcom: ssbi-gpio: fix gpio-hog related boot issues Staging: iio: adt7316: Fix i2c data reading, set the data field regulator: Fix return value of _set_load() stub MIPS: OCTEON: octeon-platform: fix typing math-emu/soft-fp.h: (_FP_ROUND_ZERO) cast 0 to void to fix warning rtc: max8997: Fix the returned value in case of error in 'max8997_rtc_read_alarm()' rtc: dt-binding: abx80x: fix resistance scale ARM: dts: exynos: Use Samsung SoC specific compatible for DWC2 module dmaengine: coh901318: Fix a double-lock bug dmaengine: coh901318: Remove unused variable ACPI: fix acpi_find_child_device() invocation in acpi_preset_companion() dma-mapping: fix return type of dma_set_max_seg_size() altera-stapl: check for a null key before strcasecmp'ing it serial: imx: fix error handling in console_setup i2c: imx: don't print error message on probe defer dlm: NULL check before kmem_cache_destroy is not needed nfsd: fix a warning in __cld_pipe_upcall() ARM: OMAP1/2: fix SoC name printing net/x25: fix called/calling length calculation in x25_parse_address_block net/x25: fix null_x25_address handling ARM: dts: mmp2: fix the gpio interrupt cell number tcp: fix off-by-one bug on aborting window-probing socket modpost: skip ELF local symbols during section mismatch check kbuild: fix single target build for external module ARM: dts: pxa: clean up USB controller nodes dlm: fix invalid cluster name warning powerpc/math-emu: Update macros from GCC MIPS: OCTEON: cvmx_pko_mem_debug8: use oldest forward compatible definition nfsd: Return EPERM, not EACCES, in some SETATTR cases mlx4: Use snprintf instead of complicated strcpy ARM: dts: sunxi: Fix PMU compatible strings sched/fair: Scale bandwidth quota and period without losing quota/period ratio precision fuse: verify nlink fuse: verify attributes ALSA: pcm: oss: Avoid potential buffer overflows Input: goodix - add upside-down quirk for Teclast X89 tablet CIFS: Fix NULL-pointer dereference in smb2_push_mandatory_locks CIFS: Fix SMB2 oplock break processing tty: vt: keyboard: reject invalid keycodes can: slcan: Fix use-after-free Read in slcan_open jbd2: Fix possible overflow in jbd2_log_space_left() drm/i810: Prevent underflow in ioctl KVM: x86: do not modify masked bits of shared MSRs KVM: x86: fix presentation of TSX feature in ARCH_CAPABILITIES crypto: crypto4xx - fix double-free in crypto4xx_destroy_sdr crypto: user - fix memory leak in crypto_report spi: atmel: Fix CS high support RDMA/qib: Validate ->show()/store() callbacks before calling them thermal: Fix deadlock in thermal thermal_zone_device_check KVM: x86: fix out-of-bounds write in KVM_GET_EMULATED_CPUID (CVE-2019-19332) appletalk: Fix potential NULL pointer dereference in unregister_snap_client appletalk: Set error code if register_snap_client failed ALSA: hda - Fix pending unsol events at shutdown sched/core: Allow putting thread_info into task_struct sched/core: Add try_get_task_stack() and put_task_stack() sched/core, x86: Make struct thread_info arch specific again fs/proc: Stop reporting eip and esp in /proc/PID/stat fs/proc: Report eip/esp in /prod/PID/stat for coredumping proc: fix coredump vs read /proc/*/stat race fs/proc/array.c: allow reporting eip/esp for all coredumping threads usb: gadget: configfs: Fix missing spin_lock_init() usb: Allow USB device to be warm reset in suspended state staging: rtl8188eu: fix interface sanity check staging: rtl8712: fix interface sanity check staging: gigaset: fix general protection fault on probe staging: gigaset: fix illegal free on probe errors staging: gigaset: add endpoint-type sanity check xhci: Increase STS_HALT timeout in xhci_suspend() iio: humidity: hdc100x: fix IIO_HUMIDITYRELATIVE channel reporting USB: atm: ueagle-atm: add missing endpoint check USB: idmouse: fix interface sanity checks USB: serial: io_edgeport: fix epic endpoint lookup USB: adutux: fix interface sanity check usb: core: urb: fix URB structure initialization function usb: mon: Fix a deadlock in usbmon between mmap and read mtd: spear_smi: Fix Write Burst mode virtio-balloon: fix managed page counts when migrating pages between zones btrfs: check page->mapping when loading free space