{"push_id":2465340701,"size":3,"distinct_size":3,"ref":"refs/heads/lineage-15.1","head":"2dfa05a04065e66646adb5c1e4ebaa064e1d7a26","before":"87da5fec35f971a42e0d26876db0c631f8bb7719","commits":[{"sha":"db866e73cd48d4f27a8edd5619444e2c3344af1d","author":{"name":"thegb","email":"48502e43edf2bc387d5a4689e2afe05764f01ec8@hotmail.com"},"message":"Revert \"USB: f_fs: Use HS and SS descriptors without checking gadget speed\"\n\nThis is needed to not have conflicts when we will update the kernel.\nIt has no sense, because in the updated kernel, it is solved anyways.\nThis reverts commit: Icb6537271ce55e44f5fc3e1ef28dd4d6810b681f\n\nChange-Id: I8ade71a5f194e1e7f00988c424c23e1ce25db2f4","distinct":true,"url":"https://api.github.com/repos/lineage-o-x2/android_kernel_leeco_msm8996/commits/db866e73cd48d4f27a8edd5619444e2c3344af1d"},{"sha":"9b12b1ed8ad69e29cd8f8ec7ab13f8d2479cd5da","author":{"name":"thegb","email":"48502e43edf2bc387d5a4689e2afe05764f01ec8@hotmail.com"},"message":"Kernel: update to v3.18.101\n\n(NEEDS a58258d Revert \"USB: f_fs: Use HS and SS descriptors without checking gadget speed\" to merge it without any conflict.)\n\nnetfilter: drop outermost socket lock in getsockopt()\n\ncommit 01ea306f2ac2baff98d472da719193e738759d93 upstream.\n\nThe Syzbot reported a possible deadlock in the netfilter area caused by\nrtnl lock, xt lock and socket lock being acquired with a different order\non different code paths, leading to the following backtrace:\nReviewed-by: Xin Long <lucien.xin@gmail.com>\n\n======================================================\nWARNING: possible circular locking dependency detected\n4.15.0+ #301 Not tainted\n------------------------------------------------------\nsyzkaller233489/4179 is trying to acquire lock:\n  (rtnl_mutex){+.+.}, at: [<0000000048e996fd>] rtnl_lock+0x17/0x20\nnet/core/rtnetlink.c:74\n\nbut task is already holding lock:\n  (&xt[i].mutex){+.+.}, at: [<00000000328553a2>]\nxt_find_table_lock+0x3e/0x3e0 net/netfilter/x_tables.c:1041\n\nwhich lock already depends on the new lock.\n===\n\nSince commit 3f34cfae1230 (\"netfilter: on sockopt() acquire sock lock\nonly in the required scope\"), we already acquire the socket lock in\nthe innermost scope, where needed. In such commit I forgot to remove\nthe outer-most socket lock from the getsockopt() path, this commit\naddresses the issues dropping it now.\n\nv1 -> v2: fix bad subj, added relavant 'fixes' tag\n\nFixes: 22265a5c3c10 (\"netfilter: xt_TEE: resolve oif using netdevice notifiers\")\nFixes: 202f59afd441 (\"netfilter: ipt_CLUSTERIP: do not hold dev\")\nFixes: 3f34cfae1230 (\"netfilter: on sockopt() acquire sock lock only in the required scope\")\nReported-by: syzbot+ddde1c7b7ff7442d7f2d@syzkaller.appspotmail.com\nSuggested-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Paolo Abeni <pabeni@redhat.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nTested-by: Krzysztof Piotr Oledzki <ole@ans.pl>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nPCI: keystone: Fix interrupt-controller-node lookup\n\ncommit eac56aa3bc8af3d9b9850345d0f2da9d83529134 upstream.\n\nFix child-node lookup during initialisation which was using the wrong\nOF-helper and ended up searching the whole device tree depth-first\nstarting at the parent rather than just matching on its children.\n\nTo make things worse, the parent pci node could end up being prematurely\nfreed as of_find_node_by_name() drops a reference to its first argument.\nAny matching child interrupt-controller node was also leaked.\n\nFixes: 0c4ffcfe1fbc (\"PCI: keystone: Add TI Keystone PCIe driver\")\nCc: stable <stable@vger.kernel.org>     # 3.18\nAcked-by: Murali Karicheri <m-karicheri2@ti.com>\nSigned-off-by: Johan Hovold <johan@kernel.org>\n[lorenzo.pieralisi@arm.com: updated commit subject]\nSigned-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>\n[johan: backport to 4.4]\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nscsi: ibmvfc: fix misdefined reserved field in ibmvfc_fcp_rsp_info\n\ncommit c39813652700f3df552b6557530f1e5f782dbe2f upstream.\n\nThe fcp_rsp_info structure as defined in the FC spec has an initial 3\nbytes reserved field. The ibmvfc driver mistakenly defined this field as\n4 bytes resulting in the rsp_code field being defined in what should be\nthe start of the second reserved field and thus always being reported as\nzero by the driver.\n\nIdeally, we should wire ibmvfc up with libfc for the sake of code\ndeduplication, and ease of maintaining standardized structures in a\nsingle place. However, for now simply fixup the definition in ibmvfc for\nbackporting to distros on older kernels. Wiring up with libfc will be\ndone in a followup patch.\n\nCc: <stable@vger.kernel.org>\nReported-by: Hannes Reinecke <hare@suse.de>\nSigned-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncfg80211: fix cfg80211_beacon_dup\n\ncommit bee92d06157fc39d5d7836a061c7d41289a55797 upstream.\n\ngcc-8 warns about some obviously incorrect code:\n\nnet/mac80211/cfg.c: In function 'cfg80211_beacon_dup':\nnet/mac80211/cfg.c:2896:3: error: 'memcpy' source argument is the same as destination [-Werror=restrict]\n\nFrom the context, I conclude that we want to copy from beacon into\nnew_beacon, as we do in the rest of the function.\n\nCc: stable@vger.kernel.org\nFixes: 73da7d5bab79 (\"mac80211: add channel switch command and beacon callbacks\")\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\niio: buffer: check if a buffer has been set up when poll is called\n\ncommit 4cd140bda6494543f1c1b0ccceceaa44b676eef6 upstream.\n\nIf no iio buffer has been set up and poll is called return 0.\nWithout this check there will be a null pointer dereference when\ncalling poll on a iio driver without an iio buffer.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Stefan Windfeldt-Prytz <stefan.windfeldt@axis.com>\nSigned-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\niio: adis_lib: Initialize trigger before requesting interrupt\n\ncommit f027e0b3a774e10302207e91d304bbf99e3a8b36 upstream.\n\nThe adis_probe_trigger() creates a new IIO trigger and requests an\ninterrupt associated with the trigger. The interrupt uses the generic\niio_trigger_generic_data_rdy_poll() function as its interrupt handler.\n\nCurrently the driver initializes some fields of the trigger structure after\nthe interrupt has been requested. But an interrupt can fire as soon as it\nhas been requested. This opens up a race condition.\n\niio_trigger_generic_data_rdy_poll() will access the trigger data structure\nand dereference the ops field. If the ops field is not yet initialized this\nwill result in a NULL pointer deref.\n\nIt is not expected that the device generates an interrupt at this point, so\ntypically this issue did not surface unless e.g. due to a hardware\nmisconfiguration (wrong interrupt number, wrong polarity, etc.).\n\nBut some newer devices from the ADIS family start to generate periodic\ninterrupts in their power-on reset configuration and unfortunately the\ninterrupt can not be masked in the device.  This makes the race condition\nmuch more visible and the following crash has been observed occasionally\nwhen booting a system using the ADIS16460.\n\n\tUnable to handle kernel NULL pointer dereference at virtual address 00000008\n\tpgd = c0004000\n\t[00000008] *pgd=00000000\n\tInternal error: Oops: 5 [#1] PREEMPT SMP ARM\n\tModules linked in:\n\tCPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.9.0-04126-gf9739f0-dirty #257\n\tHardware name: Xilinx Zynq Platform\n\ttask: ef04f640 task.stack: ef050000\n\tPC is at iio_trigger_notify_done+0x30/0x68\n\tLR is at iio_trigger_generic_data_rdy_poll+0x18/0x20\n\tpc : [<c042d868>]    lr : [<c042d924>]    psr: 60000193\n\tsp : ef051bb8  ip : 00000000  fp : ef106400\n\tr10: c081d80a  r9 : ef3bfa00  r8 : 00000087\n\tr7 : ef051bec  r6 : 00000000  r5 : ef3bfa00  r4 : ee92ab00\n\tr3 : 00000000  r2 : 00000000  r1 : 00000000  r0 : ee97e400\n\tFlags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment none\n\tControl: 18c5387d  Table: 0000404a  DAC: 00000051\n\tProcess swapper/0 (pid: 1, stack limit = 0xef050210)\n\t[<c042d868>] (iio_trigger_notify_done) from [<c0065b10>] (__handle_irq_event_percpu+0x88/0x118)\n\t[<c0065b10>] (__handle_irq_event_percpu) from [<c0065bbc>] (handle_irq_event_percpu+0x1c/0x58)\n\t[<c0065bbc>] (handle_irq_event_percpu) from [<c0065c30>] (handle_irq_event+0x38/0x5c)\n\t[<c0065c30>] (handle_irq_event) from [<c0068e28>] (handle_level_irq+0xa4/0x130)\n\t[<c0068e28>] (handle_level_irq) from [<c0064e74>] (generic_handle_irq+0x24/0x34)\n\t[<c0064e74>] (generic_handle_irq) from [<c021ab7c>] (zynq_gpio_irqhandler+0xb8/0x13c)\n\t[<c021ab7c>] (zynq_gpio_irqhandler) from [<c0064e74>] (generic_handle_irq+0x24/0x34)\n\t[<c0064e74>] (generic_handle_irq) from [<c0065370>] (__handle_domain_irq+0x5c/0xb4)\n\t[<c0065370>] (__handle_domain_irq) from [<c000940c>] (gic_handle_irq+0x48/0x8c)\n\t[<c000940c>] (gic_handle_irq) from [<c0013e8c>] (__irq_svc+0x6c/0xa8)\n\nTo fix this make sure that the trigger is fully initialized before\nrequesting the interrupt.\n\nFixes: ccd2b52f4ac6 (\"staging:iio: Add common ADIS library\")\nReported-by: Robin Getz <Robin.Getz@analog.com>\nSigned-off-by: Lars-Peter Clausen <lars@metafoo.de>\nCc: <Stable@vger.kernel.org>\nSigned-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nx86/oprofile: Fix bogus GCC-8 warning in nmi_setup()\n\ncommit 85c615eb52222bc5fab6c7190d146bc59fac289e upstream.\n\nGCC-8 shows a warning for the x86 oprofile code that copies per-CPU\ndata from CPU 0 to all other CPUs, which when building a non-SMP\nkernel turns into a memcpy() with identical source and destination\npointers:\n\n arch/x86/oprofile/nmi_int.c: In function 'mux_clone':\n arch/x86/oprofile/nmi_int.c:285:2: error: 'memcpy' source argument is the same as destination [-Werror=restrict]\n   memcpy(per_cpu(cpu_msrs, cpu).multiplex,\n   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n          per_cpu(cpu_msrs, 0).multiplex,\n          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n          sizeof(struct op_msr) * model->num_virt_counters);\n          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n arch/x86/oprofile/nmi_int.c: In function 'nmi_setup':\n arch/x86/oprofile/nmi_int.c:466:3: error: 'memcpy' source argument is the same as destination [-Werror=restrict]\n arch/x86/oprofile/nmi_int.c:470:3: error: 'memcpy' source argument is the same as destination [-Werror=restrict]\n\nI have analyzed a number of such warnings now: some are valid and the\nGCC warning is welcome. Others turned out to be false-positives, and\nGCC was changed to not warn about those any more. This is a corner case\nthat is a false-positive but the GCC developers feel it's better to keep\nwarning about it.\n\nIn this case, it seems best to work around it by telling GCC\na little more clearly that this code path is never hit with\nan IS_ENABLED() configuration check.\n\nCc:stable as we also want old kernels to build cleanly with GCC-8.\n\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nCc: Jessica Yu <jeyu@kernel.org>\nCc: Kees Cook <keescook@chromium.org>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Martin Sebor <msebor@gcc.gnu.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Robert Richter <rric@kernel.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: oprofile-list@lists.sf.net\nCc: stable@vger.kernel.org\nLink: http://lkml.kernel.org/r/20180220205826.2008875-1-arnd@arndb.de\nLink: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84095\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nirqchip/gic-v3: Use wmb() instead of smb_wmb() in gic_raise_softirq()\n\ncommit 21ec30c0ef5234fb1039cc7c7737d885bf875a9e upstream.\n\nA DMB instruction can be used to ensure the relative order of only\nmemory accesses before and after the barrier. Since writes to system\nregisters are not memory operations, barrier DMB is not sufficient\nfor observability of memory accesses that occur before ICC_SGI1R_EL1\nwrites.\n\nA DSB instruction ensures that no instructions that appear in program\norder after the DSB instruction, can execute until the DSB instruction\nhas completed.\n\nCc: stable@vger.kernel.org\nAcked-by: Will Deacon <will.deacon@arm.com>,\nSigned-off-by: Shanker Donthineni <shankerd@codeaurora.org>\nSigned-off-by: Marc Zyngier <marc.zyngier@arm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\narm64: Disable unhandled signal log messages by default\n\ncommit 5ee39a71fd89ab7240c5339d04161c44a8e03269 upstream.\n\naarch64 unhandled signal kernel messages are very verbose, suggesting\nthem to be more of a debugging aid:\n\nsigsegv[33]: unhandled level 2 translation fault (11) at 0x00000000, esr\n0x92000046, in sigsegv[400000+71000]\nCPU: 1 PID: 33 Comm: sigsegv Tainted: G        W        4.15.0-rc3+ #3\nHardware name: linux,dummy-virt (DT)\npstate: 60000000 (nZCv daif -PAN -UAO)\npc : 0x4003f4\nlr : 0x4006bc\nsp : 0000fffffe94a060\nx29: 0000fffffe94a070 x28: 0000000000000000\nx27: 0000000000000000 x26: 0000000000000000\nx25: 0000000000000000 x24: 00000000004001b0\nx23: 0000000000486ac8 x22: 00000000004001c8\nx21: 0000000000000000 x20: 0000000000400be8\nx19: 0000000000400b30 x18: 0000000000484728\nx17: 000000000865ffc8 x16: 000000000000270f\nx15: 00000000000000b0 x14: 0000000000000002\nx13: 0000000000000001 x12: 0000000000000000\nx11: 0000000000000000 x10: 0008000020008008\nx9 : 000000000000000f x8 : ffffffffffffffff\nx7 : 0004000000000000 x6 : ffffffffffffffff\nx5 : 0000000000000000 x4 : 0000000000000000\nx3 : 00000000004003e4 x2 : 0000fffffe94a1e8\nx1 : 000000000000000a x0 : 0000000000000000\n\nDisable them by default, so they can be enabled using\n/proc/sys/debug/exception-trace.