{"push_id":1104493245,"size":396,"distinct_size":0,"ref":"refs/heads/master","head":"460906b340c52b5aeaaa77189ef057ebb34679ad","before":"d15bd6cdbb1c2080fb1fca0035e5af1994f4d14f","commits":[{"sha":"177cdf7e66e41ac17d260a1bd861fada6b292215","author":{"email":"5cc5d8d4c7115f1c96c2983ec0d0f8a0f9dab596@canonical.com","name":"Kamal Mostafa"},"message":"UBUNTU: Start new release\n\nIgnore: yes\nSigned-off-by: Kamal Mostafa <kamal@canonical.com>","distinct":false,"url":"https://api.github.com/repos/inaddy/wily/commits/177cdf7e66e41ac17d260a1bd861fada6b292215"},{"sha":"378c998aadf64032fd4dd3d039ba93c57bad2768","author":{"email":"e19868f0779d9e6b21b4469e9f21d566a2671008@ericsson.com","name":"Parthasarathy Bhuvaragan"},"message":"tipc: fix connection abort during subscription cancel\n\nBugLink: http://bugs.launchpad.net/bugs/1561677\n\n[ Upstream commit 4d5cfcba2f6ec494d8810b9e3c0a7b06255c8067 ]\n\nIn 'commit 7fe8097cef5f (\"tipc: fix nullpointer bug when subscribing\nto events\")', we terminate the connection if the subscription\ncreation fails.\nIn the same commit, the subscription creation result was based on\nthe value of the subscription pointer (set in the function) instead\nof the return code.\n\nUnfortunately, the same function tipc_subscrp_create() handles\nsubscription cancel request. For a subscription cancellation request,\nthe subscription pointer cannot be set. Thus if a subscriber has\nseveral subscriptions and cancels any of them, the connection is\nterminated.\n\nIn this commit, we terminate the connection based on the return value\nof tipc_subscrp_create().\nFixes: commit 7fe8097cef5f (\"tipc: fix nullpointer bug when subscribing to events\")\n\nReviewed-by:  Jon Maloy <jon.maloy@ericsson.com>\nSigned-off-by: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Kamal Mostafa <kamal@canonical.com>","distinct":false,"url":"https://api.github.com/repos/inaddy/wily/commits/378c998aadf64032fd4dd3d039ba93c57bad2768"},{"sha":"3b47aa67d9bd49bb4a6a664f8609b3b6b390a9c2","author":{"email":"e19868f0779d9e6b21b4469e9f21d566a2671008@ericsson.com","name":"Parthasarathy Bhuvaragan"},"message":"tipc: fix nullptr crash during subscription cancel\n\nBugLink: http://bugs.launchpad.net/bugs/1561677\n\ncommit 4de13d7ed6ffdcbb34317acaa9236f121176f5f8 upstream.\n\ncommit 4d5cfcba2f6e ('tipc: fix connection abort during subscription\ncancel'), removes the check for a valid subscription before calling\ntipc_nametbl_subscribe().\n\nThis will lead to a nullptr exception when we process a\nsubscription cancel request. For a cancel request, a null\nsubscription is passed to tipc_nametbl_subscribe() resulting\nin exception.\n\nIn this commit, we call tipc_nametbl_subscribe() only for\na valid subscription.\n\nFixes: 4d5cfcba2f6e ('tipc: fix connection abort during subscription cancel')\nReported-by: Anders Widell <anders.widell@ericsson.com>\nSigned-off-by: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com>\nAcked-by: Jon Maloy <jon.maloy@ericsson.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Kamal Mostafa <kamal@canonical.com>","distinct":false,"url":"https://api.github.com/repos/inaddy/wily/commits/3b47aa67d9bd49bb4a6a664f8609b3b6b390a9c2"},{"sha":"85af47ce42d9495901c0f4a1637233f0fbd84270","author":{"email":"52616596d8f5df0d597e85ab515377f92f939c68@de.ibm.com","name":"Martin Schwidefsky"},"message":"s390/mm: four page table levels vs. fork\n\nBugLink: http://bugs.launchpad.net/bugs/1561677\n\ncommit 3446c13b268af86391d06611327006b059b8bab1 upstream.\n\nThe fork of a process with four page table levels is broken since\ngit commit 6252d702c5311ce9 \"[S390] dynamic page tables.\"\n\nAll new mm contexts are created with three page table levels and\nan asce limit of 4TB. If the parent has four levels dup_mmap will\nadd vmas to the new context which are outside of the asce limit.\nThe subsequent call to copy_page_range will walk the three level\npage table structure of the new process with non-zero pgd and pud\nindexes. This leads to memory clobbers as the pgd_index *and* the\npud_index is added to the mm->pgd pointer without a pgd_deref\nin between.