{"push_id":1435331120,"size":1,"distinct_size":1,"ref":"refs/heads/cm-14.1","head":"b4a89863d8079763b22ad445ac848a7939512432","before":"441021f2611eee2ab16c4cfd50a4d263c1f720b0","commits":[{"sha":"b4a89863d8079763b22ad445ac848a7939512432","author":{"name":"Kalpaj Chaudhari","email":"1cd0a970f1384fdfa9f069d7c82a13fa62507a9e@gmail.com"},"message":"MERGE: Linux 3.4.113\n\ncommit 1e4be01addfbc06c0d0b2e618d3c173f481855c8\nAuthor: Rahul Sharma <sharah@codeaurora.org>\nDate:   Mon Sep 26 17:56:17 2016 +0530\n\n    msm: mdp: wait for previous frame commit before unset\n\n    This change resolves the flicker on the display panel which is caused\n    because there is no wait for previous commit to finish before unsetting\n    the mdp pipe configuration.\n\n    Change-Id: I817c5273def19223d5648778dfc3d2138317aad8\n    Signed-off-by: Rahul Sharma <sharah@codeaurora.org>\n\ncommit 545bc22435f46db0d82e5c582cab6a3b05e03651\nAuthor: Rom Lemarchand <romlem@android.com>\nDate:   Fri Nov 7 12:48:17 2014 -0800\n\n    cgroup: refactor allow_attach function into common code\n\n    move cpu_cgroup_allow_attach to a common subsys_cgroup_allow_attach.\n    This allows any process with CAP_SYS_NICE to move tasks across cgroups if\n    they use this function as their allow_attach handler.\n\n    Signed-off-by: Rom Lemarchand <romlem@android.com>\n    Bug: 18260435\n    Change-Id: I6bb4933d07e889d0dc39e33b4e71320c34a2c90f\n\ncommit aab18d544a254646822794b7ec4e05704703e30a\nAuthor: Zefan Li <lizefan@huawei.com>\nDate:   Wed Oct 26 23:15:47 2016 +0800\n\n    Linux 3.4.113\n\ncommit 334fec223f1de9679de46a8ca0a0f40bb22106a7\nAuthor: Michal Hocko <mhocko@suse.com>\nDate:   Sun Oct 16 11:55:00 2016 +0200\n\n    mm, gup: close FOLL MAP_PRIVATE race\n\n    commit 19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619 upstream.\n\n    faultin_page drops FOLL_WRITE after the page fault handler did the CoW\n    and then we retry follow_page_mask to get our CoWed page. This is racy,\n    however because the page might have been unmapped by that time and so\n    we would have to do a page fault again, this time without CoW. This\n    would cause the page cache corruption for FOLL_FORCE on MAP_PRIVATE\n    read only mappings with obvious consequences.\n\n    This is an ancient bug that was actually already fixed once by Linus\n    eleven years ago in commit 4ceb5db9757a (\"Fix get_user_pages() race\n    for write access\") but that was then undone due to problems on s390\n    by commit f33ea7f404e5 (\"fix get_user_pages bug\") because s390 didn't\n    have proper dirty pte tracking until abf09bed3cce (\"s390/mm: implement\n    software dirty bits\"). This wasn't a problem at the time as pointed out\n    by Hugh Dickins because madvise relied on mmap_sem for write up until\n    0a27a14a6292 (\"mm: madvise avoid exclusive mmap_sem\") but since then we\n    can race with madvise which can unmap the fresh COWed page or with KSM\n    and corrupt the content of the shared page.\n\n    This patch is based on the Linus' approach to not clear FOLL_WRITE after\n    the CoW page fault (aka VM_FAULT_WRITE) but instead introduces FOLL_COW\n    to note this fact. The flag is then rechecked during follow_pfn_pte to\n    enforce the page fault again if we do not see the CoWed page. Linus was\n    suggesting to check pte_dirty again as s390 is OK now. But that would\n    make backporting to some old kernels harder. So instead let's just make\n    sure that vm_normal_page sees a pure anonymous page.\n\n    This would guarantee we are seeing a real CoW page. Introduce\n    can_follow_write_pte which checks both pte_write and falls back to\n    PageAnon on forced write faults which passed CoW already. Thanks to Hugh\n    to point out that a special care has to be taken for KSM pages because\n    our COWed page might have been merged with a KSM one and keep its\n    PageAnon flag.\n\n    Fixes: 0a27a14a6292 (\"mm: madvise avoid exclusive mmap_sem\")\n    Change-Id: I78568059e38fdde73e40f8c2a76d4d11cec882a7\n    Reported-by: Phil \"not Paul\" Oester <kernel@linuxace.com>\n    Disclosed-by: Andy Lutomirski <luto@kernel.org>\n    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n    Signed-off-by: Michal Hocko <mhocko@suse.com>\n    [bwh: Backported to 3.2:\n     - Adjust filename, context, indentation\n     - The 'no_page' exit path in follow_page() is different, so open-code the\n       cleanup\n     - Delete a now-unused label]\n    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 4e5bd9d7f368fc4e00515c1868a46f40fec70bd2\nAuthor: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>\nDate:   Tue Nov 17 15:49:06 2015 +0100\n\n    net/core: revert \"net: fix __netdev_update_features return..\" and add comment\n\n    commit 17b85d29e82cc3c874a497a8bc5764d6a2b043e2 upstream.\n\n    This reverts commit 00ee59271777 (\"net: fix __netdev_update_features return\n    on ndo_set_features failure\")\n    and adds a comment explaining why it's okay to return a value other than\n    0 upon error. Some drivers might actually change flags and return an\n    error so it's better to fire a spurious notification rather than miss\n    these.\n\n    CC: Michał Mirosław <mirq-linux@rere.qmqm.pl>\n    Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 884613e0e803f3fbce90f8086526d5e83ff90246\nAuthor: Paul Bolle <pebolle@tiscali.nl>\nDate:   Thu Feb 18 21:29:08 2016 +0100\n\n    ser_gigaset: use container_of() instead of detour\n\n    commit 8d2c3ab4445640957d136caa3629857d63544a2a upstream.\n\n    The purpose of gigaset_device_release() is to kfree() the struct\n    ser_cardstate that contains our struct device. This is done via a bit of\n    a detour. First we make our struct device's driver_data point to the\n    container of our struct ser_cardstate (which is a struct cardstate). In\n    gigaset_device_release() we then retrieve that driver_data again. And\n    after that we finally kfree() the struct ser_cardstate that was saved in\n    the struct cardstate.\n\n    All of this can be achieved much easier by using container_of() to get\n    from our struct device to its container, struct ser_cardstate. Do so.\n\n    Note that at the time the detour was implemented commit b8b2c7d845d5\n    (\"base/platform: assert that dev_pm_domain callbacks are called\n    unconditionally\") had just entered the tree. That commit disconnected\n    our platform_device and our platform_driver. These were reconnected\n    again in v4.5-rc2 through commit 25cad69f21f5 (\"base/platform: Fix\n    platform drivers with no probe callback\"). And one of the consequences\n    of that fix was that it broke the detour via driver_data. That's because\n    it made __device_release_driver() stop being a NOP for our struct device\n    and actually do stuff again. One of the things it now does, is setting\n    our driver_data to NULL. That, in turn, makes it impossible for\n    gigaset_device_release() to get to our struct cardstate. Which has the\n    net effect of leaking a struct ser_cardstate at every call of this\n    driver's tty close() operation. So using container_of() has the\n    additional benefit of actually working.\n\n    Reported-by: Dmitry Vyukov <dvyukov@google.com>\n    Tested-by: Dmitry Vyukov <dvyukov@google.com>\n    Signed-off-by: Paul Bolle <pebolle@tiscali.nl>\n    Acked-by: Tilman Schmidt <tilman@imap.cc>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit bb6943ef49ad4efd6f402b02b2e43c8f37c87419\nAuthor: Tilman Schmidt <tilman@imap.cc>\nDate:   Tue Dec 15 18:11:31 2015 +0100\n\n    ser_gigaset: remove unnecessary kfree() calls from release method\n\n    commit 8aeb3c3d655e22d3aa5ba49f313157bd27354bb4 upstream.\n\n    device->platform_data and platform_device->resource are never used\n    and remain NULL through their entire life. Drops the kfree() calls\n    for them from the device release method.\n\n    Signed-off-by: Tilman Schmidt <tilman@imap.cc>\n    Signed-off-by: Paul Bolle <pebolle@tiscali.nl>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit e3f112e192d8fcac75df63beea8b911703c745c9\nAuthor: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\nDate:   Thu Feb 11 16:10:24 2016 -0500\n\n    xen/pciback: Save the number of MSI-X entries to be copied later.