\n\nCc: <stable@vger.kernel.org>\nSigned-off-by: Michael Weiser <michael.weiser@gmx.de>\nSigned-off-by: Will Deacon <will.deacon@arm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nusb: dwc3: gadget: Set maxpacket size for ep0 IN\n\ncommit 6180026341e852a250e1f97ebdcf71684a3c81b9 upstream.\n\nThere are 2 control endpoint structures for DWC3. However, the driver\nonly updates the OUT direction control endpoint structure during\nConnectDone event. DWC3 driver needs to update the endpoint max packet\nsize for control IN endpoint as well. If the max packet size is not\nproperly set, then the driver will incorrectly calculate the data\ntransfer size and fail to send ZLP for HS/FS 3-stage control read\ntransfer.\n\nThe fix is simply to update the max packet size for the ep0 IN direction\nduring ConnectDone event.\n\nCc: stable@vger.kernel.org\nFixes: 72246da40f37 (\"usb: Introduce DesignWare USB3 DRD Driver\")\nSigned-off-by: Thinh Nguyen <thinhn@synopsys.com>\nSigned-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nusb: gadget: f_fs: Process all descriptors during bind\n\ncommit 6cf439e0d37463e42784271179c8a308fd7493c6 upstream.\n\nDuring _ffs_func_bind(), the received descriptors are evaluated\nto prepare for binding with the gadget in order to allocate\nendpoints and optionally set up OS descriptors. However, the\nhigh- and super-speed descriptors are only parsed based on\nwhether the gadget_is_dualspeed() and gadget_is_superspeed()\ncalls are true, respectively.\n\nThis is a problem in case a userspace program always provides\nall of the {full,high,super,OS} descriptors when configuring a\nfunction. Then, for example if a gadget device is not capable\nof SuperSpeed, the call to ffs_do_descs() for the SS descriptors\nis skipped, resulting in an incorrect offset calculation for\nthe vla_ptr when moving on to the OS descriptors that follow.\nThis causes ffs_do_os_descs() to fail as it is now looking at\nthe SS descriptors' offset within the raw_descs buffer instead.\n\n_ffs_func_bind() should evaluate the descriptors unconditionally,\nso remove the checks for gadget speed.\n\nFixes: f0175ab51993 (\"usb: gadget: f_fs: OS descriptors support\")\nCc: stable@vger.kernel.org\nCo-Developed-by: Mayank Rana <mrana@codeaurora.org>\nSigned-off-by: Mayank Rana <mrana@codeaurora.org>\nSigned-off-by: Jack Pham <jackp@codeaurora.org>\nSigned-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nASN.1: fix out-of-bounds read when parsing indefinite length item\n\ncommit e0058f3a874ebb48b25be7ff79bc3b4e59929f90 upstream.\n\nIn asn1_ber_decoder(), indefinitely-sized ASN.1 items were being passed\nto the action functions before their lengths had been computed, using\nthe bogus length of 0x80 (ASN1_INDEFINITE_LENGTH).  This resulted in\nreading data past the end of the input buffer, when given a specially\ncrafted message.\n\nFix it by rearranging the code so that the indefinite length is resolved\nbefore the action is called.\n\nThis bug was originally found by fuzzing the X.509 parser in userspace\nusing libFuzzer from the LLVM project.\n\nKASAN report (cleaned up slightly):\n\n    BUG: KASAN: slab-out-of-bounds in memcpy ./include/linux/string.h:341 [inline]\n    BUG: KASAN: slab-out-of-bounds in x509_fabricate_name.constprop.1+0x1a4/0x940 crypto/asymmetric_keys/x509_cert_parser.c:366\n    Read of size 128 at addr ffff880035dd9eaf by task keyctl/195\n\n    CPU: 1 PID: 195 Comm: keyctl Not tainted 4.14.0-09238-g1d3b78bbc6e9 #26\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-20171110_100015-anatol 04/01/2014\n    Call Trace:\n     __dump_stack lib/dump_stack.c:17 [inline]\n     dump_stack+0xd1/0x175 lib/dump_stack.c:53\n     print_address_description+0x78/0x260 mm/kasan/report.c:252\n     kasan_report_error mm/kasan/report.c:351 [inline]\n     kasan_report+0x23f/0x350 mm/kasan/report.c:409\n     memcpy+0x1f/0x50 mm/kasan/kasan.c:302\n     memcpy ./include/linux/string.h:341 [inline]\n     x509_fabricate_name.constprop.1+0x1a4/0x940 crypto/asymmetric_keys/x509_cert_parser.c:366\n     asn1_ber_decoder+0xb4a/0x1fd0 lib/asn1_decoder.c:447\n     x509_cert_parse+0x1c7/0x620 crypto/asymmetric_keys/x509_cert_parser.c:89\n     x509_key_preparse+0x61/0x750 crypto/asymmetric_keys/x509_public_key.c:174\n     asymmetric_key_preparse+0xa4/0x150 crypto/asymmetric_keys/asymmetric_type.c:388\n     key_create_or_update+0x4d4/0x10a0 security/keys/key.c:850\n     SYSC_add_key security/keys/keyctl.c:122 [inline]\n     SyS_add_key+0xe8/0x290 security/keys/keyctl.c:62\n     entry_SYSCALL_64_fastpath+0x1f/0x96\n\n    Allocated by task 195:\n     __do_kmalloc_node mm/slab.c:3675 [inline]\n     __kmalloc_node+0x47/0x60 mm/slab.c:3682\n     kvmalloc ./include/linux/mm.h:540 [inline]\n     SYSC_add_key security/keys/keyctl.c:104 [inline]\n     SyS_add_key+0x19e/0x290 security/keys/keyctl.c:62\n     entry_SYSCALL_64_fastpath+0x1f/0x96\n\nFixes: 42d5ec27f873 (\"X.509: Add an ASN.1 decoder\")\nReported-by: Alexander Potapenko <glider@google.com>\nCc: <stable@vger.kernel.org> # v3.7+\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nLinux 3.18.97\n\nipv6: Skip XFRM lookup if dst_entry in socket cache is valid\n\ncommit 00bc0ef5880dc7b82f9c320dead4afaad48e47be upstream.\n\nAt present we perform an xfrm_lookup() for each UDPv6 message we\nsend. The lookup involves querying the flow cache (flow_cache_lookup)\nand, in case of a cache miss, creating an XFRM bundle.\n\nIf we miss the flow cache, we can end up creating a new bundle and\nderiving the path MTU (xfrm_init_pmtu) from on an already transformed\ndst_entry, which we pass from the socket cache (sk->sk_dst_cache) down\nto xfrm_lookup(). This can happen only if we're caching the dst_entry\nin the socket, that is when we're using a connected UDP socket.\n\nTo put it another way, the path MTU shrinks each time we miss the flow\ncache, which later on leads to incorrectly fragmented payload. It can\nbe observed with ESPv6 in transport mode:\n\n  1) Set up a transformation and lower the MTU to trigger fragmentation\n    # ip xfrm policy add dir out src ::1 dst ::1 \\\n      tmpl src ::1 dst ::1 proto esp spi 1\n    # ip xfrm state add src ::1 dst ::1 \\\n      proto esp spi 1 enc 'aes' 0x0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b\n    # ip link set dev lo mtu 1500\n\n  2) Monitor the packet flow and set up an UDP sink\n    # tcpdump -ni lo -ttt &\n    # socat udp6-listen:12345,fork /dev/null &\n\n  3) Send a datagram that needs fragmentation with a connected socket\n    # perl -e 'print \"@\" x 1470 | socat - udp6:[::1]:12345\n    2016/06/07 18:52:52 socat[724] E read(3, 0x555bb3d5ba00, 8192): Protocol error\n    00:00:00.000000 IP6 ::1 > ::1: frag (0|1448) ESP(spi=0x00000001,seq=0x2), length 1448\n    00:00:00.000014 IP6 ::1 > ::1: frag (1448|32)\n    00:00:00.000050 IP6 ::1 > ::1: ESP(spi=0x00000001,seq=0x3), length 1272\n    (^ ICMPv6 Parameter Problem)\n    00:00:00.000022 IP6 ::1 > ::1: ESP(spi=0x00000001,seq=0x5), length 136\n\n  4) Compare it to a non-connected socket\n    # perl -e 'print \"@\" x 1500' | socat - udp6-sendto:[::1]:12345\n    00:00:40.535488 IP6 ::1 > ::1: frag (0|1448) ESP(spi=0x00000001,seq=0x6), length 1448\n    00:00:00.000010 IP6 ::1 > ::1: frag (1448|64)\n\nWhat happens in step (3) is:\n\n  1) when connecting the socket in __ip6_datagram_connect(), we\n     perform an XFRM lookup, miss the flow cache, create an XFRM\n     bundle, and cache the destination,\n\n  2) afterwards, when sending the datagram, we perform an XFRM lookup,\n     again, miss the flow cache (due to mismatch of flowi6_iif and\n     flowi6_oif, which is an issue of its own), and recreate an XFRM\n     bundle based on the cached (and already transformed) destination.\n\nTo prevent the recreation of an XFRM bundle, avoid an XFRM lookup\naltogether whenever we already have a destination entry cached in the\nsocket. This prevents the path MTU shrinkage and brings us on par with\nUDPv4.\n\nThe fix also benefits connected PINGv6 sockets, another user of\nip6_sk_dst_lookup_flow(), who also suffer messages being transformed\ntwice.\n\nJoint work with Hannes Frederic Sowa.\n\nReported-by: Jan Tluka <jtluka@redhat.com>\nSigned-off-by: Jakub Sitnicki <jkbs@redhat.com>\nAcked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Benedict Wong <benedictwong@google.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nhrtimer: Ensure POSIX compliance (relative CLOCK_REALTIME hrtimers)\n\ncommit 48d0c9becc7f3c66874c100c126459a9da0fdced upstream.\n\nThe POSIX specification defines that relative CLOCK_REALTIME timers are not\naffected by clock modifications. Those timers have to use CLOCK_MONOTONIC\nto ensure POSIX compliance.\n\nThe introduction of the additional HRTIMER_MODE_PINNED mode broke this\nrequirement for pinned timers.\n\nThere is no user space visible impact because user space timers are not\nusing pinned mode, but for consistency reasons this needs to be fixed.\n\nCheck whether the mode has the HRTIMER_MODE_REL bit set instead of\ncomparing with HRTIMER_MODE_ABS.\n\nSigned-off-by: Anna-Maria Gleixner <anna-maria@linutronix.de>\nCc: Christoph Hellwig <hch@lst.de>\nCc: John Stultz <john.stultz@linaro.org>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: keescook@chromium.org\nFixes: 597d0275736d (\"timers: Framework for identifying pinned timers\")\nLink: http://lkml.kernel.org/r/20171221104205.7269-7-anna-maria@linutronix.de\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nCc: Mike Galbraith <efault@gmx.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nmtd: nand: gpmi: Fix failure when a erased page has a bitflip at BBM\n\n[ Upstream commit fdf2e821052958a114618a95ab18a300d0b080cb ]\n\nWhen erased subpages are read then the BCH decoder returns STATUS_ERASED\nif they are all empty, or STATUS_UNCORRECTABLE if there are bitflips.\nWhen there are bitflips, we have to set these bits again to show the\nupper layers a completely erased page. When a bitflip happens in the\nexact byte where the bad block marker is, then this byte is swapped\nwith another byte in block_mark_swapping(). The correction code then\ndetects a bitflip in another subpage and no longer corrects the bitflip\nwhere it really happens.\n\nCorrect this behaviour by calling block_mark_swapping() after the\nbitflips have been corrected.\n\nIn our case UBIFS failed with this bug because it expects erased\npages to be really empty:\n\nUBIFS error (pid 187): ubifs_scan: corrupt empty space at LEB 36:118735\nUBIFS error (pid 187): ubifs_scanned_corruption: corruption at LEB 36:118735\nUBIFS error (pid 187): ubifs_scanned_corruption: first 8192 bytes from LEB 36:118735\nUBIFS error (pid 187): ubifs_scan: LEB 36 scanning failed\nUBIFS error (pid 187): do_commit: commit failed, error -117\n\nSigned-off-by: Sascha Hauer <s.hauer@pengutronix.de>\nReviewed-by: Richard Weinberger <richard@nod.at>\nAcked-by: Boris Brezillon <boris.brezillon@free-electrons.com>\nSigned-off-by: Richard Weinberger <richard@nod.at>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nipv6: icmp6: Allow icmp messages to be looped back\n\n[ Upstream commit 588753f1eb18978512b1c9b85fddb457d46f9033 ]\n\nOne example of when an ICMPv6 packet is required to be looped back is\nwhen a host acts as both a Multicast Listener and a Multicast Router.\n\nA Multicast Router will listen on address ff02::16 for MLDv2 messages.\n\nCurrently, MLDv2 messages originating from a Multicast Listener running\non the same host as the Multicast Router are not being delivered to the\nMulticast Router. This is due to dst.input being assigned the default\nvalue of dst_discard.\n\nThis results in the packet being looped back but discarded before being\ndelivered to the Multicast Router.\n\nThis patch sets dst.input to ip6_input to ensure a looped back packet\nis delivered to the Multicast Router.\n\nSigned-off-by: Brendan McGrath <redmcg@redmandi.dyndns.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nsget(): handle failures of register_shrinker()\n\n[ Upstream commit 9ee332d99e4d5a97548943b81c54668450ce641b ]\n\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nspi: atmel: fixed spin_lock usage inside atmel_spi_remove\n\n[ Upstream commit 66e900a3d225575c8b48b59ae1fe74bb6e5a65cc ]\n\nThe only part of atmel_spi_remove which needs to be atomic is hardware\nreset.\n\natmel_spi_stop_dma calls dma_terminate_all and this needs interrupts\nenabled.\natmel_spi_release_dma calls dma_release_channel and dma_release_channel\nlocks a mutex inside of spin_lock.\n\nSo the call of these functions can't be inside a spin_lock.\n\nReported-by: Jia-Ju Bai <baijiaju1990@gmail.com>\nSigned-off-by: Radu Pirea <radu.pirea@microchip.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nnet: arc_emac: fix arc_emac_rx() error paths\n\n[ Upstream commit e688822d035b494071ecbadcccbd6f3325fb0f59 ]\n\narc_emac_rx() has some issues found by code review.