{"push_id":2747169106,"size":66,"distinct_size":66,"ref":"refs/heads/pf-4.17","head":"beed34e7aad3ed0338a71099d6cbe8195eabdc3f","before":"00c4d7e6ac64edb7a9f3439ec06c16944859cf14","commits":[{"sha":"275f85d8f6226eaaf1dba5d2879a72b7a53c5f58","author":{"name":"Damien Le Moal","email":"f9b68e53a89359fcdc4af0a87b5143767d923656@wdc.com"},"message":"scsi: sd_zbc: Fix variable type and bogus comment\n\ncommit f13cff6c25bd8986627365346d123312ee7baa78 upstream.\n\nFix the description of sd_zbc_check_zone_size() to correctly explain that\nthe returned value is a number of device blocks, not bytes.  Additionally,\nthe 32 bits \"ret\" variable used in this function may truncate the 64 bits\nzone_blocks variable value upon return. To fix this, change \"ret\" type to\ns64.\n\nFixes: ccce20fc79 (\"sd_zbc: Avoid that resetting a zone fails sporadically\")\nSigned-off-by: Damien Le Moal <damien.lemoal@wdc.com>\nCc: Bart Van Assche <bart.vanassche@wdc.com>\nCc: stable@kernel.org\nReviewed-by: Hannes Reinecke <hare@suse.com>\nReviewed-by: Bart Van Assche <bart.vanassche@wdc.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/pfactum/pf-kernel/commits/275f85d8f6226eaaf1dba5d2879a72b7a53c5f58"},{"sha":"8d7555604d3a75984496aff33eb36109ad301d50","author":{"name":"Quinn Tran","email":"edc85299a7dd75d8b2b78d208ff6016e8db1c490@cavium.com"},"message":"scsi: qla2xxx: Fix inconsistent DMA mem alloc/free\n\ncommit b5f3bc39a0e815a30005da246dd4ad47fd2f88ff upstream.\n\nGPNFT command allocates 2 buffer for switch query. On completion, the same\nbuffers were freed using different size, instead of using original size at\nthe time of allocation.\n\nThis patch saves the size of the request and response buffers and uses that\nto free them.\n\nFollowing stack trace can be seen when using debug kernel\n\ndump_stack+0x19/0x1b\n__warn+0xd8/0x100\nwarn_slowpath_fmt+0x5f/0x80\ncheck_unmap+0xfb/0xa20\ndebug_dma_free_coherent+0x110/0x160\nqla24xx_sp_unmap+0x131/0x1e0 [qla2xxx]\nqla24xx_async_gnnft_done+0xb6/0x550 [qla2xxx]\nqla2x00_do_work+0x1ec/0x9f0 [qla2xxx]\n\nCc: <stable@vger.kernel.org> # v4.17+\nFixes: 33b28357dd00 (\"scsi: qla2xxx: Fix Async GPN_FT for FCP and FC-NVMe scan\")\nReported-by: Ewan D. Milne <emilne@redhat.com>\nSigned-off-by: Quinn Tran <quinn.tran@cavium.com>\nSigned-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>\nSigned-off-by: Himanshu Madhani <hmadhani@redhat.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/pfactum/pf-kernel/commits/8d7555604d3a75984496aff33eb36109ad301d50"},{"sha":"cbff7f129d34daf52b5c530a980500dd865b0b3c","author":{"name":"himanshu.madhani@cavium.com","email":"a1599b7f51f3890722b2125e7c07879c181c9399@cavium.com"},"message":"scsi: qla2xxx: Fix kernel crash due to late workqueue allocation\n\ncommit d48cc67cd4406d589fdbfa8c7d51c86532f86feb upstream.\n\nThis patch fixes crash for FCoE adapter. Once driver initialization is\ncomplete, firmware will start posting Asynchronous Event, However driver\nhas not yet allocated workqueue to process and queue up work.  This delay\nof allocating workqueue results into NULL pointer access.\n\nThe following stack trace is seen:\n\n[   24.577259] BUG: unable to handle kernel NULL pointer dereference at 0000000000000102\n[   24.623133] PGD 0 P4D 0\n[   24.636760] Oops: 0000 [#1] SMP NOPTI\n[   24.656942] Modules linked in: i2c_algo_bit drm_kms_helper sr_mod(+) syscopyarea sysfillrect sysimgblt cdrom fb_sys_fops ata_generic ttm pata_acpi sd_mod ahci pata_atiixp sfc(+) qla2xxx(+) libahci drm qla4xxx(+) nvme_fc hpsa mdio libiscsi qlcnic(+) nvme_fabrics scsi_transport_sas serio_raw mtd crc32c_intel libata nvme_core i2c_core scsi_transport_iscsi tg3 