{"push_id":961410695,"size":301,"distinct_size":301,"ref":"refs/heads/master","head":"9ed4a4b0b80b54a2baddf8199aba346e9e957ef7","before":"20847d4b17707d047c7fadc53d451a7c91791bb0","commits":[{"sha":"d590faf9e8f8509a0a0aa79c38e87fcc6b913248","author":{"email":"3318dc5ce3e4fb7c28a0b841b6801c884e1d0896@metafoo.de","name":"Lars-Peter Clausen"},"message":"iio: adis_buffer: Fix out-of-bounds memory access\n\nThe SPI tx and rx buffers are both supposed to be scan_bytes amount of\nbytes large and a common allocation is used to allocate both buffers. This\nputs the beginning of the tx buffer scan_bytes bytes after the rx buffer.\nThe initialization of the tx buffer pointer is done adding scan_bytes to\nthe beginning of the rx buffer, but since the rx buffer is of type __be16\nthis will actually add two times as much and the tx buffer ends up pointing\nafter the allocated buffer.\n\nFix this by using scan_count, which is scan_bytes / 2, instead of\nscan_bytes when initializing the tx buffer pointer.\n\nFixes: aacff892cbd5 (\"staging:iio:adis: Preallocate transfer message\")\nSigned-off-by: Lars-Peter Clausen <lars@metafoo.de>\nCc: <Stable@vger.kernel.org>\nSigned-off-by: Jonathan Cameron <jic23@kernel.org>","distinct":true,"url":"https://api.github.com/repos/faux123/mainline-crack/commits/d590faf9e8f8509a0a0aa79c38e87fcc6b913248"},{"sha":"f744c423cacf8f9666d0390e5068813afff756e5","author":{"email":"4645f7897fd33786a2ee1264d590b3c400559d85@linuxfoundation.org","name":"Greg Kroah-Hartman"},"message":"Merge tag 'iio-fixes-for-4.4c' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus\n\nJonathan writes:\n\n3rd set of IIO fixes for the 4.4 cycle.\n\nOnly a single fix this time and for a bug that's been in the kernel\nsince around about the start of 2013 (so no rush!)\n\n* Out-of-bounds memory access in adis core (Analog Devices IMUs)","distinct":true,"url":"https://api.github.com/repos/faux123/mainline-crack/commits/f744c423cacf8f9666d0390e5068813afff756e5"},{"sha":"4b8c4eddfc941a38e5bc716a37e8c4292cefaa6d","author":{"email":"cef439e78636cdab99cd2923826c5065a0743e5b@strlen.de","name":"Florian Westphal"},"message":"netfilter: nft_byteorder: avoid unneeded le/be conversion steps\n\nDavid points out that we to three le/be conversions instead\nof just one.  Doesn't matter on x86_64 w. gcc, but other\narchitectures might be less lucky.\n\nSince it also simplifies code just follow his advice.\n\nFixes: c0f3275f5cb (\"nftables: byteorder: provide le/be 64 bit conversion helper\")\nSuggested-by: David Laight <David.Laight@aculab.com>\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":true,"url":"https://api.github.com/repos/faux123/mainline-crack/commits/4b8c4eddfc941a38e5bc716a37e8c4292cefaa6d"},{"sha":"f90d2d37fb933773c9945c5939ae87aea2343057","author":{"email":"cef439e78636cdab99cd2923826c5065a0743e5b@strlen.de","name":"Florian Westphal"},"message":"netfilter: ipset: allow a 0 netmask with hash_netiface type\n\nJozsef says:\n The correct behaviour is that if we have\n ipset create test1 hash:net,iface\n ipset add test1 0.0.0.0/0,eth0\n iptables -A INPUT -m set --match-set test1 src,src\n\n then the rule should match for any traffic coming in through eth0.\n\nThis removes the -EINVAL runtime test to make matching work\nin case packet arrived via the specified interface.