\n\n    commit d159457b84395927b5a52adb72f748dd089ad5e5 upstream.\n\n    Commit 8135cf8b092723dbfcc611fe6fdcb3a36c9951c5 (xen/pciback: Save\n    xen_pci_op commands before processing it) broke enabling MSI-X because\n    it would never copy the resulting vectors into the response.  The\n    number of vectors requested was being overwritten by the return value\n    (typically zero for success).\n\n    Save the number of vectors before processing the op, so the correct\n    number of vectors are copied afterwards.\n\n    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\n    Reviewed-by: Jan Beulich <jbeulich@suse.com>\n    Signed-off-by: David Vrabel <david.vrabel@citrix.com>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit aeee3e52862677ad48aac71ffff5961a9d6b863c\nAuthor: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>\nDate:   Fri Feb 5 15:36:30 2016 -0800\n\n    mm, vmstat: fix wrong WQ sleep when memory reclaim doesn't make any progress\n\n    commit 564e81a57f9788b1475127012e0fd44e9049e342 upstream.\n\n    Jan Stancek has reported that system occasionally hanging after \"oom01\"\n    testcase from LTP triggers OOM.  Guessing from a result that there is a\n    kworker thread doing memory allocation and the values between \"Node 0\n    Normal free:\" and \"Node 0 Normal:\" differs when hanging, vmstat is not\n    up-to-date for some reason.\n\n    According to commit 373ccbe59270 (\"mm, vmstat: allow WQ concurrency to\n    discover memory reclaim doesn't make any progress\"), it meant to force\n    the kworker thread to take a short sleep, but it by error used\n    schedule_timeout(1).  We missed that schedule_timeout() in state\n    TASK_RUNNING doesn't do anything.\n\n    Fix it by using schedule_timeout_uninterruptible(1) which forces the\n    kworker thread to take a short sleep in order to make sure that vmstat\n    is up-to-date.\n\n    Fixes: 373ccbe59270 (\"mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't make any progress\")\n    Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>\n    Reported-by: Jan Stancek <jstancek@redhat.com>\n    Acked-by: Michal Hocko <mhocko@suse.com>\n    Cc: Tejun Heo <tj@kernel.org>\n    Cc: Cristopher Lameter <clameter@sgi.com>\n    Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>\n    Cc: Arkadiusz Miskiewicz <arekm@maven.pl>\n    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>\n    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 611f475d33a5ef61a298fc515cbbf36c2393ee2d\nAuthor: John Stultz <john.stultz@linaro.org>\nDate:   Thu Jun 11 15:54:55 2015 -0700\n\n    time: Prevent early expiry of hrtimers[CLOCK_REALTIME] at the leap second edge\n\n    commit 833f32d763028c1bb371c64f457788b933773b3e upstream.\n\n    Currently, leapsecond adjustments are done at tick time. As a result,\n    the leapsecond was applied at the first timer tick *after* the\n    leapsecond (~1-10ms late depending on HZ), rather then exactly on the\n    second edge.\n\n    This was in part historical from back when we were always tick based,\n    but correcting this since has been avoided since it adds extra\n    conditional checks in the gettime fastpath, which has performance\n    overhead.\n\n    However, it was recently pointed out that ABS_TIME CLOCK_REALTIME\n    timers set for right after the leapsecond could fire a second early,\n    since some timers may be expired before we trigger the timekeeping\n    timer, which then applies the leapsecond.\n\n    This isn't quite as bad as it sounds, since behaviorally it is similar\n    to what is possible w/ ntpd made leapsecond adjustments done w/o using\n    the kernel discipline. Where due to latencies, timers may fire just\n    prior to the settimeofday call. (Also, one should note that all\n    applications using CLOCK_REALTIME timers should always be careful,\n    since they are prone to quirks from settimeofday() disturbances.)\n\n    However, the purpose of having the kernel do the leap adjustment is to\n    avoid such latencies, so I think this is worth fixing.\n\n    So in order to properly keep those timers from firing a second early,\n    this patch modifies the ntp and timekeeping logic so that we keep\n    enough state so that the update_base_offsets_now accessor, which\n    provides the hrtimer core the current time, can check and apply the\n    leapsecond adjustment on the second edge. This prevents the hrtimer\n    core from expiring timers too early.\n\n    This patch does not modify any other time read path, so no additional\n    overhead is incurred. However, this also means that the leap-second\n    continues to be applied at tick time for all other read-paths.\n\n    Apologies to Richard Cochran, who pushed for similar changes years\n    ago, which I resisted due to the concerns about the performance\n    overhead.\n\n    While I suspect this isn't extremely critical, folks who care about\n    strict leap-second correctness will likely want to watch\n    this. Potentially a -stable candidate eventually.\n\n    Originally-suggested-by: Richard Cochran <richardcochran@gmail.com>\n    Reported-by: Daniel Bristot de Oliveira <bristot@redhat.com>\n    Reported-by: Prarit Bhargava <prarit@redhat.com>\n    Signed-off-by: John Stultz <john.stultz@linaro.org>\n    Cc: Richard Cochran <richardcochran@gmail.com>\n    Cc: Jan Kara <jack@suse.cz>\n    Cc: Jiri Bohac <jbohac@suse.cz>\n    Cc: Shuah Khan <shuahkh@osg.samsung.com>\n    Cc: Ingo Molnar <mingo@kernel.org>\n    Link: http://lkml.kernel.org/r/1434063297-28657-4-git-send-email-john.stultz@linaro.org\n    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>\n    [Yadi: Move do_adjtimex to timekeeping.c and solve context issues]\n    Signed-off-by: Hu <yadi.hu@windriver.com>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 11664c57391e47595e2e0ef68ef01669e1df98d8\nAuthor: Eric Dumazet <edumazet@google.com>\nDate:   Sun Jul 10 10:04:02 2016 +0200\n\n    tcp: make challenge acks less predictable\n\n    commit 75ff39ccc1bd5d3c455b6822ab09e533c551f758 upstream.\n\n    Yue Cao claims that current host rate limiting of challenge ACKS\n    (RFC 5961) could leak enough information to allow a patient attacker\n    to hijack TCP sessions. He will soon provide details in an academic\n    paper.\n\n    This patch increases the default limit from 100 to 1000, and adds\n    some randomization so that the attacker can no longer hijack\n    sessions without spending a considerable amount of probes.\n\n    Based on initial analysis and patch from Linus.\n\n    Note that we also have per socket rate limiting, so it is tempting\n    to remove the host limit in the future.\n\n    v2: randomize the count of challenge acks per second, not the period.\n\n    Fixes: 282f23c6ee34 (\"tcp: implement RFC 5961 3.2\")\n    Reported-by: Yue Cao <ycao009@ucr.edu>\n    Signed-off-by: Eric Dumazet <edumazet@google.com>\n    Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>\n    Cc: Yuchung Cheng <ycheng@google.com>\n    Cc: Neal Cardwell <ncardwell@google.com>\n    Acked-by: Neal Cardwell <ncardwell@google.com>\n    Acked-by: Yuchung Cheng <ycheng@google.com>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n    [lizf: Backported to 3.4:\n     - adjust context\n     - use ACCESS_ONCE instead WRITE_ONCE/READ_ONCE\n     - open-code prandom_u32_max()]\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit d231f350bcf3b69ea1ebcad4a99d477576d462ba\nAuthor: Zefan Li <lizefan@huawei.com>\nDate:   Sun Oct 9 19:23:12 2016 +0800\n\n    Revert \"USB: Add OTG PET device to TPL\"\n\n    This reverts commit 97fa724b23c3dd22e9c0979ad0e9d260cc6d545d.\n\n    Conflicts:\n    \tdrivers/usb/core/quirks.c\n\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit d61c6883bc9a721b617bd5960398ee2cd21da135\nAuthor: Zefan Li <lizefan@huawei.com>\nDate:   Sun Oct 9 19:20:47 2016 +0800\n\n    Revert \"USB: Add device quirk for ASUS T100 Base Station keyboard\"\n\n    This reverts commit eea5a87d270e8d6925063019c3b0f3ff61fcb49a.