scsi_transport_fc bnx2 iscsi_boot_sysfs dm_multipath dm_mirror dm_region_hash dm_log dm_mod\n[   24.887449] CPU: 0 PID: 177 Comm: kworker/0:3 Not tainted 4.17.0-rc6 #1\n[   24.925119] Hardware name: HP ProLiant DL385 G7, BIOS A18 08/15/2012\n[   24.962106] Workqueue: events work_for_cpu_fn\n[   24.987098] RIP: 0010:__queue_work+0x1f/0x3a0\n[   25.011672] RSP: 0018:ffff992642ceba10 EFLAGS: 00010082\n[   25.042116] RAX: 0000000000000082 RBX: 0000000000000082 RCX: 0000000000000000\n[   25.083293] RDX: ffff8cf9abc6d7d0 RSI: 0000000000000000 RDI: 0000000000002000\n[   25.123094] RBP: 0000000000000000 R08: 0000000000025a40 R09: ffff8cf9aade2880\n[   25.164087] R10: 0000000000000000 R11: ffff992642ceb6f0 R12: ffff8cf9abc6d7d0\n[   25.202280] R13: 0000000000002000 R14: ffff8cf9abc6d7b8 R15: 0000000000002000\n[   25.242050] FS:  0000000000000000(0000) f9b5c00000(0000) knlGS:0000000000000000\n[   25.977565] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   26.010457] CR2: 0000000000000102 CR3: 000000030760a000 CR4: 00000000000406f0\n[   26.051048] Call Trace:\n[   26.063572]  ? __switch_to_asm+0x34/0x70\n[   26.086079]  queue_work_on+0x24/0x40\n[   26.107090]  qla2x00_post_work+0x81/0xb0 [qla2xxx]\n[   26.133356]  qla2x00_async_event+0x1ad/0x1a20 [qla2xxx]\n[   26.164075]  ? lock_timer_base+0x67/0x80\n[   26.186420]  ? try_to_del_timer_sync+0x4d/0x80\n[   26.212284]  ? del_timer_sync+0x35/0x40\n[   26.234080]  ? schedule_timeout+0x165/0x2f0\n[   26.259575]  qla82xx_poll+0x13e/0x180 [qla2xxx]\n[   26.285740]  qla2x00_mailbox_command+0x74b/0xf50 [qla2xxx]\n[   26.319040]  qla82xx_set_driver_version+0x13b/0x1c0 [qla2xxx]\n[   26.352108]  ? qla2x00_init_rings+0x206/0x3f0 [qla2xxx]\n[   26.381733]  qla2x00_initialize_adapter+0x35c/0x7f0 [qla2xxx]\n[   26.413240]  qla2x00_probe_one+0x1479/0x2390 [qla2xxx]\n[   26.442055]  local_pci_probe+0x3f/0xa0\n[   26.463108]  work_for_cpu_fn+0x10/0x20\n[   26.483295]  process_one_work+0x152/0x350\n[   26.505730]  worker_thread+0x1cf/0x3e0\n[   26.527090]  kthread+0xf5/0x130\n[   26.545085]  ? max_active_store+0x80/0x80\n[   26.568085]  ? kthread_bind+0x10/0x10\n[   26.589533]  ret_from_fork+0x22/0x40\n[   26.610192] Code: 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 41 57 41 89 ff 41 56 41 55 41 89 fd 41 54 49 89 d4 55 48 89 f5 53 48 83 ec 0 86 02 01 00 00 01 0f 85 80 02 00 00 49 c7 c6 c0 ec 01 00 41\n[   27.308540] RIP: __queue_work+0x1f/0x3a0 RSP: ffff992642ceba10\n[   27.341591] CR2: 0000000000000102\n[   27.360208] ---[ end trace 01b7b7ae2c005cf3 ]---\n\nCc: <stable@vger.kernel.org> # v4.17+\nFixes: 9b3e0f4d4147 (\"scsi: qla2xxx: Move work element processing out of DPC thread\"\nReported-by: Li Wang <liwang@redhat.com>\nTested-by: Li Wang <liwang@redhat.com>\nSigned-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/pfactum/pf-kernel/commits/cbff7f129d34daf52b5c530a980500dd865b0b3c"},{"sha":"db1f278abb2461844469ee01d60404e51901713b","author":{"name":"Chuck Anderson","email":"add23bfc015ae37c969d82831147fa8faab8b6fc@oracle.com"},"message":"scsi: qla2xxx: Fix NULL pointer dereference for fcport search\n\ncommit 36eb8ff672faee83ccce60c191f0fef07c6adce6 upstream.