\n\nThe init_new_context() function is selecting the number of page\ntable levels for a new context. The function is used by mm_init()\nwhich in turn is called by dup_mm() and mm_alloc(). These two are\nused by fork() and exec(). The init_new_context() function can\ndistinguish the two cases by looking at mm->context.asce_limit,\nfor fork() the mm struct has been copied and the number of page\ntable levels may not change. For exec() the mm_alloc() function\nset the new mm structure to zero, in this case a three-level page\ntable is created as the temporary stack space is located at\nSTACK_TOP_MAX = 4TB.\n\nThis fixes CVE-2016-2143.\n\nReported-by: Marcin Kościelnicki <koriakin@0x04.net>\nReviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>\nSigned-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>\nSigned-off-by: Kamal Mostafa <kamal@canonical.com>","distinct":false,"url":"https://api.github.com/repos/inaddy/wily/commits/85af47ce42d9495901c0f4a1637233f0fbd84270"},{"sha":"7e9f1df5fc9640a287291b181ceb33bd13e44dc2","author":{"email":"f82da8db93e4ada738df910dc39037dfa2de78b0@redhat.com","name":"Vladis Dronov"},"message":"Input: aiptek - fix crash on detecting device without endpoints\n\nBugLink: http://bugs.launchpad.net/bugs/1561677\n\ncommit 8e20cf2bce122ce9262d6034ee5d5b76fbb92f96 upstream.\n\nThe aiptek driver crashes in aiptek_probe() when a specially crafted USB\ndevice without endpoints is detected. This fix adds a check that the device\nhas proper configuration expected by the driver. Also an error return value\nis changed to more matching one in one of the error paths.\n\nReported-by: Ralf Spenneberg <ralf@spenneberg.net>\nSigned-off-by: Vladis Dronov <vdronov@redhat.com>\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>\n\nSigned-off-by: Kamal Mostafa <kamal@canonical.com>","distinct":false,"url":"https://api.github.com/repos/inaddy/wily/commits/7e9f1df5fc9640a287291b181ceb33bd13e44dc2"},{"sha":"0732c50a5d57291dcebff1038f4725a272a7231d","author":{"email":"bff32994ff0f8d048f262a8388145a71b6071bfe@intel.com","name":"Johannes Berg"},"message":"wext: fix message delay/ordering\n\nBugLink: http://bugs.launchpad.net/bugs/1561677\n\ncommit 8bf862739a7786ae72409220914df960a0aa80d8 upstream.\n\nBeniamino reported that he was getting an RTM_NEWLINK message for a\ngiven interface, after the RTM_DELLINK for it. It turns out that the\nmessage is a wireless extensions message, which was sent because the\ninterface had been connected and disconnection while it was deleted\ncaused a wext message.\n\nFor its netlink messages, wext uses RTM_NEWLINK, but the message is\nwithout all the regular rtnetlink attributes, so \"ip monitor link\"\nprints just rudimentary information:\n\n5: wlan1: <BROADCAST,MULTICAST> mtu 1500 qdisc mq state DOWN group default\n    link/ether 02:00:00:00:01:00 brd ff:ff:ff:ff:ff:ff\nDeleted 5: wlan1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default\n    link/ether 02:00:00:00:01:00 brd ff:ff:ff:ff:ff:ff\n5: wlan1: <BROADCAST,MULTICAST,UP>\n    link/ether\n(from my hwsim reproduction)\n\nThis can cause userspace to get confused since it doesn't expect an\nRTM_NEWLINK message after RTM_DELLINK.\n\nThe reason for this is that wext schedules a worker to send out the\nmessages, and the scheduling delay can cause the messages to get out\nto userspace in different order.\n\nTo fix this, have wext register a netdevice notifier and flush out\nany pending messages when netdevice state changes. This fixes any\nordering whenever the original message wasn't sent by a notifier\nitself.\n\nReported-by: Beniamino Galvani <bgalvani@redhat.com>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nSigned-off-by: Kamal Mostafa <kamal@canonical.com>","distinct":false,"url":"https://api.github.com/repos/inaddy/wily/commits/0732c50a5d57291dcebff1038f4725a272a7231d"},{"sha":"ef9f1acdb1c9994629317e25be20418003200b93","author":{"email":"bff32994ff0f8d048f262a8388145a71b6071bfe@intel.com","name":"Johannes Berg"},"message":"cfg80211/wext: fix message ordering\n\nBugLink: http://bugs.launchpad.net/bugs/1561677\n\ncommit cb150b9d23be6ee7f3a0fff29784f1c5b5ac514d upstream.