\n\n    Conflicts:\n    \tdrivers/usb/core/quirks.c\n    \tinclude/linux/usb/quirks.h\n\n    Change-Id: I67a1edb1ececbcf2e24b1f65ae11777f9405a583\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 44183720b004bdba562a10962994f206eb044187\nAuthor: Zefan Li <lizefan@huawei.com>\nDate:   Sun Oct 9 19:06:49 2016 +0800\n\n    Fix incomplete backport of commit 0f792cf949a0\n\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 136cafe89325f37062b8a94bfb35f14c8bf98827\nAuthor: Zefan Li <lizefan@huawei.com>\nDate:   Sun Oct 9 19:00:59 2016 +0800\n\n    Fix incomplete backport of commit 423f04d63cf4\n\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit ff4fffaf34a5969744250ec1a9080e340bc42356\nAuthor: Nicolas Dichtel <nicolas.dichtel@6wind.com>\nDate:   Wed Sep 5 02:12:42 2012 +0000\n\n    ipv6: fix handling of blackhole and prohibit routes\n\n    commit ef2c7d7b59708d54213c7556a82d14de9a7e4475 upstream.\n\n    When adding a blackhole or a prohibit route, they were handling like classic\n    routes. Moreover, it was only possible to add this kind of routes by specifying\n    an interface.\n\n    Bug already reported here:\n      http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=498498\n\n    Before the patch:\n      $ ip route add blackhole 2001::1/128\n      RTNETLINK answers: No such device\n      $ ip route add blackhole 2001::1/128 dev eth0\n      $ ip -6 route | grep 2001\n      2001::1 dev eth0  metric 1024\n\n    After:\n      $ ip route add blackhole 2001::1/128\n      $ ip -6 route | grep 2001\n      blackhole 2001::1 dev lo  metric 1024  error -22\n\n    v2: wrong patch\n    v3: add a field fc_type in struct fib6_config to store RTN_* type\n\n    Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 234569aec591737ddf536e9123998b159f09d38d\nAuthor: Michal Kubeček <mkubecek@suse.cz>\nDate:   Mon Sep 9 21:45:04 2013 +0200\n\n    ipv6: don't call fib6_run_gc() until routing is ready\n\n    commit 2c861cc65ef4604011a0082e4dcdba2819aa191a upstream.\n\n    When loading the ipv6 module, ndisc_init() is called before\n    ip6_route_init(). As the former registers a handler calling\n    fib6_run_gc(), this opens a window to run the garbage collector\n    before necessary data structures are initialized. If a network\n    device is initialized in this window, adding MAC address to it\n    triggers a NETDEV_CHANGEADDR event, leading to a crash in\n    fib6_clean_all().\n\n    Take the event handler registration out of ndisc_init() into a\n    separate function ndisc_late_init() and move it after\n    ip6_route_init().\n\n    Signed-off-by: Michal Kubecek <mkubecek@suse.cz>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit d4002f1ab9034254377b04ac503c78d58580c133\nAuthor: Michal Kubeček <mkubecek@suse.cz>\nDate:   Thu Aug 1 10:04:24 2013 +0200\n\n    ipv6: update ip6_rt_last_gc every time GC is run\n\n    commit 49a18d86f66d33a20144ecb5a34bba0d1856b260 upstream.\n\n    As pointed out by Eric Dumazet, net->ipv6.ip6_rt_last_gc should\n    hold the last time garbage collector was run so that we should\n    update it whenever fib6_run_gc() calls fib6_clean_all(), not only\n    if we got there from ip6_dst_gc().\n\n    Signed-off-by: Michal Kubecek <mkubecek@suse.cz>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 6ed37b2676268d71ff40bf75ee970b64a4e05063\nAuthor: Karl Heiss <kheiss@gmail.com>\nDate:   Thu Sep 24 12:15:07 2015 -0400\n\n    sctp: Prevent soft lockup when sctp_accept() is called during a timeout event\n\n    commit 635682a14427d241bab7bbdeebb48a7d7b91638e upstream.\n\n    A case can occur when sctp_accept() is called by the user during\n    a heartbeat timeout event after the 4-way handshake.  Since\n    sctp_assoc_migrate() changes both assoc->base.sk and assoc->ep, the\n    bh_sock_lock in sctp_generate_heartbeat_event() will be taken with\n    the listening socket but released with the new association socket.\n    The result is a deadlock on any future attempts to take the listening\n    socket lock.\n\n    Note that this race can occur with other SCTP timeouts that take\n    the bh_lock_sock() in the event sctp_accept() is called.\n\n     BUG: soft lockup - CPU#9 stuck for 67s! [swapper:0]\n     ...\n     RIP: 0010:[<ffffffff8152d48e>]  [<ffffffff8152d48e>] _spin_lock+0x1e/0x30\n     RSP: 0018:ffff880028323b20  EFLAGS: 00000206\n     RAX: 0000000000000002 RBX: ffff880028323b20 RCX: 0000000000000000\n     RDX: 0000000000000000 RSI: ffff880028323be0 RDI: ffff8804632c4b48\n     RBP: ffffffff8100bb93 R08: 0000000000000000 R09: 0000000000000000\n     R10: ffff880610662280 R11: 0000000000000100 R12: ffff880028323aa0\n     R13: ffff8804383c3880 R14: ffff880028323a90 R15: ffffffff81534225\n     FS:  0000000000000000(0000) GS:ffff880028320000(0000) knlGS:0000000000000000\n     CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b\n     CR2: 00000000006df528 CR3: 0000000001a85000 CR4: 00000000000006e0\n     DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n     DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n     Process swapper (pid: 0, threadinfo ffff880616b70000, task ffff880616b6cab0)\n     Stack:\n     ffff880028323c40 ffffffffa01c2582 ffff880614cfb020 0000000000000000\n     <d> 0100000000000000 00000014383a6c44 ffff8804383c3880 ffff880614e93c00\n     <d> ffff880614e93c00 0000000000000000 ffff8804632c4b00 ffff8804383c38b8\n     Call Trace:\n     <IRQ>\n     [<ffffffffa01c2582>] ? sctp_rcv+0x492/0xa10 [sctp]\n     [<ffffffff8148c559>] ? nf_iterate+0x69/0xb0\n     [<ffffffff814974a0>] ? ip_local_deliver_finish+0x0/0x2d0\n     [<ffffffff8148c716>] ? nf_hook_slow+0x76/0x120\n     [<ffffffff814974a0>] ? ip_local_deliver_finish+0x0/0x2d0\n     [<ffffffff8149757d>] ? ip_local_deliver_finish+0xdd/0x2d0\n     [<ffffffff81497808>] ? ip_local_deliver+0x98/0xa0\n     [<ffffffff81496ccd>] ? ip_rcv_finish+0x12d/0x440\n     [<ffffffff81497255>] ? ip_rcv+0x275/0x350\n     [<ffffffff8145cfeb>] ? __netif_receive_skb+0x4ab/0x750\n     ...\n\n    With lockdep debugging:\n\n     =====================================\n     [ BUG: bad unlock balance detected! ]\n     -------------------------------------\n     CslRx/12087 is trying to release lock (slock-AF_INET) at:\n     [<ffffffffa01bcae0>] sctp_generate_timeout_event+0x40/0xe0 [sctp]\n     but there are no more locks to release!\n\n     other info that might help us debug this:\n     2 locks held by CslRx/12087:\n     #0:  (&asoc->timers[i]){+.-...}, at: [<ffffffff8108ce1f>] run_timer_softirq+0x16f/0x3e0\n     #1:  (slock-AF_INET){+.-...}, at: [<ffffffffa01bcac3>] sctp_generate_timeout_event+0x23/0xe0 [sctp]\n\n    Ensure the socket taken is also the same one that is released by\n    saving a copy of the socket before entering the timeout event\n    critical section.\n\n    Signed-off-by: Karl Heiss <kheiss@gmail.com>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n    [bwh: Backported to 3.2:\n     - Net namespaces are not used\n     - Keep using sctp_bh_{,un}lock_sock()\n     - Adjust context]\n    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 1170b3de634d823fb1c9ba6c44f466df4a819889\nAuthor: Dave Airlie <airlied@redhat.com>\nDate:   Thu Aug 20 10:13:55 2015 +1000\n\n    drm/radeon: fix hotplug race at startup\n\n    commit 7f98ca454ad373fc1b76be804fa7138ff68c1d27 upstream.