\n\nCrash dump shows following instructions\n\ncrash> bt\nPID: 0      TASK: ffffffffbe412480  CPU: 0   COMMAND: \"swapper/0\"\n #0 [ffff891ee0003868] machine_kexec at ffffffffbd063ef1\n #1 [ffff891ee00038c8] __crash_kexec at ffffffffbd12b6f2\n #2 [ffff891ee0003998] crash_kexec at ffffffffbd12c84c\n #3 [ffff891ee00039b8] oops_end at ffffffffbd030f0a\n #4 [ffff891ee00039e0] no_context at ffffffffbd074643\n #5 [ffff891ee0003a40] __bad_area_nosemaphore at ffffffffbd07496e\n #6 [ffff891ee0003a90] bad_area_nosemaphore at ffffffffbd074a64\n #7 [ffff891ee0003aa0] __do_page_fault at ffffffffbd074b0a\n #8 [ffff891ee0003b18] do_page_fault at ffffffffbd074fc8\n #9 [ffff891ee0003b50] page_fault at ffffffffbda01925\n    [exception RIP: qlt_schedule_sess_for_deletion+15]\n    RIP: ffffffffc02e526f  RSP: ffff891ee0003c08  RFLAGS: 00010046\n    RAX: 0000000000000000  RBX: 0000000000000000  RCX: ffffffffc0307847\n    RDX: 00000000000020e6  RSI: ffff891edbc377c8  RDI: 0000000000000000\n    RBP: ffff891ee0003c18   R8: ffffffffc02f0b20   R9: 0000000000000250\n    R10: 0000000000000258  R11: 000000000000b780  R12: ffff891ed9b43000\n    R13: 00000000000000f0  R14: 0000000000000006  R15: ffff891edbc377c8\n    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018\n #10 [ffff891ee0003c20] qla2x00_fcport_event_handler at ffffffffc02853d3 [qla2xxx]\n #11 [ffff891ee0003cf0] __dta_qla24xx_async_gnl_sp_done_333 at ffffffffc0285a1d [qla2xxx]\n #12 [ffff891ee0003de8] qla24xx_process_response_queue at ffffffffc02a2eb5 [qla2xxx]\n #13 [ffff891ee0003e88] qla24xx_msix_rsp_q at ffffffffc02a5403 [qla2xxx]\n #14 [ffff891ee0003ec0] __handle_irq_event_percpu at ffffffffbd0f4c59\n #15 [ffff891ee0003f10] handle_irq_event_percpu at ffffffffbd0f4e02\n #16 [ffff891ee0003f40] handle_irq_event at ffffffffbd0f4e90\n #17 [ffff891ee0003f68] handle_edge_irq at ffffffffbd0f8984\n #18 [ffff891ee0003f88] handle_irq at ffffffffbd0305d5\n #19 [ffff891ee0003fb8] do_IRQ at ffffffffbda02a18\n --- <IRQ stack> ---\n #20 [ffffffffbe403d30] ret_from_intr at ffffffffbda0094e\n    [exception RIP: unknown or invalid address]\n    RIP: 000000000000001f  RSP: 0000000000000000  RFLAGS: fff3b8c2091ebb3f\n    RAX: ffffbba5a0000200  RBX: 0000be8cdfa8f9fa  RCX: 0000000000000018\n    RDX: 0000000000000101  RSI: 000000000000015d  RDI: 0000000000000193\n    RBP: 0000000000000083   R8: ffffffffbe403e38   R9: 0000000000000002\n    R10: 0000000000000000  R11: ffffffffbe56b820  R12: ffff891ee001cf00\n    R13: ffffffffbd11c0a4  R14: ffffffffbe403d60  R15: 0000000000000001\n    ORIG_RAX: ffff891ee0022ac0  CS: 0000  SS: ffffffffffffffb9\n bt: WARNING: possibly bogus exception frame\n #21 [ffffffffbe403dd8] cpuidle_enter_state at ffffffffbd67c6fd\n #22 [ffffffffbe403e40] cpuidle_enter at ffffffffbd67c907\n #23 [ffffffffbe403e50] call_cpuidle at ffffffffbd0d98f3\n #24 [ffffffffbe403e60] do_idle at ffffffffbd0d9b42\n #25 [ffffffffbe403e98] cpu_startup_entry at ffffffffbd0d9da3\n #26 [ffffffffbe403ec0] rest_init at ffffffffbd81d4aa\n #27 [ffffffffbe403ed0] start_kernel at ffffffffbe67d2ca\n #28 [ffffffffbe403f28] x86_64_start_reservations at ffffffffbe67c675\n #29 [ffffffffbe403f38] x86_64_start_kernel at ffffffffbe67c6eb\n #30 [ffffffffbe403f50] secondary_startup_64 at ffffffffbd0000d5\n\nFixes: 040036bb0bc1 (\"scsi: qla2xxx: Delay loop id allocation at login\")\nCc: <stable@vger.kernel.org> # v4.17+\nSigned-off-by: Chuck Anderson <chuck.anderson@oracle.com>\nSigned-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/pfactum/pf-kernel/commits/db1f278abb2461844469ee01d60404e51901713b"},{"sha":"0e884c939420fd4b37edc4d47ac214540eb9cc60","author":{"name":"Lan Tianyu","email":"4221d0916eb5c472a0ab46f0107445bbb3e8a589@intel.com"},"message":"KVM/Eventfd: Avoid crash when assign and deassign specific eventfd in parallel.\n\ncommit b5020a8e6b54d2ece80b1e7dedb33c79a40ebd47 upstream.