{"push_id":1354734476,"size":93,"distinct_size":93,"ref":"refs/heads/linux-4.1.y","head":"91473db3a3257eacead8f4d84cf4bc96c447193f","before":"04cb720142764ebf3786eba1feb8fc4b6ef87fcf","commits":[{"sha":"3b23ff99ca496c17d3b1250d6652e2c5e4ed2e1f","author":{"name":"James Hogan","email":"00935fde11ed589f6e5a2cfc70182e355d2baa37@imgtec.com"},"message":"MIPS: KVM: Check for pfn noslot case\n\ncommit ba913e4f72fc9cfd03dad968dfb110eb49211d80 upstream.\n\nWhen mapping a page into the guest we error check using is_error_pfn(),\nhowever this doesn't detect a value of KVM_PFN_NOSLOT, indicating an\nerror HVA for the page. This can only happen on MIPS right now due to\nunusual memslot management (e.g. being moved / removed / resized), or\nwith an Enhanced Virtual Memory (EVA) configuration where the default\nKVM_HVA_ERR_* and kvm_is_error_hva() definitions are unsuitable (fixed\nin a later patch). This case will be treated as a pfn of zero, mapping\nthe first page of physical memory into the guest.\n\nIt would appear the MIPS KVM port wasn't updated prior to being merged\n(in v3.10) to take commit 81c52c56e2b4 (\"KVM: do not treat noslot pfn as\na error pfn\") into account (merged v3.8), which converted a bunch of\nis_error_pfn() calls to is_error_noslot_pfn(). Switch to using\nis_error_noslot_pfn() instead to catch this case properly.\n\nFixes: 858dd5d45733 (\"KVM/MIPS32: MMU/TLB operations for the Guest.\")\nSigned-off-by: James Hogan <james.hogan@imgtec.com>\nCc: Paolo Bonzini <pbonzini@redhat.com>\nCc: \"Radim Krčmář\" <rkrcmar@redhat.com>\nCc: Ralf Baechle <ralf@linux-mips.org>\nCc: linux-mips@linux-mips.org\nCc: kvm@vger.kernel.org\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\n[james.hogan@imgtec.com: Backport to v4.7.y]\nSigned-off-by: James Hogan <james.hogan@imgtec.com>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":true,"url":"https://api.github.com/repos/lfd/PreemptRT/commits/3b23ff99ca496c17d3b1250d6652e2c5e4ed2e1f"},{"sha":"bd2d7040028a60926e5185d0c1b9e4766a4efa89","author":{"name":"Sebastian Reichel","email":"5c640c7a90bed91e410c56f3d809209f98dfc235@kernel.org"},"message":"ARM: OMAP3: hwmod data: Add sysc information for DSI\n\n[ Upstream commit b46211d6dcfb81a8af66b8684a42d629183670d4 ]\n\nAdd missing sysconfig/sysstatus information\nto OMAP3 hwmod. The information has been\nchecked against OMAP34xx and OMAP36xx TRM.\n\nWithout this change DSI block is not reset\nduring boot, which is required for working\nNokia N950 display.\n\nSigned-off-by: Sebastian Reichel <sre@kernel.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Tony Lindgren <tony@atomide.com>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":true,"url":"https://api.github.com/repos/lfd/PreemptRT/commits/bd2d7040028a60926e5185d0c1b9e4766a4efa89"},{"sha":"cfad3a5a90466ae83e437f988cf74561e0d8b063","author":{"name":"Johannes Berg","email":"9a5936d824e6835dfe162c5611d10d2cf40ffbad@intel.com"},"message":"Revert \"wext: Fix 32 bit iwpriv compatibility issue with 64 bit Kernel\"\n\n[ Upstream commit 4d0bd46a4d55383f7b925e6cf7865a77e0f0e020 ]\n\nThis reverts commit 3d5fdff46c4b2b9534fa2f9fc78e90a48e0ff724.\n\nBen Hutchings pointed out that the commit isn't safe since it assumes\nthat the structure used by the driver is iw_point, when in fact there's\nno way to know about that.\n\nFortunately, the only driver in the tree that ever runs this code path\nis the wilc1000 staging driver, so it doesn't really matter.\n\nClearly I should have investigated this better before applying, sorry.\n\nReported-by: Ben Hutchings <ben@decadent.org.uk>\nCc: stable@vger.kernel.org [though I guess it doesn't matter much]\nFixes: 3d5fdff46c4b (\"wext: Fix 32 bit iwpriv compatibility issue with 64 bit Kernel\")\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":true,"url":"https://api.github.com/repos/lfd/PreemptRT/commits/cfad3a5a90466ae83e437f988cf74561e0d8b063"},{"sha":"0dd4c68f4a9d5629fdb3e966a25bb52461c0970e","author":{"name":"Tyrel Datwyler","email":"239574f6f50677ab121db12378c1c57839ade2b5@linux.vnet.ibm.com"},"message":"scsi: fix upper bounds check of sense key in scsi_sense_key_string()\n\n[ Upstream commit a87eeb900dbb9f8202f96604d56e47e67c936b9d ]\n\nCommit 655ee63cf371 (\"scsi constants: command, sense key + additional\nsense string\") added a \"Completed\" sense string with key 0xF to\nsnstext[], but failed to updated the upper bounds check of the sense key\nin scsi_sense_key_string().