\n\n    We apparantly get a hotplug irq before we've initialised\n    modesetting,\n\n    [drm] Loading R100 Microcode\n    BUG: unable to handle kernel NULL pointer dereference at   (null)\n    IP: [<c125f56f>] __mutex_lock_slowpath+0x23/0x91\n    *pde = 00000000\n    Oops: 0002 [#1]\n    Modules linked in: radeon(+) drm_kms_helper ttm drm i2c_algo_bit backlight pcspkr psmouse evdev sr_mod input_leds led_class cdrom sg parport_pc parport floppy intel_agp intel_gtt lpc_ich acpi_cpufreq processor button mfd_core agpgart uhci_hcd ehci_hcd rng_core snd_intel8x0 snd_ac97_codec ac97_bus snd_pcm usbcore usb_common i2c_i801 i2c_core snd_timer snd soundcore thermal_sys\n    CPU: 0 PID: 15 Comm: kworker/0:1 Not tainted 4.2.0-rc7-00015-gbf67402 #111\n    Hardware name: MicroLink                               /D850MV                         , BIOS MV85010A.86A.0067.P24.0304081124 04/08/2003\n    Workqueue: events radeon_hotplug_work_func [radeon]\n    task: f6ca5900 ti: f6d3e000 task.ti: f6d3e000\n    EIP: 0060:[<c125f56f>] EFLAGS: 00010282 CPU: 0\n    EIP is at __mutex_lock_slowpath+0x23/0x91\n    EAX: 00000000 EBX: f5e900fc ECX: 00000000 EDX: fffffffe\n    ESI: f6ca5900 EDI: f5e90100 EBP: f5e90000 ESP: f6d3ff0c\n     DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068\n    CR0: 8005003b CR2: 00000000 CR3: 36f61000 CR4: 000006d0\n    Stack:\n     f5e90100 00000000 c103c4c1 f6d2a5a0 f5e900fc f6df394c c125f162 f8b0faca\n     f6d2a5a0 c138ca00 f6df394c f7395600 c1034741 00d40000 00000000 f6d2a5a0\n     c138ca00 f6d2a5b8 c138ca10 c1034b58 00000001 f6d40000 f6ca5900 f6d0c940\n    Call Trace:\n     [<c103c4c1>] ? dequeue_task_fair+0xa4/0xb7\n     [<c125f162>] ? mutex_lock+0x9/0xa\n     [<f8b0faca>] ? radeon_hotplug_work_func+0x17/0x57 [radeon]\n     [<c1034741>] ? process_one_work+0xfc/0x194\n     [<c1034b58>] ? worker_thread+0x18d/0x218\n     [<c10349cb>] ? rescuer_thread+0x1d5/0x1d5\n     [<c103742a>] ? kthread+0x7b/0x80\n     [<c12601c0>] ? ret_from_kernel_thread+0x20/0x30\n     [<c10373af>] ? init_completion+0x18/0x18\n    Code: 42 08 e8 8e a6 dd ff c3 57 56 53 83 ec 0c 8b 35 48 f7 37 c1 8b 10 4a 74 1a 89 c3 8d 78 04 8b 40 08 89 63\n\n    Reported-and-Tested-by: Meelis Roos <mroos@linux.ee>\n    Signed-off-by: Dave Airlie <airlied@redhat.com>\n    Cc: Ben Hutchings <ben@decadent.org.uk>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 6a1d822b809105d4edb94ee9fd682742f24e5b14\nAuthor: Eric Dumazet <edumazet@google.com>\nDate:   Wed Dec 30 08:51:12 2015 -0500\n\n    udp: properly support MSG_PEEK with truncated buffers\n\n    commit 197c949e7798fbf28cfadc69d9ca0c2abbf93191 upstream.\n\n    Backport of this upstream commit into stable kernels :\n    89c22d8c3b27 (\"net: Fix skb csum races when peeking\")\n    exposed a bug in udp stack vs MSG_PEEK support, when user provides\n    a buffer smaller than skb payload.\n\n    In this case,\n    skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr),\n                                     msg->msg_iov);\n    returns -EFAULT.\n\n    This bug does not happen in upstream kernels since Al Viro did a great\n    job to replace this into :\n    skb_copy_and_csum_datagram_msg(skb, sizeof(struct udphdr), msg);\n    This variant is safe vs short buffers.\n\n    For the time being, instead reverting Herbert Xu patch and add back\n    skb->ip_summed invalid changes, simply store the result of\n    udp_lib_checksum_complete() so that we avoid computing the checksum a\n    second time, and avoid the problematic\n    skb_copy_and_csum_datagram_iovec() call.\n\n    This patch can be applied on recent kernels as it avoids a double\n    checksumming, then backported to stable kernels as a bug fix.\n\n    Signed-off-by: Eric Dumazet <edumazet@google.com>\n    Acked-by: Herbert Xu <herbert@gondor.apana.org.au>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n    [lizf: Backported to 3.4: adjust context]\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit e1a11cf9f3070d126377642b7842942ea04b102c\nAuthor: Herbert Xu <herbert@gondor.apana.org.au>\nDate:   Mon Jul 13 20:01:42 2015 +0800\n\n    net: Fix skb csum races when peeking\n\n    [ Upstream commit 89c22d8c3b278212eef6a8cc66b570bc840a6f5a ]\n\n    When we calculate the checksum on the recv path, we store the\n    result in the skb as an optimisation in case we need the checksum\n    again down the line.\n\n    This is in fact bogus for the MSG_PEEK case as this is done without\n    any locking.  So multiple threads can peek and then store the result\n    to the same skb, potentially resulting in bogus skb states.\n\n    This patch fixes this by only storing the result if the skb is not\n    shared.  This preserves the optimisations for the few cases where\n    it can be done safely due to locking or other reasons, e.g., SIOCINQ.\n\n    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>\n    Acked-by: Eric Dumazet <edumazet@google.com>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 6d13d0b827874aa0ccd64344be38cb25dcc49e33\nAuthor: Ben Hutchings <ben@decadent.org.uk>\nDate:   Wed Dec 23 13:25:54 2015 +0000\n\n    USB: ti_usb_3410_502: Fix ID table size\n\n    Commit 35a2fbc941ac (\"USB: serial: ti_usb_3410_5052: new device id for\n    Abbot strip port cable\") failed to update the size of the\n    ti_id_table_3410 array.  This doesn't need to be fixed upstream\n    following commit d7ece6515e12 (\"USB: ti_usb_3410_5052: remove\n    vendor/product module parameters\") but should be fixed in stable\n    branches older than 3.12.\n\n    Backports of commit c9d09dc7ad10 (\"USB: serial: ti_usb_3410_5052: add\n    Abbott strip port ID to combined table as well.\") similarly failed to\n    update the size of the ti_id_table_combined array.\n\n    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit b1f7dbabf13c14bc97b359b2bf83e14085501c17\nAuthor: Eric Dumazet <eric.dumazet@gmail.com>\nDate:   Wed May 1 05:24:03 2013 +0000\n\n    af_unix: fix a fatal race with bit fields\n\n    commit 60bc851ae59bfe99be6ee89d6bc50008c85ec75d upstream.\n\n    Using bit fields is dangerous on ppc64/sparc64, as the compiler [1]\n    uses 64bit instructions to manipulate them.\n    If the 64bit word includes any atomic_t or spinlock_t, we can lose\n    critical concurrent changes.\n\n    This is happening in af_unix, where unix_sk(sk)->gc_candidate/\n    gc_maybe_cycle/lock share the same 64bit word.\n\n    This leads to fatal deadlock, as one/several cpus spin forever\n    on a spinlock that will never be available again.\n\n    A safer way would be to use a long to store flags.\n    This way we are sure compiler/arch wont do bad things.\n\n    As we own unix_gc_lock spinlock when clearing or setting bits,\n    we can use the non atomic __set_bit()/__clear_bit().\n\n    recursion_level can share the same 64bit location with the spinlock,\n    as it is set only with this spinlock held.\n\n    [1] bug fixed in gcc-4.8.0 :\n    http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52080\n\n    Reported-by: Ambrose Feinstein <ambrose@google.com>\n    Signed-off-by: Eric Dumazet <edumazet@google.com>\n    Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>\n    Cc: Paul Mackerras <paulus@samba.org>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n    Cc: hejianet <hejianet@gmail.com>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit ebc0ffe141fa21341070cab45c6bd44a5a3b1fdf\nAuthor: Francesco Ruggeri <fruggeri@aristanetworks.com>\nDate:   Wed Jan 6 00:18:48 2016 -0800\n\n    net: possible use after free in dst_release\n\n    commit 07a5d38453599052aff0877b16bb9c1585f08609 upstream.\n\n    dst_release should not access dst->flags after decrementing\n    __refcnt to 0. The dst_entry may be in dst_busy_list and\n    dst_gc_task may dst_destroy it before dst_release gets a chance\n    to access dst->flags.\n\n    Fixes: d69bbf88c8d0 (\"net: fix a race in dst_release()\")\n    Fixes: 27b75c95f10d (\"net: avoid RCU for NOCACHE dst\")\n    Signed-off-by: Francesco Ruggeri <fruggeri@arista.com>\n    Acked-by: Eric Dumazet <edumazet@google.com>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n    [lizf: Backported to 3.4: adjust context]\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 2ed0b3cdb8daa602f88edda78ff43cc2b1c7cf96\nAuthor: Colin Ian King <colin.king@canonical.com>\nDate:   Wed Dec 30 23:06:41 2015 +0000\n\n    ftrace/scripts: Fix incorrect use of sprintf in recordmcount\n\n    commit 713a3e4de707fab49d5aa4bceb77db1058572a7b upstream.\n\n    Fix build warning:\n\n    scripts/recordmcount.c:589:4: warning: format not a string\n    literal and no format arguments [-Wformat-security]\n        sprintf(\"%s: failed\\n\", file);\n\n    Fixes: a50bd43935586 (\"ftrace/scripts: Have recordmcount copy the object file\")\n    Link: http://lkml.kernel.org/r/1451516801-16951-1-git-send-email-colin.king@canonical.com\n\n    Cc: Li Bin <huawei.libin@huawei.com>\n    Cc: Russell King <rmk+kernel@arm.linux.org.uk>\n    Cc: Will Deacon <will.deacon@arm.com>\n    Signed-off-by: Colin Ian King <colin.king@canonical.com>\n    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 0b3136fdde0b28ee319c36c99794476de533d413\nAuthor: Andrew Banman <abanman@sgi.com>\nDate:   Tue Dec 29 14:54:25 2015 -0800\n\n    mm/memory_hotplug.c: check for missing sections in test_pages_in_a_zone()\n\n    commit 5f0f2887f4de9508dcf438deab28f1de8070c271 upstream.