\n\nSyzbot reports crashes in kvm_irqfd_assign(), caused by use-after-free\nwhen kvm_irqfd_assign() and kvm_irqfd_deassign() run in parallel\nfor one specific eventfd. When the assign path hasn't finished but irqfd\nhas been added to kvm->irqfds.items list, another thead may deassign the\neventfd and free struct kvm_kernel_irqfd(). The assign path then uses\nthe struct kvm_kernel_irqfd that has been freed by deassign path. To avoid\nsuch issue, keep irqfd under kvm->irq_srcu protection after the irqfd\nhas been added to kvm->irqfds.items list, and call synchronize_srcu()\nin irq_shutdown() to make sure that irqfd has been fully initialized in\nthe assign path.\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nCc: Paolo Bonzini <pbonzini@redhat.com>\nCc: Radim Krčmář <rkrcmar@redhat.com>\nCc: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Tianyu Lan <tianyu.lan@intel.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/pfactum/pf-kernel/commits/0e884c939420fd4b37edc4d47ac214540eb9cc60"},{"sha":"36ea7aed04cc6740d3200d70e6f0af555a212f11","author":{"name":"Paolo Bonzini","email":"69d3ebcf5ee4e7f05a50dc23cd96655b730804b4@redhat.com"},"message":"KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer\n\ncommit 9432a3175770e06cb83eada2d91fac90c977cb99 upstream.\n\nA comment warning against this bug is there, but the code is not doing what\nthe comment says.  Therefore it is possible that an EPOLLHUP races against\nirq_bypass_register_consumer.  The EPOLLHUP handler schedules irqfd_shutdown,\nand if that runs soon enough, you get a use-after-free.\n\nReported-by: syzbot <syzkaller@googlegroups.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nReviewed-by: David Hildenbrand <david@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/pfactum/pf-kernel/commits/36ea7aed04cc6740d3200d70e6f0af555a212f11"},{"sha":"088827be904a0418188251d962dbd6922eb8c01d","author":{"name":"Liran Alon","email":"3bd57713922c8378b134977a83f75a575d0c5a83@oracle.com"},"message":"KVM: VMX: Mark VMXArea with revision_id of physical CPU even when eVMCS enabled\n\ncommit 2307af1c4b2e0ad886f30e31739845322cbd328b upstream.\n\nWhen eVMCS is enabled, all VMCS allocated to be used by KVM are marked\nwith revision_id of KVM_EVMCS_VERSION instead of revision_id reported\nby MSR_IA32_VMX_BASIC.\n\nHowever, even though not explictly documented by TLFS, VMXArea passed\nas VMXON argument should still be marked with revision_id reported by\nphysical CPU.\n\nThis issue was found by the following setup:\n* L0 = KVM which expose eVMCS to it's L1 guest.\n* L1 = KVM which consume eVMCS reported by L0.\nThis setup caused the following to occur:\n1) L1 execute hardware_enable().\n2) hardware_enable() calls kvm_cpu_vmxon() to execute VMXON.\n3) L0 intercept L1 VMXON and execute handle_vmon() which notes\nvmxarea->revision_id != VMCS12_REVISION and therefore fails with\nnested_vmx_failInvalid() which sets RFLAGS.CF.\n4) L1 kvm_cpu_vmxon() don't check RFLAGS.CF for failure and therefore\nhardware_enable() continues as usual.\n5) L1 hardware_enable() then calls ept_sync_global() which executes\nINVEPT.\n6) L0 intercept INVEPT and execute handle_invept() which notes\n!vmx->nested.vmxon and thus raise a #UD to L1.\n7) Raised #UD caused L1 to panic.\n\nReviewed-by: Krish Sadhukhan <krish.sadhukhan@oracle.com>\nCc: stable@vger.kernel.org\nFixes: 773e8a0425c923bc02668a2d6534a5ef5a43cc69\nSigned-off-by: Liran Alon <liran.alon@oracle.com>\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/pfactum/pf-kernel/commits/088827be904a0418188251d962dbd6922eb8c01d"},{"sha":"7bb53f0cf0308e1b7143adcd6390635bfe992c2d","author":{"name":"Vitaly Kuznetsov","email":"282517a3cdaae14e79e6d52f012bddb9ec2b7f0e@redhat.com"},"message":"x86/kvm/vmx: don't read current->thread.{fs,gs}base of legacy tasks\n\ncommit b062b794c7831a70bda4dfac202c1a9418e06ac0 upstream.\n\nWhen we switched from doing rdmsr() to reading FS/GS base values from\ncurrent->thread we completely forgot about legacy 32-bit userspaces which\nwe still support in KVM (why?). task->thread.