\n\nFixes: 655ee63cf371 (\"[SCSI] scsi constants: command, sense key + additional sense strings\")\nCc: <stable@vger.kernel.org> # v3.12+\nSigned-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>\nReviewed-by: Bart Van Assche <bart.vanassche@sandisk.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":true,"url":"https://api.github.com/repos/lfd/PreemptRT/commits/0dd4c68f4a9d5629fdb3e966a25bb52461c0970e"},{"sha":"b9d45ce394727a6fff3eb02c525d8bca031a3f89","author":{"name":"Pawel Moll","email":"f92b9b268e2fb5bbfc93956f24913c92252c43f4@arm.com"},"message":"bus: arm-ccn: Do not attempt to configure XPs for cycle counter\n\n[ Upstream commit b7c1beb278e8e3dc664ed3df3fc786db126120a9 ]\n\nFuzzing the CCN perf driver revealed a small but definitely dangerous\nmistake in the event setup code. When a cycle counter is requested, the\ndriver should not reconfigure the events bus at all, otherwise it will\ncorrupt (in most but the simplest cases) its configuration and may end\nup accessing XP array out of its bounds and corrupting control\nregisters.\n\nReported-by: Mark Rutland <mark.rutland@arm.com>\nReviewed-by: Mark Rutland <mark.rutland@arm.com>\nTested-by: Mark Rutland <mark.rutland@arm.com>\nCc: stable@vger.kernel.org # 3.17+\nSigned-off-by: Pawel Moll <pawel.moll@arm.com>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":true,"url":"https://api.github.com/repos/lfd/PreemptRT/commits/b9d45ce394727a6fff3eb02c525d8bca031a3f89"},{"sha":"c3e7a0e520e62317fbc567838e562ecea16901cb","author":{"name":"Pawel Moll","email":"f92b9b268e2fb5bbfc93956f24913c92252c43f4@arm.com"},"message":"bus: arm-ccn: Fix XP watchpoint settings bitmask\n\n[ Upstream commit b928466b2169e061822daad48ecf55b005445547 ]\n\nThe code setting XP watchpoint comparator and mask registers should, in\norder to be fully compliant with specification, zero one or more most\nsignificant bits of each field. In both L cases it means zeroing bit 63.\nThe bitmask doing this was wrong, though, zeroing bit 60 instead.\nFortunately, due to a lucky coincidence, this turned out to be fairly\ninnocent with the existing hardware.\n\nFixed now.\n\nCc: stable@vger.kernel.org # 3.17+\nSigned-off-by: Pawel Moll <pawel.moll@arm.com>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":true,"url":"https://api.github.com/repos/lfd/PreemptRT/commits/c3e7a0e520e62317fbc567838e562ecea16901cb"},{"sha":"bb5c68e0d5a1057b46e454992269c13e043d375e","author":{"name":"Felix Fietkau","email":"8cf1b58efcecbc12846b1b7b0c62f2bc67216d26@nbd.name"},"message":"ath9k: fix using sta->drv_priv before initializing it\n\n[ Upstream commit 7711aaf08ad3fc4d0e937eec1de0a63620444ce7 ]\n\nA station pointer can be passed to the driver on tx, before it has been\nmarked as associated. Since ath9k_sta_state was initializing the entry\ntoo late, it resulted in some spurious crashes.\n\nFixes: df3c6eb34da5 (\"ath9k: Use sta_state() callback\")\nCc: stable@vger.kernel.org\nSigned-off-by: Felix Fietkau <nbd@nbd.name>\nSigned-off-by: Kalle Valo <kvalo@qca.qualcomm.com>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":true,"url":"https://api.github.com/repos/lfd/PreemptRT/commits/bb5c68e0d5a1057b46e454992269c13e043d375e"},{"sha":"7933dd87a84947d45a98fd2f88ad4c4097ba1855","author":{"name":"Miklos Szeredi","email":"c27ee2952768e22f4d3ab9aec0e78ac5f4ddea98@redhat.com"},"message":"fuse: direct-io: don't dirty ITER_BVEC pages\n\n[ Upstream commit 8fba54aebbdf1f999738121922e74bf796ad60ee ]\n\nWhen reading from a loop device backed by a fuse file it deadlocks on\nlock_page().\n\nThis is because the page is already locked by the read() operation done on\nthe loop device.  