\n\nSince cfg80211 frequently takes actions from its netdev notifier\ncall, wireless extensions messages could still be ordered badly\nsince the wext netdev notifier, since wext is built into the\nkernel, runs before the cfg80211 netdev notifier. For example,\nthe following can happen:\n\n5: wlan1: <BROADCAST,MULTICAST> mtu 1500 qdisc mq state DOWN group default\n    link/ether 02:00:00:00:01:00 brd ff:ff:ff:ff:ff:ff\n5: wlan1: <BROADCAST,MULTICAST,UP>\n    link/ether\n\nwhen setting the interface down causes the wext message.\n\nTo also fix this, export the wireless_nlevent_flush() function\nand also call it from the cfg80211 notifier.\n\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nSigned-off-by: Kamal Mostafa <kamal@canonical.com>","distinct":false,"url":"https://api.github.com/repos/inaddy/wily/commits/ef9f1acdb1c9994629317e25be20418003200b93"},{"sha":"d34f034d987401dafcbf62e86bb14e96e8df5bc2","author":{"email":"127a166a10ede851f230a37146bc5ea8eb3dfca9@gmail.com","name":"Chris Bainbridge"},"message":"mac80211: fix use of uninitialised values in RX aggregation\n\nBugLink: http://bugs.launchpad.net/bugs/1561677\n\ncommit f39ea2690bd61efec97622c48323f40ed6e16317 upstream.\n\nUse kzalloc instead of kmalloc for struct tid_ampdu_rx to\ninitialize the \"removed\" field (all others are initialized\nmanually). That fixes:\n\nUBSAN: Undefined behaviour in net/mac80211/rx.c:932:29\nload of value 2 is not a valid value for type '_Bool'\nCPU: 3 PID: 1134 Comm: kworker/u16:7 Not tainted 4.5.0-rc1+ #265\nWorkqueue: phy0 rt2x00usb_work_rxdone\n 0000000000000004 ffff880254a7ba50 ffffffff8181d866 0000000000000007\n ffff880254a7ba78 ffff880254a7ba68 ffffffff8188422d ffffffff8379b500\n ffff880254a7bab8 ffffffff81884747 0000000000000202 0000000348620032\nCall Trace:\n [<ffffffff8181d866>] dump_stack+0x45/0x5f\n [<ffffffff8188422d>] ubsan_epilogue+0xd/0x40\n [<ffffffff81884747>] __ubsan_handle_load_invalid_value+0x67/0x70\n [<ffffffff82227b4d>] ieee80211_sta_reorder_release.isra.16+0x5ed/0x730\n [<ffffffff8222ca14>] ieee80211_prepare_and_rx_handle+0xd04/0x1c00\n [<ffffffff8222db03>] __ieee80211_rx_handle_packet+0x1f3/0x750\n [<ffffffff8222e4a7>] ieee80211_rx_napi+0x447/0x990\n\nWhile at it, convert to use sizeof(*tid_agg_rx) instead.\n\nFixes: 788211d81bfdf (\"mac80211: fix RX A-MPDU session reorder timer deletion\")\nSigned-off-by: Chris Bainbridge <chris.bainbridge@gmail.com>\n[reword commit message, use sizeof(*tid_agg_rx)]\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nSigned-off-by: Kamal Mostafa <kamal@canonical.com>","distinct":false,"url":"https://api.github.com/repos/inaddy/wily/commits/d34f034d987401dafcbf62e86bb14e96e8df5bc2"},{"sha":"22116988b60f68fec887528067d4bca20b54f05c","author":{"email":"2ac7036d3528aff465f5d4b31a65c571c86fd591@open-mesh.com","name":"Sven Eckelmann"},"message":"mac80211: minstrel: Change expected throughput unit back to Kbps\n\nBugLink: http://bugs.launchpad.net/bugs/1561677\n\ncommit 212c5a5e6ba61678be6b5fee576e38bccb50b613 upstream.\n\nThe change from cur_tp to the function\nminstrel_get_tp_avg/minstrel_ht_get_tp_avg changed the unit used for the\ncurrent throughput. For example in minstrel_ht the correct\nconversion between them would be:\n\n    mrs->cur_tp / 10 == minstrel_ht_get_tp_avg(..).\n\nThis factor 10 must also be included in the calculation of\nminstrel_get_expected_throughput and minstrel_ht_get_expected_throughput to\nreturn values with the unit [Kbps] instead of [10Kbps]. Otherwise routing\nalgorithms like B.A.T.M.A.N. V will make incorrect decision based on these\nvalues. Its kernel based implementation expects expected_throughput always\nto have the unit [Kbps] and not sometimes [10Kbps] and sometimes [Kbps].\n\nThe same requirement has iw or olsrdv2's nl80211 based statistics module\nwhich retrieve the same data via NL80211_STA_INFO_TX_BITRATE.