\n\nIn case netdev_alloc_skb_ip_align() or dma_map_single() failure\nrx fifo entry will not be returned to EMAC.\n\nIn case dma_map_single() failure previously allocated skb became\nlost to driver. At the same time address of newly allocated skb\nwill not be provided to EMAC.\n\nSigned-off-by: Alexander Kochetkov <al.kochet@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nscsi: storvsc: Fix scsi_cmd error assignments in storvsc_handle_error\n\n[ Upstream commit d1b8b2391c24751e44f618fcf86fb55d9a9247fd ]\n\nWhen an I/O is returned with an srb_status of SRB_STATUS_INVALID_LUN\nwhich has zero good_bytes it must be assigned an error. Otherwise the\nI/O will be continuously requeued and will cause a deadlock in the case\nwhere disks are being hot added and removed. sd_probe_async will wait\nforever for its I/O to complete while holding scsi_sd_probe_domain.\n\nAlso returning the default error of DID_TARGET_FAILURE causes multipath\nto not retry the I/O resulting in applications receiving I/O errors\nbefore a failover can occur.\n\nSigned-off-by: Cathy Avery <cavery@redhat.com>\nSigned-off-by: Long Li <longli@microsoft.com>\nReviewed-by: Stephen Hemminger <stephen@networkplumber.org>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ntg3: Add workaround to restrict 5762 MRRS to 2048\n\n[ Upstream commit 4419bb1cedcda0272e1dc410345c5a1d1da0e367 ]\n\nOne of AMD based server with 5762 hangs with jumbo frame traffic.\nThis AMD platform has southbridge limitation which is restricting MRRS\nto 4000. As a work around, driver to restricts the MRRS to 2048 for\nthis particular 5762 NX1 card.\n\nSigned-off-by: Siva Reddy Kallam <siva.kallam@broadcom.com>\nSigned-off-by: Michael Chan <michael.chan@broadcom.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ntg3: Enable PHY reset in MTU change path for 5720\n\n[ Upstream commit e60ee41aaf898584205a6af5c996860d0fe6a836 ]\n\nA customer noticed RX path hang when MTU is changed on the fly while\nrunning heavy traffic with NCSI enabled for 5717 and 5719. Since 5720\nbelongs to same ASIC family, we observed same issue and same fix\ncould solve this problem for 5720.\n\nSigned-off-by: Siva Reddy Kallam <siva.kallam@broadcom.com>\nSigned-off-by: Michael Chan <michael.chan@broadcom.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nbnx2x: Improve reliability in case of nested PCI errors\n\n[ Upstream commit f7084059a9cb9e56a186e1677b1dcffd76c2cd24 ]\n\nWhile in recovery process of PCI error (called EEH on PowerPC arch),\nanother PCI transaction could be corrupted causing a situation of\nnested PCI errors. Also, this scenario could be reproduced with\nerror injection mechanisms (for debug purposes).\n\nWe observe that in case of nested PCI errors, bnx2x might attempt to\ninitialize its shmem and cause a kernel crash due to bad addresses\nread from MCP. Multiple different stack traces were observed depending\non the point the second PCI error happens.\n\nThis patch avoids the crashes by:\n\n * failing PCI recovery in case of nested errors (since multiple\n PCI errors in a row are not expected to lead to a functional\n adapter anyway), and by,\n\n * preventing access to adapter FW when MCP is failed (we mark it as\n failed when shmem cannot get initialized properly).\n\nReported-by: Abdul Haleem <abdhalee@linux.vnet.ibm.com>\nSigned-off-by: Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>\nAcked-by: Shahed Shaikh <Shahed.Shaikh@cavium.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nled: core: Fix brightness setting when setting delay_off=0\n\n[ Upstream commit 2b83ff96f51d0b039c4561b9f95c824d7bddb85c ]\n\nWith the current code, the following sequence won't work :\necho timer > trigger\n\necho 0 >  delay_off\n* at this point we call\n** led_delay_off_store\n** led_blink_set\n\ns390/dasd: fix wrongly assigned configuration data\n\n[ Upstream commit 8a9bd4f8ebc6800bfc0596e28631ff6809a2f615 ]\n\nWe store per path and per device configuration data to identify the\npath or device correctly. The per path configuration data might get\nmixed up if the original request gets into error recovery and is\nstarted with a random path mask.\n\nThis would lead to a wrong identification of a path in case of a CUIR\nevent for example.\n\nFix by copying the path mask from the original request to the error\nrecovery request in case it is a path verification request.\n\nSigned-off-by: Stefan Haberland <sth@linux.vnet.ibm.com>\nReviewed-by: Jan Hoeppner <hoeppner@linux.vnet.ibm.com>\nSigned-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nxfs: quota: fix missed destroy of qi_tree_lock\n\n[ Upstream commit 2196881566225f3c3428d1a5f847a992944daa5b ]\n\nxfs_qm_destroy_quotainfo() does not destroy quotainfo->qi_tree_lock\nwhile destroys quotainfo->qi_quotaofflock.\n\nSigned-off-by: Aliaksei Karaliou <akaraliou.dev@gmail.com>\nReviewed-by: Darrick J. Wong <darrick.wong@oracle.com>\nSigned-off-by: Darrick J. Wong <darrick.wong@oracle.com>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nxfs: quota: check result of register_shrinker()\n\n[ Upstream commit 3a3882ff26fbdbaf5f7e13f6a0bccfbf7121041d ]\n\nxfs_qm_init_quotainfo() does not check result of register_shrinker()\nwhich was tagged as __must_check recently, reported by sparse.\n\nSigned-off-by: Aliaksei Karaliou <akaraliou.dev@gmail.com>\n[darrick: move xfs_qm_destroy_quotainos nearer xfs_qm_init_quotainos]\nReviewed-by: Darrick J. Wong <darrick.wong@oracle.com>\nSigned-off-by: Darrick J. Wong <darrick.wong@oracle.com>\n\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ne1000: fix disabling already-disabled warning\n\n[ Upstream commit 0b76aae741abb9d16d2c0e67f8b1e766576f897d ]\n\nThis patch adds check so that driver does not disable already\ndisabled device.\n\n[   44.637743] advantechwdt: Unexpected close, not stopping watchdog!\n[   44.997548] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input6\n[   45.013419] e1000 0000:00:03.0: disabling already-disabled device\n[   45.013447] ------------[ cut here ]------------\n[   45.014868] WARNING: CPU: 1 PID: 71 at drivers/pci/pci.c:1641 pci_disable_device+0xa1/0x105:\n\t\t\t\t\t\tpci_disable_device at drivers/pci/pci.c:1640\n[   45.016171] CPU: 1 PID: 71 Comm: rcu_perf_shutdo Not tainted 4.14.0-01330-g3c07399 #1\n[   45.017197] task: ffff88011bee9e40 task.stack: ffffc90000860000\n[   45.017987] RIP: 0010:pci_disable_device+0xa1/0x105:\n\t\t\t\t\t\tpci_disable_device at drivers/pci/pci.c:1640\n[   45.018603] RSP: 0000:ffffc90000863e30 EFLAGS: 00010286\n[   45.019282] RAX: 0000000000000035 RBX: ffff88013a230008 RCX: 0000000000000000\n[   45.020182] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000203\n[   45.021084] RBP: ffff88013a3f31e8 R08: 0000000000000001 R09: 0000000000000000\n[   45.021986] R10: ffffffff827ec29c R11: 0000000000000002 R12: 0000000000000001\n[   45.022946] R13: ffff88013a230008 R14: ffff880117802b20 R15: ffffc90000863e8f\n[   45.023842] FS:  0000000000000000(0000) GS:ffff88013fd00000(0000) knlGS:0000000000000000\n[   45.024863] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   45.025583] CR2: ffffc900006d4000 CR3: 000000000220f000 CR4: 00000000000006a0\n[   45.026478] Call Trace:\n[   45.026811]  __e1000_shutdown+0x1d4/0x1e2:\n\t\t\t\t\t\t__e1000_shutdown at drivers/net/ethernet/intel/e1000/e1000_main.c:5162\n[   45.027344]  ? rcu_perf_cleanup+0x2a1/0x2a1:\n\t\t\t\t\t\trcu_perf_shutdown at kernel/rcu/rcuperf.c:627\n[   45.027883]  e1000_shutdown+0x14/0x3a:\n\t\t\t\t\t\te1000_shutdown at drivers/net/ethernet/intel/e1000/e1000_main.c:5235\n[   45.028351]  device_shutdown+0x110/0x1aa:\n\t\t\t\t\t\tdevice_shutdown at drivers/base/core.c:2807\n[   45.028858]  kernel_power_off+0x31/0x64:\n\t\t\t\t\t\tkernel_power_off at kernel/reboot.c:260\n[   45.029343]  rcu_perf_shutdown+0x9b/0xa7:\n\t\t\t\t\t\trcu_perf_shutdown at kernel/rcu/rcuperf.c:637\n[   45.029852]  ? __wake_up_common_lock+0xa2/0xa2:\n\t\t\t\t\t\tautoremove_wake_function at kernel/sched/wait.c:376\n[   45.030414]  kthread+0x126/0x12e:\n\t\t\t\t\t\tkthread at kernel/kthread.c:233\n[   45.030834]  ? __kthread_bind_mask+0x8e/0x8e:\n\t\t\t\t\t\tkthread at kernel/kthread.c:190\n[   45.031399]  ? ret_from_fork+0x1f/0x30:\n\t\t\t\t\t\tret_from_fork at arch/x86/entry/entry_64.S:443\n[   45.031883]  ? kernel_init+0xa/0xf5:\n\t\t\t\t\t\tkernel_init at init/main.c:997\n[   45.032325]  ret_from_fork+0x1f/0x30:\n\t\t\t\t\t\tret_from_fork at arch/x86/entry/entry_64.S:443\n[   45.032777] Code: 00 48 85 ed 75 07 48 8b ab a8 00 00 00 48 8d bb 98 00 00 00 e8 aa d1 11 00 48 89 ea 48 89 c6 48 c7 c7 d8 e4 0b 82 e8 55 7d da ff <0f> ff b9 01 00 00 00 31 d2 be 01 00 00 00 48 c7 c7 f0 b1 61 82\n[   45.035222] ---[ end trace c257137b1b1976ef ]---\n[   45.037838] ACPI: Preparing to enter system sleep state S5\n\nSigned-off-by: Tushar Dave <tushar.n.dave@oracle.com>\nTested-by: Fengguang Wu <fengguang.wu@intel.com>\nSigned-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ndrm/ttm: check the return value of kzalloc\n\n[ Upstream commit 19d859a7205bc59ffc38303eb25ae394f61d21dc ]\n\nIn the function ttm_page_alloc_init, kzalloc call is made for variable\n_manager, we need to check its return value, it may return NULL.\n\nSigned-off-by: Xiongwei Song <sxwjean@gmail.com>\nReviewed-by: Christian König <christian.koenig@amd.com>\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nxen-netfront: enable device after manual module load\n\n[ Upstream commit b707fda2df4070785d0fa8a278aa13944c5f51f8 ]\n\nWhen loading the module after unloading it, the network interface would\nnot be enabled and thus wouldn't have a backend counterpart and unable\nto be used by the guest.\n\nThe guest would face errors like:\n\n  [root@guest ~]# ethtool -i eth0\n  Cannot get driver information: No such device\n\n  [root@guest ~]# ifconfig eth0\n  eth0: error fetching interface information: Device not found\n\nThis patch initializes the state of the netfront device whenever it is\nloaded manually, this state would communicate the netback to create its\ndevice and establish the connection between them.\n\nSigned-off-by: Eduardo Otubo <otubo@redhat.com>\nReviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nmdio-sun4i: Fix a memory leak\n\n[ Upstream commit 56c0290202ab94a2f2780c449395d4ae8495fab4 ]\n\nIf the probing of the regulator is deferred, the memory allocated by\n'mdiobus_alloc_size()' will be leaking.\nIt should be freed before the next call to 'sun4i_mdio_probe()' which will\nreallocate it.\n\nFixes: 4bdcb1dd9feb (\"net: Add MDIO bus driver for the Allwinner EMAC\")\nSigned-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nSolutionEngine771x: fix Ether platform data\n\n[ Upstream commit 195e2addbce09e5afbc766efc1e6567c9ce840d3 ]\n\nThe 'sh_eth' driver's probe() method would fail  on the SolutionEngine7710\nboard and crash on SolutionEngine7712 board  as the platform code is\nhopelessly behind the driver's platform data --  it passes the PHY address\ninstead of 'struct sh_eth_plat_data *'; pass the latter to the driver in\norder to fix the bug...\n\nFixes: 71557a37adb5 (\"[netdrvr] sh_eth: Add SH7619 support\")\nSigned-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nxen/gntdev: Fix off-by-one error when unmapping with holes\n\n[ Upstream commit 951a010233625b77cde3430b4b8785a9a22968d1 ]\n\nIf the requested range has a hole, the calculation of the number of\npages to unmap is off by one. Fix it.\n\nSigned-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>\nReviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>\nSigned-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nxen/gntdev: Fix partial gntdev_mmap() cleanup\n\n[ Upstream commit cf2acf66ad43abb39735568f55e1f85f9844e990 ]\n\nWhen cleaning up after a partially successful gntdev_mmap(), unmap the\nsuccessfully mapped grant pages otherwise Xen will kill the domain if\nin debug mode (Attempt to implicitly unmap a granted PTE) or Linux will\nkill the process and emit \"BUG: Bad page map in process\" if Xen is in\nrelease mode.\n\nThis is only needed when use_ptemod is true because gntdev_put_map()\nwill unmap grant pages itself when use_ptemod is false.\n\nSigned-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>\nReviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>\nSigned-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nsctp: make use of pre-calculated len\n\n[ Upstream commit c76f97c99ae6d26d14c7f0e50e074382bfbc9f98 ]\n\nSome sockopt handling functions were calculating the length of the\nbuffer to be written to userspace and then calculating it again when\nactually writing the buffer, which could lead to some write not using\nan up-to-date length.\n\nThis patch updates such places to just make use of the len variable.\n\nAlso, replace some sizeof(type) to sizeof(var).\n\nSigned-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nnet: gianfar_ptp: move set_fipers() to spinlock protecting area\n\n[ Upstream commit 11d827a993a969c3c6ec56758ff63a44ba19b466 ]\n\nset_fipers() calling should be protected by spinlock in\ncase that any interrupt breaks related registers setting\nand the function we expect. This patch is to move set_fipers()\nto spinlock protecting area in ptp_gianfar_adjtime().