\n\n    test_pages_in_a_zone() does not account for the possibility of missing\n    sections in the given pfn range.  pfn_valid_within always returns 1 when\n    CONFIG_HOLES_IN_ZONE is not set, allowing invalid pfns from missing\n    sections to pass the test, leading to a kernel oops.\n\n    Wrap an additional pfn loop with PAGES_PER_SECTION granularity to check\n    for missing sections before proceeding into the zone-check code.\n\n    This also prevents a crash from offlining memory devices with missing\n    sections.  Despite this, it may be a good idea to keep the related patch\n    '[PATCH 3/3] drivers: memory: prohibit offlining of memory blocks with\n    missing sections' because missing sections in a memory block may lead to\n    other problems not covered by the scope of this fix.\n\n    Signed-off-by: Andrew Banman <abanman@sgi.com>\n    Acked-by: Alex Thorlton <athorlton@sgi.com>\n    Cc: Russ Anderson <rja@sgi.com>\n    Cc: Alex Thorlton <athorlton@sgi.com>\n    Cc: Yinghai Lu <yinghai@kernel.org>\n    Cc: Greg KH <greg@kroah.com>\n    Cc: Seth Jennings <sjennings@variantweb.net>\n    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>\n    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 700bee0516432758be1cbd2de9c3155047237578\nAuthor: Joseph Qi <joseph.qi@huawei.com>\nDate:   Tue Dec 29 14:54:06 2015 -0800\n\n    ocfs2: fix BUG when calculate new backup super\n\n    commit 5c9ee4cbf2a945271f25b89b137f2c03bbc3be33 upstream.\n\n    When resizing, it firstly extends the last gd.  Once it should backup\n    super in the gd, it calculates new backup super and update the\n    corresponding value.\n\n    But it currently doesn't consider the situation that the backup super is\n    already done.  And in this case, it still sets the bit in gd bitmap and\n    then decrease from bg_free_bits_count, which leads to a corrupted gd and\n    trigger the BUG in ocfs2_block_group_set_bits:\n\n        BUG_ON(le16_to_cpu(bg->bg_free_bits_count) < num_bits);\n\n    So check whether the backup super is done and then do the updates.\n\n    Signed-off-by: Joseph Qi <joseph.qi@huawei.com>\n    Reviewed-by: Jiufei Xue <xuejiufei@huawei.com>\n    Reviewed-by: Yiwen Jiang <jiangyiwen@huawei.com>\n    Cc: Mark Fasheh <mfasheh@suse.de>\n    Cc: Joel Becker <jlbec@evilplan.org>\n    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>\n    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n    [lizf: Backported to 3.4: adjust context]\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit baa5e0fbae0ecde44b5cd3f37453cf28d33d4e4e\nAuthor: Andrey Ryabinin <aryabinin@virtuozzo.com>\nDate:   Mon Dec 21 12:54:45 2015 +0300\n\n    ipv6/addrlabel: fix ip6addrlbl_get()\n\n    commit e459dfeeb64008b2d23bdf600f03b3605dbb8152 upstream.\n\n    ip6addrlbl_get() has never worked. If ip6addrlbl_hold() succeeded,\n    ip6addrlbl_get() will exit with '-ESRCH'. If ip6addrlbl_hold() failed,\n    ip6addrlbl_get() will use about to be free ip6addrlbl_entry pointer.\n\n    Fix this by inverting ip6addrlbl_hold() check.\n\n    Fixes: 2a8cc6c89039 (\"[IPV6] ADDRCONF: Support RFC3484 configurable address selection policy table.\")\n    Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>\n    Reviewed-by: Cong Wang <cwang@twopensource.com>\n    Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 6c6e9cae1cdbe7de624048feb2e6f9eba1495b28\nAuthor: Helge Deller <deller@gmx.de>\nDate:   Mon Dec 21 10:03:30 2015 +0100\n\n    parisc: Fix syscall restarts\n\n    commit 71a71fb5374a23be36a91981b5614590b9e722c3 upstream.\n\n    On parisc syscalls which are interrupted by signals sometimes failed to\n    restart and instead returned -ENOSYS which in the worst case lead to\n    userspace crashes.\n    A similiar problem existed on MIPS and was fixed by commit e967ef02\n    (\"MIPS: Fix restart of indirect syscalls\").\n\n    On parisc the current syscall restart code assumes that all syscall\n    callers load the syscall number in the delay slot of the ble\n    instruction. That's how it is e.g. done in the unistd.h header file:\n    \tble 0x100(%sr2, %r0)\n    \tldi #syscall_nr, %r20\n    Because of that assumption the current code never restored %r20 before\n    returning to userspace.\n\n    This assumption is at least not true for code which uses the glibc\n    syscall() function, which instead uses this syntax:\n    \tble 0x100(%sr2, %r0)\n    \tcopy regX, %r20\n    where regX depend on how the compiler optimizes the code and register\n    usage.\n\n    This patch fixes this problem by adding code to analyze how the syscall\n    number is loaded in the delay branch and - if needed - copy the syscall\n    number to regX prior returning to userspace for the syscall restart.\n\n    Signed-off-by: Helge Deller <deller@gmx.de>\n    Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>\n    [lizf: Backported to 3.4: adjust context]\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 3de4fd3b096a650cf1d72c5241a1a04b344e287e\nAuthor: Alan Stern <stern@rowland.harvard.edu>\nDate:   Wed Dec 16 13:32:38 2015 -0500\n\n    USB: fix invalid memory access in hub_activate()\n\n    commit e50293ef9775c5f1cf3fcc093037dd6a8c5684ea upstream.\n\n    Commit 8520f38099cc (\"USB: change hub initialization sleeps to\n    delayed_work\") changed the hub_activate() routine to make part of it\n    run in a workqueue.  However, the commit failed to take a reference to\n    the usb_hub structure or to lock the hub interface while doing so.  As\n    a result, if a hub is plugged in and quickly unplugged before the work\n    routine can run, the routine will try to access memory that has been\n    deallocated.  Or, if the hub is unplugged while the routine is\n    running, the memory may be deallocated while it is in active use.\n\n    This patch fixes the problem by taking a reference to the usb_hub at\n    the start of hub_activate() and releasing it at the end (when the work\n    is finished), and by locking the hub interface while the work routine\n    is running.  It also adds a check at the start of the routine to see\n    if the hub has already been disconnected, in which nothing should be\n    done.\n\n    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>\n    Reported-by: Alexandru Cornea <alexandru.cornea@intel.com>\n    Tested-by: Alexandru Cornea <alexandru.cornea@intel.com>\n    Fixes: 8520f38099cc (\"USB: change hub initialization sleeps to delayed_work\")\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n    [lizf: Backported to 3.4: add forward declaration of hub_release()]\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 640a0776efafe53dda24a6e6e351e1da701f573f\nAuthor: Dan Carpenter <dan.carpenter@oracle.com>\nDate:   Wed Dec 16 14:06:37 2015 +0300\n\n    USB: ipaq.c: fix a timeout loop\n\n    commit abdc9a3b4bac97add99e1d77dc6d28623afe682b upstream.\n\n    The code expects the loop to end with \"retries\" set to zero but, because\n    it is a post-op, it will end set to -1.  I have fixed this by moving the\n    decrement inside the loop.\n\n    Fixes: 014aa2a3c32e ('USB: ipaq: minor ipaq_open() cleanup.')\n    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 31d6dec85706d3bff3901cb59f612a9601a7ceba\nAuthor: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\nDate:   Mon Nov 2 18:13:27 2015 -0500\n\n    xen/pciback: Don't allow MSI-X ops if PCI_COMMAND_MEMORY is not set.\n\n    commit 408fb0e5aa7fda0059db282ff58c3b2a4278baa0 upstream.\n\n    commit f598282f51 (\"PCI: Fix the NIU MSI-X problem in a better way\")\n    teaches us that dealing with MSI-X can be troublesome.\n\n    Further checks in the MSI-X architecture shows that if the\n    PCI_COMMAND_MEMORY bit is turned of in the PCI_COMMAND we\n    may not be able to access the BAR (since they are memory regions).\n\n    Since the MSI-X tables are located in there.. that can lead\n    to us causing PCIe errors. Inhibit us performing any\n    operation on the MSI-X unless the MEMORY bit is set.