\n\nBugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1297092\nSigned-off-by: Florian Westphal <fw@strlen.de>\nAcked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":true,"url":"https://api.github.com/repos/faux123/mainline-crack/commits/f90d2d37fb933773c9945c5939ae87aea2343057"},{"sha":"e9db45578706e216d9bb0fb5f459b137da54be63","author":{"email":"bff32994ff0f8d048f262a8388145a71b6071bfe@intel.com","name":"Johannes Berg"},"message":"mac80211: recalculate SW ROC only when needed\n\nThe current (new) code recalculates the new work timeout\nfor software remain-on-channel whenever any item started.\nIn two of the callers of ieee80211_handle_roc_started(),\nthis is completely pointless since they're for hardware\nand will skip the recalculation entirely; it's necessary\nonly in the case of having just added a new item to the\nlist, as in the last remaining case the recalculation had\njust been done.\n\nThis last case, however, is also problematic - if one of\nthe items on the list actually expires during the recalc\nthe list iteration outside becomes corrupted and crashes.\n\nFix this by moving the recalculation to the only place\nwhere it's required.\n\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>","distinct":true,"url":"https://api.github.com/repos/faux123/mainline-crack/commits/e9db45578706e216d9bb0fb5f459b137da54be63"},{"sha":"e6a8a3aaaac832f47092df93f46298251b136fc9","author":{"email":"bff32994ff0f8d048f262a8388145a71b6071bfe@intel.com","name":"Johannes Berg"},"message":"mac80211: fix remain-on-channel cancellation\n\nIlan's previous commit 1b894521e60c (\"mac80211: handle HW\nROC expired properly\") neglected to take into account that\nhw_begun was now always set in the software implementation\nas well as the offloaded case.\n\nFix hw_begun to only apply to the offloaded case to make\nthe check in Ilan's commit safe and correct.\n\nReported-by: Jouni Malinen <j@w1.fi>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>","distinct":true,"url":"https://api.github.com/repos/faux123/mainline-crack/commits/e6a8a3aaaac832f47092df93f46298251b136fc9"},{"sha":"94c4fd641e1bc438092f0214bb5ec77ea73b13cf","author":{"email":"5716cc40769303914dac486db0fc6ac4cba9419e@redhat.com","name":"Dave Young"},"message":"wireless: change cfg80211 regulatory domain info as debug messages\n\ncfg80211 module prints a lot of messages like below. Actually printing\nonce is acceptable but sometimes it will print again and again, it looks\nvery annoying. It is better to change these detail messages to debugging\nonly.\n\ncfg80211: World regulatory domain updated:\ncfg80211:  DFS Master region: unset\ncfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)\ncfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)\ncfg80211:   (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)\ncfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)\ncfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (N/A)\ncfg80211:   (5250000 KHz - 5330000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (0 s)\ncfg80211:   (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s)\ncfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)\ncfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A)\n\nThe changes in this patch is to replace pr_info with pr_debug in function\nprint_rd_rules and print_regdomain_info\n\nSigned-off-by: Dave Young <dyoung@redhat.com>\n[change some pr_err() statements to at least keep the alpha2]\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>","distinct":true,"url":"https://api.github.com/repos/faux123/mainline-crack/commits/94c4fd641e1bc438092f0214bb5ec77ea73b13cf"},{"sha":"c3826807bbb3de693208da4ecb9c9602de16c616","author":{"email":"bff32994ff0f8d048f262a8388145a71b6071bfe@intel.com","name":"Johannes Berg"},"message":"regulatory: fix world regulatory domain data\n\nThe rule definitions here aren't really valid, they would\nbe rejected if it came from userspace due to the bandwidth\nspecified being bigger than the rule's width.