\n\nSigned-off-by: Yangbo Lu <yangbo.lu@nxp.com>\nAcked-by: Richard Cochran <richardcochran@gmail.com>\nReviewed-by: Fabio Estevam <fabio.estevam@nxp.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nLinux 3.18.98\n\ntpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on the bus\n\ncommit 9b8cb28d7c62568a5916bdd7ea1c9176d7f8f2ed upstream.\n\nDiscrete TPMs are often connected over slow serial buses which, on\nsome platforms, can have glitches causing bit flips.  In all the\ndriver _recv() functions, we need to use a u32 to unmarshal the\nresponse size, otherwise a bit flip of the 31st bit would cause the\nexpected variable to go negative, which would then try to read a huge\namount of data.  Also sanity check that the expected amount of data is\nlarge enough for the TPM header.\n\nSigned-off-by: Jeremy Boone <jeremy.boone@nccgroup.trust>\nCc: stable@vger.kernel.org\nSigned-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>\nReviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>\nSigned-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>\nSigned-off-by: James Morris <james.morris@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ntpm_i2c_nuvoton: fix potential buffer overruns caused by bit glitches on the bus\n\ncommit f9d4d9b5a5ef2f017bc344fb65a58a902517173b upstream.\n\nDiscrete TPMs are often connected over slow serial buses which, on\nsome platforms, can have glitches causing bit flips.  In all the\ndriver _recv() functions, we need to use a u32 to unmarshal the\nresponse size, otherwise a bit flip of the 31st bit would cause the\nexpected variable to go negative, which would then try to read a huge\namount of data.  Also sanity check that the expected amount of data is\nlarge enough for the TPM header.\n\nSigned-off-by: Jeremy Boone <jeremy.boone@nccgroup.trust>\nCc: stable@vger.kernel.org\nSigned-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>\nReviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>\nSigned-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>\nSigned-off-by: James Morris <james.morris@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nALSA: usb-audio: Add a quirck for B&W PX headphones\n\ncommit 240a8af929c7c57dcde28682725b29cf8474e8e5 upstream.\n\nThe capture interface doesn't work and the playback interface only\nsupports 48 kHz sampling rate even though it advertises more rates.\n\nSigned-off-by: Erik Veijola <erik.veijola@gmail.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncpufreq: s3c24xx: Fix broken s3c_cpufreq_init()\n\ncommit 0373ca74831b0f93cd4cdbf7ad3aec3c33a479a5 upstream.\n\ncommit a307a1e6bc0d \"cpufreq: s3c: use cpufreq_generic_init()\"\naccidentally broke cpufreq on s3c2410 and s3c2412.\n\nThese two platforms don't have a CPU frequency table and used to skip\ncalling cpufreq_table_validate_and_show() for them.  But with the\nabove commit, we started calling it unconditionally and that will\neventually fail as the frequency table pointer is NULL.\n\nFix this by calling cpufreq_table_validate_and_show() conditionally\nagain.\n\nFixes: a307a1e6bc0d \"cpufreq: s3c: use cpufreq_generic_init()\"\nCc: 3.13+ <stable@vger.kernel.org> # v3.13+\nSigned-off-by: Viresh Kumar <viresh.kumar@linaro.org>\nSigned-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nARM: mvebu: Fix broken PL310_ERRATA_753970 selects\n\ncommit 8aa36a8dcde3183d84db7b0d622ffddcebb61077 upstream.\n\nThe MACH_ARMADA_375 and MACH_ARMADA_38X boards select ARM_ERRATA_753970,\nbut it was renamed to PL310_ERRATA_753970 by commit fa0ce4035d48 (\"ARM:\n7162/1: errata: tidy up Kconfig options for PL310 errata workarounds\").\n\nFix the selects to use the new name.\n\nDiscovered with the\nhttps://github.com/ulfalizer/Kconfiglib/blob/master/examples/list_undefined.py\nscript.\nFixes: fa0ce4035d48 (\"ARM: 7162/1: errata: tidy up Kconfig options for\nPL310 errata workarounds\"\ncc: stable@vger.kernel.org\nSigned-off-by: Ulf Magnusson <ulfalizer@gmail.com>\nSigned-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nnet: fec: introduce fec_ptp_stop and use in probe fail path\n\ncommit 32cba57ba74be58589aeb4cb6496183e46a5e3e5 upstream.\n\nThis function frees resources and cancels delayed work item that\nhave been initialized in fec_ptp_init().\n\nUse this to do proper error handling if something goes wrong in\nprobe function after fec_ptp_init has been called.\n\nSigned-off-by: Lucas Stach <l.stach@pengutronix.de>\nAcked-by: Fugang Duan <B38611@freescale.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n[groeck: backport: context changes in .../fec_main.c]\nSigned-off-by: Guenter Roeck <linux@roeck-us.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nleds: do not overflow sysfs buffer in led_trigger_show\n\ncommit 3b9b95363c45365d606ad4bbba16acca75fdf6d3 upstream.\n\nPer the documentation, use scnprintf instead of sprintf to ensure there\nis never more than PAGE_SIZE bytes of trigger names put into the\nbuffer.\n\nSigned-off-by: Nathan Sullivan <nathan.sullivan@ni.com>\nSigned-off-by: Zach Brown <zach.brown@ni.com>\nSigned-off-by: Jacek Anaszewski <j.anaszewski@samsung.com>\nCc: Willy Tarreau <w@1wt.eu>\nCc: Vlastimil Babka <vbabka@suse.cz>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nbridge: check brport attr show in brport_show\n\n[ Upstream commit 1b12580af1d0677c3c3a19e35bfe5d59b03f737f ]\n\nNow br_sysfs_if file flush doesn't have attr show. To read it will\ncause kernel panic after users chmod u+r this file.\n\nXiong found this issue when running the commands:\n\n  ip link add br0 type bridge\n  ip link add type veth\n  ip link set veth0 master br0\n  chmod u+r /sys/devices/virtual/net/veth0/brport/flush\n  timeout 3 cat /sys/devices/virtual/net/veth0/brport/flush\n\nkernel crashed with NULL a pointer dereference call trace.\n\nThis patch is to fix it by return -EINVAL when brport_attr->show\nis null, just the same as the check for brport_attr->store in\nbrport_store().\n\nFixes: 9cf637473c85 (\"bridge: add sysfs hook to flush forwarding table\")\nReported-by: Xiong Zhou <xzhou@redhat.com>\nSigned-off-by: Xin Long <lucien.xin@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nhdlc_ppp: carrier detect ok, don't turn off negotiation\n\n[ Upstream commit b6c3bad1ba83af1062a7ff6986d9edc4f3d7fc8e ]\n\nSometimes when physical lines have a just good noise to make the protocol\nhandshaking fail, but the carrier detect still good. Then after remove of\nthe noise, nobody will trigger this protocol to be start again to cause\nthe link to never come back. The fix is when the carrier is still on, not\nterminate the protocol handshaking.\n\nSigned-off-by: Denis Du <dudenis2000@yahoo.ca>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nipv6 sit: work around bogus gcc-8 -Wrestrict warning\n\n[ Upstream commit ca79bec237f5809a7c3c59bd41cd0880aa889966 ]\n\ngcc-8 has a new warning that detects overlapping input and output arguments\nin memcpy(). It triggers for sit_init_net() calling ipip6_tunnel_clone_6rd(),\nwhich is actually correct:\n\nnet/ipv6/sit.c: In function 'sit_init_net':\nnet/ipv6/sit.c:192:3: error: 'memcpy' source argument is the same as destination [-Werror=restrict]\n\nThe problem here is that the logic detecting the memcpy() arguments finds them\nto be the same, but the conditional that tests for the input and output of\nipip6_tunnel_clone_6rd() to be identical is not a compile-time constant.\n\nWe know that netdev_priv(t->dev) is the same as t for a tunnel device,\nand comparing \"dev\" directly here lets the compiler figure out as well\nthat 'dev == sitn->fb_tunnel_dev' when called from sit_init_net(), so\nit no longer warns.\n\nThis code is old, so Cc stable to make sure that we don't get the warning\nfor older kernels built with new gcc.\n\nCc: Martin Sebor <msebor@gmail.com>\nLink: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=83456\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nnet: fix race on decreasing number of TX queues\n\n[ Upstream commit ac5b70198adc25c73fba28de4f78adcee8f6be0b ]\n\nnetif_set_real_num_tx_queues() can be called when netdev is up.\nThat usually happens when user requests change of number of\nchannels/rings with ethtool -L.  The procedure for changing\nthe number of queues involves resetting the qdiscs and setting\ndev->num_tx_queues to the new value.  When the new value is\nlower than the old one, extra care has to be taken to ensure\nordering of accesses to the number of queues vs qdisc reset.\n\nCurrently the queues are reset before new dev->num_tx_queues\nis assigned, leaving a window of time where packets can be\nenqueued onto the queues going down, leading to a likely\ncrash in the drivers, since most drivers don't check if TX\nskbs are assigned to an active queue.\n\nFixes: e6484930d7c7 (\"net: allocate tx queues in register_netdevice\")\nSigned-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nnetlink: ensure to loop over all netns in genlmsg_multicast_allns()\n\n[ Upstream commit cb9f7a9a5c96a773bbc9c70660dc600cfff82f82 ]\n\nNowadays, nlmsg_multicast() returns only 0 or -ESRCH but this was not the\ncase when commit 134e63756d5f was pushed.\nHowever, there was no reason to stop the loop if a netns does not have\nlisteners.\nReturns -ESRCH only if there was no listeners in all netns.\n\nTo avoid having the same problem in the future, I didn't take the\nassumption that nlmsg_multicast() returns only 0 or -ESRCH.\n\nFixes: 134e63756d5f (\"genetlink: make netns aware\")\nCC: Johannes Berg <johannes.berg@intel.com>\nSigned-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nppp: prevent unregistered channels from connecting to PPP units\n\n[ Upstream commit 77f840e3e5f09c6d7d727e85e6e08276dd813d11 ]\n\nPPP units don't hold any reference on the channels connected to it.\nIt is the channel's responsibility to ensure that it disconnects from\nits unit before being destroyed.\nIn practice, this is ensured by ppp_unregister_channel() disconnecting\nthe channel from the unit before dropping a reference on the channel.\n\nHowever, it is possible for an unregistered channel to connect to a PPP\nunit: register a channel with ppp_register_net_channel(), attach a\n/dev/ppp file to it with ioctl(PPPIOCATTCHAN), unregister the channel\nwith ppp_unregister_channel() and finally connect the /dev/ppp file to\na PPP unit with ioctl(PPPIOCCONNECT).\n\nOnce in this situation, the channel is only held by the /dev/ppp file,\nwhich can be released at anytime and free the channel without letting\nthe parent PPP unit know. Then the ppp structure ends up with dangling\npointers in its ->channels list.\n\nPrevent this scenario by forbidding unregistered channels from\nconnecting to PPP units. This maintains the code logic by keeping\nppp_unregister_channel() responsible from disconnecting the channel if\nnecessary and avoids modification on the reference counting mechanism.\n\nThis issue seems to predate git history (successfully reproduced on\nLinux 2.6.26 and earlier PPP commits are unrelated).\n\nSigned-off-by: Guillaume Nault <g.nault@alphalink.fr>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nudplite: fix partial checksum initialization\n\n[ Upstream commit 15f35d49c93f4fa9875235e7bf3e3783d2dd7a1b ]\n\nSince UDP-Lite is always using checksum, the following path is\ntriggered when calculating pseudo header for it:\n\n  udp4_csum_init() or udp6_csum_init()\n    skb_checksum_init_zero_check()\n      __skb_checksum_validate_complete()\n\nThe problem can appear if skb->len is less than CHECKSUM_BREAK. In\nthis particular case __skb_checksum_validate_complete() also invokes\n__skb_checksum_complete(skb). If UDP-Lite is using partial checksum\nthat covers only part of a packet, the function will return bad\nchecksum and the packet will be dropped.\n\nIt can be fixed if we skip skb_checksum_init_zero_check() and only\nset the required pseudo header checksum for UDP-Lite with partial\nchecksum before udp4_csum_init()/udp6_csum_init() functions return.\n\nFixes: ed70fcfcee95 (\"net: Call skb_checksum_init in IPv4\")\nFixes: e4f45b7f40bd (\"net: Call skb_checksum_init in IPv6\")\nSigned-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nsctp: fix dst refcnt leak in sctp_v6_get_dst()\n\n[ Upstream commit 957d761cf91cdbb175ad7d8f5472336a4d54dbf2 ]\n\nWhen going through the bind address list in sctp_v6_get_dst() and\nthe previously found address is better ('matchlen > bmatchlen'),\nthe code continues to the next iteration without releasing currently\nheld destination.\n\nFix it by releasing 'bdst' before continue to the next iteration, and\ninstead of introducing one more '!IS_ERR(bdst)' check for dst_release(),\nmove the already existed one right after ip6_dst_lookup_flow(), i.e. we\nshouldn't proceed further if we get an error for the route lookup.\n\nFixes: dbc2b5e9a09e (\"sctp: fix src address selection if using secondary addresses for ipv6\")\nSigned-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>\nAcked-by: Neil Horman <nhorman@tuxdriver.com>\nAcked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ns390/qeth: fix SETIP command handling\n\n[ Upstream commit 1c5b2216fbb973a9410e0b06389740b5c1289171 ]\n\nsend_control_data() applies some special handling to SETIP v4 IPA\ncommands. But current code parses *all* command types for the SETIP\ncommand code. Limit the command code check to IPA commands.