cache btrfs: Remove btrfs_bio::flags member rtlwifi: rtl8192de: Fix missing code to retrieve RX buffer address rtlwifi: rtl8192de: Fix missing callback that tests for hw release of buffer rtlwifi: rtl8192de: Fix missing enable interrupt flag lib: raid6: fix awk build warnings workqueue: Fix spurious sanity check failures in destroy_workqueue() workqueue: Fix pwq ref leak in rescuer_thread() ASoC: Jack: Fix NULL pointer dereference in snd_soc_jack_report blk-mq: avoid sysfs buffer overflow with too many CPU cores cgroup: pids: use atomic64_t for pids->limit ar5523: check NULL before memcpy() in ar5523_cmd() media: bdisp: fix memleak on release media: radio: wl1273: fix interrupt masking on release cpuidle: Do not unset the driver if it is there already ACPI: OSL: only free map once in osl.c ACPI: bus: Fix NULL pointer check in acpi_bus_get_private_data() ACPI: PM: Avoid attaching ACPI PM domain to certain devices pinctrl: samsung: Fix device node refcount leaks in S3C24xx wakeup controller init pinctrl: samsung: Fix device node refcount leaks in init code powerpc: Allow 64bit VDSO __kernel_sync_dicache to work across ranges >4GB video/hdmi: Fix AVI bar unpack quota: Check that quota is not dirty before release quota: fix livelock in dquot_writeback_dquots scsi: zfcp: trace channel log even for FCP command responses usb: xhci: only set D3hot for pci device xhci: Fix memory leak in xhci_add_in_port() xhci: make sure interrupts are restored to correct state iio: adis16480: Add debugfs_reg_access entry Btrfs: fix negative subv_writers counter and data space leak after buffered write scsi: lpfc: Cap NPIV vports to 256 e100: Fix passing zero to 'PTR_ERR' warning in e100_load_ucode_wait x86/MCE/AMD: Turn off MC4_MISC thresholding on all family 0x15 models ARM: dts: omap3-tao3530: Fix incorrect MMC card detection GPIO polarity pinctrl: samsung: Fix device node refcount leaks in S3C64xx wakeup controller init scsi: qla2xxx: Fix DMA unmap leak scsi: qla2xxx: Fix qla24xx_process_bidir_cmd() scsi: qla2xxx: Always check the qla2x00_wait_for_hba_online() return value powerpc: Fix vDSO clock_getres() mm/shmem.c: cast the type of unmap_start to u64 blk-mq: make sure that line break can be printed workqueue: Fix missing kfree(rescuer) in destroy_workqueue() sunrpc: fix crash when cache_head become valid before update kernel/module.c: wakeup processes in module_wq on module unload net: bridge: deny dev_set_mac_address() when unregistering tcp: md5: fix potential overestimation of TCP option space tipc: fix ordering of tipc module init and exit routine inet: protect against too small mtu values. tcp: fix rejected syncookies due to stale timestamps tcp: tighten acceptance of ACKs not matching a child socket tcp: Protect accesses to .ts_recent_stamp with {READ,WRITE}_ONCE() net: ethernet: ti: cpsw: fix extra rx interrupt PCI: Fix Intel ACS quirk UPDCR register address PCI/MSI: Fix incorrect MSI-X masking on resume xtensa: fix TLB sanity checker CIFS: Respect O_SYNC and O_DIRECT flags during reconnect ARM: dts: s3c64xx: Fix init order of clock providers ARM: tegra: Fix FLOW_CTLR_HALT register clobbering by tegra_resume() vfio/pci: call irq_bypass_unregister_producer() before freeing irq dm btree: increase rebalance threshold in __rebalance2() drm/radeon: fix r1xx/r2xx register checker for POT textures xhci: fix USB3 device initiated resume race with roothub autosuspend net: stmmac: use correct DMA buffer size in the RX descriptor net: stmmac: don't stop NAPI processing when dropping a packet Linux 4.4.207 Change-Id: I2505ee1dcf004c7f28e711cd71977ea33150e733 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * dm btree: increase rebalance threshold in __rebalance2()Hou Tao2019-12-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 474e559567fa631dea8fb8407ab1b6090c903755 upstream. We got the following warnings from thin_check during thin-pool setup: $ thin_check /dev/vdb examining superblock examining devices tree missing devices: [1, 84] too few entries in btree_node: 41, expected at least 42 (block 138, max_entries = 126) examining mapping tree The phenomenon is the number of entries in one node of