{fsbase,gsbase} are only\nsynced for 64-bit processes, calling save_fsgs_for_kvm() and using\nits result from current is illegal for legacy processes.\n\nThere's no ARCH_SET_FS/GS prctls for legacy applications. Base MSRs are,\nhowever, not always equal to zero. Intel's manual says (3.4.4 Segment\nLoading Instructions in IA-32e Mode):\n\n\"In order to set up compatibility mode for an application, segment-load\ninstructions (MOV to Sreg, POP Sreg) work normally in 64-bit mode. An\nentry is read from the system descriptor table (GDT or LDT) and is loaded\nin the hidden portion of the segment register.\n...\nThe hidden descriptor register fields for FS.base and GS.base are\nphysically mapped to MSRs in order to load all address bits supported by\na 64-bit implementation.\n\"\n\nThe issue was found by strace test suite where 32-bit ioctl_kvm_run test\nstarted segfaulting.\n\nReported-by: Dmitry V. Levin <ldv@altlinux.org>\nBisected-by: Masatake YAMATO <yamato@redhat.com>\nFixes: 42b933b59721 (\"x86/kvm/vmx: read MSR_{FS,KERNEL_GS}_BASE from current->thread\")\nCc: stable@vger.kernel.org\nSigned-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/pfactum/pf-kernel/commits/7bb53f0cf0308e1b7143adcd6390635bfe992c2d"},{"sha":"7d606a69d987d936ff21ab80be113549df804523","author":{"name":"Radim Krčmář","email":"e4aea3f2c531804c57884e1d444a6744efb5af4d@redhat.com"},"message":"x86/kvmclock: set pvti_cpu0_va after enabling kvmclock\n\ncommit 94ffba484663ab3fc695ce2a34871e8c3db499f7 upstream.\n\npvti_cpu0_va is the address of shared kvmclock data structure.\n\npvti_cpu0_va is currently kept unset (1) on 32 bit systems, (2) when\nkvmclock vsyscall is disabled, and (3) if kvmclock is not stable.\nThis poses a problem, because kvm_ptp needs pvti_cpu0_va, but (1) can\nwork on 32 bit, (2) has little relation to the vsyscall, and (3) does\nnot need stable kvmclock (although kvmclock won't be used for system\nclock if it's not stable, so kvm_ptp is pointless in that case).\n\nExpose pvti_cpu0_va whenever kvmclock is enabled to allow all users to\nwork with it.\n\nThis fixes a regression found on Gentoo: https://bugs.gentoo.org/658544.\n\nFixes: 9f08890ab906 (\"x86/pvclock: add setter for pvclock_pvti_cpu0_va\")\nCc: stable@vger.kernel.org\nReported-by: Andreas Steinmetz <ast@domdv.de>\nSigned-off-by: Radim Krčmář <rkrcmar@redhat.com>\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/pfactum/pf-kernel/commits/7d606a69d987d936ff21ab80be113549df804523"},{"sha":"822e65c0beea0a974b54cd04c292c4cbcb1f28f6","author":{"name":"Ville Syrjälä","email":"cd6e8d405ca90be3a03d5427c5b24fbd2d68dcc4@linux.intel.com"},"message":"x86/apm: Don't access __preempt_count with zeroed fs\n\ncommit 6f6060a5c9cc76fdbc22748264e6aa3779ec2427 upstream.\n\nAPM_DO_POP_SEGS does not restore fs/gs which were zeroed by\nAPM_DO_ZERO_SEGS. Trying to access __preempt_count with\nzeroed fs doesn't really work.\n\nMove the ibrs call outside the APM_DO_SAVE_SEGS/APM_DO_RESTORE_SEGS\ninvocations so that fs is actually restored before calling\npreempt_enable().