\n\nFixes: 5b54e16f1a54 (\"qeth: do not spin for SETIP ip assist command\")\nSigned-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ns390/qeth: fix IPA command submission race\n\n[ Upstream commit d22ffb5a712f9211ffd104c38fc17cbfb1b5e2b0 ]\n\nIf multiple IPA commands are build & sent out concurrently,\nfill_ipacmd_header() may assign a seqno value to a command that's\ndifferent from what send_control_data() later assigns to this command's\nreply.\nThis is due to other commands passing through send_control_data(),\nand incrementing card->seqno.ipa along the way.\n\nSo one IPA command has no reply that's waiting for its seqno, while some\nother IPA command has multiple reply objects waiting for it.\nOnly one of those waiting replies wins, and the other(s) times out and\ntriggers a recovery via send_ipa_cmd().\n\nFix this by making sure that the same seqno value is assigned to\na command and its reply object.\nDo so immediately before submitting the command & while holding the\nirq_pending \"lock\", to produce nicely ascending seqnos.\n\nAs a side effect, *all* IPA commands now use a reply object that's\nwaiting for its actual seqno. Previously, early IPA commands that were\nsubmitted while the card was still DOWN used the \"catch-all\" IDX seqno.\n\nSigned-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nsctp: verify size of a new chunk in _sctp_make_chunk()\n\n[ Upstream commit 07f2c7ab6f8d0a7e7c5764c4e6cc9c52951b9d9c ]\n\nWhen SCTP makes INIT or INIT_ACK packet the total chunk length\ncan exceed SCTP_MAX_CHUNK_LEN which leads to kernel panic when\ntransmitting these packets, e.g. the crash on sending INIT_ACK:\n\n[  597.804948] skbuff: skb_over_panic: text:00000000ffae06e4 len:120168\n               put:120156 head:000000007aa47635 data:00000000d991c2de\n               tail:0x1d640 end:0xfec0 dev:<NULL>\n...\n[  597.976970] ------------[ cut here ]------------\n[  598.033408] kernel BUG at net/core/skbuff.c:104!\n[  600.314841] Call Trace:\n[  600.345829]  <IRQ>\n[  600.371639]  ? sctp_packet_transmit+0x2095/0x26d0 [sctp]\n[  600.436934]  skb_put+0x16c/0x200\n[  600.477295]  sctp_packet_transmit+0x2095/0x26d0 [sctp]\n[  600.540630]  ? sctp_packet_config+0x890/0x890 [sctp]\n[  600.601781]  ? __sctp_packet_append_chunk+0x3b4/0xd00 [sctp]\n[  600.671356]  ? sctp_cmp_addr_exact+0x3f/0x90 [sctp]\n[  600.731482]  sctp_outq_flush+0x663/0x30d0 [sctp]\n[  600.788565]  ? sctp_make_init+0xbf0/0xbf0 [sctp]\n[  600.845555]  ? sctp_check_transmitted+0x18f0/0x18f0 [sctp]\n[  600.912945]  ? sctp_outq_tail+0x631/0x9d0 [sctp]\n[  600.969936]  sctp_cmd_interpreter.isra.22+0x3be1/0x5cb0 [sctp]\n[  601.041593]  ? sctp_sf_do_5_1B_init+0x85f/0xc30 [sctp]\n[  601.104837]  ? sctp_generate_t1_cookie_event+0x20/0x20 [sctp]\n[  601.175436]  ? sctp_eat_data+0x1710/0x1710 [sctp]\n[  601.233575]  sctp_do_sm+0x182/0x560 [sctp]\n[  601.284328]  ? sctp_has_association+0x70/0x70 [sctp]\n[  601.345586]  ? sctp_rcv+0xef4/0x32f0 [sctp]\n[  601.397478]  ? sctp6_rcv+0xa/0x20 [sctp]\n...\n\nHere the chunk size for INIT_ACK packet becomes too big, mostly\nbecause of the state cookie (INIT packet has large size with\nmany address parameters), plus additional server parameters.\n\nLater this chunk causes the panic in skb_put_data():\n\n  skb_packet_transmit()\n      sctp_packet_pack()\n          skb_put_data(nskb, chunk->skb->data, chunk->skb->len);\n\n'nskb' (head skb) was previously allocated with packet->size\nfrom u16 'chunk->chunk_hdr->length'.\n\nAs suggested by Marcelo we should check the chunk's length in\n_sctp_make_chunk() before trying to allocate skb for it and\ndiscard a chunk if its size bigger than SCTP_MAX_CHUNK_LEN.\n\nSigned-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>\nAcked-by: Marcelo Ricardo Leitner <marcelo.leinter@gmail.com>\nAcked-by: Neil Horman <nhorman@tuxdriver.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nnet: ipv4: don't allow setting net.ipv4.route.min_pmtu below 68\n\n[ Upstream commit c7272c2f1229125f74f22dcdd59de9bbd804f1c8 ]\n\nAccording to RFC 1191 sections 3 and 4, ICMP frag-needed messages\nindicating an MTU below 68 should be rejected:\n\n    A host MUST never reduce its estimate of the Path MTU below 68\n    octets.\n\nand (talking about ICMP frag-needed's Next-Hop MTU field):\n\n    This field will never contain a value less than 68, since every\n    router \"must be able to forward a datagram of 68 octets without\n    fragmentation\".\n\nFurthermore, by letting net.ipv4.route.min_pmtu be set to negative\nvalues, we can end up with a very large PMTU when (-1) is cast into u32.\n\nLet's also make ip_rt_min_pmtu a u32, since it's only ever compared to\nunsigned ints.\n\nReported-by: Jianlin Shi <jishi@redhat.com>\nSigned-off-by: Sabrina Dubroca <sd@queasysnail.net>\nReviewed-by: Stefano Brivio <sbrivio@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nfib_semantics: Don't match route with mismatching tclassid\n\n[ Upstream commit a8c6db1dfd1b1d18359241372bb204054f2c3174 ]\n\nIn fib_nh_match(), if output interface or gateway are passed in\nthe FIB configuration, we don't have to check next hops of\nmultipath routes to conclude whether we have a match or not.\n\nHowever, we might still have routes with different realms\nmatching the same output interface and gateway configuration,\nand this needs to cause the match to fail. Otherwise the first\nroute inserted in the FIB will match, regardless of the realms:\n\n # ip route add 1.1.1.1 dev eth0 table 1234 realms 1/2\n # ip route append 1.1.1.1 dev eth0 table 1234 realms 3/4\n # ip route list table 1234\n 1.1.1.1 dev eth0 scope link realms 1/2\n 1.1.1.1 dev eth0 scope link realms 3/4\n # ip route del 1.1.1.1 dev ens3 table 1234 realms 3/4\n # ip route list table 1234\n 1.1.1.1 dev ens3 scope link realms 3/4\n\nwhereas route with realms 3/4 should have been deleted instead.\n\nExplicitly check for fc_flow passed in the FIB configuration\n(this comes from RTA_FLOW extracted by rtm_to_fib_config()) and\nfail matching if it differs from nh_tclassid.\n\nThe handling of RTA_FLOW for multipath routes later in\nfib_nh_match() is still needed, as we can have multiple RTA_FLOW\nattributes that need to be matched against the tclassid of each\nnext hop.\n\nv2: Check that fc_flow is set before discarding the match, so\n    that the user can still select the first matching rule by\n    not specifying any realm, as suggested by David Ahern.\n\nReported-by: Jianlin Shi <jishi@redhat.com>\nSigned-off-by: Stefano Brivio <sbrivio@redhat.com>\nAcked-by: David Ahern <dsahern@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ndm io: fix duplicate bio completion due to missing ref count\n\ncommit feb7695fe9fb83084aa29de0094774f4c9d4c9fc upstream.\n\nIf only a subset of the devices associated with multiple regions support\na given special operation (eg. DISCARD) then the dec_count() that is\nused to set error for the region must increment the io->count.\n\nOtherwise, when the dec_count() is called it can cause the dm-io\ncaller's bio to be completed multiple times.  As was reported against\nthe dm-mirror target that had mirror legs with a mix of discard\ncapabilities.\n\nBug: https://bugzilla.kernel.org/show_bug.cgi?id=196077\nReported-by: Zhang Yi <yizhan@redhat.com>\nSigned-off-by: Mike Snitzer <snitzer@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nLinux 3.18.99\n\nusb-core: Add LINEAR_FRAME_INTR_BINTERVAL USB quirk\n\ncommit 3243367b209faed5c320a4e5f9a565ee2a2ba958 upstream.\n\nSome USB 2.0 devices erroneously report millisecond values in\nbInterval. The generic config code manages to catch most of them,\nbut in some cases it's not completely enough.\n\nThe case at stake here is a USB 2.0 braille device, which wants to\nannounce 10ms and thus sets bInterval to 10, but with the USB 2.0\ncomputation that yields to 64ms.  It happens that one can type fast\nenough to reach this interval and get the device buffers overflown,\nleading to problematic latencies.  The generic config code does not\ncatch this case because the 64ms is considered a sane enough value.\n\nThis change thus adds a USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL quirk\nto mark devices which actually report milliseconds in bInterval,\nand marks Vario Ultra devices as needing it.\n\nSigned-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>\nAcked-by: Alan Stern <stern@rowland.harvard.edu>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nscsi: qla2xxx: Fix NULL pointer crash due to active timer for ABTS\n\ncommit 1514839b366417934e2f1328edb50ed1e8a719f5 upstream.\n\nThis patch fixes NULL pointer crash due to active timer running for abort\nIOCB.\n\nFrom crash dump analysis it was discoverd that get_next_timer_interrupt()\nencountered a corrupted entry on the timer list.\n\n #9 [ffff95e1f6f0fd40] page_fault at ffffffff914fe8f8\n    [exception RIP: get_next_timer_interrupt+440]\n    RIP: ffffffff90ea3088  RSP: ffff95e1f6f0fdf0  RFLAGS: 00010013\n    RAX: ffff95e1f6451028  RBX: 000218e2389e5f40  RCX: 00000001232ad600\n    RDX: 0000000000000001  RSI: ffff95e1f6f0fdf0  RDI: 0000000001232ad6\n    RBP: ffff95e1f6f0fe40   R8: ffff95e1f6451188   R9: 0000000000000001\n    R10: 0000000000000016  R11: 0000000000000016  R12: 00000001232ad5f6\n    R13: ffff95e1f6450000  R14: ffff95e1f6f0fdf8  R15: ffff95e1f6f0fe10\n    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018\n\nLooking at the assembly of get_next_timer_interrupt(), address came\nfrom %r8 (ffff95e1f6451188) which is pointing to list_head with single\nentry at ffff95e5ff621178.\n\n 0xffffffff90ea307a <get_next_timer_interrupt+426>:      mov    (%r8),%rdx\n 0xffffffff90ea307d <get_next_ti…","distinct":true,"url":"https://api.github.com/repos/lineage-o-x2/android_kernel_leeco_msm8996/commits/9b12b1ed8ad69e29cd8f8ec7ab13f8d2479cd5da"},{"sha":"2dfa05a04065e66646adb5c1e4ebaa064e1d7a26","author":{"name":"thegb","email":"48502e43edf2bc387d5a4689e2afe05764f01ec8@hotmail.com"},"message":"f2fs: Update to v4.16-rc1\n\nfscrypt: make ->dummy_context() return bool\n\nThis makes it consistent with ->is_encrypted(), ->empty_dir(), and\nfscrypt_dummy_context_enabled().\n\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\n\nfscrypt: fix dereference of NULL user_key_payload\n\nWhen an fscrypt-encrypted file is opened, we request the file's master\nkey from the keyrings service as a logon key, then access its payload.\nHowever, a revoked key has a NULL payload, and we failed to check for\nthis.  request_key() *does* skip revoked keys, but there is still a\nwindow where the key can be revoked before we acquire its semaphore.\n\nFix it by checking for a NULL payload, treating it like a key which was\nalready revoked at the time it was requested.\n\nFixes: 88bd6ccdcdd6 (\"ext4 crypto: add encryption key management facilities\")\nReviewed-by: James Morris <james.l.morris@oracle.com>\nCc: <stable@vger.kernel.org>    [v4.1+]\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\n\nfscrypt: clean up include file mess\n\nFilesystems have to include different header files based on whether they\nare compiled with encryption support or not. That's nasty and messy.\n\nInstead, rationalise the headers so we have a single include fscrypt.h\nand let it decide what internal implementation to include based on the\n__FS_HAS_ENCRYPTION define.  Filesystems set __FS_HAS_ENCRYPTION to 1\nbefore including linux/fscrypt.h if they are built with encryption\nsupport.  Otherwise, they must set __FS_HAS_ENCRYPTION to 0.\n\nAdd guards to prevent fscrypt_supp.h and fscrypt_notsupp.h from being\ndirectly included by filesystems.\n\nSigned-off-by: Dave Chinner <dchinner@redhat.com>\n[EB: use 1 and 0 rather than defined/undefined]\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\n\nfs, fscrypt: add an S_ENCRYPTED inode flag\n\nIntroduce a flag S_ENCRYPTED which can be set in ->i_flags to indicate\nthat the inode is encrypted using the fscrypt (fs/crypto/) mechanism.\n\nChecking this flag will give the same information that\ninode->i_sb->s_cop->is_encrypted(inode) currently does, but will be more\nefficient.  This will be useful for adding higher-level helper functions\nfor filesystems to use.  For example we'll be able to replace this:\n\n\tif (ext4_encrypted_inode(inode)) {\n\t\tret = fscrypt_get_encryption_info(inode);\n\t\tif (ret)\n\t\t\treturn ret;\n\t\tif (!fscrypt_has_encryption_key(inode))\n\t\t\treturn -ENOKEY;\n\t}\n\nwith this:\n\n\tret = fscrypt_require_key(inode);\n\tif (ret)\n\t\treturn ret;\n\n... since we'll be able to retain the fast path for unencrypted files as\na single flag check, using an inline function.  This wasn't possible\nbefore because we'd have had to frequently call through the\n->i_sb->s_cop->is_encrypted function pointer, even when the encryption\nsupport was disabled or not being used.\n\nNote: we don't define S_ENCRYPTED to 0 if CONFIG_FS_ENCRYPTION is\ndisabled because we want to continue to return an error if an encrypted\nfile is accessed without encryption support, rather than pretending that\nit is unencrypted.