details_info tree is less than (max_entries / 3). And it can be easily reproduced by the following procedures: $ new a thin pool $ presume the max entries of details_info tree is 126 $ new 127 thin devices (e.g. 1~127) to make the root node being full and then split $ remove the first 43 (e.g. 1~43) thin devices to make the children reblance repeatedly $ stop the thin pool $ thin_check The root cause is that the B-tree removal procedure in __rebalance2() doesn't guarantee the invariance: the minimal number of entries in non-root node should be >= (max_entries / 3). Simply fix the problem by increasing the rebalance threshold to make sure the number of entries in each child will be greater than or equal to (max_entries / 3 + 1), so no matter which child is used for removal, the number will still be valid. Cc: stable@vger.kernel.org Signed-off-by: Hou Tao <houtao1@huawei.com> Acked-by: Joe Thornber <ejt@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | Merge android-4.4-p.204 (583bdda) into msm-4.4Srinivasarao P2019-12-02
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-583bdda Linux 4.4.204 KVM: PPC: Book3S HV: Flush link stack on guest exit to host kernel powerpc/book3s64: Fix link stack flush on context switch powerpc/64s: support nospectre_v2 cmdline option staging: comedi: usbduxfast: usbduxfast_ai_cmdtest rounding error USB: serial: option: add support for Foxconn T77W968 LTE modules USB: serial: option: add support for DW5821e with eSIM support USB: serial: mos7840: fix remote wakeup USB: serial: mos7720: fix remote wakeup USB: serial: mos7840: add USB ID to support Moxa UPort 2210 appledisplay: fix error handling in the scheduled work usb-serial: cp201x: support Mark-10 digital force gauge virtio_console: move removal code virtio_console: drop custom control queue cleanup virtio_console: fix uninitialized variable use virtio_console: allocate inbufs in add_port() only if it is needed virtio_console: don't tie bufs to a vq virtio_console: reset on out of memory media: imon: invalid dereference in imon_touch_event media: cxusb: detect cxusb_ctrl_msg error in query media: b2c2-flexcop-usb: add sanity checking cpufreq: Add NULL checks to show() and store() methods of cpufreq media: vivid: Fix wrong locking that causes race conditions on streaming stop media: vivid: Set vid_cap_streaming and vid_out_streaming to true x86/speculation: Fix redundant MDS mitigation message x86/speculation: Fix incorrect MDS/TAA mitigation status x86/insn: Fix awk regexp warnings ARC: perf: Accommodate big-endian CPU mmc: block: Fix tag condition with packed writes ocfs2: remove ocfs2_is_o2cb_active() cpufreq: Skip cpufreq resume if it's not suspended arm64: fix for bad_mode() handler to always result in panic dm: use blk_set_queue_dying() in __dm_destroy() ath9k_hw: fix uninitialized variable data Bluetooth: Fix invalid-free in bcsp_close() IB/hfi1: Ensure full Gen3 speed in a Gen4 system spi: omap2-mcspi: Fix DMA and FIFO event trigger size mismatch PCI: keystone: Use quirk to limit MRRS for K2G pinctrl: zynq: Use define directive for PIN_CONFIG_IO_STANDARD pinctrl: qcom: spmi-gpio: fix gpio-hog related boot issues sock: Reset dst when changing sk_mark via setsockopt net: bcmgenet: return correct value 'ret' from bcmgenet_power_down dlm: don't leak kernel pointer to userspace dlm: fix invalid free scsi: lpfc: fcoe: Fix link down issue after 1000+ link bounces scsi: megaraid_sas: Fix msleep granularity scsi: mpt3sas: Fix driver modifying persistent data in Manufacturing page11 scsi: mpt3sas: Fix Sync cache command failure during driver unload rtlwifi: rtl8192de: Fix misleading REG_MCUFWDL information wireless: airo: potential buffer overflow in sprintf() brcmsmac: never log "tid x is not agg'able" by default rtl8xxxu: Fix missing break in switch wlcore: Fix the return value in case of error in 'wlcore_vendor_cmd_smart_config_start()' audit: print empty EXECVE args sched/fair: Don't increase sd->balance_interval on newidle balance net: do not abort bulk send on BQL status ocfs2: fix clusters leak in ocfs2_defrag_extent() ocfs2: don't put and assigning null to bh allocated outside ntb: intel: fix return