{"push_id":958486130,"size":1,"distinct_size":1,"ref":"refs/heads/saberTest","head":"3bc0995ec3475c6c4e9644a7fb7e0c5fb1cc13c2","before":"f3b8d8dff4ee139fd581f6b93bfc8b9786b63c2c","commits":[{"sha":"3bc0995ec3475c6c4e9644a7fb7e0c5fb1cc13c2","author":{"email":"872f71ea18f72c0748629a56d0a990d2fe86539f@gmail.com","name":"f100cleveland"},"message":"Linux 3.10.96\n\n(cherry picked from commit 2c3c81cd7b5c04267fab0ec93fd04180d062f797)\nLinux 3.10.96\n\nx86/signal: Fix restart_syscall number for x32 tasks\n\ncommit 22eab1108781eff09961ae7001704f7bd8fb1dce upstream.\n\nWhen restarting a syscall with regs->ax == -ERESTART_RESTARTBLOCK,\nregs->ax is assigned to a restart_syscall number.  For x32 tasks, this\nsyscall number must have __X32_SYSCALL_BIT set, otherwise it will be\nan x86_64 syscall number instead of a valid x32 syscall number. This\nissue has been there since the introduction of x32.\n\nReported-by: strace/tests/restart_syscall.test\nReported-and-tested-by: Elvira Khabirova <lineprinter0@gmail.com>\nSigned-off-by: Dmitry V. Levin <ldv@altlinux.org>\nCc: Elvira Khabirova <lineprinter0@gmail.com>\nLink: http://lkml.kernel.org/r/20151130215436.GA25996@altlinux.org\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nxen/gntdev: Grant maps should not be subject to NUMA balancing\n\ncommit 9c17d96500f78d7ecdb71ca6942830158bc75a2b upstream.\n\nDoing so will cause the grant to be unmapped and then, during\nfault handling, the fault to be mistakenly treated as NUMA hint\nfault.\n\nIn addition, even if those maps could partcipate in NUMA\nbalancing, it wouldn't provide any benefit since we are unable\nto determine physical page's node (even if/when VNUMA is\nimplemented).\n\nMarking grant maps' VMAs as VM_IO will exclude them from being\npart of NUMA balancing.\n\nSigned-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>\nSigned-off-by: David Vrabel <david.vrabel@citrix.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nx86/xen: don't reset vcpu_info on a cancelled suspend\n\ncommit 6a1f513776b78c994045287073e55bae44ed9f8c upstream.\n\nOn a cancelled suspend the vcpu_info location does not change (it's\nstill in the per-cpu area registered by xen_vcpu_setup()).  So do not\ncall xen_hvm_init_shared_info() which would make the kernel think its\nback in the shared info.  With the wrong vcpu_info, events cannot be\nreceived and the domain will hang after a cancelled suspend.\n\nSigned-off-by: Charles Ouyang <ouyangzhaowei@huawei.com>\nReviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>\nSigned-off-by: David Vrabel <david.vrabel@citrix.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nKVM: PPC: Book3S HV: Prohibit setting illegal transaction state in MSR\n\ncommit c20875a3e638e4a03e099b343ec798edd1af5cc6 upstream.\n\nCurrently it is possible for userspace (e.g. QEMU) to set a value\nfor the MSR for a guest VCPU which has both of the TS bits set,\nwhich is an illegal combination.  The result of this is that when\nwe execute a hrfid (hypervisor return from interrupt doubleword)\ninstruction to enter the guest, the CPU will take a TM Bad Thing\ntype of program interrupt (vector 0x700).\n\nNow, if PR KVM is configured in the kernel along with HV KVM, we\nactually handle this without crashing the host or giving hypervisor\nprivilege to the guest; instead what happens is that we deliver a\nprogram interrupt to the guest, with SRR0 reflecting the address\nof the hrfid instruction and SRR1 containing the MSR value at that\npoint.  If PR KVM is not configured in the kernel, then we try to\nrun the host's program interrupt handler with the MMU set to the\nguest context, which almost certainly causes a host crash.\n\nThis closes the hole by making kvmppc_set_msr_hv() check for the\nillegal combination and force the TS field to a safe value (00,\nmeaning non-transactional).\n\nSigned-off-by: Paul Mackerras <paulus@samba.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nx86/reboot/quirks: Add iMac10,1 to pci_reboot_dmi_table[]\n\ncommit 2f0c0b2d96b1205efb14347009748d786c2d9ba5 upstream.\n\nWithout the reboot=pci method, the iMac 10,1 simply\nhangs after printing \"Restarting system\" at the point\nwhen it should reboot. This fixes it.\n\nSigned-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>\nCc: Andy Lutomirski <luto@amacapital.net>\nCc: Borislav Petkov <bp@alien8.de>\nCc: Brian Gerst <brgerst@gmail.com>\nCc: Dave Jones <davej@codemonkey.org.uk>\nCc: Denys Vlasenko <dvlasenk@redhat.com>\nCc: H. Peter Anvin <hpa@zytor.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nLink: http://lkml.kernel.org/r/1450466646-26663-1-git-send-email-mario.kleiner.de@gmail.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nx86/boot: Double BOOT_HEAP_SIZE to 64KB\n\ncommit 8c31902cffc4d716450be549c66a67a8a3dd479c upstream.\n\nWhen decompressing kernel image during x86 bootup, malloc memory\nfor ELF program headers may run out of heap space, which leads\nto system halt.  This patch doubles BOOT_HEAP_SIZE to 64KB.\n\nTested with 32-bit kernel which failed to boot without this patch.\n\nSigned-off-by: H.J. Lu <hjl.tools@gmail.com>\nAcked-by: H. Peter Anvin <hpa@zytor.com>\nCc: Andy Lutomirski <luto@amacapital.net>\nCc: Borislav Petkov <bp@alien8.de>\nCc: Brian Gerst <brgerst@gmail.com>\nCc: Denys Vlasenko <dvlasenk@redhat.