\n\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nAcked-by: Dave Chinner <dchinner@redhat.com>\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\n\nfscrypt: switch from ->is_encrypted() to IS_ENCRYPTED()\n\nIS_ENCRYPTED() now gives the same information as\ni_sb->s_cop->is_encrypted() but is more efficient, since IS_ENCRYPTED()\nis just a simple flag check.  Prepare to remove ->is_encrypted() by\nswitching all callers to IS_ENCRYPTED().\n\nAcked-by: Dave Chinner <dchinner@redhat.com>\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\n\nfscrypt: remove ->is_encrypted()\n\nNow that all callers of fscrypt_operations.is_encrypted() have been\nswitched to IS_ENCRYPTED(), remove ->is_encrypted().\n\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nAcked-by: Dave Chinner <dchinner@redhat.com>\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\n\nfscrypt: remove unneeded empty fscrypt_operations structs\n\nIn the case where a filesystem has been configured without encryption\nsupport, there is no longer any need to initialize ->s_cop at all, since\nnone of the methods are ever called.\n\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nAcked-by: Dave Chinner <dchinner@redhat.com>\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\n\nfscrypt: new helper function - fscrypt_require_key()\n\nAdd a helper function which checks if an inode is encrypted, and if so,\ntries to set up its encryption key.  This is a pattern which is\nduplicated in multiple places in each of ext4, f2fs, and ubifs --- for\nexample, when a regular file is asked to be opened or truncated.\n\nAcked-by: Dave Chinner <dchinner@redhat.com>\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\n\nfscrypt: new helper function - fscrypt_file_open()\n\nAdd a helper function which prepares to open a regular file which may be\nencrypted.  It handles setting up the file's encryption key, then\nchecking that the file's encryption policy matches that of its parent\ndirectory (if the parent directory is encrypted).  It may be set as the\n->open() method or it can be called from another ->open() method.\n\nAcked-by: Dave Chinner <dchinner@redhat.com>\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\n\nfscrypt: new helper function - fscrypt_prepare_link()\n\nIntroduce a helper function which prepares to link an inode into a\npossibly-encrypted directory.  It handles setting up the target\ndirectory's encryption key, then verifying that the link won't violate\nthe constraint that all files in an encrypted directory tree use the\nsame encryption policy.\n\nAcked-by: Dave Chinner <dchinner@redhat.com>\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\n\nfscrypt: new helper function - fscrypt_prepare_rename()\n\nIntroduce a helper function which prepares to rename a file into a\npossibly encrypted directory.  It handles loading the encryption keys\nfor the source and target directories if needed, and it handles\nenforcing that if the target directory (and the source directory for a\ncross-rename) is encrypted, then the file being moved into the directory\nhas the same encryption policy as its containing directory.\n\nAcked-by: Dave Chinner <dchinner@redhat.com>\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\n\nfscrypt: new helper function - fscrypt_prepare_lookup()\n\nIntroduce a helper function which prepares to look up the given dentry\nin the given directory.  If the directory is encrypted, it handles\nloading the directory's encryption key, setting the dentry's ->d_op to\nfscrypt_d_ops, and setting DCACHE_ENCRYPTED_WITH_KEY if the directory's\nencryption key is available.\n\nNote: once all filesystems switch over to this, we'll be able to move\nfscrypt_d_ops and fscrypt_set_encrypted_dentry() to fscrypt_private.h.\n\nAcked-by: Dave Chinner <dchinner@redhat.com>\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\n\nfscrypt: new helper function - fscrypt_prepare_setattr()\n\nIntroduce a helper function for filesystems to call when processing\n->setattr() on a possibly-encrypted inode.  It handles enforcing that an\nencrypted file can only be truncated if its encryption key is available.\n\nAcked-by: Dave Chinner <dchinner@redhat.com>\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\n\nfscrypt: lock mutex before checking for bounce page pool\n\nfscrypt_initialize(), which allocates the global bounce page pool when\nan encrypted file is first accessed, uses \"double-checked locking\" to\ntry to avoid locking fscrypt_init_mutex.  However, it doesn't use any\nmemory barriers, so it's theoretically possible for a thread to observe\na bounce page pool which has not been fully initialized.  This is a\nclassic bug with \"double-checked locking\".\n\nWhile \"only a theoretical issue\" in the latest kernel, in pre-4.8\nkernels the pointer that was checked was not even the last to be\ninitialized, so it was easily possible for a crash (NULL pointer\ndereference) to happen.  This was changed only incidentally by the large\nrefactor to use fs/crypto/.\n\nSolve both problems in a trivial way that can easily be backported: just\nalways take the mutex.  It's theoretically less efficient, but it\nshouldn't be noticeable in practice as the mutex is only acquired very\nbriefly once per encrypted file.\n\nLater I'd like to make this use a helper macro like DO_ONCE().  However,\nDO_ONCE() runs in atomic context, so we'd need to add a new macro that\nallows blocking.\n\nCc: stable@vger.kernel.org # v4.1+\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\n\ncrypto: introduce crypto wait for async op\n\nInvoking a possibly async. crypto op and waiting for completion\nwhile correctly handling backlog processing is a common task\nin the crypto API implementation and outside users of it.\n\nThis patch adds a generic implementation for doing so in\npreparation for using it across the board instead of hand\nrolled versions.\n\nSigned-off-by: Gilad Ben-Yossef <gilad@benyossef.com>\nCC: Eric Biggers <ebiggers3@gmail.com>\nCC: Jonathan Cameron <Jonathan.Cameron@huawei.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\n\nfscrypt: move to generic async completion\n\nfscrypt starts several async. crypto ops and waiting for them to\ncomplete. Move it over to generic code doing the same.\n\nSigned-off-by: Gilad Ben-Yossef <gilad@benyossef.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\n\nfscrypt: resolve some cherry-pick bugs\n\n- remove wrong linux/fscrypt.h declared in ext4\n- remove obsolete function\n\nFixes: 734f0d241d2b (\"fscrypt: clean up include file mess\")\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: reserve nid resource for quota sysfile\n\nDuring mkfs, quota sysfiles have already occupied nid resource,\nit needs to adjust remaining available nid count in kernel side.\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: no need to read nat block if nat_block_bitmap is set\n\nNo need to read nat block if nat_block_bitmap is set.\n\nSigned-off-by: Yunlei He <heyunlei@huawei.com>\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: remove unneeded memory footprint accounting\n\nWe forgot to remov memory footprint accounting of per-cpu type\nvariables, fix it.\n\nFixes: 35782b233f37 (\"f2fs: remove percpu_count due to performance regression\")\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: fix concurrent problem for updating free bitmap\n\nalloc_nid_failed and scan_nat_page can be called at the same time,\nand we haven't protected add_free_nid and update_free_nid_bitmap\nwith the same nid_list_lock. That could lead to\n\nThread A\t\t\t\tThread B\n- __build_free_nids\n - scan_nat_page\n  - add_free_nid\n\t\t\t\t\t- alloc_nid_failed\n\t\t\t\t\t - update_free_nid_bitmap\n  - update_free_nid_bitmap\n\nscan_nat_page will clear the free bitmap since the nid is PREALLOC_NID,\nbut alloc_nid_failed needs to set the free bitmap. This results in\nfree nid with free bitmap cleared.\nThis patch update the bitmap under the same nid_list_lock in add_free_nid.\nAnd use __GFP_NOFAIL to make sure to update status of free nid correctly.\n\nSigned-off-by: Fan li <fanofcode.li@samsung.com>\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: introduce sysfs readdir_ra to readahead inode block in readdir\n\nThis patch introduces a sysfs interface readdir_ra to enable/disable\nreadaheading inode block in f2fs_readdir. When readdir_ra is enabled,\nit improves the performance of \"readdir + stat\".\n\nFor 300,000 files:\n\ttime find /data/test > /dev/null\ndisable readdir_ra: 1m25.69s real  0m01.94s user  0m50.80s system\nenable  readdir_ra: 0m18.55s real  0m00.44s user  0m15.39s system\n\nSigned-off-by: Sheng Yong <shengyong1@huawei.com>\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: do not preallocate blocks which has wrong buffer\n\nSheng Yong reports needless preallocation if write(small_buffer, large_size)\nis called.\n\nIn that case, f2fs preallocates large_size, but vfs returns early due to\nsmall_buffer size. Let's detect it before preallocation phase in f2fs.\n\nReported-by: Sheng Yong <shengyong1@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: still write data if preallocate only partial blocks\n\nIf there is not enough space left, f2fs_preallocate_blocks may only\npreallocte partial blocks. As a result, the write operation fails\nbut i_blocks is not 0.  To avoid this, f2fs should write data in\nnon-preallocation way and write as many data as the size of i_blocks.\n\nSigned-off-by: Sheng Yong <shengyong1@huawei.com>\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: remove unused parameter\n\nCommit d260081ccf37 (\"f2fs: change recovery policy of xattr node block\")\nremoves the use of blkaddr, which is no longer used. So remove the\nparameter.\n\nSigned-off-by: Sheng Yong <shengyong1@huawei.com>\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: fix lock dependency in between dio_rwsem & i_mmap_sem\n\ntest/generic/208 reports a potential deadlock as below:\n\nChain exists of:\n  &mm->mmap_sem --> &fi->i_mmap_sem --> &fi->dio_rwsem[WRITE]\n\n Possible unsafe locking scenario:\n\n       CPU0                    CPU1\n       ----                    ----\n  lock(&fi->dio_rwsem[WRITE]);\n                               lock(&fi->i_mmap_sem);\n                               lock(&fi->dio_rwsem[WRITE]);\n  lock(&mm->mmap_sem);\n\nThis patch changes the lock dependency as below in fallocate() to\nfix this issue:\n- dio_rwsem\n - i_mmap_sem\n\nFixes: bb06664a534b (\"f2fs: avoid race in between GC and block exchange\")\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: remove an excess variable\n\nRemove the variable page_idx which no one would miss.\n\nSigned-off-by: Fan li <fanofcode.li@samsung.com>\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: remove repeated f2fs_bug_on\n\nf2fs: remove repeated f2fs_bug_on which has already existed\n      in function invalidate_blocks.\n\nSigned-off-by: Zhikang Zhang <zhangzhikang1@huawei.com>\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: switch to fscrypt_file_open()\n\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: switch to fscrypt_prepare_link()\n\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: switch to fscrypt_prepare_rename()\n\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: switch to fscrypt_prepare_lookup()\n\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: switch to fscrypt_prepare_setattr()\n\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: apply write hints to select the type of segment for direct write\n\nWhen blocks are allocated for direct write, select the type of\nsegment using the kiocb hint. But if an inode has FI_NO_ALLOC,\nuse the inode hint.\n\nSigned-off-by: Hyunchul Lee <cheol.lee@lge.com>\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: remove a redundant conditional expression\n\nAvoid checking is_inode repeatedly, and make the logic\na little bit clearer.\n\nSigned-off-by: Fan li <fanofcode.li@samsung.com>\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: inject fault to kzalloc\n\nThis patch introduces f2fs_kzalloc based on f2fs_kmalloc in order to\nsupport error injection for kzalloc().\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: inject fault to kvmalloc\n\nThis patch supports to inject fault into kvmalloc/kvzalloc.\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: spread f2fs_k{m,z}alloc\n\nUse f2fs_k{m,z}alloc as much as possible to increase fault injection\npoints.\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: fix error handling in fill_super\n\nIn fill_super, if we fail to call f2fs_build_stats(), it needs to detach\nfrom global f2fs shrink list, otherwise once system starts to shrink slab\ncache, we will encounter below panic:\n\nBUG: unable to handle kernel paging request at 00007d35\nOops: 0002 [#1] PREEMPT SMP\nEIP: __lock_acquire+0x70/0x12c0\nCall Trace:\n lock_acquire+0xae/0x220\n mutex_trylock+0xc5/0xf0\n f2fs_shrink_count+0x32/0xb0 [f2fs]\n shrink_slab+0xf1/0x5b0\n drop_slab_node+0x35/0x60\n drop_slab+0xf/0x20\n drop_caches_sysctl_handler+0x79/0xc0\n proc_sys_call_handler+0xa4/0xc0\n proc_sys_write+0x1f/0x30\n __vfs_write+0x24/0x150\n SyS_write+0x44/0x90\n do_fast_syscall_32+0xa1/0x1ca\n entry_SYSENTER_32+0x4c/0x7b\n\nIn addition, this patch relocates f2fs_join_shrinker in fill_super to\navoid unneeded error handling of it.