In this case we don't want to either lock the page or\ndirty it.\n\nSo do what fs/direct-io.c does: only dirty the page for ITER_IOVEC vectors.\n\nReported-by: Sheng Yang <sheng@yasker.org>\nFixes: aa4d86163e4e (\"block: loop: switch to VFS ITER_BVEC\")\nSigned-off-by: Miklos Szeredi <mszeredi@redhat.com>\nCc: <stable@vger.kernel.org> # v4.1+\nReviewed-by: Sheng Yang <sheng@yasker.org>\nReviewed-by: Ashish Samant <ashish.samant@oracle.com>\nTested-by: Sheng Yang <sheng@yasker.org>\nTested-by: Ashish Samant <ashish.samant@oracle.com>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":true,"url":"https://api.github.com/repos/lfd/PreemptRT/commits/7933dd87a84947d45a98fd2f88ad4c4097ba1855"},{"sha":"8773752e97e1b7887dc0c714bf45f32fb5facbf7","author":{"name":"Simon Baatz","email":"782f0210c357cdd3b831b75c91702528503e3029@gmail.com"},"message":"ARM: kirkwood: ib62x0: fix size of u-boot environment partition\n\n[ Upstream commit a778937888867aac17a33887d1c429120790fbc2 ]\n\nCommit 148c274ea644 (\"ARM: kirkwood: ib62x0: add u-boot environment\npartition\") split the \"u-boot\" partition into \"u-boot\" and \"u-boot\nenvironment\".  However, instead of the size of the environment, an offset\nwas given, resulting in overlapping partitions.\n\nSigned-off-by: Simon Baatz <gmbnomis@gmail.com>\nFixes: 148c274ea644 (\"ARM: kirkwood: ib62x0: add u-boot environment partition\")\nCc: Jason Cooper <jason@lakedaemon.net>\nCc: Andrew Lunn <andrew@lunn.ch>\nCc: Gregory Clement <gregory.clement@free-electrons.com>\nCc: Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>\nCc: Luka Perkov <luka@openwrt.org>\nCc: stable@vger.kernel.org # 3.13+\nReviewed-by: Andrew Lunn <andrew@lunn.ch>\nSigned-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":true,"url":"https://api.github.com/repos/lfd/PreemptRT/commits/8773752e97e1b7887dc0c714bf45f32fb5facbf7"},{"sha":"2350481bee62b2a8bbe1d0a974c933d5d08206c0","author":{"name":"Vegard Nossum","email":"9c44e0ed746b5c309b0bf31e4bae8fb5eb72beb1@oracle.com"},"message":"ALSA: timer: fix division by zero after SNDRV_TIMER_IOCTL_CONTINUE\n\n[ Upstream commit 6b760bb2c63a9e322c0e4a0b5daf335ad93d5a33 ]\n\nI got this:\n\n    divide error: 0000 [#1] PREEMPT SMP KASAN\n    CPU: 1 PID: 1327 Comm: a.out Not tainted 4.8.0-rc2+ #189\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014\n    task: ffff8801120a9580 task.stack: ffff8801120b0000\n    RIP: 0010:[<ffffffff82c8bd9a>]  [<ffffffff82c8bd9a>] snd_hrtimer_callback+0x1da/0x3f0\n    RSP: 0018:ffff88011aa87da8  EFLAGS: 00010006\n    RAX: 0000000000004f76 RBX: ffff880112655e88 RCX: 0000000000000000\n    RDX: 0000000000000000 RSI: ffff880112655ea0 RDI: 0000000000000001\n    RBP: ffff88011aa87e00 R08: ffff88013fff905c R09: ffff88013fff9048\n    R10: ffff88013fff9050 R11: 00000001050a7b8c R12: ffff880114778a00\n    R13: ffff880114778ab4 R14: ffff880114778b30 R15: 0000000000000000\n    FS:  00007f071647c700(0000) GS:ffff88011aa80000(0000) knlGS:0000000000000000\n    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n    CR2: 0000000000603001 CR3: 0000000112021000 CR4: 00000000000006e0\n    Stack:\n     0000000000000000 ffff880114778ab8 ffff880112655ea0 0000000000004f76\n     ffff880112655ec8 ffff880112655e80 ffff880112655e88 ffff88011aa98fc0\n     00000000b97ccf2b dffffc0000000000 ffff88011aa98fc0 ffff88011aa87ef0\n    Call Trace:\n     <IRQ>\n     [<ffffffff813abce7>] __hrtimer_run_queues+0x347/0xa00\n     [<ffffffff82c8bbc0>] ? snd_hrtimer_close+0x130/0x130\n     [<ffffffff813ab9a0>] ? retrigger_next_event+0x1b0/0x1b0\n     [<ffffffff813ae1a6>] ? hrtimer_interrupt+0x136/0x4b0\n     [<ffffffff813ae220>] hrtimer_interrupt+0x1b0/0x4b0\n     [<ffffffff8120f91e>] local_apic_timer_interrupt+0x6e/0xf0\n     [<ffffffff81227ad3>] ? kvm_guest_apic_eoi_write+0x13/0xc0\n     [<ffffffff83c35086>] smp_apic_timer_interrupt+0x76/0xa0\n     [<ffffffff83c3416c>] apic_timer_interrupt+0x8c/0xa0\n     <EOI>\n     [<ffffffff83c3239c>] ? _raw_spin_unlock_irqrestore+0x2c/0x60\n     [<ffffffff82c8185d>] snd_timer_start1+0xdd/0x670\n     [<ffffffff82c87015>] snd_timer_continue+0x45/0x80\n     [<ffffffff82c88100>] snd_timer_user_ioctl+0x1030/0x2830\n     [<ffffffff8159f3a0>] ? __follow_pte.isra.49+0x430/0x430\n     [<ffffffff82c870d0>] ? snd_timer_pause+0x80/0x80\n     [<ffffffff815a26fa>] ? do_wp_page+0x3aa/0x1c90\n     [<ffffffff815aa4f8>] ? handle_mm_fault+0xbc8/0x27f0\n     [<ffffffff815a9930>] ? __pmd_alloc+0x370/0x370\n     [<ffffffff82c870d0>] ? snd_timer_pause+0x80/0x80\n     [<ffffffff816b0733>] do_vfs_ioctl+0x193/0x1050\n     [<ffffffff816b05a0>] ? ioctl_preallocate+0x200/0x200\n     [<ffffffff81002f2f>] ? syscall_trace_enter+0x3cf/0xdb0\n     [<ffffffff815045ba>] ? __context_tracking_exit.part.4+0x9a/0x1e0\n     [<ffffffff81002b60>] ? exit_to_usermode_loop+0x190/0x190\n     [<ffffffff82001a97>] ? check_preemption_disabled+0x37/0x1e0\n     [<ffffffff81d93889>] ? security_file_ioctl+0x89/0xb0\n     [<ffffffff816b167f>] SyS_ioctl+0x8f/0xc0\n     [<ffffffff816b15f0>] ? do_vfs_ioctl+0x1050/0x1050\n     [<ffffffff81005524>] do_syscall_64+0x1c4/0x4e0\n     [<ffffffff83c32b2a>] entry_SYSCALL64_slow_path+0x25/0x25\n    Code: e8 fc 42 7b fe 8b 0d 06 8a 50 03 49 0f af cf 48 85 c9 0f 88 7c 01 00 00 48 89 4d a8 e8 e0 42 7b fe 48 8b 45 c0 48 8b 4d a8 48 99 <48> f7 f9 49 01 c7 e8 cb 42 7b fe 48 8b 55 d0 48 b8 00 00 00 00\n    RIP  [<ffffffff82c8bd9a>] snd_hrtimer_callback+0x1da/0x3f0\n     RSP <ffff88011aa87da8>\n    ---[ end trace 6aa380f756a21074 ]---\n\nThe problem happens when you call ioctl(SNDRV_TIMER_IOCTL_CONTINUE) on a\ncompletely new/unused timer -- it will have ->sticks == 0, which causes a\ndivide by 0 in snd_hrtimer_callback().\n\nSigned-off-by: Vegard Nossum <vegard.nossum@oracle.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":true,"url":"https://api.github.com/repos/lfd/PreemptRT/commits/2350481bee62b2a8bbe1d0a974c933d5d08206c0"},{"sha":"6138d59d0c734a390f456075a083f83d8a4eef77","author":{"name":"Vegard Nossum","email":"9c44e0ed746b5c309b0bf31e4bae8fb5eb72beb1@oracle.com"},"message":"ALSA: timer: fix NULL pointer dereference on memory allocation failure\n\n[ Upstream commit 8ddc05638ee42b18ba4fe99b5fb647fa3ad20456 ]\n\nI hit this with syzkaller:\n\n    kasan: CONFIG_KASAN_INLINE enabled\n    kasan: GPF could be caused by NULL-ptr deref or user memory access\n    general protection fault: 0000 [#1] PREEMPT SMP KASAN\n    CPU: 0 PID: 1327 Comm: a.out Not tainted 4.8.0-rc2+ #190\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014\n    task: ffff88011278d600 task.stack: ffff8801120c0000\n    RIP: 0010:[<ffffffff82c8ba07>]  [<ffffffff82c8ba07>] snd_hrtimer_start+0x77/0x100\n    RSP: 0018:ffff8801120c7a60  EFLAGS: 00010006\n    RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000007\n    RDX: 0000000000000009 RSI: 1ffff10023483091 RDI: 0000000000000048\n    RBP: ffff8801120c7a78 R08: ffff88011a5cf768 R09: ffff88011a5ba790\n    R10: 0000000000000002 R11: ffffed00234b9ef1 R12: ffff880114843980\n    R13: ffffffff84213c00 R14: ffff880114843ab0 R15: 0000000000000286\n    FS:  00007f72958f3700(0000) GS:ffff88011aa00000(0000) knlGS:0000000000000000\n    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n    CR2: 0000000000603001 CR3: 00000001126ab000 CR4: 00000000000006f0\n    Stack:\n     ffff880114843980 ffff880111eb2dc0 ffff880114843a34 ffff8801120c7ad0\n     ffffffff82c81ab1 0000000000000000 ffffffff842138e0 0000000100000000\n     ffff880111eb2dd0 ffff880111eb2dc0 0000000000000001 ffff880111eb2dc0\n    Call Trace:\n     [<ffffffff82c81ab1>] snd_timer_start1+0x331/0x670\n     [<ffffffff82c85bfd>] snd_timer_start+0x5d/0xa0\n     [<ffffffff82c8795e>] snd_timer_user_ioctl+0x88e/0x2830\n     [<ffffffff8159f3a0>] ? __follow_pte.isra.49+0x430/0x430\n     [<ffffffff82c870d0>] ? snd_timer_pause+0x80/0x80\n     [<ffffffff815a26fa>] ? do_wp_page+0x3aa/0x1c90\n     [<ffffffff8132762f>] ? put_prev_entity+0x108f/0x21a0\n     [<ffffffff82c870d0>] ? snd_timer_pause+0x80/0x80\n     [<ffffffff816b0733>] do_vfs_ioctl+0x193/0x1050\n     [<ffffffff813510af>] ? cpuacct_account_field+0x12f/0x1a0\n     [<ffffffff816b05a0>] ? ioctl_preallocate+0x200/0x200\n     [<ffffffff81002f2f>] ? syscall_trace_enter+0x3cf/0xdb0\n     [<ffffffff815045ba>] ? __context_tracking_exit.part.4+0x9a/0x1e0\n     [<ffffffff81002b60>] ? exit_to_usermode_loop+0x190/0x190\n     [<ffffffff82001a97>] ? check_preemption_disabled+0x37/0x1e0\n     [<ffffffff81d93889>] ? security_file_ioctl+0x89/0xb0\n     [<ffffffff816b167f>] SyS_ioctl+0x8f/0xc0\n     [<ffffffff816b15f0>] ? do_vfs_ioctl+0x1050/0x1050\n     [<ffffffff81005524>] do_syscall_64+0x1c4/0x4e0\n     [<ffffffff83c32b2a>] entry_SYSCALL64_slow_path+0x25/0x25\n    Code: c7 c7 c4 b9 c8 82 48 89 d9 4c 89 ee e8 63 88 7f fe e8 7e 46 7b fe 48 8d 7b 48 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 04 84 c0 7e 65 80 7b 48 00 74 0e e8 52 46\n    RIP  [<ffffffff82c8ba07>] snd_hrtimer_start+0x77/0x100\n     RSP <ffff8801120c7a60>\n    ---[ end trace 5955b08db7f2b029 ]---\n\nThis can happen if snd_hrtimer_open() fails to allocate memory and\nreturns an error, which is currently not checked by snd_timer_open():\n\n    ioctl(SNDRV_TIMER_IOCTL_SELECT)\n     - snd_timer_user_tselect()\n\t- snd_timer_close()\n\t   - snd_hrtimer_close()\n\t      - (struct snd_timer *) t->private_data = NULL\n        - snd_timer_open()\n           - snd_hrtimer_open()\n              - kzalloc() fails; t->private_data is still NULL\n\n    ioctl(SNDRV_TIMER_IOCTL_START)\n     - snd_timer_user_start()\n\t- snd_timer_start()\n\t   - snd_timer_start1()\n\t      - snd_hrtimer_start()\n\t\t- t->private_data == NULL // boom\n\nSigned-off-by: Vegard Nossum <vegard.nossum@oracle.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":true,"url":"https://api.github.com/repos/lfd/PreemptRT/commits/6138d59d0c734a390f456075a083f83d8a4eef77"},{"sha":"7b7cc6996fefe5f84250b26f5a713161f4545a5e","author":{"name":"Ken Lin","email":"6210ca49aa7597016c32c42a46763a794379bb1b@advantech.com.tw"},"message":"ALSA: usb-audio: Add sample rate inquiry quirk for B850V3 CP2114\n\n[ Upstream commit 83d9956b7e6b310c1062df7894257251c625b22e ]\n\nAvoid getting sample rate on B850V3 CP2114 as it is unsupported and\ncauses noisy \"current rate is different from the runtime rate\" messages\nwhen playback starts.\n\nSigned-off-by: Ken Lin <ken.lin@advantech.com.tw>\nSigned-off-by: Akshay Bhat <akshay.bhat@timesys.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":true,"url":"https://api.github.com/repos/lfd/PreemptRT/commits/7b7cc6996fefe5f84250b26f5a713161f4545a5e"},{"sha":"6558ce65ea89058a9b472ab994154931988efcae","author":{"name":"Kai-Heng Feng","email":"49d050d7a2ceecc3a608b6160348d55167459976@canonical.com"},"message":"ALSA: hda - Enable subwoofer on Dell Inspiron 7559\n\n[ Upstream commit fd06c77eb9200b53d421da5fffe0dcd894b5d72a ]\n\nThe subwoofer on Inspiron 7559 was disabled originally.\nApplying a pin fixup to node 0x1b can enable it and make it work.\n\nOld pin: 0x411111f0\nNew pin: 0x90170151\n\nSigned-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":true,"url":"https://api.github.com/repos/lfd/PreemptRT/commits/6558ce65ea89058a9b472ab994154931988efcae"},{"sha":"82ae68a84f2ce4de5bbcff7976bbfa46096862b5","author":{"name":"Anson Huang","email":"179ef82d441ac04a1b4453aaebdb3906d832770d@nxp.com"},"message":"ARM: imx6: add missing BM_CLPCR_BYPASS_PMIC_READY setting for imx6sx\n\n[ Upstream commit 8aade778f787305fdbfd3c1d54e6b583601b5902 ]\n\ni.MX6SX has bypass PMIC ready function, as this function\nis normally NOT enabled on the board design, so we need\nto bypass the PMIC ready pin check during DSM mode resume\nflow, otherwise, the internal DSM resume logic will be\nwaiting for this signal to be ready forever and cause\nresume fail.