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: linux-kernel@vger.kernel.org\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nipmi: move timer init to before irq is setup\n\ncommit 27f972d3e00b50639deb4cc1392afaeb08d3cecc upstream.\n\nWe encountered a panic on boot in ipmi_si on a dell per320 due to an\nuninitialized timer as follows.\n\nstatic int smi_start_processing(void       *send_info,\n                                ipmi_smi_t intf)\n{\n        /* Try to claim any interrupts. */\n        if (new_smi->irq_setup)\n                new_smi->irq_setup(new_smi);\n\n --> IRQ arrives here and irq handler tries to modify uninitialized timer\n\n    which triggers BUG_ON(!timer->function) in __mod_timer().\n\n Call Trace:\n   <IRQ>\n   [<ffffffffa0532617>] start_new_msg+0x47/0x80 [ipmi_si]\n   [<ffffffffa053269e>] start_check_enables+0x4e/0x60 [ipmi_si]\n   [<ffffffffa0532bd8>] smi_event_handler+0x1e8/0x640 [ipmi_si]\n   [<ffffffff810f5584>] ? __rcu_process_callbacks+0x54/0x350\n   [<ffffffffa053327c>] si_irq_handler+0x3c/0x60 [ipmi_si]\n   [<ffffffff810efaf0>] handle_IRQ_event+0x60/0x170\n   [<ffffffff810f245e>] handle_edge_irq+0xde/0x180\n   [<ffffffff8100fc59>] handle_irq+0x49/0xa0\n   [<ffffffff8154643c>] do_IRQ+0x6c/0xf0\n   [<ffffffff8100ba53>] ret_from_intr+0x0/0x11\n\n        /* Set up the timer that drives the interface. */\n        setup_timer(&new_smi->si_timer, smi_timeout, (long)new_smi);\n\nThe following patch fixes the problem.\n\nTo: Openipmi-developer@lists.sourceforge.net\nTo: Corey Minyard <minyard@acm.org>\nCC: linux-kernel@vger.kernel.org\n\nSigned-off-by: Jan Stancek <jstancek@redhat.com>\nSigned-off-by: Tony Camuso <tcamuso@redhat.com>\nSigned-off-by: Corey Minyard <cminyard@mvista.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nALSA: hda - Add Intel Lewisburg device IDs Audio\n\ncommit 5cf92c8b3dc5da59e05dc81bdc069cedf6f38313 upstream.\n\nAdding Intel codename Lewisburg platform device IDs for audio.\n\n[rearranged the position by tiwai]\n\nSigned-off-by: Alexandra Yates <alexandra.yates@linux.intel.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nALSA: hda - Apply pin fixup for HP ProBook 6550b\n\ncommit c932b98c1e47312822d911c1bb76e81ef50e389c upstream.\n\nHP ProBook 6550b needs the same pin fixup applied to other HP B-series\nlaptops with docks for making its headphone and dock headphone jacks\nworking properly.  We just need to add the codec SSID to the list.\n\nBugzilla: https://bugzilla.kernel.org/attachment.cgi?id=191971\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nALSA: rme96: Fix unexpected volume reset after rate changes\n\ncommit a74a821624c0c75388a193337babd17a8c02c740 upstream.\n\nrme96 driver needs to reset DAC depending on the sample rate, and this\nresults in resetting to the max volume suddenly.  It's because of the\nmissing call of snd_rme96_apply_dac_volume().\n\nHowever, calling this function right after the DAC reset still may not\nwork, and we need some delay before this call.  Since the DAC reset\nand the procedure after that are performed in the spinlock, we delay\nthe DAC volume restore at the end after the spinlock.\n\nReported-and-tested-by: Sylvain LABOISNE <maeda1@free.fr>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nALSA: hda - Add inverted dmic for Packard Bell DOTS\n\ncommit 02f6ff90400d055f08b0ba0b5f0707630b6faed7 upstream.\n\nOn the internal mic of the Packard Bell DOTS, one channel\nhas an inverted signal. Add a quirk to fix this up.\n\nBugLink: https://bugs.launchpad.net/bugs/1523232\nSigned-off-by: David Henningsson <david.henningsson@canonical.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nALSA: hda - Set SKL+ hda controller power at freeze() and thaw()\n\ncommit 3e6db33aaf1d42a30339f831ec4850570d6cc7a3 upstream.\n\nIt takes three minutes to enter into hibernation on some OEM SKL\nmachines and we see many codec spurious response after thaw() opertion.\nThis is because HDA is still in D0 state after freeze() call and\npci_pm_freeze/pci_pm_freeze_noirq() don't set D3 hot in pci_bus driver.\nIt seems bios still access HDA when system enter into freeze state,\nHDA will receive codec response interrupt immediately after thaw() call.\nBecause of this unexpected interrupt, HDA enter into a abnormal\nstate and slow down the system enter into hibernation.\n\nIn this patch, we put HDA into D3 hot state in azx_freeze_noirq() and\nput HDA into D0 state in azx_thaw_noirq().\n\nV2: Only apply this fix to SKL+\n    Fix compile error when CONFIG_PM_SLEEP isn't defined\n\n[Yet another fix for CONFIG_PM_SLEEP ifdef and the additional comment\n by tiwai]\n\nSigned-off-by: Xiong Zhang <xiong.y.zhang@intel.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nALSA: hda/realtek - Fix silent headphone output on MacPro 4,1 (v2)\n\ncommit 9f660a1c43890c2cdd1f423fd73654e7ca08fe56 upstream.\n\nWithout this patch, internal speaker and line-out work,\nbut front headphone output jack stays silent on the\nMac Pro 4,1.\n\nThis code path also gets executed on the MacPro 5,1 due\nto identical codec SSID, but i don't know if it has any\npositive or adverse effects there or not.\n\n(v2) Implement feedback from Takashi Iwai: Reuse\n     alc889_fixup_mbp_vref and just add a new nid\n     0x19 for the MacPro 4,1.\n\nSigned-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nALSA: seq: Fix missing NULL check at remove_events ioctl\n\ncommit 030e2c78d3a91dd0d27fef37e91950dde333eba1 upstream.