\n\nFixes the following sort of oopses:\n[    0.313581] general protection fault: 0000 [#1] PREEMPT SMP\n[    0.313803] Modules linked in:\n[    0.314040] CPU: 0 PID: 268 Comm: kapmd Not tainted 4.16.0-rc1-triton-bisect-00090-gdd84441a7971 #19\n[    0.316161] EIP: __apm_bios_call_simple+0xc8/0x170\n[    0.316161] EFLAGS: 00210016 CPU: 0\n[    0.316161] EAX: 00000102 EBX: 00000000 ECX: 00000102 EDX: 00000000\n[    0.316161] ESI: 0000530e EDI: dea95f64 EBP: dea95f18 ESP: dea95ef0\n[    0.316161]  DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068\n[    0.316161] CR0: 80050033 CR2: 00000000 CR3: 015d3000 CR4: 000006d0\n[    0.316161] Call Trace:\n[    0.316161]  ? cpumask_weight.constprop.15+0x20/0x20\n[    0.316161]  on_cpu0+0x44/0x70\n[    0.316161]  apm+0x54e/0x720\n[    0.316161]  ? __switch_to_asm+0x26/0x40\n[    0.316161]  ? __schedule+0x17d/0x590\n[    0.316161]  kthread+0xc0/0xf0\n[    0.316161]  ? proc_apm_show+0x150/0x150\n[    0.316161]  ? kthread_create_worker_on_cpu+0x20/0x20\n[    0.316161]  ret_from_fork+0x2e/0x38\n[    0.316161] Code: da 8e c2 8e e2 8e ea 57 55 2e ff 1d e0 bb 5d b1 0f 92 c3 5d 5f 07 1f 89 47 0c 90 8d b4 26 00 00 00 00 90 8d b4 26 00 00 00 00 90 <64> ff 0d 84 16 5c b1 74 7f 8b 45 dc 8e e0 8b 45 d8 8e e8 8b 45\n[    0.316161] EIP: __apm_bios_call_simple+0xc8/0x170 SS:ESP: 0068:dea95ef0\n[    0.316161] ---[ end trace 656253db2deaa12c ]---\n\nFixes: dd84441a7971 (\"x86/speculation: Use IBRS if available before calling into firmware\")\nSigned-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: stable@vger.kernel.org\nCc:  David Woodhouse <dwmw@amazon.co.uk>\nCc:  \"H. Peter Anvin\" <hpa@zytor.com>\nCc:  x86@kernel.org\nCc: David Woodhouse <dwmw@amazon.co.uk>\nCc: \"H. Peter Anvin\" <hpa@zytor.com>\nLink: https://lkml.kernel.org/r/20180709133534.5963-1-ville.syrjala@linux.intel.com\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/pfactum/pf-kernel/commits/822e65c0beea0a974b54cd04c292c4cbcb1f28f6"},{"sha":"16b2d5ad46f7f905ee26ef107e5ac82e2cb6064f","author":{"name":"Hugh Dickins","email":"d3abdf3e2800e6cb849f11b81e6eb50b34d96431@google.com"},"message":"x86/events/intel/ds: Fix bts_interrupt_threshold alignment\n\ncommit 2c991e408df6a407476dbc453d725e1e975479e7 upstream.\n\nMarkus reported that BTS is sporadically missing the tail of the trace\nin the perf_event data buffer: [decode error (1): instruction overflow]\nshown in GDB; and bisected it to the conversion of debug_store to PTI.\n\nA little \"optimization\" crept into alloc_bts_buffer(), which mistakenly\nplaced bts_interrupt_threshold away from the 24-byte record boundary.\nIntel SDM Vol 3B 17.4.9 says \"This address must point to an offset from\nthe BTS buffer base that is a multiple of the BTS record size.\"\n\nRevert \"max\" from a byte count to a record count, to calculate the\nbts_interrupt_threshold correctly: which turns out to fix problem seen.\n\nFixes: c1961a4631da (\"x86/events/intel/ds: Map debug buffers in cpu_entry_area\")\nReported-and-tested-by: Markus T Metzger <markus.t.metzger@intel.com>\nSigned-off-by: Hugh Dickins <hughd@google.com>\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Arnaldo Carvalho de Melo <acme@kernel.org>\nCc: Alexander Shishkin <alexander.shishkin@intel.com>\nCc: Andi Kleen <andi.kleen@intel.com>\nCc: Dave Hansen <dave.hansen@intel.com>\nCc: Stephane Eranian <eranian@google.com>\nCc: stable@vger.kernel.org # v4.14+\nLink: https://lkml.kernel.org/r/alpine.LSU.2.11.1807141248290.1614@eggly.anvils\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/pfactum/pf-kernel/commits/16b2d5ad46f7f905ee26ef107e5ac82e2cb6064f"},{"sha":"cf42670fe67fab8b329c7ceb21c3f28f84840acc","author":{"name":"Dewet Thibaut","email":"7cb3b8504b40999a891fc2b4fa769090fa160f13@nokia.com"},"message":"x86/MCE: Remove min interval polling limitation\n\ncommit fbdb328c6bae0a7c78d75734a738b66b86dffc96 upstream.\n\ncommit b3b7c4795c (\"x86/MCE: Serialize sysfs changes\") introduced a min\ninterval limitation when setting the check interval for polled MCEs.\nHowever, the logic is that 0 disables polling for corrected MCEs, see\nDocumentation/x86/x86_64/machinecheck. The limitation prevents disabling.