value for ndev_vec_mask() ntb_netdev: fix sleep time mismatch igb: shorten maximum PHC timecounter update interval fs/hfs/extent.c: fix array out of bounds read of array extent hfs: fix return value of hfs_get_block() hfsplus: fix return value of hfsplus_get_block() hfs: prevent btree data loss on ENOSPC hfsplus: prevent btree data loss on ENOSPC hfs: fix BUG on bnode parent update hfsplus: fix BUG on bnode parent update linux/bitmap.h: fix type of nbits in bitmap_shift_right() linux/bitmap.h: handle constant zero-size bitmaps correctly um: Make line/tty semantics use true write IRQ mm/page-writeback.c: fix range_cyclic writeback vs writepages deadlock fs/ocfs2/dlm/dlmdebug.c: fix a sleep-in-atomic-context bug in dlm_print_one_mle() sparc64: Rework xchg() definition to avoid warnings. thermal: rcar_thermal: Prevent hardware access during system suspend selftests/ftrace: Fix to test kprobe $comm arg only if available mfd: max8997: Enale irq-wakeup unconditionally mfd: mc13xxx-core: Fix PMIC shutdown when reading ADC values qlcnic: fix a return in qlcnic_dcb_get_capability() mISDN: Fix type of switch control variable in ctrl_teimanager rtc: s35390a: Change buf's type to u8 in s35390a_init ceph: fix dentry leak in ceph_readdir_prepopulate sparc: Fix parport build warnings. spi: omap2-mcspi: Set FIFO DMA trigger level to word length s390/perf: Return error when debug_register fails atm: zatm: Fix empty body Clang warnings SUNRPC: Fix a compile warning for cmpxchg64() USB: misc: appledisplay: fix backlight update_status return code macintosh/windfarm_smu_sat: Fix debug output ALSA: i2c/cs8427: Fix int to char conversion kprobes, x86/ptrace.h: Make regs_get_kernel_stack_nth() not fault on bad stack net: fix warning in af_unix scsi: dc395x: fix DMA API usage in sg_update_list scsi: dc395x: fix dma API usage in srb_done clk: mmp2: fix the clock id for sdh2_clk and sdh3_clk scsi: iscsi_tcp: Explicitly cast param in iscsi_sw_tcp_host_get_param scsi: isci: Change sci_controller_start_task's return type to sci_status scsi: isci: Use proper enumerated type in atapi_d2h_reg_frame_handler KVM/x86: Fix invvpid and invept register operand size in 64-bit mode scsi: ips: fix missing break in switch amiflop: clean up on errors during setup misc: mic: fix a DMA pool free failure gsmi: Fix bug in append_to_eventlog sysfs handler btrfs: handle error of get_old_root mmc: mediatek: fix cannot receive new request when msdc_cmd_is_ready fail spi: sh-msiof: fix deferred probing brcmsmac: AP mode: update beacon when TIM changes powerpc/eeh: Fix use of EEH_PE_KEEP on wrong field powerpc: Fix signedness bug in update_flash_db() synclink_gt(): fix compat_ioctl() gfs2: Fix marking bitmaps non-full printk: fix integer overflow in setup_log_buf() ALSA: isight: fix leak of reference to firewire unit in error path of .probe callback mwifiex: Fix NL80211_TX_POWER_LIMITED platform/x86: asus-wmi: add SERIO_I8042 dependency platform/x86: asus-wmi: Only Tell EC the OS will handle display hotkeys from asus_nb_wmi platform/x86: asus-nb-wmi: Support ALS on the Zenbook UX430UQ platform/x86: asus-wmi: try to set als by default asus-wmi: provide access to ALS control platform/x86: asus-wmi: Set specified XUSB2PR value for X550LB platform/x86: asus-wmi: fix asus ux303ub brightness issue platform/x86: asus-wmi: Filter buggy scan codes on ASUS Q500A asus-wmi: Add quirk_no_rfkill for the Asus Z550MA asus-wmi: Add quirk_no_rfkill for the Asus U303LB asus-wmi: Add quirk_no_rfkill for the Asus N552VW asus-wmi: Add quirk_no_rfkill_wapf4 for the Asus X456UF asus-wmi: Create quirk for airplane_mode LED mm/ksm.c: don't WARN if page is still mapped in remove_stable_node() Revert "fs: ocfs2: fix possible null-pointer dereferences in ocfs2_xa_prepare_entry()" net: rtnetlink: prevent underflows in do_setvfinfo() net/sched: act_pedit: fix WARN() in the traffic path sfc: Only cancel the PPS workqueue if it exists net/mlx4_en: fix mlx4 ethtool -N insertion Conflicts: arch/arm64/kernel/traps.c Change-Id: Ie8f88d491b2d80c031e81346687624d7b5a770f1 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | Merge 4.4.204 into android-4.4-pGreg Kroah-Hartman2019-11-28