\n\nsnd_seq_ioctl_remove_events() calls snd_seq_fifo_clear()\nunconditionally even if there is no FIFO assigned, and this leads to\nan Oops due to NULL dereference.  The fix is just to add a proper NULL\ncheck.\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nTested-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nALSA: seq: Fix race at timer setup and close\n\ncommit 3567eb6af614dac436c4b16a8d426f9faed639b3 upstream.\n\nALSA sequencer code has an open race between the timer setup ioctl and\nthe close of the client.  This was triggered by syzkaller fuzzer, and\na use-after-free was caught there as a result.\n\nThis patch papers over it by adding a proper queue->timer_mutex lock\naround the timer-related calls in the relevant code path.\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nTested-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nALSA: timer: Harden slave timer list handling\n\ncommit b5a663aa426f4884c71cd8580adae73f33570f0d upstream.\n\nA slave timer instance might be still accessible in a racy way while\noperating the master instance as it lacks of locking.  Since the\nmaster operation is mostly protected with timer->lock, we should cope\nwith it while changing the slave instance, too.  Also, some linked\nlists (active_list and ack_list) of slave instances aren't unlinked\nimmediately at stopping or closing, and this may lead to unexpected\naccesses.\n\nThis patch tries to address these issues.  It adds spin lock of\ntimer->lock (either from master or slave, which is equivalent) in a\nfew places.  For avoiding a deadlock, we ensure that the global\nslave_active_lock is always locked at first before each timer lock.\n\nAlso, ack and active_list of slave instances are properly unlinked at\nsnd_timer_stop() and snd_timer_close().\n\nLast but not least, remove the superfluous call of _snd_timer_stop()\nat removing slave links.  This is a noop, and calling it may confuse\nreaders wrt locking.  Further cleanup will follow in a later patch.\n\nActually we've got reports of use-after-free by syzkaller fuzzer, and\nthis hopefully fixes these issues.\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nALSA: timer: Fix race among timer ioctls\n\ncommit af368027a49a751d6ff4ee9e3f9961f35bb4fede upstream.\n\nALSA timer ioctls have an open race and this may lead to a\nuse-after-free of timer instance object.  A simplistic fix is to make\neach ioctl exclusive.  We have already tread_sem for controlling the\ntread, and extend this as a global mutex to be applied to each ioctl.\n\nThe downside is, of course, the worse concurrency.  But these ioctls\naren't to be parallel accessible, in anyway, so it should be fine to\nserialize there.\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nTested-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nALSA: timer: Fix double unlink of active_list\n\ncommit ee8413b01045c74340aa13ad5bdf905de32be736 upstream.\n\nALSA timer instance object has a couple of linked lists and they are\nunlinked unconditionally at snd_timer_stop().  Meanwhile\nsnd_timer_interrupt() unlinks it, but it calls list_del() which leaves\nthe element list itself unchanged.  This ends up with unlinking twice,\nand it was caught by syzkaller fuzzer.\n\nThe fix is to use list_del_init() variant properly there, too.\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nTested-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode\n\ncommit 9586495dc3011a80602329094e746dbce16cb1f1 upstream.\n\nThis reverts one hunk of\ncommit ef44a1ec6eee (\"ALSA: sound/core: use memdup_user()\"), which\nreplaced a number of kmalloc followed by memcpy with memdup calls.\n\nIn this case, we are copying from a struct snd_seq_port_info32 to a\nstruct snd_seq_port_info, but the latter is 4 bytes longer than the\n32-bit version, so we need to separate kmalloc and copy calls.\n\nFixes: ef44a1ec6eee ('ALSA: sound/core: use memdup_user()')\nSigned-off-by: Nicolas Boichat <drinkcat@chromium.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nALSA: pcm: Fix snd_pcm_hw_params struct copy in compat mode\n\ncommit 43c54b8c7cfe22f868a751ba8a59abf1724160b1 upstream.\n\nThis reverts one hunk of\ncommit ef44a1ec6eee (\"ALSA: sound/core: use memdup_user()\"), which\nreplaced a number of kmalloc followed by memcpy with memdup calls.\n\nIn this case, we are copying from a struct snd_pcm_hw_params32 to\na struct snd_pcm_hw_params, but the latter is 4 bytes longer than\nthe 32-bit version, so we need to separate kmalloc and copy calls.\n\nThis actually leads to an out-of-bounds memory access later on\nin sound/soc/soc-pcm.c:soc_pcm_hw_params() (detected using KASan).\n\nFixes: ef44a1ec6eee ('ALSA: sound/core: use memdup_user()')\nSigned-off-by: Nicolas Boichat <drinkcat@chromium.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nALSA: hrtimer: Fix stall by hrtimer_cancel()\n\ncommit 2ba1fe7a06d3624f9a7586d672b55f08f7c670f3 upstream.\n\nhrtimer_cancel() waits for the completion from the callback, thus it\nmust not be called inside the callback itself.  This was already a\nproblem in the past with ALSA hrtimer driver, and the early commit\n[fcfdebe70759: ALSA: hrtimer - Fix lock-up] tried to address it.\n\nHowever, the previous fix is still insufficient: it may still cause a\nlockup when the ALSA timer instance reprograms itself in its callback.