\n\nFixes: 6a27b2c40b48 (\"mac80211: restructure per-rate throughput calculation into function\")\nSigned-off-by: Sven Eckelmann <sven@open-mesh.com>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nSigned-off-by: Kamal Mostafa <kamal@canonical.com>","distinct":false,"url":"https://api.github.com/repos/inaddy/wily/commits/22116988b60f68fec887528067d4bca20b54f05c"},{"sha":"5b1f5f0c56389532c474d2f232eed83b0214901d","author":{"email":"f2c659f01951776204a6c5b902787d9019fbeebd@arndb.de","name":"Arnd Bergmann"},"message":"libata: fix HDIO_GET_32BIT ioctl\n\nBugLink: http://bugs.launchpad.net/bugs/1561677\n\ncommit 287e6611ab1eac76c2c5ebf6e345e04c80ca9c61 upstream.\n\nAs reported by Soohoon Lee, the HDIO_GET_32BIT ioctl does not\nwork correctly in compat mode with libata.\n\nI have investigated the issue further and found multiple problems\nthat all appeared with the same commit that originally introduced\nHDIO_GET_32BIT handling in libata back in linux-2.6.8 and presumably\nalso linux-2.4, as the code uses \"copy_to_user(arg, &val, 1)\" to copy\na 'long' variable containing either 0 or 1 to user space.\n\nThe problems with this are:\n\n* On big-endian machines, this will always write a zero because it\n  stores the wrong byte into user space.\n\n* In compat mode, the upper three bytes of the variable are updated\n  by the compat_hdio_ioctl() function, but they now contain\n  uninitialized stack data.\n\n* The hdparm tool calling this ioctl uses a 'static long' variable\n  to store the result. This means at least the upper bytes are\n  initialized to zero, but calling another ioctl like HDIO_GET_MULTCOUNT\n  would fill them with data that remains stale when the low byte\n  is overwritten. Fortunately libata doesn't implement any of the\n  affected ioctl commands, so this would only happen when we query\n  both an IDE and an ATA device in the same command such as\n  \"hdparm -N -c /dev/hda /dev/sda\"\n\n* The libata code for unknown reasons started using ATA_IOC_GET_IO32\n  and ATA_IOC_SET_IO32 as aliases for HDIO_GET_32BIT and HDIO_SET_32BIT,\n  while the ioctl commands that were added later use the normal\n  HDIO_* names. This is harmless but rather confusing.\n\nThis addresses all four issues by changing the code to use put_user()\non an 'unsigned long' variable in HDIO_GET_32BIT, like the IDE subsystem\ndoes, and by clarifying the names of the ioctl commands.\n\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nReported-by: Soohoon Lee <Soohoon.Lee@f5.com>\nTested-by: Soohoon Lee <Soohoon.Lee@f5.com>\nSigned-off-by: Tejun Heo <tj@kernel.org>\nSigned-off-by: Kamal Mostafa <kamal@canonical.com>","distinct":false,"url":"https://api.github.com/repos/inaddy/wily/commits/5b1f5f0c56389532c474d2f232eed83b0214901d"},{"sha":"e72fefdc60484e4d32036637d8e6a0d0b13fd515","author":{"email":"30d0a3ea07b25a90f61a738417c75a14d6abc5ff@intel.com","name":"Liad Kaufman"},"message":"iwlwifi: mvm: inc pending frames counter also when txing non-sta\n\nBugLink: http://bugs.launchpad.net/bugs/1561677\n\ncommit fb896c44f88a75843a072cd6961b1615732f7811 upstream.\n\nUntil this patch, when TXing non-sta the pending_frames counter\nwasn't increased, but it WAS decreased in\niwl_mvm_rx_tx_cmd_single(), what makes it negative in certain\nconditions. This in turn caused much trouble when we need to\nremove the station since we won't be waiting forever until\npending_frames gets 0. In certain cases, we were exhausting\nthe station table even in BSS mode, because we had a lot of\nstale stations.\n\nIncrease the counter also in iwl_mvm_tx_skb_non_sta() after a\nsuccessful TX to avoid this outcome.\n\nSigned-off-by: Liad Kaufman <liad.kaufman@intel.com>\nSigned-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>\n[ kamal: backport to 4.2: file rename ]\nSigned-off-by: Kamal Mostafa <kamal@canonical.com>","distinct":false,"url":"https://api.github.com/repos/inaddy/wily/commits/e72fefdc60484e4d32036637d8e6a0d0b13fd515"},{"sha":"2420aca84f3e610a5589326137f43cbd1451603a","author":{"email":"3481f239a7c653fe39f8234515e209844ad540bc@cisco.com","name":"Hans Verkuil"},"message":"[media] adv7604: fix tx 5v detect regression\n\nBugLink: http://bugs.launchpad.net/bugs/1561677\n\ncommit 0ba4581c84cfb39fd527f6b3457f1c97f6356c04 upstream.