\n\nThis is fairly much inconsequential since the other rules\naround them do enable the bandwidth, but express that better\nusing the NL80211_RRF_AUTO_BW flag.\n\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>","distinct":true,"url":"https://api.github.com/repos/faux123/mainline-crack/commits/c3826807bbb3de693208da4ecb9c9602de16c616"},{"sha":"470f4d613b51806e15e055428234a04a99f076fc","author":{"email":"fdf5551f20996bc0613832b4b54eb06eecaffd38@wizery.com","name":"Eliad Peller"},"message":"mac80211: avoid ROC during hw restart\n\nDefer ROC requests during hw restart, as the driver\nmight not be fully configured in this stage (e.g.\nchannel contexts were not added yet)\n\nSigned-off-by: Eliad Peller <eliadx.peller@intel.com>\nSigned-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>","distinct":true,"url":"https://api.github.com/repos/faux123/mainline-crack/commits/470f4d613b51806e15e055428234a04a99f076fc"},{"sha":"b9f628fcc673ba582cc7a17c4fd9be01133e61bd","author":{"email":"fdf5551f20996bc0613832b4b54eb06eecaffd38@wizery.com","name":"Eliad Peller"},"message":"mac80211: clear local->sched_scan_req properly on reconfig\n\nOn reconfig, in case of sched_scan_req->n_scan_plans > 1,\nlocal->sched_scan_req was never cleared, although\ncfg80211_sched_scan_stopped_rtnl() was called, resulting\nin local->sched_scan_req holding a stale and preventing\nfurther scheduled scan requests.\n\nClear it explicitly in this case.\n\nFixes: 42a7e82c6792 (\"mac80211: Do not restart scheduled scan if multiple scan plans are set\")\nSigned-off-by: Eliad Peller <eliadx.peller@intel.com>\nSigned-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>","distinct":true,"url":"https://api.github.com/repos/faux123/mainline-crack/commits/b9f628fcc673ba582cc7a17c4fd9be01133e61bd"},{"sha":"354210f8046cc801d6001f10c5c32967932b09a2","author":{"email":"b1c1d8736f20db3fb6c1c66bb1455ed43909f0d8@bobcopeland.com","name":"Bob Copeland"},"message":"Revert \"mac80211_hwsim: support any address in userspace\"\n\nThis reverts commit cd37a90b2a417e5882414e19954eeed174aa4d29.\n\nDifferent userspace programs interpreted HWSIM_ATTR_ADDR_TRANSMITTER\nand HWSIM_ATTR_ADDR_RECEIVER differently: some expected it to\nbe an unchanging hardware address that is tied to the radio despite\nwhich address is configured on the interface, while others expected\nto be a copy of the address in the frame (the configured address).\nThe intent of the original authors is unclear.\n\nThe latter interpretation doesn't really work properly with multiple\nvifs and broadcast frames.  Also, as the TA is already in the\nframe, userspace programs can actually support configured addresses\nin the former interpretation by mapping between them and the supplied\nHWSIM_ATTR_ADDR_TRANSMITTER.\n\nSo, in the interest of API stability, revert to the previous mode\nof operation and going forward use the former interpretation.\n\nSigned-off-by: Bob Copeland <me@bobcopeland.com>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>","distinct":true,"url":"https://api.github.com/repos/faux123/mainline-crack/commits/354210f8046cc801d6001f10c5c32967932b09a2"},{"sha":"1a57081add2529fb4d8d11e7385990e7e550d30b","author":{"email":"643a80aaf16a8332d6a70921c14d4bb265446494@intel.com","name":"Emmanuel Grumbach"},"message":"mac80211: fix PS-Poll handling\n\nMy commit below broken PS-Poll handling. In case the driver\nhas no frames buffered, driver_release_tids will be 0, but\ncalling find_highest_prio_tid() with 0 as a parameter is\nnot a good idea:\nfls(0) - 1 = -1.