\nThen it invokes the start function even in snd_timer_interrupt() that\nis called in hrtimer callback itself, results in a CPU stall.  This is\nno hypothetical problem but actually triggered by syzkaller fuzzer.\n\nThis patch tries to fix the issue again.  Now we call\nhrtimer_try_to_cancel() at both start and stop functions so that it\nwon't fall into a deadlock, yet giving some chance to cancel the queue\nif the functions have been called outside the callback.  The proper\nhrtimer_cancel() is called in anyway at closing, so this should be\nenough.\n\nReported-and-tested-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nALSA: control: Avoid kernel warnings from tlv ioctl with numid 0\n\ncommit c0bcdbdff3ff73a54161fca3cb8b6cdbd0bb8762 upstream.\n\nWhen a TLV ioctl with numid zero is handled, the driver may spew a\nkernel warning with a stack trace at each call.  The check was\nintended obviously only for a kernel driver, but not for a user\ninteraction.  Let's fix it.\n\nThis was spotted by syzkaller fuzzer.\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nASoC: wm8962: correct addresses for HPF_C_0/1\n\ncommit e9f96bc53c1b959859599cb30ce6fd4fbb4448c2 upstream.\n\nFrom datasheet:\nR17408 (4400h) HPF_C_1\nR17409 (4401h) HPF_C_0\n17048 -> 17408 (0x4400)\n17049 -> 17409 (0x4401)\n\nSigned-off-by: Sachin Pandhare <sachinpandhare@gmail.com>\nAcked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nASoC: arizona: Fix bclk for sample rates that are multiple of 4kHz\n\ncommit e73694d871867cae8471d2350ce89acb38bc2b63 upstream.\n\nFor a sample rate of 12kHz the bclk was taken from the 44.1kHz table as\nwe test for a multiple of 8kHz. This patch fixes this issue by testing\nfor multiples of 4kHz instead.\n\nSigned-off-by: Nikesh Oswal <Nikesh.Oswal@cirrus.com>\nSigned-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nASoC: compress: Fix compress device direction check\n\ncommit a1068045883ed4a18363a4ebad0c3d55e473b716 upstream.\n\nThe detection of direction for compress was only taking into account codec\ncapabilities and not CPU ones. Fix this by checking the CPU side capabilities\nas well\n\nTested-by: Ashish Panwar <ashish.panwar@intel.com>\nSigned-off-by: Vinod Koul <vinod.koul@intel.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nusb: xhci: fix config fail of FS hub behind a HS hub with MTT\n\ncommit 096b110a3dd3c868e4610937c80d2e3f3357c1a9 upstream.\n\nif a full speed hub connects to a high speed hub which\nsupports MTT, the MTT field of its slot context will be set\nto 1 when xHCI driver setups an xHCI virtual device in\nxhci_setup_addressable_virt_dev(); once usb core fetch its\nhub descriptor, and need to update the xHC's internal data\nstructures for the device, the HUB field of its slot context\nwill be set to 1 too, meanwhile MTT is also set before,\nthis will cause configure endpoint command fail, so in the\ncase, we should clear MTT to 0 for full speed hub according\nto section 6.2.2\n\nSigned-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>\nSigned-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nUSB: ipaq.c: fix a timeout loop\n\ncommit abdc9a3b4bac97add99e1d77dc6d28623afe682b upstream.\n\nThe code expects the loop to end with \"retries\" set to zero but, because\nit is a post-op, it will end set to -1.  I have fixed this by moving the\ndecrement inside the loop.\n\nFixes: 014aa2a3c32e ('USB: ipaq: minor ipaq_open() cleanup.')\nSigned-off-by: Dan Carpenter <dan.carpenter@oracle.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nUSB: cp210x: add ID for ELV Marble Sound Board 1\n\ncommit f7d7f59ab124748156ea551edf789994f05da342 upstream.\n\nAdd the USB device ID for ELV Marble Sound Board 1.\n\nSigned-off-by: Oliver Freyermuth <o.freyermuth@googlemail.com>\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nxhci: refuse loading if nousb is used\n\ncommit 1eaf35e4dd592c59041bc1ed3248c46326da1f5f upstream.\n\nThe module should fail to load.\n\nSigned-off-by: Oliver Neukum <oneukum@suse.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nveth: don’t modify ip_summed; doing so treats packets with bad checksums as good.\n\n[ Upstream commit ce8c839b74e3017996fad4e1b7ba2e2625ede82f ]\n\nPackets that arrive from real hardware devices have ip_summed ==\nCHECKSUM_UNNECESSARY if the hardware verified the checksums, or\nCHECKSUM_NONE if the packet is bad or it was unable to verify it. The\ncurrent version of veth will replace CHECKSUM_NONE with\nCHECKSUM_UNNECESSARY, which causes corrupt packets routed from hardware to\na veth device to be delivered to the application. This caused applications\nat Twitter to receive corrupt data when network hardware was corrupting\npackets.\n\nWe believe this was added as an optimization to skip computing and\nverifying checksums for communication between containers. However, locally\ngenerated packets have ip_summed == CHECKSUM_PARTIAL, so the code as\nwritten does nothing for them. As far as we can tell, after removing this\ncode, these packets are transmitted from one stack to another unmodified\n(tcpdump shows invalid checksums on both sides, as expected), and they are\ndelivered correctly to applications. We didn’t test every possible network\nconfiguration, but we tried a few common ones such as bridging containers,\nusing NAT between the host and a container, and routing from hardware\ndevices to containers. We have effectively deployed this in production at\nTwitter (by disabling RX checksum offloading on veth devices).