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.204 net/mlx4_en: fix mlx4 ethtool -N insertion sfc: Only cancel the PPS workqueue if it exists net/sched: act_pedit: fix WARN() in the traffic path net: rtnetlink: prevent underflows in do_setvfinfo() Revert "fs: ocfs2: fix possible null-pointer dereferences in ocfs2_xa_prepare_entry()" mm/ksm.c: don't WARN if page is still mapped in remove_stable_node() asus-wmi: Create quirk for airplane_mode LED asus-wmi: Add quirk_no_rfkill_wapf4 for the Asus X456UF asus-wmi: Add quirk_no_rfkill for the Asus N552VW asus-wmi: Add quirk_no_rfkill for the Asus U303LB asus-wmi: Add quirk_no_rfkill for the Asus Z550MA platform/x86: asus-wmi: Filter buggy scan codes on ASUS Q500A platform/x86: asus-wmi: fix asus ux303ub brightness issue platform/x86: asus-wmi: Set specified XUSB2PR value for X550LB asus-wmi: provide access to ALS control platform/x86: asus-wmi: try to set als by default platform/x86: asus-nb-wmi: Support ALS on the Zenbook UX430UQ platform/x86: asus-wmi: Only Tell EC the OS will handle display hotkeys from asus_nb_wmi platform/x86: asus-wmi: add SERIO_I8042 dependency mwifiex: Fix NL80211_TX_POWER_LIMITED ALSA: isight: fix leak of reference to firewire unit in error path of .probe callback printk: fix integer overflow in setup_log_buf() gfs2: Fix marking bitmaps non-full synclink_gt(): fix compat_ioctl() powerpc: Fix signedness bug in update_flash_db() powerpc/eeh: Fix use of EEH_PE_KEEP on wrong field brcmsmac: AP mode: update beacon when TIM changes spi: sh-msiof: fix deferred probing mmc: mediatek: fix cannot receive new request when msdc_cmd_is_ready fail btrfs: handle error of get_old_root gsmi: Fix bug in append_to_eventlog sysfs handler misc: mic: fix a DMA pool free failure amiflop: clean up on errors during setup scsi: ips: fix missing break in switch KVM/x86: Fix invvpid and invept register operand size in 64-bit mode scsi: isci: Use proper enumerated type in atapi_d2h_reg_frame_handler scsi: isci: Change sci_controller_start_task's return type to sci_status scsi: iscsi_tcp: Explicitly cast param in iscsi_sw_tcp_host_get_param clk: mmp2: fix the clock id for sdh2_clk and sdh3_clk scsi: dc395x: fix dma API usage in srb_done scsi: dc395x: fix DMA API usage in sg_update_list net: fix warning in af_unix kprobes, x86/ptrace.h: Make regs_get_kernel_stack_nth() not fault on bad stack ALSA: i2c/cs8427: Fix int to char conversion macintosh/windfarm_smu_sat: Fix debug output USB: misc: appledisplay: fix backlight update_status return code SUNRPC: Fix a compile warning for cmpxchg64() atm: zatm: Fix empty body Clang warnings s390/perf: Return error when debug_register fails spi: omap2-mcspi: Set FIFO DMA trigger level to word length sparc: Fix parport build warnings. ceph: fix dentry leak in ceph_readdir_prepopulate rtc: s35390a: Change buf's type to u8 in s35390a_init mISDN: Fix type of switch control variable in ctrl_teimanager qlcnic: fix a return in qlcnic_dcb_get_capability() mfd: mc13xxx-core: Fix PMIC shutdown when reading ADC values mfd: max8997: Enale irq-wakeup unconditionally selftests/ftrace: Fix to test kprobe $comm arg only if available thermal: rcar_thermal: Prevent hardware access during system suspend sparc64: Rework xchg() definition to avoid warnings. fs/ocfs2/dlm/dlmdebug.c: fix a sleep-in-atomic-context bug in dlm_print_one_mle() mm/page-writeback.c: fix range_cyclic writeback vs writepages deadlock um: Make line/tty semantics use true write IRQ linux/bitmap.h: handle constant zero-size bitmaps correctly linux/bitmap.h: fix type of nbits in bitmap_shift_right() hfsplus: fix BUG on bnode parent update hfs: fix BUG on bnode parent update hfsplus: prevent btree data loss on ENOSPC hfs: prevent btree data loss on ENOSPC hfsplus: fix return value of hfsplus_get_block() hfs: fix return value of hfs_get_block() fs/hfs/extent.c: fix array out of bounds read of array extent igb: shorten maximum PHC timecounter update interval ntb_netdev: fix sleep time mismatch ntb: intel: fix return value for ndev_vec_mask() ocfs2: don't put and assigning null to bh allocated outside ocfs2: fix clusters leak in ocfs2_defrag_extent() net: do not abort bulk send on BQL status sched/fair: Don't increase sd->balance_interval on newidle balance audit: print empty EXECVE args wlcore: Fix the return value in case of error in 'wlcore_vendor_cmd_smart_config_start()' rtl8xxxu: Fix missing break in switch brcmsmac: never log "tid x is not agg'able" by default wireless: airo: potential buffer overflow in sprintf() rtlwifi: rtl8192de: Fix misleading REG_MCUFWDL information scsi: mpt3sas: Fix Sync cache command failure during driver unload scsi: mpt3sas: Fix driver modifying persistent data in Manufacturing page11 scsi: megaraid_sas: Fix msleep granularity scsi: lpfc: fcoe: Fix link down issue after 1000+ link bounces dlm: fix invalid free dlm: don't leak kernel pointer to userspace net: bcmgenet: return correct value 'ret' from bcmgenet_power_down sock: Reset dst when changing sk_mark via setsockopt pinctrl: qcom: spmi-gpio: fix gpio-hog related boot issues pinctrl: zynq: Use define directive for PIN_CONFIG_IO_STANDARD PCI: keystone: Use quirk to limit MRRS for K2G spi: omap2-mcspi: Fix DMA and FIFO event trigger size mismatch IB/hfi1: Ensure full Gen3 speed in a Gen4 system Bluetooth: Fix invalid-free in bcsp_close() ath9k_hw: fix uninitialized variable data dm: use blk_set_queue_dying() in __dm_destroy() arm64: fix for bad_mode() handler to always result in panic cpufreq: Skip cpufreq resume if it's not suspended ocfs2: remove ocfs2_is_o2cb_active() mmc: block: Fix tag condition with packed writes ARC: perf: Accommodate big-endian CPU x86/insn: Fix awk regexp warnings x86/speculation: Fix incorrect MDS/TAA mitigation status x86/speculation: Fix redundant MDS mitigation message media: vivid: Set vid_cap_streaming and vid_out_streaming to true media: vivid: Fix wrong locking that causes race conditions on streaming stop cpufreq: Add NULL checks to show() and store() methods of cpufreq media: b2c2-flexcop-usb: add sanity checking media: cxusb: detect cxusb_ctrl_msg error in query media: imon: invalid dereference in imon_touch_event virtio_console: reset on out of memory virtio_console: don't tie bufs to a vq virtio_console: allocate inbufs in add_port() only if it is needed virtio_console: fix uninitialized variable use virtio_console: drop custom control queue cleanup virtio_console: move removal code usb-serial: cp201x: support Mark-10 digital force gauge appledisplay: fix error handling in the scheduled work USB: serial: mos7840: add USB ID to support Moxa UPort 2210 USB: serial: mos7720: fix remote wakeup USB: serial: mos7840: fix remote wakeup USB: serial: option: add support for DW5821e with eSIM support USB: serial: option: add support for Foxconn T77W968 LTE modules staging: comedi: usbduxfast: usbduxfast_ai_cmdtest rounding error powerpc/64s: support nospectre_v2 cmdline option powerpc/book3s64: Fix link stack flush on context switch KVM: PPC: Book3S HV: Flush link stack on guest exit to host kernel Linux 4.4.204 Change-Id: I63f64a109a8797f479bc7226be23ca591fa01b1c Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * dm: use blk_set_queue_dying() in __dm_destroy()Bart Van Assche2019-11-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 2e91c3694181dc500faffec16c5aaa0ac5e15449 upstream. After QUEUE_FLAG_DYING has been set any code that is waiting in get_request() should be woken up. But to get this behaviour blk_set_queue_dying() must be used instead of only setting QUEUE_FLAG_DYING. Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Lee Jones <lee.jones@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | Merge android-4.4-p.203 (40ef73d) into msm-4.4Srinivasarao P2019-11-26