\nThis bug caused mac80211 to think that frames were buffered\nin the driver which in turn was confused because mac80211\nwas asking to release frames that were not reported to\nexist.\nOn iwlwifi, this led to the WARNING below:\n\nWARNING: CPU: 0 PID: 11230 at drivers/net/wireless/intel/iwlwifi/mvm/sta.c:1733 iwl_mvm_sta_modify_sleep_tx_count+0x2af/0x320 [iwlmvm]()\nffffffffc0627c60 ffff8800069b7648 ffffffff81888913 0000000000000000\n0000000000000000 ffff8800069b7688 ffffffff81089d6a ffff8800069b7678\n0000000000000001 ffff88003b35abf0 ffff88000698b128 ffff8800069b76d4\nCall Trace:\n[<ffffffff81888913>] dump_stack+0x4c/0x65\n[<ffffffff81089d6a>] warn_slowpath_common+0x8a/0xc0\n[<ffffffff81089e5a>] warn_slowpath_null+0x1a/0x20\n[<ffffffffc05f36bf>] iwl_mvm_sta_modify_sleep_tx_count+0x2af/0x320 [iwlmvm]\n[<ffffffffc05dae41>] iwl_mvm_mac_release_buffered_frames+0x31/0x40 [iwlmvm]\n[<ffffffffc045d8b6>] ieee80211_sta_ps_deliver_response+0x6e6/0xd80 [mac80211]\n[<ffffffffc0461296>] ieee80211_sta_ps_deliver_poll_response+0x26/0x30 [mac80211]\n[<ffffffffc048f743>] ieee80211_rx_handlers+0xa83/0x2900 [mac80211]\n[<ffffffffc04917ad>] ieee80211_prepare_and_rx_handle+0x1ed/0xa70 [mac80211]\n[<ffffffffc045e3d5>] ? sta_info_get_bss+0x5/0x4a0 [mac80211]\n[<ffffffffc04925b6>] ieee80211_rx_napi+0x586/0xcd0 [mac80211]\n[<ffffffffc05eaa3e>] iwl_mvm_rx_rx_mpdu+0x59e/0xc60 [iwlmvm]\n\nFixes: 0ead2510f8ce (\"mac80211: allow the driver to send EOSP when needed\")\nSigned-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>","distinct":true,"url":"https://api.github.com/repos/faux123/mainline-crack/commits/1a57081add2529fb4d8d11e7385990e7e550d30b"},{"sha":"2bc533bd9dcf48eaf4af6fb89a338734a9e8f76e","author":{"email":"fdf5551f20996bc0613832b4b54eb06eecaffd38@wizery.com","name":"Eliad Peller"},"message":"mac80211: handle sched_scan_stopped vs. hw restart race\n\nOn hw restart, mac80211 might try to reconfigure already\nstopped sched scan, if ieee80211_sched_scan_stopped_work()\nwasn't scheduled yet.\n\nThis in turn will keep the device driver with scheduled scan\nconfigured, while both mac80211 and cfg80211 will clear\ntheir sched scan state once the work is scheduled.\n\nFix it by ignoring ieee80211_sched_scan_stopped() calls\nwhile in hw restart, and flush the work before starting\nthe reconfiguration.\n\nSigned-off-by: Eliad Peller <eliadx.peller@intel.com>\nSigned-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>","distinct":true,"url":"https://api.github.com/repos/faux123/mainline-crack/commits/2bc533bd9dcf48eaf4af6fb89a338734a9e8f76e"},{"sha":"da629cf111a2b9a182d1b43f03f2cb0d3f258af4","author":{"email":"b93afca131f86f2653331097f5dcdcaaa5682625@googlemail.com","name":"Helmut Schaa"},"message":"mac80211: Don't buffer non-bufferable MMPDUs\n\nNon-bufferable MMPDUs are sent out to STAs even while in PS mode\n(for example probe responses). Applying filtered frame handling for\nthese doesn't seem to make much sense and will only create more\nair utilization when the STA wakes up. Hence, apply filtered frame\nhandling only for bufferable MMPDUs.