\n\nThis code dates back to the first version of the driver, commit\n<e314dbdc1c0dc6a548ecf> (\"[NET]: Virtual ethernet device driver\"), so I\nsuspect this bug occurred mostly because the driver API has evolved\nsignificantly since then. Commit <0b7967503dc97864f283a> (\"net/veth: Fix\npacket checksumming\") (in December 2010) fixed this for packets that get\ncreated locally and sent to hardware devices, by not changing\nCHECKSUM_PARTIAL. However, the same issue still occurs for packets coming\nin from hardware devices.\n\nCo-authored-by: Evan Jones <ej@evanjones.ca>\nSigned-off-by: Evan Jones <ej@evanjones.ca>\nCc: Nicolas Dichtel <nicolas.dichtel@6wind.com>\nCc: Phil Sutter <phil@nwl.cc>\nCc: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>\nCc: netdev@vger.kernel.org\nCc: linux-kernel@vger.kernel.org\nSigned-off-by: Vijay Pandurangan <vijayp@vijayp.ca>\nAcked-by: Cong Wang <cwang@twopensource.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nipv6/addrlabel: fix ip6addrlbl_get()\n\n[ Upstream commit e459dfeeb64008b2d23bdf600f03b3605dbb8152 ]\n\nip6addrlbl_get() has never worked. If ip6addrlbl_hold() succeeded,\nip6addrlbl_get() will exit with '-ESRCH'. If ip6addrlbl_hold() failed,\nip6addrlbl_get() will use about to be free ip6addrlbl_entry pointer.\n\nFix this by inverting ip6addrlbl_hold() check.\n\nFixes: 2a8cc6c89039 (\"[IPV6] ADDRCONF: Support RFC3484 configurable address selection policy table.\")\nSigned-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>\nReviewed-by: Cong Wang <cwang@twopensource.com>\nAcked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nsctp: sctp should release assoc when sctp_make_abort_user return NULL in sctp_close\n\n[ Upstream commit 068d8bd338e855286aea54e70d1c101569284b21 ]\n\nIn sctp_close, sctp_make_abort_user may return NULL because of memory\nallocation failure. If this happens, it will bypass any state change\nand never free the assoc. The assoc has no chance to be freed and it\nwill be kept in memory with the state it had even after the socket is\nclosed by sctp_close().\n\nSo if sctp_make_abort_user fails to allocate memory, we should abort\nthe asoc via sctp_primitive_ABORT as well. Just like the annotation in\nsctp_sf_cookie_wait_prm_abort and sctp_sf_do_9_1_prm_abort said,\n\"Even if we can't send the ABORT due to low memory delete the TCB.\nThis is a departure from our typical NOMEM handling\".\n\nBut then the chunk is NULL (low memory) and the SCTP_CMD_REPLY cmd would\ndereference the chunk pointer, and system crash. So we should add\nSCTP_CMD_REPLY cmd only when the chunk is not NULL, just like other\nplaces where it adds SCTP_CMD_REPLY cmd.\n\nSigned-off-by: Xin Long <lucien.xin@gmail.com>\nAcked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nconnector: bump skb->users before callback invocation\n\n[ Upstream commit 55285bf09427c5abf43ee1d54e892f352092b1f1 ]\n\nDmitry reports memleak with syskaller program.\nProblem is that connector bumps skb usecount but might not invoke callback.\n\nSo move skb_get to where we invoke the callback.\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nunix: properly account for FDs passed over unix sockets\n\n[ Upstream commit 712f4aad406bb1ed67f3f98d04c044191f0ff593 ]\n\nIt is possible for a process to allocate and accumulate far more FDs than\nthe process' limit by sending them over a unix socket then closing them\nto keep the process' fd count low.\n\nThis change addresses this problem by keeping track of the number of FDs\nin flight per user and preventing non-privileged processes from having\nmore FDs in flight than their configured FD limit.\n\nReported-by: socketpair@gmail.com\nReported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>\nMitigates: CVE-2013-4312 (Linux 2.0+)\nSuggested-by: Linus Torvalds <torvalds@linux-foundation.org>\nAcked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nbridge: Only call /sbin/bridge-stp for the initial network namespace\n\n[ Upstream commit ff62198553e43cdffa9d539f6165d3e83f8a42bc ]\n\n[I stole this patch from Eric Biederman. He wrote:]\n\n> There is no defined mechanism to pass network namespace information\n> into /sbin/bridge-stp therefore don't even try to invoke it except\n> for bridge devices in the initial network namespace.\n>\n> It is possible for unprivileged users to cause /sbin/bridge-stp to be\n> invoked for any network device name which if /sbin/bridge-stp does not\n> guard against unreasonable arguments or being invoked twice on the\n> same network device could cause problems.\n\n[Hannes: changed patch using netns_eq]\n\nCc: Eric W. Biederman <ebiederm@xmission.com>\nSigned-off-by: Eric W. Biederman <ebiederm@xmission.com>\nSigned-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nnet: possible use after free in dst_release\n\n[ Upstream commit 07a5d38453599052aff0877b16bb9c1585f08609 ]\n\ndst_release should not access dst->flags after decrementing\n__refcnt to 0. The dst_entry may be in dst_busy_list and\ndst_gc_task may dst_destroy it before dst_release gets a chance\nto access dst->flags.