\n\nSigned-off-by: Anson Huang <Anson.Huang@nxp.com>\nFixes: ff843d621bfc (\"ARM: imx: add suspend support for i.mx6sx\")\nCc: <stable@vger.kernel.org>\nTested-by: Peter Chen <peter.chen@nxp.com>\nSigned-off-by: Shawn Guo <shawnguo@kernel.org>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":true,"url":"https://api.github.com/repos/lfd/PreemptRT/commits/82ae68a84f2ce4de5bbcff7976bbfa46096862b5"},{"sha":"854a40facfc9f5463ff6f084cd7d885b5e06ef9f","author":{"name":"Takashi Sakamoto","email":"df5cd14c20ca9e9623cd2ae7eba41070ac8353e1@sakamocchi.jp"},"message":"ALSA: fireworks: accessing to user space outside spinlock\n\n[ Upstream commit 6b1ca4bcadf9ef077cc5f03c6822ba276ed14902 ]\n\nIn hwdep interface of fireworks driver, accessing to user space is in a\ncritical section with disabled local interrupt. Depending on architecture,\naccessing to user space can cause page fault exception. Then local\nprocessor stores machine status and handles the synchronous event. A\nhandler corresponding to the event can call task scheduler to wait for\npreparing pages. In a case of usage of single core processor, the state to\ndisable local interrupt is worse because it don't handle usual interrupts\nfrom hardware.\n\nThis commit fixes this bug, performing the accessing outside spinlock. This\ncommit also gives up counting the number of queued response messages to\nsimplify ring-buffer management.\n\nReported-by: Vaishali Thakkar <vaishali.thakkar@oracle.com>\nCc: stable@vger.kernel.org\nFixes: 555e8a8f7f14('ALSA: fireworks: Add command/response functionality into hwdep interface')\nSigned-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":true,"url":"https://api.github.com/repos/lfd/PreemptRT/commits/854a40facfc9f5463ff6f084cd7d885b5e06ef9f"},{"sha":"193eb8f1ca047995ff02a6ccc64486c5e6d64b10","author":{"name":"Vegard Nossum","email":"9c44e0ed746b5c309b0bf31e4bae8fb5eb72beb1@oracle.com"},"message":"ALSA: timer: fix NULL pointer dereference in read()/ioctl() race\n\n[ Upstream commit 11749e086b2766cccf6217a527ef5c5604ba069c ]\n\nI got this with syzkaller:\n\n    ==================================================================\n    BUG: KASAN: null-ptr-deref on address 0000000000000020\n    Read of size 32 by task syz-executor/22519\n    CPU: 1 PID: 22519 Comm: syz-executor Not tainted 4.8.0-rc2+ #169\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2\n    014\n     0000000000000001 ffff880111a17a00 ffffffff81f9f141 ffff880111a17a90\n     ffff880111a17c50 ffff880114584a58 ffff880114584a10 ffff880111a17a80\n     ffffffff8161fe3f ffff880100000000 ffff880118d74a48 ffff880118d74a68\n    Call Trace:\n     [<ffffffff81f9f141>] dump_stack+0x83/0xb2\n     [<ffffffff8161fe3f>] kasan_report_error+0x41f/0x4c0\n     [<ffffffff8161ff74>] kasan_report+0x34/0x40\n     [<ffffffff82c84b54>] ? snd_timer_user_read+0x554/0x790\n     [<ffffffff8161e79e>] check_memory_region+0x13e/0x1a0\n     [<ffffffff8161e9c1>] kasan_check_read+0x11/0x20\n     [<ffffffff82c84b54>] snd_timer_user_read+0x554/0x790\n     [<ffffffff82c84600>] ? snd_timer_user_info_compat.isra.5+0x2b0/0x2b0\n     [<ffffffff817d0831>] ? proc_fault_inject_write+0x1c1/0x250\n     [<ffffffff817d0670>] ? next_tgid+0x2a0/0x2a0\n     [<ffffffff8127c278>] ? do_group_exit+0x108/0x330\n     [<ffffffff8174653a>] ? fsnotify+0x72a/0xca0\n     [<ffffffff81674dfe>] __vfs_read+0x10e/0x550\n     [<ffffffff82c84600>] ? snd_timer_user_info_compat.isra.5+0x2b0/0x2b0\n     [<ffffffff81674cf0>] ? do_sendfile+0xc50/0xc50\n     [<ffffffff81745e10>] ? __fsnotify_update_child_dentry_flags+0x60/0x60\n     [<ffffffff8143fec6>] ? kcov_ioctl+0x56/0x190\n     [<ffffffff81e5ada2>] ? common_file_perm+0x2e2/0x380\n     [<ffffffff81746b0e>] ? __fsnotify_parent+0x5e/0x2b0\n     [<ffffffff81d93536>] ? security_file_permission+0x86/0x1e0\n     [<ffffffff816728f5>] ? rw_verify_area+0xe5/0x2b0\n     [<ffffffff81675355>] vfs_read+0x115/0x330\n     [<ffffffff81676371>] SyS_read+0xd1/0x1a0\n     [<ffffffff816762a0>] ? vfs_write+0x4b0/0x4b0\n     [<ffffffff82001c2c>] ? __this_cpu_preempt_check+0x1c/0x20\n     [<ffffffff8150455a>] ? __context_tracking_exit.part.4+0x3a/0x1e0\n     [<ffffffff816762a0>] ? vfs_write+0x4b0/0x4b0\n     [<ffffffff81005524>] do_syscall_64+0x1c4/0x4e0\n     [<ffffffff810052fc>] ? syscall_return_slowpath+0x16c/0x1d0\n     [<ffffffff83c3276a>] entry_SYSCALL64_slow_path+0x25/0x25\n    ==================================================================\n\nThere are a couple of problems that I can see:\n\n - ioctl(SNDRV_TIMER_IOCTL_SELECT), which potentially sets\n   tu->queue/tu->tqueue to NULL on memory allocation failure, so read()\n   would get a NULL pointer dereference like the above splat\n\n - the same ioctl() can free tu->queue/to->tqueue which means read()\n   could potentially see (and dereference) the freed pointer\n\nWe can fix both by taking the ioctl_lock mutex when dereferencing\n->queue/->tqueue, since that's always held over all the ioctl() code.\n\nJust looking at the code I find it likely that there are more problems\nhere such as tu->qhead pointing outside the buffer if the size is\nchanged concurrently using SNDRV_TIMER_IOCTL_PARAMS.\n\nSigned-off-by: Vegard Nossum <vegard.nossum@oracle.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":true,"url":"https://api.github.com/repos/lfd/PreemptRT/commits/193eb8f1ca047995ff02a6ccc64486c5e6d64b10"},{"sha":"1ea35b9f0b42ceb9a480479ff16f9eafb34860aa","author":{"name":"Linus Walleij","email":"b0d9e537b6c72323d8ac72352e58c452d7c4fc88@linaro.org"},"message":"iio: accel: kxsd9: Fix scaling bug\n\n[ Upstream commit 307fe9dd11ae44d4f8881ee449a7cbac36e1f5de ]\n\nAll the scaling of the KXSD9 involves multiplication with a\nfraction number < 1.\n\nHowever the scaling value returned from IIO_INFO_SCALE was\nunpredictable as only the micros of the value was assigned, and\nnot the integer part, resulting in scaling like this:\n\n$cat in_accel_scale\n-1057462640.011978\n\nFix this by assigning zero to the integer part.\n\nCc: stable@vger.kernel.org\nTested-by: Jonathan Cameron <jic23@kernel.org>\nSigned-off-by: Linus Walleij <linus.walleij@linaro.org>\nSigned-off-by: Jonathan Cameron <jic23@kernel.org>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":true,"url":"https://api.github.com/repos/lfd/PreemptRT/commits/1ea35b9f0b42ceb9a480479ff16f9eafb34860aa"},{"sha":"431d09f289e89b45513fc12277601adfaf84df6d","author":{"name":"Balbir Singh","email":"daca7b412031fb0e95d58c31aac905f736b2d1c1@gmail.com"},"message":"sched/core: Fix a race between try_to_wake_up() and a woken up task\n\n[ Upstream commit 135e8c9250dd5c8c9aae5984fde6f230d0cbfeaf ]\n\nThe origin of the issue I've seen is related to\na missing memory barrier between check for task->state and\nthe check for task->on_rq.\n\nThe task being woken up is already awake from a schedule()\nand is doing the following:\n\n\tdo {\n\t\tschedule()\n\t\tset_current_state(TASK_(UN)INTERRUPTIBLE);\n\t} while (!cond);\n\nThe waker, actually gets stuck doing the following in\ntry_to_wake_up():\n\n\twhile (p->on_cpu)\n\t\tcpu_relax();\n\nAnalysis:\n\nThe instance I've seen involves the following race:\n\n CPU1\t\t\t\t\tCPU2\n\n while () {\n   if (cond)\n     break;\n   do {\n     schedule();\n     set_current_state(TASK_UN..)\n   } while (!cond);\n\t\t\t\t\twakeup_routine()\n\t\t\t\t\t  spin_lock_irqsave(wait_lock)\n   raw_spin_lock_irqsave(wait_lock)\t  wake_up_process()\n }\t\t\t\t\t  try_to_wake_up()\n set_current_state(TASK_RUNNING);\t  ..\n list_del(&waiter.list);\n\nCPU2 wakes up CPU1, but before it can get the wait_lock and set\ncurrent state to TASK_RUNNING the following occurs:\n\n CPU3\n wakeup_routine()\n raw_spin_lock_irqsave(wait_lock)\n if (!list_empty)\n   wake_up_process()\n   try_to_wake_up()\n   raw_spin_lock_irqsave(p->pi_lock)\n   ..\n   if (p->on_rq && ttwu_wakeup())\n   ..\n   while (p->on_cpu)\n     cpu_relax()\n   ..\n\nCPU3 tries to wake up the task on CPU1 again since it finds\nit on the wait_queue, CPU1 is spinning on wait_lock, but immediately\nafter CPU2, CPU3 got it.\n\nCPU3 checks the state of p on CPU1, it is TASK_UNINTERRUPTIBLE and\nthe task is spinning on the wait_lock. Interestingly since p->on_rq\nis checked under pi_lock, I've noticed that try_to_wake_up() finds\np->on_rq to be 0. This was the most confusing bit of the analysis,\nbut p->on_rq is changed under runqueue lock, rq_lock, the p->on_rq\ncheck is not reliable without this fix IMHO. The race is visible\n(based on the analysis) only when ttwu_queue() does a remote wakeup\nvia ttwu_queue_remote. In which case the p->on_rq change is not\ndone uder the pi_lock.