\n\nDiscovered while testing an old VOIP phone that started probing\nfor APs while in PS mode. The mac80211/ath9k AP where the STA is\nassociated would reply with a probe response but the phone sometimes\nmoved to a new channel already and couldn't ack the probe response\nanymore. In that case mac80211 applied filtered frame handling\nfor the un-acked probe response.\n\nSigned-off-by: Helmut Schaa <helmut.schaa@googlemail.com>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>","distinct":true,"url":"https://api.github.com/repos/faux123/mainline-crack/commits/da629cf111a2b9a182d1b43f03f2cb0d3f258af4"},{"sha":"efaea94aaf0decd55b15aa7068d4d516a352e56e","author":{"email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","name":"Pablo Neira Ayuso"},"message":"netfilter: nft_ct: keep counters away from CONFIG_NF_CONNTRACK_LABELS\n\nThis is accidental, they don't depend on the label infrastructure.\n\nFixes: 48f66c905a97 (\"netfilter: nft_ct: add byte/packet counter support\")\nReported-by: Arnd Bergmann <arnd@arndb.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nAcked-by: Florian Westphal <fw@strlen.de>","distinct":true,"url":"https://api.github.com/repos/faux123/mainline-crack/commits/efaea94aaf0decd55b15aa7068d4d516a352e56e"},{"sha":"570540d50710ed192e98e2f7f74578c9486b6b05","author":{"email":"00e4cf8f46a57000a44449bf9dd8cbbcc209fd2a@linutronix.de","name":"Thomas Gleixner"},"message":"genirq: Validate action before dereferencing it in handle_irq_event_percpu()\n\ncommit 71f64340fc0e changed the handling of irq_desc->action from\n\nCPU 0                   CPU 1\nfree_irq()              lock(desc)\n  lock(desc)            handle_edge_irq()\n                        if (desc->action) {\n                          handle_irq_event()\n                            action = desc->action\n                            unlock(desc)\n  desc->action = NULL       handle_irq_event_percpu(desc, action)\n                              action->xxx\nto\n\nCPU 0                   CPU 1\nfree_irq()              lock(desc)\n  lock(desc)            handle_edge_irq()\n                        if (desc->action) {\n                          handle_irq_event()\n                            unlock(desc)\n  desc->action = NULL       handle_irq_event_percpu(desc, action)\n                              action = desc->action\n                              action->xxx\n\nSo if free_irq manages to set the action to NULL between the unlock and before\nthe readout, we happily dereference a null pointer.\n\nWe could simply revert 71f64340fc0e, but we want to preserve the better code\ngeneration. A simple solution is to change the action loop from a do {} while\nto a while {} loop.\n\nThis is safe because we either see a valid desc->action or NULL. If the action\nis about to be removed it is still valid as free_irq() is blocked on\nsynchronize_irq().\n\nCPU 0                   CPU 1\nfree_irq()              lock(desc)\n  lock(desc)            handle_edge_irq()\n                          handle_irq_event(desc)\n                            set(INPROGRESS)\n                            unlock(desc)\n                            handle_irq_event_percpu(desc)\n                            action = desc->action\n  desc->action = NULL           while (action) {\n                                  action->xxx\n                                  ...\n                                  action = action->next;\n  sychronize_irq()\n    while(INPROGRESS);      lock(desc)\n                            clr(INPROGRESS)\nfree(action)\n\nThat's basically the same mechanism as we have for shared\ninterrupts. action->next can become NULL while handle_irq_event_percpu()\nruns. Either it sees the action or NULL. It does not matter, because action\nitself cannot go away before the interrupt in progress flag has been cleared.