\n\n    Note that Xen hypervisor with:\n    \"x86/MSI-X: access MSI-X table only after having enabled MSI-X\"\n    will return:\n    xen_pciback: 0000:0a:00.1: error -6 enabling MSI-X for guest 3!\n\n    When the generic MSI code tries to setup the PIRQ without\n    MEMORY bit set. Which means with later versions of Xen\n    (4.6) this patch is not neccessary.\n\n    This is part of XSA-157\n\n    Reviewed-by: Jan Beulich <jbeulich@suse.com>\n    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit e44c460fad5403be212b770b64214bd0bacb37ba\nAuthor: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\nDate:   Wed Apr 1 10:49:47 2015 -0400\n\n    xen/pciback: For XEN_PCI_OP_disable_msi[|x] only disable if device has MSI(X) enabled.\n\n    commit 7cfb905b9638982862f0331b36ccaaca5d383b49 upstream.\n\n    Otherwise just continue on, returning the same values as\n    previously (return of 0, and op->result has the PIRQ value).\n\n    This does not change the behavior of XEN_PCI_OP_disable_msi[|x].\n\n    The pci_disable_msi or pci_disable_msix have the checks for\n    msi_enabled or msix_enabled so they will error out immediately.\n\n    However the guest can still call these operations and cause\n    us to disable the 'ack_intr'. That means the backend IRQ handler\n    for the legacy interrupt will not respond to interrupts anymore.\n\n    This will lead to (if the device is causing an interrupt storm)\n    for the Linux generic code to disable the interrupt line.\n\n    Naturally this will only happen if the device in question\n    is plugged in on the motherboard on shared level interrupt GSI.\n\n    This is part of XSA-157\n\n    Reviewed-by: David Vrabel <david.vrabel@citrix.com>\n    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit ed637b1e5f1e09a8c80dcb01bb713d00b51e6649\nAuthor: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\nDate:   Mon Nov 2 17:24:08 2015 -0500\n\n    xen/pciback: Do not install an IRQ handler for MSI interrupts.\n\n    commit a396f3a210c3a61e94d6b87ec05a75d0be2a60d0 upstream.\n\n    Otherwise an guest can subvert the generic MSI code to trigger\n    an BUG_ON condition during MSI interrupt freeing:\n\n     for (i = 0; i < entry->nvec_used; i++)\n            BUG_ON(irq_has_action(entry->irq + i));\n\n    Xen PCI backed installs an IRQ handler (request_irq) for\n    the dev->irq whenever the guest writes PCI_COMMAND_MEMORY\n    (or PCI_COMMAND_IO) to the PCI_COMMAND register. This is\n    done in case the device has legacy interrupts the GSI line\n    is shared by the backend devices.\n\n    To subvert the backend the guest needs to make the backend\n    to change the dev->irq from the GSI to the MSI interrupt line,\n    make the backend allocate an interrupt handler, and then command\n    the backend to free the MSI interrupt and hit the BUG_ON.\n\n    Since the backend only calls 'request_irq' when the guest\n    writes to the PCI_COMMAND register the guest needs to call\n    XEN_PCI_OP_enable_msi before any other operation. This will\n    cause the generic MSI code to setup an MSI entry and\n    populate dev->irq with the new PIRQ value.\n\n    Then the guest can write to PCI_COMMAND PCI_COMMAND_MEMORY\n    and cause the backend to setup an IRQ handler for dev->irq\n    (which instead of the GSI value has the MSI pirq). See\n    'xen_pcibk_control_isr'.\n\n    Then the guest disables the MSI: XEN_PCI_OP_disable_msi\n    which ends up triggering the BUG_ON condition in 'free_msi_irqs'\n    as there is an IRQ handler for the entry->irq (dev->irq).\n\n    Note that this cannot be done using MSI-X as the generic\n    code does not over-write dev->irq with the MSI-X PIRQ values.\n\n    The patch inhibits setting up the IRQ handler if MSI or\n    MSI-X (for symmetry reasons) code had been called successfully.\n\n    P.S.\n    Xen PCIBack when it sets up the device for the guest consumption\n    ends up writting 0 to the PCI_COMMAND (see xen_pcibk_reset_device).\n    XSA-120 addendum patch removed that - however when upstreaming said\n    addendum we found that it caused issues with qemu upstream. That\n    has now been fixed in qemu upstream.\n\n    This is part of XSA-157\n\n    Reviewed-by: David Vrabel <david.vrabel@citrix.com>\n    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit f78f7fdaaf20d385a688fdd653c8b953c2bbc545\nAuthor: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\nDate:   Mon Nov 2 18:07:44 2015 -0500\n\n    xen/pciback: Return error on XEN_PCI_OP_enable_msix when device has MSI or MSI-X enabled\n\n    commit 5e0ce1455c09dd61d029b8ad45d82e1ac0b6c4c9 upstream.\n\n    The guest sequence of:\n\n      a) XEN_PCI_OP_enable_msix\n      b) XEN_PCI_OP_enable_msix\n\n    results in hitting an NULL pointer due to using freed pointers.\n\n    The device passed in the guest MUST have MSI-X capability.\n\n    The a) constructs and SysFS representation of MSI and MSI groups.\n    The b) adds a second set of them but adding in to SysFS fails (duplicate entry).\n    'populate_msi_sysfs' frees the newly allocated msi_irq_groups (note that\n    in a) pdev->msi_irq_groups is still set) and also free's ALL of the\n    MSI-X entries of the device (the ones allocated in step a) and b)).\n\n    The unwind code: 'free_msi_irqs' deletes all the entries and tries to\n    delete the pdev->msi_irq_groups (which hasn't been set to NULL).\n    However the pointers in the SysFS are already freed and we hit an\n    NULL pointer further on when 'strlen' is attempted on a freed pointer.\n\n    The patch adds a simple check in the XEN_PCI_OP_enable_msix to guard\n    against that. The check for msi_enabled is not stricly neccessary.\n\n    This is part of XSA-157\n\n    Reviewed-by: David Vrabel <david.vrabel@citrix.com>\n    Reviewed-by: Jan Beulich <jbeulich@suse.com>\n    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 99dcef333d27b319c240b416e255e1d88e374c4f\nAuthor: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\nDate:   Fri Apr 3 11:08:22 2015 -0400\n\n    xen/pciback: Return error on XEN_PCI_OP_enable_msi when device has MSI or MSI-X enabled\n\n    commit 56441f3c8e5bd45aab10dd9f8c505dd4bec03b0d upstream.\n\n    The guest sequence of:\n\n     a) XEN_PCI_OP_enable_msi\n     b) XEN_PCI_OP_enable_msi\n     c) XEN_PCI_OP_disable_msi\n\n    results in hitting an BUG_ON condition in the msi.c code.\n\n    The MSI code uses an dev->msi_list to which it adds MSI entries.\n    Under the above conditions an BUG_ON() can be hit. The device\n    passed in the guest MUST have MSI capability.\n\n    The a) adds the entry to the dev->msi_list and sets msi_enabled.\n    The b) adds a second entry but adding in to SysFS fails (duplicate entry)\n    and deletes all of the entries from msi_list and returns (with msi_enabled\n    is still set).  c) pci_disable_msi passes the msi_enabled checks and hits:\n\n    BUG_ON(list_empty(dev_to_msi_list(&dev->dev)));\n\n    and blows up.\n\n    The patch adds a simple check in the XEN_PCI_OP_enable_msi to guard\n    against that. The check for msix_enabled is not stricly neccessary.\n\n    This is part of XSA-157.\n\n    Reviewed-by: David Vrabel <david.vrabel@citrix.com>\n    Reviewed-by: Jan Beulich <jbeulich@suse.com>\n    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit c554ac157125d7db9a24f6540b22e2eca4e8099d\nAuthor: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\nDate:   Mon Nov 16 12:40:48 2015 -0500\n\n    xen/pciback: Save xen_pci_op commands before processing it\n\n    commit 8135cf8b092723dbfcc611fe6fdcb3a36c9951c5 upstream.\n\n    Double fetch vulnerabilities that happen when a variable is\n    fetched twice from shared memory but a security check is only\n    performed the first time.\n\n    The xen_pcibk_do_op function performs a switch statements on the op->cmd\n    value which is stored in shared memory. Interestingly this can result\n    in a double fetch vulnerability depending on the performed compiler\n    optimization.\n\n    This patch fixes it by saving the xen_pci_op command before\n    processing it. We also use 'barrier' to make sure that the\n    compiler does not perform any optimization.