\n\nFixes: d69bbf88c8d0 (\"net: fix a race in dst_release()\")\nFixes: 27b75c95f10d (\"net: avoid RCU for NOCACHE dst\")\nSigned-off-by: Francesco Ruggeri <fruggeri@arista.com>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ntcp_yeah: don't set ssthresh below 2\n\n[ Upstream commit 83d15e70c4d8909d722c0d64747d8fb42e38a48f ]\n\nFor tcp_yeah, use an ssthresh floor of 2, the same floor used by Reno\nand CUBIC, per RFC 5681 (equation 4).\n\ntcp_yeah_ssthresh() was sometimes returning a 0 or negative ssthresh\nvalue if the intended reduction is as big or bigger than the current\ncwnd. Congestion control modules should never return a zero or\nnegative ssthresh. A zero ssthresh generally results in a zero cwnd,\ncausing the connection to stall. A negative ssthresh value will be\ninterpreted as a u32 and will set a target cwnd for PRR near 4\nbillion.\n\nOleksandr Natalenko reported that a system using tcp_yeah with ECN\ncould see a warning about a prior_cwnd of 0 in\ntcp_cwnd_reduction(). Testing verified that this was due to\ntcp_yeah_ssthresh() misbehaving in this way.\n\nReported-by: Oleksandr Natalenko <oleksandr@natalenko.name>\nSigned-off-by: Neal Cardwell <ncardwell@google.com>\nSigned-off-by: Yuchung Cheng <ycheng@google.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nphonet: properly unshare skbs in phonet_rcv()\n\n[ Upstream commit 7aaed57c5c2890634cfadf725173c7c68ea4cb4f ]\n\nIvaylo Dimitrov reported a regression caused by commit 7866a621043f\n(\"dev: add per net_device packet type chains\").\n\nskb->dev becomes NULL and we crash in __netif_receive_skb_core().\n\nBefore above commit, different kind of bugs or corruptions could happen\nwithout major crash.\n\nBut the root cause is that phonet_rcv() can queue skb without checking\nif skb is shared or not.\n\nMany thanks to Ivaylo Dimitrov for his help, diagnosis and tests.\n\nReported-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>\nTested-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Remi Denis-Courmont <courmisch@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nisdn_ppp: Add checks for allocation failure in isdn_ppp_open()\n\n[ Upstream commit 0baa57d8dc32db78369d8b5176ef56c5e2e18ab3 ]\n\nCompile-tested only.\n\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nppp, slip: Validate VJ compression slot parameters completely\n\n[ Upstream commit 4ab42d78e37a294ac7bc56901d563c642e03c4ae ]\n\nCurrently slhc_init() treats out-of-range values of rslots and tslots\nas equivalent to 0, except that if tslots is too large it will\ndereference a null pointer (CVE-2015-7799).\n\nAdd a range-check at the top of the function and make it return an\nERR_PTR() on error instead of NULL.  Change the callers accordingly.\n\nCompile-tested only.\n\nReported-by: 郭永刚 <guoyonggang@360.cn>\nReferences: http://article.gmane.org/gmane.comp.security.oss.general/17908\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nteam: Replace rcu_read_lock with a mutex in team_vlan_rx_kill_vid\n\n[ Upstream commit 60a6531bfe49555581ccd65f66a350cc5693fcde ]\n\nWe can't be within an RCU read-side critical section when deleting\nVLANs, as underlying drivers might sleep during the hardware operation.\nTherefore, replace the RCU critical section with a mutex. This is\nconsistent with team_vlan_rx_add_vid.\n\nFixes: 3d249d4ca7d0 (\"net: introduce ethernet teaming device\")\nAcked-by: Jiri Pirko <jiri@mellanox.com>\nSigned-off-by: Ido Schimmel <idosch@mellanox.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\npowerpc/tm: Block signal return setting invalid MSR state\n\ncommit d2b9d2a5ad5ef04ff978c9923d19730cb05efd55 upstream.\n\nCurrently we allow both the MSR T and S bits to be set by userspace on\na signal return.  Unfortunately this is a reserved configuration and\nwill cause a TM Bad Thing exception if attempted (via rfid).\n\nThis patch checks for this case in both the 32 and 64 bit signals\ncode.  If both T and S are set, we mark the context as invalid.\n\nFound using a syscall fuzzer.\n\nFixes: 2b0a576d15e0 (\"powerpc: Add new transactional memory state to the signal context\")\nSigned-off-by: Michael Neuling <mikey@neuling.org>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\npowerpc: Make value-returning atomics fully ordered\n\ncommit 49e9cf3f0c04bf76ffa59242254110309554861d upstream.\n\nAccording to memory-barriers.txt:\n\n> Any atomic operation that modifies some state in memory and returns\n> information about the state (old or new) implies an SMP-conditional\n> general memory barrier (smp_mb()) on each side of the actual\n> operation ...\n\nWhich mean these operations should be fully ordered. However on PPC,\nPPC_ATOMIC_ENTRY_BARRIER is the barrier before the actual operation,\nwhich is currently \"lwsync\" if SMP=y. The leading \"lwsync\" can not\nguarantee fully ordered atomics, according to Paul Mckenney:\n\nhttps://lkml.org/lkml/2015/10/14/970\n\nTo fix this, we define PPC_ATOMIC_ENTRY_BARRIER as \"sync\" to guarantee\nthe fully-ordered semantics.\n\nThis also makes futex atomics fully ordered, which can avoid possible\nmemory ordering problems if userspace code relies on futex system call\nfor fully ordered semantics.\n\nFixes: b97021f85517 (\"powerpc: Fix atomic_xxx_return barrier semantics\")\nSigned-off-by: Boqun Feng <boqun.feng@gmail.com>\nReviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>\nAcked-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\npowerpc: Make {cmp}xchg* and their atomic_ versions fully ordered\n\ncommit 81d7a3294de7e9828310bbf986a67246b13fa01e upstream.