\n\nRemove this limitation and allow the value 0 to disable polling again.\n\nFixes: b3b7c4795c (\"x86/MCE: Serialize sysfs changes\")\nSigned-off-by: Dewet Thibaut <thibaut.dewet@nokia.com>\nSigned-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>\n[ Massage commit message. ]\nSigned-off-by: Borislav Petkov <bp@suse.de>\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: Tony Luck <tony.luck@intel.com>\nCc: linux-edac <linux-edac@vger.kernel.org>\nCc: stable@vger.kernel.org\nLink: http://lkml.kernel.org/r/20180716084927.24869-1-alexander.sverdlin@nokia.com\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/pfactum/pf-kernel/commits/cf42670fe67fab8b329c7ceb21c3f28f84840acc"},{"sha":"44bbcf08aba01e6f14578f3f9e4a29fb60c8be6c","author":{"name":"OGAWA Hirofumi","email":"1dd685eef08048be95744a1b104ca593a93cc914@mail.parknet.co.jp"},"message":"fat: fix memory allocation failure handling of match_strdup()\n\ncommit 35033ab988c396ad7bce3b6d24060c16a9066db8 upstream.\n\nIn parse_options(), if match_strdup() failed, parse_options() leaves\nopts->iocharset in unexpected state (i.e.  still pointing the freed\nstring).  And this can be the cause of double free.\n\nTo fix, this initialize opts->iocharset always when freeing.\n\nLink: http://lkml.kernel.org/r/8736wp9dzc.fsf@mail.parknet.co.jp\nSigned-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>\nReported-by: syzbot+90b8e10515ae88228a92@syzkaller.appspotmail.com\nCc: <stable@vger.kernel.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/pfactum/pf-kernel/commits/44bbcf08aba01e6f14578f3f9e4a29fb60c8be6c"},{"sha":"f5f3789f192981a482856a69bd2ef38088f0e635","author":{"name":"Takashi Iwai","email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de"},"message":"ALSA: rawmidi: Change resized buffers atomically\n\ncommit 39675f7a7c7e7702f7d5341f1e0d01db746543a0 upstream.\n\nThe SNDRV_RAWMIDI_IOCTL_PARAMS ioctl may resize the buffers and the\ncurrent code is racy.  For example, the sequencer client may write to\nbuffer while it being resized.\n\nAs a simple workaround, let's switch to the resized buffer inside the\nstream runtime lock.\n\nReported-by: syzbot+52f83f0ea8df16932f7f@syzkaller.appspotmail.com\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/pfactum/pf-kernel/commits/f5f3789f192981a482856a69bd2ef38088f0e635"},{"sha":"96b120fa8fe17b20e27056dfa4de1491ae8a42f9","author":{"name":"YOKOTA Hiroshi","email":"ca8cc18cb55c31d6e2a4a1073fd19f78f4873c2e@gmail.com"},"message":"ALSA: hda/realtek - Add Panasonic CF-SZ6 headset jack quirk\n\ncommit 0fca97a29b83e3f315c14ed2372cfd0f9ee0a006 upstream.\n\nThis adds some required quirk when uses headset or headphone on\nPanasonic CF-SZ6.\n\nSigned-off-by: YOKOTA Hiroshi <yokota.hgml@gmail.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/pfactum/pf-kernel/commits/96b120fa8fe17b20e27056dfa4de1491ae8a42f9"},{"sha":"0cae4b483f2761225e097f8ea87057f5611ba0a3","author":{"name":"Takashi Iwai","email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de"},"message":"ALSA: hda/realtek - Yet another Clevo P950 quirk entry\n\ncommit f3d737b6340b0c7bacd8bc751605f0ed6203f146 upstream.\n\nThe PCI SSID 1558:95e1 needs the same quirk for other Clevo P950\nmodels, too.  Otherwise no sound comes out of speakers.\n\nBugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=1101143\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/pfactum/pf-kernel/commits/0cae4b483f2761225e097f8ea87057f5611ba0a3"},{"sha":"e98863e74502b6c0656d79f16ec04e9042866659","author":{"name":"Po-Hsu Lin","email":"4995ece5d2ee592bd019942436af23bc2b08a65e@canonical.com"},"message":"ALSA: hda: add mute led support for HP ProBook 455 G5\n\ncommit 9a6249d2a145226ec1b294116fcb08744cf7ab56 upstream.