\n\n    This is part of XSA155.\n\n    Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\n    Signed-off-by: Jan Beulich <JBeulich@suse.com>\n    Signed-off-by: David Vrabel <david.vrabel@citrix.com>\n    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit e364c55c0504a8669b96b158dbe4cf1d482350b7\nAuthor: Roger Pau Monné <roger.pau@citrix.com>\nDate:   Tue Nov 3 16:34:09 2015 +0000\n\n    xen-blkback: only read request operation from shared ring once\n\n    commit 1f13d75ccb806260079e0679d55d9253e370ec8a upstream.\n\n    A compiler may load a switch statement value multiple times, which could\n    be bad when the value is in memory shared with the frontend.\n\n    When converting a non-native request to a native one, ensure that\n    src->operation is only loaded once by using READ_ONCE().\n\n    This is part of XSA155.\n\n    Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>\n    Signed-off-by: David Vrabel <david.vrabel@citrix.com>\n    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\n    [lizf: Backported to 3.4:\n     - adjust context\n     - call ACCESS_ONCE instead of READ_ONCE]\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 231abbb6e9677fb298995b3020a68d8b86955b6b\nAuthor: David Vrabel <david.vrabel@citrix.com>\nDate:   Fri Oct 30 15:17:06 2015 +0000\n\n    xen-netback: use RING_COPY_REQUEST() throughout\n\n    commit 68a33bfd8403e4e22847165d149823a2e0e67c9c upstream.\n\n    Instead of open-coding memcpy()s and directly accessing Tx and Rx\n    requests, use the new RING_COPY_REQUEST() that ensures the local copy\n    is correct.\n\n    This is more than is strictly necessary for guest Rx requests since\n    only the id and gref fields are used and it is harmless if the\n    frontend modifies these.\n\n    This is part of XSA155.\n\n    Reviewed-by: Wei Liu <wei.liu2@citrix.com>\n    Signed-off-by: David Vrabel <david.vrabel@citrix.com>\n    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\n    [lizf: Backported to 3.4:\n     - adjust context\n     - s/queue/vif/g]\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 0451869ba42861adaf3f1230472386aa79a89eeb\nAuthor: David Vrabel <david.vrabel@citrix.com>\nDate:   Fri Oct 30 15:16:01 2015 +0000\n\n    xen-netback: don't use last request to determine minimum Tx credit\n\n    commit 0f589967a73f1f30ab4ac4dd9ce0bb399b4d6357 upstream.\n\n    The last from guest transmitted request gives no indication about the\n    minimum amount of credit that the guest might need to send a packet\n    since the last packet might have been a small one.\n\n    Instead allow for the worst case 128 KiB packet.\n\n    This is part of XSA155.\n\n    Reviewed-by: Wei Liu <wei.liu2@citrix.com>\n    Signed-off-by: David Vrabel <david.vrabel@citrix.com>\n    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\n    [lizf: Backported to 3.4: s/queue/vif/g]\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit aeac38e7127d94e1ddd23232f8ce975aa4586f39\nAuthor: David Vrabel <david.vrabel@citrix.com>\nDate:   Fri Oct 30 14:58:08 2015 +0000\n\n    xen: Add RING_COPY_REQUEST()\n\n    commit 454d5d882c7e412b840e3c99010fe81a9862f6fb upstream.\n\n    Using RING_GET_REQUEST() on a shared ring is easy to use incorrectly\n    (i.e., by not considering that the other end may alter the data in the\n    shared ring while it is being inspected).  Safe usage of a request\n    generally requires taking a local copy.\n\n    Provide a RING_COPY_REQUEST() macro to use instead of\n    RING_GET_REQUEST() and an open-coded memcpy().  This takes care of\n    ensuring that the copy is done correctly regardless of any possible\n    compiler optimizations.\n\n    Use a volatile source to prevent the compiler from reordering or\n    omitting the copy.\n\n    This is part of XSA155.\n\n    Signed-off-by: David Vrabel <david.vrabel@citrix.com>\n    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 79508351bd4b4f6f9b347f283b2619ade739ad88\nAuthor: Steven Rostedt (Red Hat) <rostedt@goodmis.org>\nDate:   Tue Dec 15 16:06:10 2015 -0500\n\n    ftrace/scripts: Have recordmcount copy the object file\n\n    commit a50bd43935586420fb75f4558369eb08566fac5e upstream.\n\n    Russell King found that he had weird side effects when compiling the kernel\n    with hard linked ccache. The reason was that recordmcount modified the\n    kernel in place via mmap, and when a file gets modified twice by\n    recordmcount, it will complain about it. To fix this issue, Russell wrote a\n    patch that checked if the file was hard linked more than once and would\n    unlink it if it was.\n\n    Linus Torvalds was not happy with the fact that recordmcount does this in\n    place modification. Instead of doing the unlink only if the file has two or\n    more hard links, it does the unlink all the time. In otherwords, it always\n    does a copy if it changed something. That is, it does the write out if a\n    change was made.\n\n    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 8328708f8465edf080c341066446f6c3d1042394\nAuthor: Russell King <rmk+kernel@arm.linux.org.uk>\nDate:   Fri Dec 11 12:09:03 2015 +0000\n\n    scripts: recordmcount: break hardlinks\n\n    commit dd39a26538e37f6c6131e829a4a510787e43c783 upstream.\n\n    recordmcount edits the file in-place, which can cause problems when\n    using ccache in hardlink mode.  Arrange for recordmcount to break a\n    hardlinked object.\n\n    Link: http://lkml.kernel.org/r/E1a7MVT-0000et-62@rmk-PC.arm.linux.org.uk\n\n    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>\n    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 33fb2aabaff2bc6127acf271b3f27cd1e7b59a2d\nAuthor: Johan Hovold <johan@kernel.org>\nDate:   Mon Dec 14 16:16:19 2015 +0100\n\n    spi: fix parent-device reference leak\n\n    commit 157f38f993919b648187ba341bfb05d0e91ad2f6 upstream.\n\n    Fix parent-device reference leak due to SPI-core taking an unnecessary\n    reference to the parent when allocating the master structure, a\n    reference that was never released.\n\n    Note that driver core takes its own reference to the parent when the\n    master device is registered.\n\n    Fixes: 49dce689ad4e (\"spi doesn't need class_device\")\n    Signed-off-by: Johan Hovold <johan@kernel.org>\n    Signed-off-by: Mark Brown <broonie@kernel.org>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 5e382555809a0116886bd453527a2536ce1f6337\nAuthor: Tilman Schmidt <tilman@imap.cc>\nDate:   Tue Dec 15 18:11:30 2015 +0100\n\n    ser_gigaset: fix deallocation of platform device structure\n\n    commit 4c5e354a974214dfb44cd23fa0429327693bc3ea upstream.\n\n    When shutting down the device, the struct ser_cardstate must not be\n    kfree()d immediately after the call to platform_device_unregister()\n    since the embedded struct platform_device is still in use.\n    Move the kfree() call to the release method instead.\n\n    Signed-off-by: Tilman Schmidt <tilman@imap.cc>\n    Fixes: 2869b23e4b95 (\"drivers/isdn/gigaset: new M101 driver (v2)\")\n    Reported-by: Sasha Levin <sasha.levin@oracle.com>\n    Signed-off-by: Paul Bolle <pebolle@tiscali.nl>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit fa07da78975d0ce62e8459c8f71ea2e32f6dc4de\nAuthor: Dan Carpenter <dan.carpenter@oracle.com>\nDate:   Tue Dec 15 13:07:52 2015 +0300\n\n    mISDN: fix a loop count\n\n    commit 40d24c4d8a7430aa4dfd7a665fa3faf3b05b673f upstream.\n\n    There are two issue here.\n    1)  cnt starts as maxloop + 1 so all these loops iterate one more time\n        than intended.\n    2)  At the end of the loop we test for \"if (maxloop && !cnt)\" but for\n        the first two loops, we end with cnt equal to -1.  Changing this to\n        a pre-op means we end with cnt set to 0.\n\n    Fixes: cae86d4a4e56 ('mISDN: Add driver for Infineon ISDN chipset family')\n    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 173bcf5050fe18f95f7a08ba9c9b6db19788e1c7\nAuthor: Anson Huang <Anson.Huang@freescale.com>\nDate:   Mon Dec 7 10:09:19 2015 +0100\n\n    ARM: 8471/1: need to save/restore arm register(r11) when it is corrupted\n\n    commit fa0708b320f6da4c1104fe56e01b7abf66fd16ad upstream.