\n\nThe result is that after a while the entire system locks up on\nthe raw_spin_irqlock_save(wait_lock) and the holder spins infintely\n\nReproduction of the issue:\n\nThe issue can be reproduced after a long run on my system with 80\nthreads and having to tweak available memory to very low and running\nmemory stress-ng mmapfork test. It usually takes a long time to\nreproduce. I am trying to work on a test case that can reproduce\nthe issue faster, but thats work in progress. I am still testing the\nchanges on my still in a loop and the tests seem OK thus far.\n\nBig thanks to Benjamin and Nick for helping debug this as well.\nBen helped catch the missing barrier, Nick caught every missing\nbit in my theory.\n\nSigned-off-by: Balbir Singh <bsingharora@gmail.com>\n[ Updated comment to clarify matching barriers. Many\n  architectures do not have a full barrier in switch_to()\n  so that cannot be relied upon. ]\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nAcked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>\nCc: Alexey Kardashevskiy <aik@ozlabs.ru>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Nicholas Piggin <nicholas.piggin@gmail.com>\nCc: Nicholas Piggin <npiggin@gmail.com>\nCc: Oleg Nesterov <oleg@redhat.com>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: <stable@vger.kernel.org>\nLink: http://lkml.kernel.org/r/e02cce7b-d9ca-1ad0-7a61-ea97c7582b37@gmail.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\n\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":true,"url":"https://api.github.com/repos/lfd/PreemptRT/commits/431d09f289e89b45513fc12277601adfaf84df6d"},{"sha":"8af2ce0777ab7f143f6513c8de9e4c3a258f5085","author":{"name":"Yoshihiro Shimoda","email":"806084c42fbad0778b005fdc6faa04d57cfdf777@renesas.com"},"message":"usb: renesas_usbhs: fix clearing the {BRDY,BEMP}STS condition\n\n[ Upstream commit 519d8bd4b5d3d82c413eac5bb42b106bb4b9ec15 ]\n\nThe previous driver is possible to stop the transfer wrongly.\nFor example:\n 1) An interrupt happens, but not BRDY interruption.\n 2) Read INTSTS0. And than state->intsts0 is not set to BRDY.\n 3) BRDY is set to 1 here.\n 4) Read BRDYSTS.\n 5) Clear the BRDYSTS. And then. the BRDY is cleared wrongly.\n\nRemarks:\n - The INTSTS0.BRDY is read only.\n  - If any bits of BRDYSTS are set to 1, the BRDY is set to 1.\n  - If BRDYSTS is 0, the BRDY is set to 0.\n\nSo, this patch adds condition to avoid such situation. (And about\nNRDYSTS, this is not used for now. But, avoiding any side effects,\nthis patch doesn't touch it.)\n\nFixes: d5c6a1e024dd (\"usb: renesas_usbhs: fixup interrupt status clear method\")\nCc: <stable@vger.kernel.org> # v3.8+\nSigned-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>\nSigned-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":true,"url":"https://api.github.com/repos/lfd/PreemptRT/commits/8af2ce0777ab7f143f6513c8de9e4c3a258f5085"},{"sha":"12c68a9c1eed60b8acd716ec248b3ff9877f003f","author":{"name":"Miklos Szeredi","email":"c27ee2952768e22f4d3ab9aec0e78ac5f4ddea98@redhat.com"},"message":"ovl: fix workdir creation\n\n[ Upstream commit e1ff3dd1ae52cef5b5373c8cc4ad949c2c25a71c ]\n\nWorkdir creation fails in latest kernel.\n\nFix by allowing EOPNOTSUPP as a valid return value from\nvfs_removexattr(XATTR_NAME_POSIX_ACL_*).  Upper filesystem may not support\nACL and still be perfectly able to support overlayfs.\n\nReported-by: Martin Ziegler <ziegler@uni-freiburg.de>\nSigned-off-by: Miklos Szeredi <mszeredi@redhat.com>\nFixes: c11b9fdd6a61 (\"ovl: remove posix_acl_default from workdir\")\nCc: <stable@vger.kernel.org>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":true,"url":"https://api.github.com/repos/lfd/PreemptRT/commits/12c68a9c1eed60b8acd716ec248b3ff9877f003f"}]}
{"actor":{"display_login":"rralf"}}