\n\nThe 5 volt detect functionality broke in 3.14: the code reads IO register 0x70\nagain after it has already been cleared. Instead it should use the cached\nirq_reg_0x70 value and the io_write to 0x71 to clear 0x70 can be dropped since\nthis has already been done.\n\nSigned-off-by: Hans Verkuil <hans.verkuil@cisco.com>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>\nSigned-off-by: Kamal Mostafa <kamal@canonical.com>","distinct":false,"url":"https://api.github.com/repos/inaddy/wily/commits/2420aca84f3e610a5589326137f43cbd1451603a"},{"sha":"8e3080f0e9a1cbd938188cda40f1e740211f62a7","author":{"email":"da19f0d1311a690ef93489efaf9b0ff7bd44ca5d@linux.intel.com","name":"Alexandra Yates"},"message":"ahci: add new Intel device IDs\n\nBugLink: http://bugs.launchpad.net/bugs/1561677\n\ncommit 56e74338a535cbcc2f2da08b1ea1a92920194364 upstream.\n\nAdding Intel codename Lewisburg platform device IDs for SATA.\n\nSigned-off-by: Alexandra Yates <alexandra.yates@linux.intel.com>\nSigned-off-by: Tejun Heo <tj@kernel.org>\nSigned-off-by: Kamal Mostafa <kamal@canonical.com>","distinct":false,"url":"https://api.github.com/repos/inaddy/wily/commits/8e3080f0e9a1cbd938188cda40f1e740211f62a7"},{"sha":"0d53d3c51f7a96174673d1484c6da3f4e49978dd","author":{"email":"da19f0d1311a690ef93489efaf9b0ff7bd44ca5d@linux.intel.com","name":"Alexandra Yates"},"message":"ahci: Order SATA device IDs for codename Lewisburg\n\nBugLink: http://bugs.launchpad.net/bugs/1561677\n\ncommit 4d92f0099a06ef0e36c7673f7c090f1a448b2d1b upstream.\n\nThis change was to preserve the ascending order of device IDs.\nThere was an exception with the first two Lewisburg device IDs to\nkeep all device IDs of the same kind grouped by code name.\n\nSigned-off-by: Alexandra Yates <alexandra.yates@linux.intel.com>\nsigned-off-by: Tejun Heo <tj@kernel.org>\nSigned-off-by: Kamal Mostafa <kamal@canonical.com>","distinct":false,"url":"https://api.github.com/repos/inaddy/wily/commits/0d53d3c51f7a96174673d1484c6da3f4e49978dd"},{"sha":"32cf93c3c6f82d91729ce7e8960bc16364c076cd","author":{"email":"da19f0d1311a690ef93489efaf9b0ff7bd44ca5d@linux.intel.com","name":"Alexandra Yates"},"message":"Adding Intel Lewisburg device IDs for SATA\n\nBugLink: http://bugs.launchpad.net/bugs/1561677\n\ncommit f5bdd66c705484b4bc77eb914be15c1b7881fae7 upstream.\n\nThis patch complements the list of device IDs previously\nadded for lewisburg sata.\n\nSigned-off-by: Alexandra Yates <alexandra.yates@linux.intel.com>\nSigned-off-by: Tejun Heo <tj@kernel.org>\nSigned-off-by: Kamal Mostafa <kamal@canonical.com>","distinct":false,"url":"https://api.github.com/repos/inaddy/wily/commits/32cf93c3c6f82d91729ce7e8960bc16364c076cd"},{"sha":"b1382982662e1c605fad8373696e0e90612d26f4","author":{"email":"8e4aa0015eb43ed5ca66aaca3fb498609e1e427c@opensource.wolfsonmicro.com","name":"Charles Keepax"},"message":"ASoC: samsung: Use IRQ safe spin lock calls\n\nBugLink: http://bugs.launchpad.net/bugs/1561677\n\ncommit 316fa9e09ad76e095b9d7e9350c628b918370a22 upstream.\n\nLockdep warns of a potential lock inversion, i2s->lock is held numerous\ntimes whilst we are under the substream lock (snd_pcm_stream_lock). If\nwe use the IRQ unsafe spin lock calls, you can also end up locking\nsnd_pcm_stream_lock whilst under i2s->lock (if an IRQ happens whilst we\nare holding i2s->lock). This could result in deadlock.\n\n[   18.147001]        CPU0                    CPU1\n[   18.151509]        ----                    ----\n[   18.156022]   lock(&(&pri_dai->spinlock)->rlock);\n[   18.160701]                                local_irq_disable();\n[   18.166622]                                lock(&(&substream->self_group.lock)->rlock);\n[   18.174595]                                lock(&(&pri_dai->spinlock)->rlock);\n[   18.181806]   <Interrupt>\n[   18.184408]     lock(&(&substream->self_group.lock)->rlock);\n[   18.190045]\n[   18.190045]  *** DEADLOCK ***\n\nThis patch changes to using the irq safe spinlock calls, to avoid this\nissue.