\n\nFixes: commit 71f64340fc0e \"genirq: Remove the second parameter from handle_irq_event_percpu()\"\nReported-by: zyjzyj2000@gmail.com\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: Huang Shijie <shijie.huang@arm.com>\nCc: Jiang Liu <jiang.liu@linux.intel.com>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: stable@vger.kernel.org\nLink: http://lkml.kernel.org/r/alpine.DEB.2.11.1601131224190.3575@nanos","distinct":true,"url":"https://api.github.com/repos/faux123/mainline-crack/commits/570540d50710ed192e98e2f7f74578c9486b6b05"},{"sha":"f02b4b72d12cbae7020a959e2ed0410a464b4cc4","author":{"email":"a7228e626ecf0022ac91fc1cd8db88e71d0e5e0e@free-electrons.com","name":"Alexandre Belloni"},"message":"clockevents/tcb_clksrc: Prevent disabling an already disabled clock\n\nclockevents_exchange_device is calling clockevents_shutdown() on the new\nclockenvents device but it may have never been enabled in the first place.\nThis results in the tcb clock being disabled without being enabled first:\n\n------------[ cut here ]------------\nWARNING: CPU: 0 PID: 1 at drivers/clk/clk.c:680 clk_disable+0x28/0x34()\nModules linked in:\nCPU: 0 PID: 1 Comm: swapper Not tainted 4.4.0+ #6\nHardware name: Atmel AT91SAM9\n[<c000f2b8>] (unwind_backtrace) from [<c000d01c>] (show_stack+0x10/0x14)\n[<c000d01c>] (show_stack) from [<c00172f0>] (warn_slowpath_common+0x78/0xa0)\n[<c00172f0>] (warn_slowpath_common) from [<c00173a8>] (warn_slowpath_null+0x18/0x20)\n[<c00173a8>] (warn_slowpath_null) from [<c0361528>] (clk_disable+0x28/0x34)\n[<c0361528>] (clk_disable) from [<c034d560>] (tc_shutdown+0x38/0x4c)\n[<c034d560>] (tc_shutdown) from [<c0059ad4>] (clockevents_switch_state+0x38/0x6c)\n[<c0059ad4>] (clockevents_switch_state) from [<c0059b18>] (clockevents_shutdown+0x10/0x24)\n[<c0059b18>] (clockevents_shutdown) from [<c005a458>] (tick_check_new_device+0x84/0xac)\n[<c005a458>] (tick_check_new_device) from [<c0059660>] (clockevents_register_device+0x7c/0x108)\n[<c0059660>] (clockevents_register_device) from [<c06b5a68>] (tcb_clksrc_init+0x390/0x3e8)\n[<c06b5a68>] (tcb_clksrc_init) from [<c00097cc>] (do_one_initcall+0x114/0x1d4)\n[<c00097cc>] (do_one_initcall) from [<c069bd54>] (kernel_init_freeable+0xfc/0x1b8)\n[<c069bd54>] (kernel_init_freeable) from [<c04c3818>] (kernel_init+0x8/0xe0)\n[<c04c3818>] (kernel_init) from [<c000a410>] (ret_from_fork+0x14/0x24)\n---[ end trace 0000000000000001 ]---\n\nCheck what state we were in before trying to disable the clock.\n\nFixes: cf4541c101ea (\"clockevents/drivers/tcb_clksrc: Migrate to new 'set-state' interface\")\nSigned-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>\nCc: Nicolas Ferre <nicolas.ferre@atmel.com>\nCc: Boris Brezillon <boris.brezillon@free-electrons.com>\nCc: linux-arm-kernel@lists.infradead.org\nCc: Daniel Lezcano <daniel.lezcano@linaro.org>\nCc: stable@vger.kernel.org\nLink: http://lkml.kernel.org/r/1452854061-30370-1-git-send-email-alexandre.belloni@free-electrons.com\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>","distinct":true,"url":"https://api.github.com/repos/faux123/mainline-crack/commits/f02b4b72d12cbae7020a959e2ed0410a464b4cc4"},{"sha":"e23b257c293ce4bcc8cabb2aa3097b6ed8a8261a","author":{"email":"00e4cf8f46a57000a44449bf9dd8cbbcc209fd2a@linutronix.de","name":"Thomas Gleixner"},"message":"x86/irq: Call chip->irq_set_affinity in proper context\n\nsetup_ioapic_dest() calls irqchip->irq_set_affinity() completely\nunprotected. That's wrong in several aspects:\n\n - it opens a race window where irq_set_affinity() can be interrupted and the\n   irq chip left in unconsistent state.