\n\n    In cpu_v7_do_suspend routine, r11 is used while it is NOT\n    saved/restored, different compiler may have different usage\n    of ARM general registers, so it may cause issues during\n    calling cpu_v7_do_suspend.\n\n    We meet kernel fault occurs when using GCC 4.8.3, r11 contains\n    valid value before calling into cpu_v7_do_suspend, but when returned\n    from this routine, r11 is corrupted and lead to kernel fault.\n    Doing save/restore for those corrupted registers is a must in\n    assemble code.\n\n    Signed-off-by: Anson Huang <Anson.Huang@freescale.com>\n    Reviewed-by: Nicolas Pitre <nico@linaro.org>\n    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>\n    [lizf: Backported to 3.4: adjust context]\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit c28e94143a7b8b8126808e2a070a949b67789eff\nAuthor: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>\nDate:   Sun Dec 13 21:27:04 2015 +0300\n\n    sh_eth: fix TX buffer byte-swapping\n\n    commit 3e2309937f1e5d538ff13da5fb8de41196927c61 upstream.\n\n    For the little-endian SH771x kernels the driver has to byte-swap the RX/TX\n    buffers,  however yet unset physcial address from the TX descriptor is used\n    to call sh_eth_soft_swap(). Use 'skb->data' instead...\n\n    Fixes: 31fcb99d9958 (\"net: sh_eth: remove __flush_purge_region\")\n    Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit ae741decd0d98a60db64cc0b3651036b3a7f3d33\nAuthor: Thomas Gleixner <tglx@linutronix.de>\nDate:   Sun Dec 13 18:12:30 2015 +0100\n\n    genirq: Prevent chip buslock deadlock\n\n    commit abc7e40c81d113ef4bacb556f0a77ca63ac81d85 upstream.\n\n    If a interrupt chip utilizes chip->buslock then free_irq() can\n    deadlock in the following way:\n\n    CPU0\t\t\t\tCPU1\n    \t\t\t\tinterrupt(X) (Shared or spurious)\n    free_irq(X)\t\t\tinterrupt_thread(X)\n    chip_bus_lock(X)\n    \t\t\t\t   irq_finalize_oneshot(X)\n    \t\t\t\t     chip_bus_lock(X)\n    synchronize_irq(X)\n\n    synchronize_irq() waits for the interrupt thread to complete,\n    i.e. forever.\n\n    Solution is simple: Drop chip_bus_lock() before calling\n    synchronize_irq() as we do with the irq_desc lock. There is nothing to\n    be protected after the point where irq_desc lock has been released.\n\n    This adds chip_bus_lock/unlock() to the remove_irq() code path, but\n    that's actually correct in the case where remove_irq() is called on\n    such an interrupt. The current users of remove_irq() are not affected\n    as none of those interrupts is on a chip which requires buslock.\n\n    Reported-by: Fredrik Markström <fredrik.markstrom@gmail.com>\n    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 5234953975ef6479464d9b37d38df7f1f55934e6\nAuthor: Peter Hurley <peter@hurleysoftware.com>\nDate:   Fri Nov 27 14:25:08 2015 -0500\n\n    tty: Fix GPF in flush_to_ldisc()\n\n    commit 9ce119f318ba1a07c29149301f1544b6c4bea52a upstream.\n\n    A line discipline which does not define a receive_buf() method can\n    can cause a GPF if data is ever received [1]. Oddly, this was known\n    to the author of n_tracesink in 2011, but never fixed.\n\n    [1] GPF report\n        BUG: unable to handle kernel NULL pointer dereference at           (null)\n        IP: [<          (null)>]           (null)\n        PGD 3752d067 PUD 37a7b067 PMD 0\n        Oops: 0010 [#1] SMP KASAN\n        Modules linked in:\n        CPU: 2 PID: 148 Comm: kworker/u10:2 Not tainted 4.4.0-rc2+ #51\n        Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\n        Workqueue: events_unbound flush_to_ldisc\n        task: ffff88006da94440 ti: ffff88006db60000 task.ti: ffff88006db60000\n        RIP: 0010:[<0000000000000000>]  [<          (null)>]           (null)\n        RSP: 0018:ffff88006db67b50  EFLAGS: 00010246\n        RAX: 0000000000000102 RBX: ffff88003ab32f88 RCX: 0000000000000102\n        RDX: 0000000000000000 RSI: ffff88003ab330a6 RDI: ffff88003aabd388\n        RBP: ffff88006db67c48 R08: ffff88003ab32f9c R09: ffff88003ab31fb0\n        R10: ffff88003ab32fa8 R11: 0000000000000000 R12: dffffc0000000000\n        R13: ffff88006db67c20 R14: ffffffff863df820 R15: ffff88003ab31fb8\n        FS:  0000000000000000(0000) GS:ffff88006dc00000(0000) knlGS:0000000000000000\n        CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n        CR2: 0000000000000000 CR3: 0000000037938000 CR4: 00000000000006e0\n        Stack:\n         ffffffff829f46f1 ffff88006da94bf8 ffff88006da94bf8 0000000000000000\n         ffff88003ab31fb0 ffff88003aabd438 ffff88003ab31ff8 ffff88006430fd90\n         ffff88003ab32f9c ffffed0007557a87 1ffff1000db6cf78 ffff88003ab32078\n        Call Trace:\n         [<ffffffff8127cf91>] process_one_work+0x8f1/0x17a0 kernel/workqueue.c:2030\n         [<ffffffff8127df14>] worker_thread+0xd4/0x1180 kernel/workqueue.c:2162\n         [<ffffffff8128faaf>] kthread+0x1cf/0x270 drivers/block/aoe/aoecmd.c:1302\n         [<ffffffff852a7c2f>] ret_from_fork+0x3f/0x70 arch/x86/entry/entry_64.S:468\n        Code:  Bad RIP value.\n        RIP  [<          (null)>]           (null)\n         RSP <ffff88006db67b50>\n        CR2: 0000000000000000\n        ---[ end trace a587f8947e54d6ea ]---\n\n    Reported-by: Dmitry Vyukov <dvyukov@google.com>\n    Signed-off-by: Peter Hurley <peter@hurleysoftware.com>\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n    [lizf: Backportd to 3.4: adjust context]\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 03b2da43e245191ff10b43c2b78c75e035fad5e9\nAuthor: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>\nDate:   Fri Dec 11 13:40:49 2015 -0800\n\n    mm: hugetlb: call huge_pte_alloc() only if ptep is null\n\n    commit 0d777df5d8953293be090d9ab5a355db893e8357 upstream.\n\n    Currently at the beginning of hugetlb_fault(), we call huge_pte_offset()\n    and check whether the obtained *ptep is a migration/hwpoison entry or\n    not.  And if not, then we get to call huge_pte_alloc().  This is racy\n    because the *ptep could turn into migration/hwpoison entry after the\n    huge_pte_offset() check.  This race results in BUG_ON in\n    huge_pte_alloc().\n\n    We don't have to call huge_pte_alloc() when the huge_pte_offset()\n    returns non-NULL, so let's fix this bug with moving the code into else\n    block.\n\n    Note that the *ptep could turn into a migration/hwpoison entry after\n    this block, but that's not a problem because we have another\n    !pte_present check later (we never go into hugetlb_no_page() in that\n    case.)\n\n    Fixes: 290408d4a250 (\"hugetlb: hugepage migration core\")\n    Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>\n    Acked-by: Hillf Danton <hillf.zj@alibaba-inc.com>\n    Acked-by: David Rientjes <rientjes@google.com>\n    Cc: Hugh Dickins <hughd@google.com>\n    Cc: Dave Hansen <dave.hansen@intel.com>\n    Cc: Mel Gorman <mgorman@suse.de>\n    Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>\n    Cc: Mike Kravetz <mike.kravetz@oracle.com>\n    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>\n    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n    [lizf: Backported to 3.4: adjust context]\n    Signed-off-by: Zefan Li <lizefan@huawei.com>\n\ncommit 7f9839373319aec06425712de04842017d749919\nAuthor: Michal Hocko <mhocko@suse.com>\nDate:   Fri Dec 11 13:40:32 2015 -0800\n\n    mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't make any progress\n\n    commit 373ccbe5927034b55bdc80b0f8b54d6e13fe8d12 upstream.\n\n    Tetsuo Handa has reported that the system might basically livelock in\n    OOM condition without triggering the OOM killer.\n\n    The issue is caused by internal dependency of the direct reclaim on\n    vmstat counter updates (via zone_reclaimable) which are performed from\n    the workqueue context.  If all the current workers get assigned to an\n    allocation request, though, they will be looping inside the allocator\n    trying to reclaim mem…","distinct":true,"url":"https://api.github.com/repos/daedroza/android_kernel_sony_apq8064/commits/b4a89863d8079763b22ad445ac848a7939512432"}]}
{"actor":{"display_login":"daedroza"}}