\n\nAccording to memory-barriers.txt, xchg*, cmpxchg* and their atomic_\nversions all need to be fully ordered, however they are now just\nRELEASE+ACQUIRE, which are not fully ordered.\n\nSo also replace PPC_RELEASE_BARRIER and PPC_ACQUIRE_BARRIER with\nPPC_ATOMIC_ENTRY_BARRIER and PPC_ATOMIC_EXIT_BARRIER in\n__{cmp,}xchg_{u32,u64} respectively to guarantee fully ordered semantics\nof atomic{,64}_{cmp,}xchg() and {cmp,}xchg(), as a complement of commit\nb97021f85517 (\"powerpc: Fix atomic_xxx_return barrier semantics\")\n\nThis patch depends on patch \"powerpc: Make value-returning atomics fully\nordered\" for PPC_ATOMIC_ENTRY_BARRIER definition.\n\nSigned-off-by: Boqun Feng <boqun.feng@gmail.com>\nReviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>\nAcked-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nscripts/recordmcount.pl: support data in text section on powerpc\n\ncommit 2e50c4bef77511b42cc226865d6bc568fa7f8769 upstream.\n\nIf a text section starts out with a data blob before the first\nfunction start label, disassembly parsing doing in recordmcount.pl\ngets confused on powerpc, leading to creation of corrupted module\nobjects.\n\nThis was not a problem so far since the compiler would never create\nsuch text sections.  However, this has changed with a recent change\nin GCC 6 to support distances of > 2GB between a function and its\nassoicated TOC in the ELFv2 ABI, exposing this problem.\n\nThere is already code in recordmcount.pl to handle such data blobs\non the sparc64 platform.  This patch uses the same method to handle\nthose on powerpc as well.\n\nAcked-by: Steven Rostedt <rostedt@goodmis.org>\nSigned-off-by: Ulrich Weigand <ulrich.weigand@de.ibm.com>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\narm64: fix building without CONFIG_UID16\n\ncommit fbc416ff86183e2203cdf975e2881d7c164b0271 upstream.\n\nAs reported by Michal Simek, building an ARM64 kernel with CONFIG_UID16\ndisabled currently fails because the system call table still needs to\nreference the individual function entry points that are provided by\nkernel/sys_ni.c in this case, and the declarations are hidden inside\nof #ifdef CONFIG_UID16:\n\narch/arm64/include/asm/unistd32.h:57:8: error: 'sys_lchown16' undeclared here (not in a function)\n __SYSCALL(__NR_lchown, sys_lchown16)\n\nI believe this problem only exists on ARM64, because older architectures\ntend to not need declarations when their system call table is built\nin assembly code, while newer architectures tend to not need UID16\nsupport. ARM64 only uses these system calls for compatibility with\n32-bit ARM binaries.\n\nThis changes the CONFIG_UID16 check into CONFIG_HAVE_UID16, which is\nset unconditionally on ARM64 with CONFIG_COMPAT, so we see the\ndeclarations whenever we need them, but otherwise the behavior is\nunchanged.\n\nFixes: af1839eb4bd4 (\"Kconfig: clean up the long arch list for the UID16 config option\")\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nAcked-by: Will Deacon <will.deacon@arm.com>\nSigned-off-by: Catalin Marinas <catalin.marinas@arm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\narm64: Clear out any singlestep state on a ptrace detach operation\n\ncommit 5db4fd8c52810bd9740c1240ebf89223b171aa70 upstream.\n\nMake sure to clear out any ptrace singlestep state when a ptrace(2)\nPTRACE_DETACH call is made on arm64 systems.\n\nOtherwise, the previously ptraced task will die off with a SIGTRAP\nsignal if the debugger just previously singlestepped the ptraced task.\n\nSigned-off-by: John Blackwood <john.blackwood@ccur.com>\n[will: added comment to justify why this is in the arch code]\nSigned-off-by: Will Deacon <will.deacon@arm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\narm64: mm: ensure that the zero page is visible to the page table walker\n\ncommit 32d6397805d00573ce1fa55f408ce2bca15b0ad3 upstream.\n\nIn paging_init, we allocate the zero page, memset it to zero and then\npoint TTBR0 to it in order to avoid speculative fetches through the\nidentity mapping.\n\nIn order to guarantee that the freshly zeroed page is indeed visible to\nthe page table walker, we need to execute a dsb instruction prior to\nwriting the TTBR.\n\nSigned-off-by: Will Deacon <will.deacon@arm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nparisc iommu: fix panic due to trying to allocate too large region\n\ncommit e46e31a3696ae2d66f32c207df3969613726e636 upstream.\n\nWhen using the Promise TX2+ SATA controller on PA-RISC, the system often\ncrashes with kernel panic, for example just writing data with the dd\nutility will make it crash.