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-40ef73d Linux 4.4.203 arm64: uaccess: Ensure PAN is re-enabled after unhandled uaccess fault spi: rockchip: initialize dma_slave_config properly mac80211: minstrel: fix CCK rate group streams value hwmon: (pwm-fan) Silence error on probe deferral ARM: 8802/1: Call syscall_trace_exit even when system call skipped spi: spidev: Fix OF tree warning logic gpio: syscon: Fix possible NULL ptr usage x86/kexec: Correct KEXEC_BACKUP_SRC_END off-by-one error media: cx231xx: fix potential sign-extension overflow on large shift GFS2: Flush the GFS2 delete workqueue before stopping the kernel threads media: isif: fix a NULL pointer dereference bug printk: Give error on attempt to set log buffer length to over 2G backlight: lm3639: Unconditionally call led_classdev_unregister proc/vmcore: Fix i386 build error of missing copy_oldmem_page_encrypted() bcache: recal cached_dev_sectors on detach fbdev: sbuslib: integer overflow in sbusfb_ioctl_helper() fbdev: sbuslib: use checked version of put_user() ACPI / SBS: Fix rare oops when removing modules crypto: mxs-dcp - Fix AES issues crypto: mxs-dcp - Fix SHA null hashes and output length x86/olpc: Fix build error with CONFIG_MFD_CS5535=m Input: st1232 - set INPUT_PROP_DIRECT property dmaengine: ioat: fix prototype of ioat_enumerate_channels NFSv4.x: fix lock recovery during delegation recall brcmfmac: fix full timeout waiting for action frame on-channel tx mtd: physmap_of: Release resources on error USB: serial: cypress_m8: fix interrupt-out transfer length KVM: PPC: Book3S PR: Exiting split hack mode needs to fixup both PC and LR ALSA: hda/sigmatel - Disable automute for Elo VuPoint ata: ep93xx: Use proper enums for directions IB/mthca: Fix error return code in __mthca_init_one() ixgbe: Fix crash with VFs and flow director on interface flap mtd: rawnand: sh_flctl: Use proper enum for flctl_dma_fifo0_transfer powerpc/pseries: Fix how we iterate over the DTL entries powerpc/pseries: Fix DTL buffer registration cxgb4: Use proper enum in IEEE_FAUX_SYNC cxgb4: Use proper enum in cxgb4_dcb_handle_fw_update mei: samples: fix a signedness bug in amt_host_if_call() dmaengine: timb_dma: Use proper enum in td_prep_slave_sg dmaengine: ep93xx: Return proper enum in ep93xx_dma_chan_direction nl80211: Fix a GET_KEY reply attribute usb: gadget: udc: fotg210-udc: Fix a sleep-in-atomic-context bug in fotg210_get_status() ath9k: fix reporting calculated new FFT upper max ath10k: fix vdev-start timeout on error SUNRPC: Fix priority queue fairness f2fs: return correct errno in f2fs_gc net: ovs: fix return type of ndo_start_xmit function libata: have ata_scsi_rw_xlat() fail invalid passthrough requests block: introduce blk_rq_is_passthrough fbdev: Ditch fb_edid_add_monspecs fbdev: Remove unused SH-Mobile HDMI driver uprobes/x86: Prohibit probing on MOV SS instruction kprobes/x86: Prohibit probing on exception masking instructions apparmor: fix module parameters can be changed after policy is locked apparmor: fix update the mtime of the profile file on replacement apparmor: fix uninitialized lsm_audit member x86/atomic: Fix smp_mb__{before,after}_atomic() net: cdc_ncm: Signedness bug in cdc_ncm_set_dgram_size() slcan: Fix memory leak in error path memfd: Use radix_tree_deref_slot_protected to avoid the warning. Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in hci_uart_set_proto() Bluetooth: hci_ldisc: Fix null pointer derefence in case of early data fuse: use READ_ONCE on congestion_threshold and max_background arm64: dts: amd: Fix SPI bus warnings Bluetooth: L2CAP: Detect if remote is not able to use the whole MPS EDAC: Raise the maximum number of memory controllers net: smsc: fix return type of ndo_start_xmit function ARM: tegra: apalis_t30: fix mmc1 cmd pull-up ARM: dts: tegra30: fix xcvr-setup-use-fuses scsi: libsas: always unregister the old device if going to discover new vfio/pci: Fix potential memory leak in vfio_msi_cap_len misc: genwqe: should return proper error value. misc: kgdbts: Fix restrict error usb: gadget: uvc: Only halt video streaming endpoint in bulk mode usb: gadget: uvc: Factor out video USB request queueing usb: gadget: uvc: configfs: Prevent format changes after linking header usb: gadget: uvc: configfs: Drop leaked references to config items media: davinci: Fix implicit enum conversion warning media: pci: ivtv: Fix a sleep-in-atomic-context bug in ivtv_yuv_init() MIPS: kexec: Relax memory restriction x86/CPU: Use correct macros for Cyrix calls net: micrel: fix return type of ndo_start_xmit function bnx2x: Ignore bandwidth attention in single function mode cpufeature: avoid warning when compiling with clang ARM: dts: ste: Fix SPI controller