\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: clean up hash codes\n\nf2fs_chksum and f2fs_crc32 use the same 'crc32' crypto engine, also\ntheir implementation are almost the same, except with different\nshash description context.\n\nIntroduce __f2fs_crc32 to wrap the common codes, and reuse it in\nf2fs_chksum and f2fs_crc32.\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: clean up f2fs_map_blocks\n\nf2fs_map_blocks():\n\nif (blkaddr == NEW_ADDR || blkaddr == NULL_ADDR) {\n\tif (create) {\n\t\t...\n\t} else {\n\t\t...\n\t\tif (flag == F2FS_GET_BLOCK_FIEMAP &&\n\t\t\t\t\tblkaddr == NULL_ADDR) {\n\t\t\t...\n\t\t}\n\t\tif (flag != F2FS_GET_BLOCK_FIEMAP ||\n\t\t\t\t\tblkaddr != NEW_ADDR)\n\t\t\tgoto sync_out;\n\t}\n\nIt means we can break the loop in cases of:\na) flag != F2FS_GET_BLOCK_FIEMAP or\nb) flag == F2FS_GET_BLOCK_FIEMAP && blkaddr == NULL_ADDR\n\nCondition b) is the same as previous one, so merge operations of them\nfor readability.\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: don't return value in truncate_data_blocks_range\n\nThere is no caller cares about return value of truncate_data_blocks_range,\nremove it.\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: use unlikely for release case\n\nSince the variable release is only nonzero when another unlikely\ncase occurs, use unlikely() on it seems logical.\n\nSigned-off-by: Fan li <fanofcode.li@samsung.com>\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: no need return value in restore summary process\n\nNo need return value in restore summary process\n\nSigned-off-by: Yunlei He <heyunlei@huawei.com>\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: fix potential hangtask in f2fs_trace_pid\n\nAs Jia-Ju Bai reported:\n\n\"According to fs/f2fs/trace.c, the kernel module may sleep under a spinlock.\nThe function call path is:\nf2fs_trace_pid (acquire the spinlock)\n   f2fs_radix_tree_insert\n     cond_resched --> may sleep\n\nI do not find a good way to fix it, so I only report.\nThis possible bug is found by my static analysis tool (DSAC) and my code\nreview.\"\n\nObviously, it's problemetic to schedule in critical region of spinlock,\nwhich will cause uninterruptable sleep if there is no waker.\n\nThis patch changes to use mutex lock intead of spinlock to avoid this\ncondition.\n\nReported-by: Jia-Ju Bai <baijiaju1990@gmail.com>\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: fix an error case of missing update inode page\n\n-Thread A                             Thread B\n\n-write_checkpoint\n -block_operations\n  -f2fs_unlock_all                    -f2fs_sync_file\n                                       -f2fs_write_inode\n                                        -f2fs_inode_synced\n    -f2fs_sync_inode_meta\n     -sync_node_pages\n                                        -set_page_drity\n\nIn this case, if sudden power off without next new checkpoint,\nthe last inode page update will lost. wb_writeback is same with\nfsync.\n\nYunlei also reproduced the bug by:\n\n@@ -366,7 +366,7 @@ int update_inode(struct inode *inode, struct page *node_page)\n        struct extent_tree *et = F2FS_I(inode)->extent_tree;\n\n        f2fs_inode_synced(inode);\n-\n+       msleep(10000);\n        f2fs_wait_on_page_writeback(node_page, NODE, true);\n\nshell 1:                                       shell2:\n\ndd if=/dev/zero of=./test bs=1M count=10\nsync\necho \"hello\" >> ./test\nfsync test  // sleep 10s\n                                               sync //return quickly\necho c > /proc/sysrq-trigger\n\nSigned-off-by: Yunlei He <heyunlei@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: return error during fill_super\n\nLet's avoid BUG_ON during fill_super, when on-disk was totall corrupted.\n\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: recover directory operations by fsync\n\nThis fixes generic/342 which doesn't recover renamed file which was fsynced\nbefore. It will be done via another fsync on newly created file.\n\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: fix missing error number for xattr operation\n\nThis fixes generic/449 hang problem caused by no ENOSPC forever which should be\nreturned by setxattr under disk full scenario.\n\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: skip stop_checkpoint for user data writes\n\nWe can give another chance to write user data, which can resolve\ngeneric/441.\n\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: enable quota at remount from r to w\n\nWe have to enable quota only when remounting from read to write. Otherwise,\nwe'll get remount failure. (e.g., write to write case)\n\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: continue to do direct IO if we only preallocate partial blocks\n\nWhile doing direct IO, if we run out-of-space when we preallocate blocks,\nwe should not return ENOSPC error directly, instead, we should continue\nto do following direct IO, which will keep directIO of f2fs acting like\nother filesystems.\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: clean up unneeded declaration\n\nCommit 6afc662e68b5 (\"f2fs: support flexible inline xattr size\")\ndeclared f2fs_sb_has_flexible_inline_xattr in f2fs.h for latter being\nused in get_inline_xattr_addrs, but in latter version, related code\nhas been changed, leave f2fs_sb_has_flexible_inline_xattr w/o any\nusers. Let's remove it for cleanup.\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: show precise # of blocks that user/root can use\n\nLet's show precise # of blocks that user/root can use through bavail and bfree\nrespectively.\n\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: update inode info to inode page for new file\n\nAfter checkpoint,\n 1. creat a new file A ,(with dirty inode && dirty inode page && xattr info)\n 2. backgroud wb write back file A inode page (without update from inode cache)\n 3. fsync file A, write back inode page of file A with inode cache info\n 4. sudden power off before new checkpoint\n\nIn this case, recovery process will try to recover a zero inode\npage. Inline xattr flag of file A will be miss and xattr info\nwill be taken as blkaddr index.\n\nSigned-off-by: Yunlei He <heyunlei@huawei.com>\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: check segment type in __f2fs_replace_block\n\nIn some case, the node blocks has wrong blkaddr whose segment type is\nNODE, e.g., recover inode has missing xattr flag and the blkaddr is in\nthe xattr range. Since fsck.f2fs does not check the recovery nodes, this\nwill cause __f2fs_replace_block change the curseg of node and do the\nupdate_sit_entry(sbi, new_blkaddr, 1) with no next_blkoff refresh, as a\nresult, when recovery process write checkpoint and sync nodes, the\nnext_blkoff of curseg is used in the segment bit map, then it will\ncause f2fs_bug_on. So let's check segment type in __f2fs_replace_block.\n\nSigned-off-by: Yunlong Song <yunlong.song@huawei.com>\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: add reserved blocks for root user\n\nThis patch allows root to reserve some blocks via mount option.\n\n\"-o reserve_root=N\" means N x 4KB-sized blocks for root only.\n\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: make local functions static\n\nFixes the following sparse warnings:\n\nfs/f2fs/segment.c:887:6: warning:\n symbol '__check_sit_bitmap' was not declared. Should it be static?\nfs/f2fs/segment.c:1327:6: warning:\n symbol 'f2fs_wait_discard_bio' was not declared. Should it be static?\nfs/f2fs/super.c:1661:5: warning:\n symbol 'f2fs_get_projid' was not declared. Should it be static?\n\nSigned-off-by: Wei Yongjun <weiyongjun1@huawei.com>\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: avoid high cpu usage in discard thread\n\nWe take very long time to finish generic/476, this is because we will\ncheck consistence of all discard entries in global rb tree while\ntraversing all different granularity pending lists, even when the list\nis empty, in order to avoid that unneeded overhead, we have to skip\nthe check when coming up an empty list.\n\ngeneric/476 time consumption:\n\t\t\t\t\tcost\nBefore patch & w/o consistence check\t57s\nBefore patch & w/ consistence check\t1426s\nAfter patch\t\t\t\t78s\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: remove unused pend_list_tag\n\nIn commit 78997b569f56 (\"f2fs: split discard policy\"), we have get rid\nof using pend_list_tag field in struct discard_cmd_control, but forgot\nto remove it, now do it.\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: implement cgroup writeback support\n\nCgroup writeback requires explicit support from the filesystem.\nf2fs's data and node writeback IOs go through __write_data_page,\nwhich sets fio for submiting IOs. So, we add io_wbc for fio,\nassociate bios with blkcg by invoking wbc_init_bio() and\naccount IOs issuing by wbc_account_io().\nIn addtion, f2fs_fill_super() is updated to set SB_I_CGROUPWB.\n\nMeta writeback IOs is left alone by this patch and will always be\nattributed to the root cgroup.\n\nThe results show that f2fs can throttle writeback nicely for\ndata writing and file creating.\n\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Yufen Yu <yuyufen@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: add resgid and resuid to reserve root blocks\n\nThis patch adds mount options to reserve some blocks via resgid=%u,resuid=%u.\nIt only activates with reserve_root=%u.\n\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: handle newly created page when revoking inmem pages\n\nWhen committing inmem pages is successful, we revoke already committed\nblocks in __revoke_inmem_pages() and finally replace the committed\nones with the old blocks using f2fs_replace_block(). However, if\nthe committed block was newly created one, the address of the old\nblock is NEW_ADDR and __f2fs_replace_block() cannot handle NEW_ADDR\nas new_blkaddr properly and a kernel panic occurrs.\n\nSigned-off-by: Daeho Jeong <daeho.jeong@samsung.com>\nTested-by: Shu Tan <shu.tan@samsung.com>\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: fix to caclulate required free section correctly\n\nWhen calculating required free section during file defragmenting, we\nshould skip holes in file, otherwise we will probably fail to defrag\nsparse file with large size.\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: check node page again in write end io\n\nCheck node page again in write end io in case of\ndata corruption during inflght IO.\n\nSigned-off-by: Yunlei He <heyunlei@huawei.com>\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: fix to cover f2fs_inline_data_fiemap with inode_lock\n\nThis patch fix to cover f2fs_inline_data_fiemap with inode_lock in order\nto make that interface avoiding race with mapping change.\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: support FIEMAP_FLAG_XATTR\n\nThis patch enables ->fiemap to handle FIEMAP_FLAG_XATTR flag for xattr\nmapping info lookup purpose.\n\nIt makes f2fs passing generic/425 test in fstest.\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: prevent newly created inode from being dirtied incorrectly\n\nNow, we invoke f2fs_mark_inode_dirty_sync() to make an inode dirty in\nadvance of creating a new node page for the inode. By this, some inodes\nwhose node page is not created yet can be linked into the global dirty\nlist.\n\nIf the checkpoint is executed at this moment, the inode will be written\nback by writeback_single_inode() and finally update_inode_page() will\nfail to detach the inode from the global dirty list because the inode\ndoesn't have a node page.\n\nThe problem is that the inode's state in VFS layer will become clean\nafter execution of writeback_single_inode() and it's still linked in\nthe global dirty list of f2fs and this will cause a kernel panic.\n\nSo, we will prevent the newly created inode from being dirtied during\nthe FI_NEW_INODE flag of the inode is set. We will make it dirty\nright after the flag is cleared.\n\nSigned-off-by: Daeho Jeong <daeho.jeong@samsung.com>\nSigned-off-by: Youngjin Gil <youngjin.gil@samsung.com>\nTested-by: Hobin Woo <hobin.woo@samsung.com>\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: add an ioctl to disable GC for specific file\n\nThis patch gives a flag to disable GC on given file, which would be useful, when\nuser wants to keep its block map. It also conducts in-place-update for dontmove\nfile.\n\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: support F2FS_IOC_PRECACHE_EXTENTS\n\nThis patch introduces a new ioctl F2FS_IOC_PRECACHE_EXTENTS to precache\nextent info like ext4, in order to gain better performance during\ntriggering AIO by eliminating synchronous waiting of mapping info.\n\nReferred commit: 7869a4a6c5ca (\"ext4: add support for extent pre-caching\")\n\nIn addition, with newly added extent precache abilitiy, this patch add\nto support FIEMAP_FLAG_CACHE in ->fiemap.\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: speed up defragment on sparse file\n\nWe have supported to get next page offset with valid mapping crossing\nhole in f2fs_map_blocks, utilizing it to speed up defragment on sparse\nfile.