\n\nFixes: ce8bcdbb61d9 (\"ASoC: samsung: i2s: Protect more registers with a spinlock\")\nSigned-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>\nTested-by: Anand Moon <linux.amoon@gmail.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nSigned-off-by: Kamal Mostafa <kamal@canonical.com>","distinct":false,"url":"https://api.github.com/repos/inaddy/wily/commits/b1382982662e1c605fad8373696e0e90612d26f4"},{"sha":"d57be5232ee6c7b3d9860af50d04466f36c5b7a0","author":{"email":"118ed6118e893d16e8c6e0776e0ebc290952c897@openwrt.org","name":"Felix Fietkau"},"message":"mac80211: minstrel_ht: set default tx aggregation timeout to 0\n\nBugLink: http://bugs.launchpad.net/bugs/1561677\n\ncommit 7a36b930e6ed4702c866dc74a5ad07318a57c688 upstream.\n\nThe value 5000 was put here with the addition of the timeout field to\nieee80211_start_tx_ba_session. It was originally added in mac80211 to\nsave resources for drivers like iwlwifi, which only supports a limited\nnumber of concurrent aggregation sessions.\n\nSince iwlwifi does not use minstrel_ht and other drivers don't need\nthis, 0 is a better default - especially since there have been\nrecent reports of aggregation setup related issues reproduced with\nath9k. This should improve stability without causing any adverse\neffects.\n\nAcked-by: Avery Pennarun <apenwarr@gmail.com>\nSigned-off-by: Felix Fietkau <nbd@openwrt.org>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nSigned-off-by: Kamal Mostafa <kamal@canonical.com>","distinct":false,"url":"https://api.github.com/repos/inaddy/wily/commits/d57be5232ee6c7b3d9860af50d04466f36c5b7a0"},{"sha":"25866cccf94d66a916812a28d86ae27f9a3f003a","author":{"email":"c01a8c815a4ad165fff2d1c0d35ddf5b16bd3d7b@nxp.com","name":"Peter Chen"},"message":"usb: chipidea: otg: change workqueue ci_otg as freezable\n\nBugLink: http://bugs.launchpad.net/bugs/1561677\n\ncommit d144dfea8af7108f613139623e63952ed7e69c0c upstream.\n\nIf we use USB ID pin as wakeup source, and there is a USB block\ndevice on this USB OTG (ID) cable, the system will be deadlock\nafter system resume.\n\nThe root cause for this problem is: the workqueue ci_otg may try\nto remove hcd before the driver resume has finished, and hcd will\ndisconnect the device on it, then, it will call device_release_driver,\nand holds the device lock \"dev->mutex\", but it is never unlocked since\nit waits workqueue writeback to run to flush the block information, but\nthe workqueue writeback is freezable, it is not thawed before driver\nresume has finished.\n\nWhen the driver (device: sd 0:0:0:0:) resume goes to dpm_complete, it\ntries to get its device lock \"dev->mutex\", but it can't get it forever,\nthen the deadlock occurs. Below call stacks show the situation.\n\nSo, in order to fix this problem, we need to change workqueue ci_otg\nas freezable, then the work item in this workqueue will be run after\ndriver's resume, this workqueue will not be blocked forever like above\ncase since the workqueue writeback has been thawed too.\n\nTested at: i.mx6qdl-sabresd and i.mx6sx-sdb.\n\n[  555.178869] kworker/u2:13   D c07de74c     0   826      2 0x00000000\n[  555.185310] Workqueue: ci_otg ci_otg_work\n[  555.189353] Backtrace:\n[  555.191849] [<c07de4fc>] (__schedule) from [<c07dec6c>] (schedule+0x48/0xa0)\n[  555.198912]  r10:ee471ba0 r9:00000000 r8:00000000 r7:00000002 r6:ee470000 r5:ee471ba4\n[  555.206867]  r4:ee470000\n[  555.209453] [<c07dec24>] (schedule) from [<c07e2fc4>] (schedule_timeout+0x15c/0x1e0)\n[  555.217212]  r4:7fffffff r3:edc2b000\n[  555.220862] [<c07e2e68>] (schedule_timeout) from [<c07df6c8>] (wait_for_common+0x94/0x144)\n[  555.229140]  r8:00000000 r7:00000002 r6:ee470000 r5:ee471ba4 r4:7fffffff\n[  555.235980] [<c07df634>] (wait_for_common) from [<c07df790>] (wait_for_completion+0x18/0x1c)\n[  555.244430]  r10:00000001 r9:c0b5563c r8:c0042e48 r7:ef086000 r6:eea4372c r5:ef131b00\n[  555.252383]  r4:00000000\n[  555.254970] [<c07df778>] (wait_for_completion) from [<c0043cb8>] (flush_work+0x19c/0x234)\n[  555.263177] [<c0043b1c>] (flush_work) from [<c0043fac>] (flush_delayed_work+0x48/0x4c)\n[  555.271106]  r8:ed5b5000 