node names ARM: dts: ux500: Fix LCDA clock line muxing ARM: dts: ux500: Correct SCU unit address ARM: dts: am335x-evm: fix number of cpsw usb: chipidea: Fix otg event handler net: amd: fix return type of ndo_start_xmit function net: broadcom: fix return type of ndo_start_xmit function net: xilinx: fix return type of ndo_start_xmit function net: toshiba: fix return type of ndo_start_xmit function power: supply: twl4030_charger: disable eoc interrupt on linear charge power: supply: twl4030_charger: fix charging current out-of-bounds libfdt: Ensure INT_MAX is defined in libfdt_env.h powerpc/pseries: Disable CPU hotplug across migrations powerpc/64s/hash: Fix stab_rr off by one initialization powerpc/iommu: Avoid derefence before pointer check serial: mxs-auart: Fix potential infinite loop PCI/ACPI: Correct error message for ASPM disabling s390/qeth: invoke softirqs after napi_schedule() kernfs: Fix range checks in kernfs_get_target_path power: supply: max8998-charger: Fix platform data retrieval power: supply: ab8500_fg: silence uninitialized variable warnings cxgb4: Fix endianness issue in t4_fwcache() pinctrl: at91: don't use the same irqchip with multiple gpiochips ARM: dts: socfpga: Fix I2C bus unit-address error powerpc/vdso: Correct call frame information llc: avoid blocking in llc_sap_close() pinctrl: at91-pio4: fix has_config check in atmel_pctl_dt_subnode_to_map() ALSA: intel8x0m: Register irq handler after register initializations media: fix: media: pci: meye: validate offset to avoid arbitrary access nvmem: core: return error code instead of NULL from nvmem_device_get kprobes: Don't call BUG_ON() if there is a kprobe in use on free list scsi: pm80xx: Fixed system hang issue during kexec boot scsi: pm80xx: Corrected dma_unmap_sg() parameter ARM: imx6: register pm_power_off handler if "fsl,pmic-stby-poweroff" is set scsi: sym53c8xx: fix NULL pointer dereference panic in sym_int_sir() signal: Properly deliver SIGSEGV from x86 uprobes signal: Properly deliver SIGILL from uprobes signal: Always ignore SIGKILL and SIGSTOP sent to the global init dmaengine: dma-jz4780: Further residue status fix ARM: dts: omap3-gta04: keep vpll2 always on ARM: dts: omap3-gta04: make NAND partitions compatible with recent U-Boot ARM: dts: omap3-gta04: tvout: enable as display1 alias ARM: dts: omap3-gta04: give spi_lcd node a label so that we can overwrite in other DTS files of: make PowerMac cache node search conditional on CONFIG_PPC_PMAC mips: txx9: fix iounmap related issue ath10k: wmi: disable softirq's while calling ieee80211_rx ASoC: sgtl5000: avoid division by zero if lo_vag is zero net: lan78xx: Bail out if lan78xx_get_endpoints fails rtl8187: Fix warning generated when strncpy() destination length matches the sixe argument ARM: dts: pxa: fix power i2c base address i40e: Prevent deleting MAC address from VF when set by PF i40e: hold the rtnl lock on clearing interrupt scheme i40e: use correct length for strncpy ARM: dts: exynos: Fix sound in Snow-rev5 Chromebook MIPS: BCM47XX: Enable USB power on Netgear WNDR3400v3 ASoC: dpcm: Properly initialise hw->rate_max gfs2: Don't set GFS2_RDF_UPTODATE when the lvb is updated ALSA: seq: Do error checks at creating system ports ARM: dts: at91/trivial: Fix USART1 definition for at91sam9g45 ALSA: pcm: signedness bug in snd_pcm_plug_alloc() iio: dac: mcp4922: fix error handling in mcp4922_write_raw mmc: sdhci-of-at91: fix quirk2 overwrite mm: hugetlb: switch to css_tryget() in hugetlb_cgroup_charge_cgroup() mm: memcg: switch to css_tryget() in get_mem_cgroup_from_mm() iommu/vt-d: Fix QI_DEV_IOTLB_PFSID and QI_DEV_EIOTLB_PFSID macros ecryptfs_lookup_interpose(): lower_dentry->d_parent is not stable either ecryptfs_lookup_interpose(): lower_dentry->d_inode is not stable Input: ff-memless - kill timer in destroy() ALSA: usb-audio: not submit urb for stopped endpoint ALSA: usb-audio: Fix missing error check at mixer resolution test ax88172a: fix information leak on short answers slip: Fix memory leak in slip_open error path Conflicts: include/linux/libfdt_env.h Change-Id: I9f83f275479e286f79b6744124c23cdbfff90114 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>