\n\nAudio mute led does not work on HP ProBook 455 G5,\nthis can be fixed by using CXT_FIXUP_MUTE_LED_GPIO to support it.\n\nBugLink: https://bugs.launchpad.net/bugs/1781763\nReported-by: James Buren\nSigned-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/pfactum/pf-kernel/commits/e98863e74502b6c0656d79f16ec04e9042866659"},{"sha":"d68ac6cba419abaae331112261388dcff0ea1fd1","author":{"name":"Vineet Gupta","email":"af669d95a4c0de051445d4cafdbb2c5c4a2838be@synopsys.com"},"message":"ARCv2: [plat-hsdk]: Save accl reg pair by default\n\ncommit af1fc5baa724c63ce1733dfcf855bad5ef6078e3 upstream.\n\nThis manifsted as strace segfaulting on HSDK because gcc was targetting\nthe accumulator registers as GPRs, which kernek was not saving/restoring\nby default.\n\nCc: stable@vger.kernel.org   #4.14+\nSigned-off-by: Vineet Gupta <vgupta@synopsys.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/pfactum/pf-kernel/commits/d68ac6cba419abaae331112261388dcff0ea1fd1"},{"sha":"3c23a42e6a2d6454a439b82dc273d7a79873c0fb","author":{"name":"Alexey Brodkin","email":"1fa739873496c8c0c1b521f2061ee5fa4a0306e8@synopsys.com"},"message":"ARC: Fix CONFIG_SWAP\n\ncommit 6e3761145a9ba3ce267c330b6bff51cf6a057b06 upstream.\n\nswap was broken on ARC due to silly copy-paste issue.\n\nWe encode offset from swapcache page in __swp_entry() as (off << 13) but\nwere not decoding back in __swp_offset() as (off >> 13) - it was still\n(off << 13).\n\nThis finally fixes swap usage on ARC.\n\n| # mkswap /dev/sda2\n|\n| # swapon -a -e /dev/sda2\n| Adding 500728k swap on /dev/sda2.  Priority:-2 extents:1 across:500728k\n|\n| # free\n|              total       used       free     shared    buffers     cached\n| Mem:        765104      13456     751648       4736          8       4736\n| -/+ buffers/cache:       8712     756392\n| Swap:       500728          0     500728\n\nCc: stable@vger.kernel.org\nSigned-off-by: Alexey Brodkin <abrodkin@synopsys.com>\nSigned-off-by: Vineet Gupta <vgupta@synopsys.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/pfactum/pf-kernel/commits/3c23a42e6a2d6454a439b82dc273d7a79873c0fb"},{"sha":"d94c1605ec79994faa8cc75183bb98259cacdd85","author":{"name":"Alexey Brodkin","email":"df74735e5e8e4da139876d19d7450f461d604b9f@synopsys.com"},"message":"ARC: configs: Remove CONFIG_INITRAMFS_SOURCE from defconfigs\n\ncommit 64234961c145606b36eaa82c47b11be842b21049 upstream.\n\nWe used to have pre-set CONFIG_INITRAMFS_SOURCE with local path\nto intramfs in ARC defconfigs. This was quite convenient for\nin-house development but not that convenient for newcomers\nwho obviusly don't have folders like \"arc_initramfs\" next to\nthe Linux source tree. Which leads to quite surprising failure\nof defconfig building:\n------------------------------->8-----------------------------\n  ../scripts/gen_initramfs_list.sh: Cannot open '../../arc_initramfs_hs/'\n../usr/Makefile:57: recipe for target 'usr/initramfs_data.cpio.gz' failed\nmake[2]: *** [usr/initramfs_data.cpio.gz] Error 1\n------------------------------->8-----------------------------\n\nSo now when more and more people start to deal with our defconfigs\nlet's make their life easier with removal of CONFIG_INITRAMFS_SOURCE.\n\nSigned-off-by: Alexey Brodkin <abrodkin@synopsys.com>\nCc: Kevin Hilman <khilman@baylibre.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Alexey Brodkin <abrodkin@synopsys.com>\nSigned-off-by: Vineet Gupta <vgupta@synopsys.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/pfactum/pf-kernel/commits/d94c1605ec79994faa8cc75183bb98259cacdd85"}]}
{"actor":{"display_login":"pfactum"}}