r7:c0b38a3c r6:eea439cc r5:eea4372c r4:eea4372c\n[  555.277958] [<c0043f64>] (flush_delayed_work) from [<c00eae18>] (bdi_unregister+0x84/0xec)\n[  555.286236]  r4:eea43520 r3:20000153\n[  555.289885] [<c00ead94>] (bdi_unregister) from [<c02c2154>] (blk_cleanup_queue+0x180/0x29c)\n[  555.298250]  r5:eea43808 r4:eea43400\n[  555.301909] [<c02c1fd4>] (blk_cleanup_queue) from [<c0417914>] (__scsi_remove_device+0x48/0xb8)\n[  555.310623]  r7:00000000 r6:20000153 r5:ededa950 r4:ededa800\n[  555.316403] [<c04178cc>] (__scsi_remove_device) from [<c0415e90>] (scsi_forget_host+0x64/0x68)\n[  555.325028]  r5:ededa800 r4:ed5b5000\n[  555.328689] [<c0415e2c>] (scsi_forget_host) from [<c0409828>] (scsi_remove_host+0x78/0x104)\n[  555.337054]  r5:ed5b5068 r4:ed5b5000\n[  555.340709] [<c04097b0>] (scsi_remove_host) from [<c04cdfcc>] (usb_stor_disconnect+0x50/0xb4)\n[  555.349247]  r6:ed5b56e4 r5:ed5b5818 r4:ed5b5690 r3:00000008\n[  555.355025] [<c04cdf7c>] (usb_stor_disconnect) from [<c04b3bc8>] (usb_unbind_interface+0x78/0x25c)\n[  555.363997]  r8:c13919b4 r7:edd3c000 r6:edd3c020 r5:ee551c68 r4:ee551c00 r3:c04cdf7c\n[  555.371892] [<c04b3b50>] (usb_unbind_interface) from [<c03dc248>] (__device_release_driver+0x8c/0x118)\n[  555.381213]  r10:00000001 r9:edd90c00 r8:c13919b4 r7:ee551c68 r6:c0b546e0 r5:c0b5563c\n[  555.389167]  r4:edd3c020\n[  555.391752] [<c03dc1bc>] (__device_release_driver) from [<c03dc2fc>] (device_release_driver+0x28/0x34)\n[  555.401071]  r5:edd3c020 r4:edd3c054\n[  555.404721] [<c03dc2d4>] (device_release_driver) from [<c03db304>] (bus_remove_device+0xe0/0x110)\n[  555.413607]  r5:edd3c020 r4:ef17f04c\n[  555.417253] [<c03db224>] (bus_remove_device) from [<c03d8128>] (device_del+0x114/0x21c)\n[  555.425270]  r6:edd3c028 r5:edd3c020 r4:ee551c00 r3:00000000\n[  555.431045] [<c03d8014>] (device_del) from [<c04b1560>] (usb_disable_device+0xa4/0x1e8)\n[  555.439061]  r8:edd3c000 r7:eded8000 r6:00000000 r5:00000001 r4:ee551c00\n[  555.445906] [<c04b14bc>] (usb_disable_device) from [<c04a8e54>] (usb_disconnect+0x74/0x224)\n[  555.454271]  r9:edd90c00 r8:ee551000 r7:ee551c68 r6:ee551c9c r5:ee551c00 r4:00000001\n[  555.462156] [<c04a8de0>] (usb_disconnect) from [<c04a8fb8>] (usb_disconnect+0x1d8/0x224)\n[  555.470259]  r10:00000001 r9:edd90000 r8:ee471e2c r7:ee551468 r6:ee55149c r5:ee551400\n[  555.478213]  r4:00000001\n[  555.480797] [<c04a8de0>] (usb_disconnect) from [<c04ae5ec>] (usb_remove_hcd+0xa0/0x1ac)\n[  555.488813]  r10:00000001 r9:ee471eb0 r8:00000000 r7:ef3d9500 r6:eded810c r5:eded80b0\n[  555.496765]  r4:eded8000\n[  555.499351] [<c04ae54c>] (usb_remove_hcd) from [<c04d4158>] (host_stop+0x28/0x64)\n[  555.506847]  r6:eeb50010 r5:eded8000 r4:eeb51010\n[  555.511563] [<c04d4130>] (host_stop) from [<c04d09b8>] (ci_otg_work+0xc4/0x124)\n[  555.518885]  r6:00000001 r5:eeb50010 r4:eeb502a0 r3:c04d4130\n[  555.524665] [<c04d08f4>] (ci_otg_work) from [<c00454f0>] (process_one_work+0x194/0x420)\n[  555.532682]  r6:ef086000 r5:eeb502a0 r4:edc44480\n[  555.537393] [<c004535c>] (process_one_work) from [<c00457b0>] (worker_thread+0x34/0x514)\n[  555.545496]  r10:edc44480 r9:ef086000 r8:c0b1a100 r7:ef086034 r6:00000088 r5:edc44498\n[  555.553450]  r4:ef086000\n[  555.556032] [<c004577c>] (worker_thread) from [<c004bab4>] (kthread+0xdc/0xf8)\n[  555.563268]  r10:00000000 r9:00000000 r8:00000000 r7:c004577c r6:edc44480 r5:eddc15c0\n[  555.571221]  r4:00000000\n[  555.573804] [<c004b9d8>] (kthread) from [<c000fef0>] (ret_from_fork+0x14/0x24)\n[  555.581040]  r7:00000000 r6:00000000 r5:c004b9d8 r4:eddc15c0\n\n[  553.429383] sh              D c07de74c     0   694    691 0x00000000\n[  553.435801] Backtrace:\n[  553.438295] [<c07de4fc>] (__schedule) from [<c07dec6c>] (schedule+0x48/0xa0)\n[  553.445358]  r10:edd3c054 r9:edd3c078 r8:edddbd50 r7:edcbbc00 r6:c1377c34 r5:60000153\n[  553.453313]  r4:eddda000\n[  553.455896] [<c07dec24>] (schedule) from [<c07deff8>] (schedule_preempt_disabled+0x10/0x14)\n[  553.464261]  r4:edd3c058 r3:0000000a\n[  553.467910] [<c07defe8>] (schedule_preempt_disabled) from [<c07e0bbc>] (mutex_lock_nested+0x1a0/0x3e8)\n[  553.477254] [<c07e0a1c>] (mutex_lock_nested) from [<c03e927c>] (dpm_complete+0xc0/0x1b0)\n[  553.485358]  r10:00561408 r9:edd3c054 r8:c0b4863c r7:edddbd90 r6:c0b485d8 r5:edd3c020\n[  553.493313]  r4:edd3c0d0\n[  553.495896] [<c03e91bc>] (dpm_complete) from [<c03e9388>] (dpm_resume_end+0x1c/0x20)\n[  553.503652]  r9:00000000 r8:c0b1a9d0 r7:c1334ec0 r6:c1334edc r5:00000003 r4:00000010\n[  553.511544] [<c03e936c>] (dpm_resume_end) from [<c0079894>] (suspend_devices_and_enter+0x158/0x504)\n[  553.520604]  r4:00000000 r3:c1334efc\n[  553.524250] [<c007973c>] (suspend_devices_and_enter) from [<c0079e74>] (pm_suspend+0x234/0x2cc)\n[  553.532961]  r10:00561408 r9:ed6b7300 r8:00000004 r7:c1334eec r6:00000000 r5:c1334ee8\n[  553.540914]  r4:00000003\n[  553.543493] [<c0079c40>] (pm_suspend) from [<c0078a6c>] (state_store+0x6c/0xc0)\n\n[  555.703684] 7 locks held by kworker/u2:13/826:\n[  555.708140]  #0:  (\"%s\"\"ci_otg\"){++++.+}, at: [<c0045484>] process_one_work+0x128/0x420\n[  555.716277]  #1:  ((&ci->work)){+.+.+.}, at: [<c0045484>] process_one_work+0x128/0x420\n[  555.724317]  #2:  (usb_bus_list_lock){+.+.+.}, at: [<c04ae5e4>] usb_remove_hcd+0x98/0x1ac\n[  555.732626]  #3:  (&dev->mutex){......}, at: [<c04a8e28>] usb_disconnect+0x48/0x224\n[  555.740403]  #4:  (&dev->mutex){......}, at: [<c04a8e28>] usb_disconnect+0x48/0x224\n[  555.748179]  #5:  (&dev->mutex){......}, at: [<c03dc2f4>] device_release_driver+0x20/0x34\n[  555.756487]  #6:  (&shost->scan_mutex){+.+.+.}, at: [<c04097d0>] scsi_remove_host+0x20/0x104\n\nCc: Jun Li <jun.li@nxp.com>\nSigned-off-by: Peter Chen <peter.chen@nxp.com>\nSigned-off-by: Kamal Mostafa <kamal@canonical.com>","distinct":false,"url":"https://api.github.com/repos/inaddy/wily/commits/25866cccf94d66a916812a28d86ae27f9a3f003a"},{"sha":"1a4f24b12ed97d83d3cb6a348d2b0a7ed951a7f0","author":{"email":"5832886f93ec934ed3ea3b4687be7c55600d6eaf@rohde-schwarz.com","name":"Thomas Betker"},"message":"Revert \"jffs2: Fix lock acquisition order bug in jffs2_write_begin\"\n\nBugLink: http://bugs.launchpad.net/bugs/1561677\n\ncommit 157078f64b8a9cd7011b6b900b2f2498df850748 upstream.\n\nThis reverts commit 5ffd3412ae55\n(\"jffs2: Fix lock acquisition order bug in jffs2_write_begin\").\n\nThe commit modified jffs2_write_begin() to remove a deadlock with\njffs2_garbage_collect_live(), but this introduced new deadlocks found\nby multiple users. page_lock() actually has to be called before\nmutex_lock(&c->alloc_sem) or mutex_lock(&f->sem) because\njffs2_write_end() and jffs2_readpage() are called with the page locked,\nand they acquire c->alloc_sem and f->sem, resp.\n\nIn other words, the lock order in jffs2_write_begin() was correct, and\nit is the jffs2_garbage_collect_live() path that has to be changed.\n\nRevert the commit to get rid of the new deadlocks, and to clear the way\nfor a better fix of the original deadlock.\n\nReported-by: Deng Chao <deng.chao1@zte.com.cn>\nReported-by: Ming Liu <liu.ming50@gmail.com>\nReported-by: wangzaiwei <wangzaiwei@top-vision.cn>\nSigned-off-by: Thomas Betker <thomas.betker@rohde-schwarz.com>\nSigned-off-by: David Woodhouse <David.Woodhouse@intel.com>\nSigned-off-by: Kamal Mostafa <kamal@canonical.com>","distinct":false,"url":"https://api.github.com/repos/inaddy/wily/commits/1a4f24b12ed97d83d3cb6a348d2b0a7ed951a7f0"},{"sha":"b4668c717c9ec2556864e2724457b54b81669297","author":{"email":"b460d66aaf00c296a3db1c1d9eeafc081d5f7d70@intel.com","name":"David Woodhouse"},"message":"jffs2: Fix page lock / f->sem deadlock\n\nBugLink: http://bugs.launchpad.net/bugs/1561677\n\ncommit 49e91e7079febe59a20ca885a87dd1c54240d0f1 upstream.\n\nWith this fix, all code paths should now be obtaining the page lock before\nf->sem.\n\nReported-by: Szabó Tamás <sztomi89@gmail.com>\nTested-by: Thomas Betker <thomas.betker@rohde-schwarz.com>\nSigned-off-by: David Woodhouse <David.Woodhouse@intel.com>\nSigned-off-by: Kamal Mostafa <kamal@canonical.com>","distinct":false,"url":"https://api.github.com/repos/inaddy/wily/commits/b4668c717c9ec2556864e2724457b54b81669297"}]}