\n\n - it triggers a lockdep splat when we fix the vector race for 4.3+ because\n   vector lock is taken with interrupts enabled.\n\nThe proper calling convention is irq descriptor lock held and interrupts\ndisabled.\n\nReported-and-tested-by: Borislav Petkov <bp@alien8.de>\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: Jiang Liu <jiang.liu@linux.intel.com>\nCc: Jeremiah Mahler <jmmahler@gmail.com>\nCc: andy.shevchenko@gmail.com\nCc: Guenter Roeck <linux@roeck-us.net>\nCc: Joe Lawrence <joe.lawrence@stratus.com>\nCc: stable@vger.kernel.org\nLink: http://lkml.kernel.org/r/alpine.DEB.2.11.1601140919420.3575@nanos\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>","distinct":true,"url":"https://api.github.com/repos/faux123/mainline-crack/commits/e23b257c293ce4bcc8cabb2aa3097b6ed8a8261a"},{"sha":"111abeba67e0dbdc26537429de9155e4f1d807d8","author":{"email":"68ee766e574f18b34b683085865827393efe88bd@linux.intel.com","name":"Jiang Liu"},"message":"x86/irq: Fix a race in x86_vector_free_irqs()\n\nThere's a race condition between\n\nx86_vector_free_irqs()\n{\n\tfree_apic_chip_data(irq_data->chip_data);\n\txxxxx\t//irq_data->chip_data has been freed, but the pointer\n\t\t//hasn't been reset yet\n\tirq_domain_reset_irq_data(irq_data);\n}\n\nand \n\nsmp_irq_move_cleanup_interrupt()\n{\n\traw_spin_lock(&vector_lock);\n\tdata = apic_chip_data(irq_desc_get_irq_data(desc));\n\taccess data->xxxx\t// may access freed memory\n\traw_spin_unlock(&desc->lock);\n}\n\nwhich may cause smp_irq_move_cleanup_interrupt() to access freed memory.\n\nCall irq_domain_reset_irq_data(), which clears the pointer with vector lock\nheld.\n\n[ tglx: Free memory outside of lock held region. ]\n\nSigned-off-by: Jiang Liu <jiang.liu@linux.intel.com>\nTested-by: Borislav Petkov <bp@alien8.de>\nTested-by: Joe Lawrence <joe.lawrence@stratus.com>\nCc: Jeremiah Mahler <jmmahler@gmail.com>\nCc: andy.shevchenko@gmail.com\nCc: Guenter Roeck <linux@roeck-us.net>\nCc: stable@vger.kernel.org #4.3+\nLink: http://lkml.kernel.org/r/1450880014-11741-3-git-send-email-jiang.liu@linux.intel.com\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>","distinct":true,"url":"https://api.github.com/repos/faux123/mainline-crack/commits/111abeba67e0dbdc26537429de9155e4f1d807d8"},{"sha":"36f34c8c63da3e272fd66f91089228c22d2b6e8b","author":{"email":"00e4cf8f46a57000a44449bf9dd8cbbcc209fd2a@linutronix.de","name":"Thomas Gleixner"},"message":"x86/irq: Validate that irq descriptor is still active\n\nIn fixup_irqs() we unconditionally dereference the irq chip of an irq\ndescriptor. The descriptor might still be valid, but already cleaned up,\ni.e. the chip removed. Add a check for this condition.\n\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: Jiang Liu <jiang.liu@linux.intel.com>\nCc: Joe Lawrence <joe.lawrence@stratus.com>\nCc: Jeremiah Mahler <jmmahler@gmail.com>\nCc: Borislav Petkov <bp@alien8.de>\nCc: andy.shevchenko@gmail.com\nCc: Guenter Roeck <linux@roeck-us.net>\nCc: stable@vger.kernel.org #4.3+\nLink: http://lkml.kernel.org/r/20151231160106.236423282@linutronix.de\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>","distinct":true,"url":"https://api.github.com/repos/faux123/mainline-crack/commits/36f34c8c63da3e272fd66f91089228c22d2b6e8b"}]}