\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: fix to drop all inmem pages correctly\n\nIn commit 57864ae5ce3a (\"f2fs: limit # of inmemory pages\"), we have\nlimited memory footprint of all inmem pages with 20% of total memory,\notherwise, if we exceed the threshold, we will try to drop all inmem\npages to avoid excessive memory pressure resulting in performance\nregression.\n\nBut in some unrelated error paths, we will also drop all inmem pages,\nwhich should be wrong, fix it in this patch.\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: allow quota to use reserved blocks\n\nThis patch allows quota to use reserved blocks all the time.\n\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: avoid hungtask when GC encrypted block if io_bits is set\n\nWhen io_bits is set, GCing encrypted block may hit the following hungtask.\nSince io_bits requires aligned block address, f2fs_submit_page_write may\nreturn -EAGAIN if new_blkaddr does not satisify io_bits alignment. As a\nresult, the encrypted page will never be writtenback.\n\nThis patch makes move_data_block aware the EAGAIN error and cancel the\nwriteback.\n\n[  246.751371] INFO: task kworker/u4:4:797 blocked for more than 90 seconds.\n[  246.752423]       Not tainted 4.15.0-rc4+ #11\n[  246.754176] \"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n[  246.755336] kworker/u4:4    D25448   797      2 0x80000000\n[  246.755597] Workqueue: writeback wb_workfn (flush-7:0)\n[  246.755616] Call Trace:\n[  246.755695]  ? __schedule+0x322/0xa90\n[  246.755761]  ? blk_init_request_from_bio+0x120/0x120\n[  246.755773]  ? pci_mmcfg_check_reserved+0xb0/0xb0\n[  246.755801]  ? __radix_tree_create+0x19e/0x200\n[  246.755813]  ? delete_node+0x136/0x370\n[  246.755838]  schedule+0x43/0xc0\n[  246.755904]  io_schedule+0x17/0x40\n[  246.755939]  wait_on_page_bit_common+0x17b/0x240\n[  246.755950]  ? wake_page_function+0xa0/0xa0\n[  246.755961]  ? add_to_page_cache_lru+0x160/0x160\n[  246.755972]  ? page_cache_tree_insert+0x170/0x170\n[  246.755983]  ? __lru_cache_add+0x96/0xb0\n[  246.756086]  __filemap_fdatawait_range+0x14f/0x1c0\n[  246.756097]  ? wait_on_page_bit_common+0x240/0x240\n[  246.756120]  ? __wake_up_locked_key_bookmark+0x20/0x20\n[  246.756167]  ? wait_on_all_pages_writeback+0xc9/0x100\n[  246.756179]  ? __remove_ino_entry+0x120/0x120\n[  246.756192]  ? wait_woken+0x100/0x100\n[  246.756204]  filemap_fdatawait_range+0x9/0x20\n[  246.756216]  write_checkpoint+0x18a1/0x1f00\n[  246.756254]  ? blk_get_request+0x10/0x10\n[  246.756265]  ? cpumask_next_and+0x43/0x60\n[  246.756279]  ? f2fs_sync_inode_meta+0x160/0x160\n[  246.756289]  ? remove_element.isra.4+0xa0/0xa0\n[  246.756300]  ? __put_compound_page+0x40/0x40\n[  246.756310]  ? f2fs_sync_fs+0xec/0x1c0\n[  246.756320]  ? f2fs_sync_fs+0x120/0x1c0\n[  246.756329]  f2fs_sync_fs+0x120/0x1c0\n[  246.756357]  ? trace_event_raw_event_f2fs__page+0x260/0x260\n[  246.756393]  ? ata_build_rw_tf+0x173/0x410\n[  246.756397]  f2fs_balance_fs_bg+0x198/0x390\n[  246.756405]  ? drop_inmem_page+0x230/0x230\n[  246.756415]  ? ahci_qc_prep+0x1bb/0x2e0\n[  246.756418]  ? ahci_qc_issue+0x1df/0x290\n[  246.756422]  ? __accumulate_pelt_segments+0x42/0xd0\n[  246.756426]  ? f2fs_write_node_pages+0xd1/0x380\n[  246.756429]  f2fs_write_node_pages+0xd1/0x380\n[  246.756437]  ? sync_node_pages+0x8f0/0x8f0\n[  246.756440]  ? update_curr+0x53/0x220\n[  246.756444]  ? __accumulate_pelt_segments+0xa2/0xd0\n[  246.756448]  ? __update_load_avg_se.isra.39+0x349/0x360\n[  246.756452]  ? do_writepages+0x2a/0xa0\n[  246.756456]  do_writepages+0x2a/0xa0\n[  246.756460]  __writeback_single_inode+0x70/0x490\n[  246.756463]  ? check_preempt_wakeup+0x199/0x310\n[  246.756467]  writeback_sb_inodes+0x2a2/0x660\n[  246.756471]  ? is_empty_dir_inode+0x40/0x40\n[  246.756474]  ? __writeback_single_inode+0x490/0x490\n[  246.756477]  ? string+0xbf/0xf0\n[  246.756480]  ? down_read_trylock+0x35/0x60\n[  246.756484]  __writeback_inodes_wb+0x9f/0xf0\n[  246.756488]  wb_writeback+0x41d/0x4b0\n[  246.756492]  ? writeback_inodes_wb.constprop.55+0x150/0x150\n[  246.756498]  ? set_worker_desc+0xf7/0x130\n[  246.756502]  ? current_is_workqueue_rescuer+0x60/0x60\n[  246.756511]  ? _find_next_bit+0x2c/0xa0\n[  246.756514]  ? wb_workfn+0x400/0x5d0\n[  246.756518]  wb_workfn+0x400/0x5d0\n[  246.756521]  ? finish_task_switch+0xdf/0x2a0\n[  246.756525]  ? inode_wait_for_writeback+0x30/0x30\n[  246.756529]  process_one_work+0x3a7/0x6f0\n[  246.756533]  worker_thread+0x82/0x750\n[  246.756537]  kthread+0x16f/0x1c0\n[  246.756541]  ? trace_event_raw_event_workqueue_work+0x110/0x110\n[  246.756544]  ? kthread_create_worker_on_cpu+0xb0/0xb0\n[  246.756548]  ret_from_fork+0x1f/0x30\n\nSigned-off-by: Sheng Yong <shengyong1@huawei.com>\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: clean up error path of fill_super\n\nThis patch cleans up error path of fille_super to avoid unneeded\nrelease step.\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: kill F2FS_INLINE_XATTR_ADDRS for cleanup\n\nUse get_inline_xattr_addrs directly instead of F2FS_INLINE_XATTR_ADDRS.\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: fix to update last_disk_size correctly\n\nThis patch fixes to update last_disk_size only when writing out page\nsuccessfully.\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: split need_inplace_update\n\nThis patch splits need_inplace_update to two functions:\na. should_update_inplace() includes all conditions that we must use IPU.\nb. should_update_outplace() includes all conditions that we must use OPU.\n\nSo that, in f2fs_ioc_set_pin_file() and f2fs_defragment_range(), we can\nuse corresponding function to check whether we can trigger OPU/IPU or not.\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: hanlde error case in f2fs_ioc_shutdown\n\nThis patch makes f2fs_ioc_shutdown handling error case correctly.\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: stop gc/discard thread after fs shutdown\n\nOnce filesystem shuts down, daemons like gc/discard thread should be\naware of it, and do exit, in addtion, drop all cached pending discard\ncommands and turn off real-time discard mode.\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: drop page cache after fs shutdown\n\nDon't remain dirtied page cache in f2fs after shutdown, it can mitigate\nmemory pressure of whole system, in order to keep other modules working\nproperly.\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: correct removexattr behavior for null valued extended attribute\n\n__vfs_removexattr() transfers \"NULL\" value to the setxattr handler of\nthe f2fs filesystem in order to remove the extended attribute. But,\n__f2fs_setxattr() just ignores the removal request when the value of\nthe extended attribute is already NULL. We have to remove the extended\nattribute itself even if the value of that is already NULL.\n\nWe can reporduce this bug with the below:\n\n1. touch file\n2. setfattr -n \"user.foo\" file\n3. setfattr -x \"user.foo\" file\n4. getfattr -d file\n> user.foo\n\nSigned-off-by: Daeho Jeong <daeho.jeong@samsung.com>\nSigned-off-by: Youngjin Gil <youngjin.gil@samsung.com>\nTested-by: Hobin Woo <hobin.woo@samsung.com>\nTested-by: Chao Yu <yuchao0@huawei.com>\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: recover some i_inline flags\n\nThis fixes lost i_inline flags during roll-forward.\n\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: allow to recover node blocks given updated checkpoint\n\nIf fsck.f2fs changes crc, we have no way to recover some inode blocks by roll-\nforward recovery. Let's relax the condition to recover them.\n\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: use GFP_F2FS_ZERO for cleanup\n\nClean up codes with GFP_F2FS_ZERO, no logic changes.\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: clean up duplicated assignment in init_discard_policy\n\nRemove duplicated codes of assignment for .max_requests and .io_aware_gran.\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: stop issuing discard if fs is readonly\n\nIf filesystem is readonly, stop to issue discard in daemon.\n\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: rebuild sit page from sit info in mem\n\nThis patch rebuild sit page from sit info in mem instead\nof issue a read io.\n\nI test this method and the result is as below:\n\nPre:\n mmc_perf_test-12061 [001] ...1   976.819992: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = start flush sit\n mmc_perf_test-12061 [001] ...1   976.856446: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = end flush sit\n mmc_perf_test-12061 [003] ...1   998.976946: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = start flush sit\n mmc_perf_test-12061 [003] ...1   999.023269: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = end flush sit\n mmc_perf_test-12061 [003] ...1  1022.060772: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = start flush sit\n mmc_perf_test-12061 [003] ...1  1022.111034: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = end flush sit\n mmc_perf_test-12061 [002] ...1  1070.127643: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = start flush sit\n mmc_perf_test-12061 [003] ...1  1070.187352: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = end flush sit\n mmc_perf_test-12061 [003] ...1  1095.942124: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = start flush sit\n mmc_perf_test-12061 [003] ...1  1095.995975: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = end flush sit\n mmc_perf_test-12061 [003] ...1  1122.535091: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = start flush sit\n mmc_perf_test-12061 [003] ...1  1122.586521: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = end flush sit\n mmc_perf_test-12061 [001] ...1  1147.897487: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = start flush sit\n mmc_perf_test-12061 [001] ...1  1147.959438: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = end flush sit\n mmc_perf_test-12061 [003] ...1  1177.926951: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = start flush sit\n mmc_perf_test-12061 [002] ...1  1177.976823: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = end flush sit\n mmc_perf_test-12061 [002] ...1  1204.176087: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = start flush sit\n mmc_perf_test-12061 [002] ...1  1204.239046: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = end flush sit\n\nSome sit flush consume more than 50ms.\n\nNow:\nmmc_perf_test-2187  [007] ...1   196.840684: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = start flush sit\nmmc_perf_test-2187  [007] ...1   196.841258: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = end flush sit\nmmc_perf_test-2187  [007] ...1   219.430582: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = start flush sit\nmmc_perf_test-2187  [007] ...1   219.431144: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = end flush sit\nmmc_perf_test-2187  [002] ...1   243.638678: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = start flush sit\nmmc_perf_test-2187  [000] ...1   243.638980: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = end flush sit\nmmc_perf_test-2187  [002] ...1   265.392180: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = start flush sit\nmmc_perf_test-2187  [002] ...1   265.392245: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = end flush sit\nmmc_perf_test-2187  [000] ...1   290.309051: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = start flush sit\nmmc_perf_test-2187  [000] ...1   290.309116: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = end flush sit\nmmc_perf_test-2187  [003] ...1   317.144209: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = start flush sit\nmmc_perf_test-2187  [003] ...1   317.145913: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = end flush sit\nmmc_perf_test-2187  [005] ...1   343.224954: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = start flush sit\nmmc_perf_test-2187  [005] ...1   343.225574: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = end flush sit\nmmc_perf_test-2187  [000] ...1   370.239846: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = start flush sit\nmmc_perf_test-2187  [000] ...1   370.241138: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = end flush sit\nmmc_perf_test-2187  [001] ...1   397.029043: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = start flush sit\nmmc_perf_test-2187  [001] ...1   397.030750: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = end flush sit\nmmc_perf_test-2187  [003] ...1   425.386377: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = start flush sit\nmmc_perf_test-2187  [003] ...1   425.387735: f2fs_write_checkpoint: dev = (259,44), checkpoint for Sync, state = end flush sit\n\nMost sit flush consume no more than 1ms.\n\nSigned-off-by: Yunlei He <heyunlei@huawei.com>\nReviewed-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nf2fs: support inode creation time\n\nThis patch adds creation time field in inode layout to support showing\nkstat.btime in ->statx.\n\nChange-Id: Idd43daac0ab3b0e07a7e2f40fb9157d8a115cfbc\nSigned-off-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>","distinct":true,"url":"https://api.github.com/repos/lineage-o-x2/android_kernel_leeco_msm8996/commits/2dfa05a04065e66646adb5c1e4ebaa064e1d7a26"}]}
{"actor":{"display_login":"ThEMarD"}}