\n\nKernel panic - not syncing: drivers/parisc/sba_iommu.c: I/O MMU @ 000000000000a000 is out of mapping resources\n\nCPU: 0 PID: 18442 Comm: mkspadfs Not tainted 4.4.0-rc2 #2\nBacktrace:\n [<000000004021497c>] show_stack+0x14/0x20\n [<0000000040410bf0>] dump_stack+0x88/0x100\n [<000000004023978c>] panic+0x124/0x360\n [<0000000040452c18>] sba_alloc_range+0x698/0x6a0\n [<0000000040453150>] sba_map_sg+0x260/0x5b8\n [<000000000c18dbb4>] ata_qc_issue+0x264/0x4a8 [libata]\n [<000000000c19535c>] ata_scsi_translate+0xe4/0x220 [libata]\n [<000000000c19a93c>] ata_scsi_queuecmd+0xbc/0x320 [libata]\n [<0000000040499bbc>] scsi_dispatch_cmd+0xfc/0x130\n [<000000004049da34>] scsi_request_fn+0x6e4/0x970\n [<00000000403e95a8>] __blk_run_queue+0x40/0x60\n [<00000000403e9d8c>] blk_run_queue+0x3c/0x68\n [<000000004049a534>] scsi_run_queue+0x2a4/0x360\n [<000000004049be68>] scsi_end_request+0x1a8/0x238\n [<000000004049de84>] scsi_io_completion+0xfc/0x688\n [<0000000040493c74>] scsi_finish_command+0x17c/0x1d0\n\nThe cause of the crash is not exhaustion of the IOMMU space, there is\nplenty of free pages. The function sba_alloc_range is called with size\n0x11000, thus the pages_needed variable is 0x11. The function\nsba_search_bitmap is called with bits_wanted 0x11 and boundary size is\n0x10 (because dma_get_seg_boundary(dev) returns 0xffff).\n\nThe function sba_search_bitmap attempts to allocate 17 pages that must not\ncross 16-page boundary - it can't satisfy this requirement\n(iommu_is_span_boundary always returns true) and fails even if there are\nmany free entries in the IOMMU space.\n\nHow did it happen that we try to allocate 17 pages that don't cross\n16-page boundary? The cause is in the function iommu_coalesce_chunks. This\nfunction tries to coalesce adjacent entries in the scatterlist. The\nfunction does several checks if it may coalesce one entry with the next,\none of those checks is this:\n\n\tif (startsg->length + dma_len > max_seg_size)\n\t\tbreak;\n\nWhen it finishes coalescing adjacent entries, it allocates the mapping:\n\nsg_dma_len(contig_sg) = dma_len;\ndma_len = ALIGN(dma_len + dma_offset, IOVP_SIZE);\nsg_dma_address(contig_sg) =\n\tPIDE_FLAG\n\t| (iommu_alloc_range(ioc, dev, dma_len) << IOVP_SHIFT)\n\t| dma_offset;\n\nIt is possible that (startsg->length + dma_len > max_seg_size) is false\n(we are just near the 0x10000 max_seg_size boundary), so the funcion\ndecides to coalesce this entry with the next entry. When the coalescing\nsucceeds, the function performs\n\tdma_len = ALIGN(dma_len + dma_offset, IOVP_SIZE);\nAnd now, because of non-zero dma_offset, dma_len is greater than 0x10000.\niommu_alloc_range (a pointer to sba_alloc_range) is called and it attempts\nto allocate 17 pages for a device that must not cross 16-page boundary.\n\nTo fix the bug, we must make sure that dma_len after addition of\ndma_offset and alignment doesn't cross the segment boundary. I.e. change\n\tif (startsg->length + dma_len > max_seg_size)\n\t\tbreak;\nto\n\tif (ALIGN(dma_len + dma_offset + startsg->length, IOVP_SIZE) > max_seg_size)\n\t\tbreak;\n\nThis patch makes this change (it precalculates max_seg_boundary at the\nbeginning of the function iommu_coalesce_chunks). I also added a check\nthat the mapping length doesn't exceed dma_get_seg_boundary(dev) (it is\nnot needed for Promise TX2+ SATA, but it may be needed for other devices\nthat have dma_get_seg_boundary lower than dma_get_max_seg_size).\n\nSigned-off-by: Mikulas Patocka <mpatocka@redhat.com>\nSigned-off-by: Helge Deller <deller@gmx.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nHID: core: Avoid uninitialized buffer access\n\ncommit 79b568b9d0c7c5d81932f4486d50b38efdd6da6d upstream.\n\nhid_connect adds various strings to the buffer but they're all\nconditional. You can find circumstances where nothing would be written\nto it but the kernel will still print the supposedly empty buffer with\nprintk. This leads to corruption on the console/in the logs.\n\nEnsure buf is initialized to an empty string.\n\nSigned-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>\n[dvhart: Initialize string to \"\" rather than assign buf[0] = NULL;]\nCc: Jiri Kosina <jikos@kernel.org>\nCc: linux-input@vger.kernel.org\nSigned-off-by: Darren Hart <dvhart@linux.intel.com>\nSigned-off-by: Jiri Kosina <jkosina@suse.cz>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nopenrisc: fix CONFIG_UID16 setting\n\ncommit 04ea1e91f85615318ea91ce8ab50cb6a01ee4005 upstream.\n\nopenrisc-allnoconfig:\n\n  kernel/uid16.c: In function 'SYSC_setgroups16':\n  kernel/uid16.c:184:2: error: implicit declaration of function 'groups_alloc'\n  kernel/uid16.c:184:13: warning: assignment makes pointer from integer without a cast\n\nopenrisc shouldn't be setting CONFIG_UID16 when CONFIG_MULTIUSER=n.\n\nFixes: 2813893f8b197a1 (\"kernel: conditionally support non-root users, groups and capabilities\")\nReported-by: Fengguang Wu <fengguang.wu@gmail.com>\nCc: Iulia Manda <iulia.manda21@gmail.com>\nCc: Josh Triplett <josh@joshtriplett.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nmn10300: Select CONFIG_HAVE_UID16 to fix build failure\n\ncommit c86576ea114a9a881cf7328dc7181052070ca311 upstream.\n\nmn10300 builds fail with\n\nfs/stat.c: In function 'cp_old_stat':\nfs/stat.c:163:2: error: 'old_uid_t' undeclared\n\nipc/util.c: In function 'ipc64_perm_to_ipc_perm':\nipc/util.c:540:2: error: 'old_uid_t' undeclared\n\nSelect CONFIG_HAVE_UID16 and remove local definition of CONFIG_UID16\nto fix the problem.\n\nFixes: fbc416ff8618 (\"arm64: fix building without CONFIG_UID16\")\nCc: Arnd Bergmann <arnd@arndb.de>\nAcked-by: Arnd Bergmann <arnd@arndb.de>\nAcked-by: Acked-by: David Howells <dhowells@redhat.com>\nSigned-off-by: Guenter Roeck <linux@roeck-us.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nLinux 3.10.96\n\n(cherry picked from commit fe611afed2c672b34d62a492f171d00a979dc2ee)","distinct":true,"url":"https://api.github.com/repos/f100cleveland/saberCore64/commits/3bc0995ec3475c6c4e9644a7fb7e0c5fb1cc13c2"}]}