{"push_id":2956168000,"size":33,"distinct_size":33,"ref":"refs/heads/linux-4.9.y","head":"deb3303f665b31c29210ef4b30b1e69cb06cc397","before":"3622426cc93ab5bc75fa9cf2e897441dff894c34","commits":[{"sha":"e308fb9f145abcdb7f3fbd58f425dc4f00eba869","author":{"name":"Jann Horn","email":"0fcb39c6619aeb747ed6898bfde644ba26b24452@google.com"},"message":"mm/vmstat.c: skip NR_TLB_REMOTE_FLUSH* properly\n\ncommit 58bc4c34d249bf1bc50730a9a209139347cfacfe upstream.\n\n5dd0b16cdaff (\"mm/vmstat: Make NR_TLB_REMOTE_FLUSH_RECEIVED available even\non UP\") made the availability of the NR_TLB_REMOTE_FLUSH* counters inside\nthe kernel unconditional to reduce #ifdef soup, but (either to avoid\nshowing dummy zero counters to userspace, or because that code was missed)\ndidn't update the vmstat_array, meaning that all following counters would\nbe shown with incorrect values.\n\nThis only affects kernel builds with\nCONFIG_VM_EVENT_COUNTERS=y && CONFIG_DEBUG_TLBFLUSH=y && CONFIG_SMP=n.\n\nLink: http://lkml.kernel.org/r/20181001143138.95119-2-jannh@google.com\nFixes: 5dd0b16cdaff (\"mm/vmstat: Make NR_TLB_REMOTE_FLUSH_RECEIVED available even on UP\")\nSigned-off-by: Jann Horn <jannh@google.com>\nReviewed-by: Kees Cook <keescook@chromium.org>\nReviewed-by: Andrew Morton <akpm@linux-foundation.org>\nAcked-by: Michal Hocko <mhocko@suse.com>\nAcked-by: Roman Gushchin <guro@fb.com>\nCc: Davidlohr Bueso <dave@stgolabs.net>\nCc: Oleg Nesterov <oleg@redhat.com>\nCc: Christoph Lameter <clameter@sgi.com>\nCc: Kemi Wang <kemi.wang@intel.com>\nCc: Andy Lutomirski <luto@kernel.org>\nCc: Ingo Molnar <mingo@kernel.org>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/e308fb9f145abcdb7f3fbd58f425dc4f00eba869"},{"sha":"22feb4d4f4547a495b51c6a03c55989643ac712a","author":{"name":"Tomi Valkeinen","email":"e1ca4dbb8be1acaf20734fecd2da10ed1d46a9bb@ti.com"},"message":"fbdev/omapfb: fix omapfb_memory_read infoleak\n\ncommit 1bafcbf59fed92af58955024452f45430d3898c5 upstream.\n\nOMAPFB_MEMORY_READ ioctl reads pixels from the LCD's memory and copies\nthem to a userspace buffer. The code has two issues:\n\n- The user provided width and height could be large enough to overflow\n  the calculations\n- The copy_to_user() can copy uninitialized memory to the userspace,\n  which might contain sensitive kernel information.\n\nFix these by limiting the width & height parameters, and only copying\nthe amount of data that we actually received from the LCD.\n\nSigned-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>\nReported-by: Jann Horn <jannh@google.com>\nCc: stable@vger.kernel.org\nCc: security@kernel.org\nCc: Will Deacon <will.deacon@arm.com>\nCc: Jann Horn <jannh@google.com>\nCc: Tony Lindgren <tony@atomide.com>\nSigned-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/22feb4d4f4547a495b51c6a03c55989643ac712a"},{"sha":"2962761863cb161d419c94f3dde7443af0e63c31","author":{"name":"Jan Beulich","email":"051346888327db48cce19d2cfd0e1c700bb7cf16@suse.com"},"message":"xen-netback: fix input validation in xenvif_set_hash_mapping()\n\ncommit 780e83c259fc33e8959fed8dfdad17e378d72b62 upstream.\n\nBoth len and off are frontend specified values, so we need to make\nsure there's no overflow when adding the two for the bounds check. We\nalso want to avoid undefined behavior and hence use off to index into\n->hash.mapping[] only after bounds checking. This at the same time\nallows to take care of not applying off twice for the bounds checking\nagainst vif->num_queues.\n\nIt is also insufficient to bounds check copy_op.len, as this is len\ntruncated to 16 bits.\n\nThis is XSA-270 / CVE-2018-15471.\n\nReported-by: Felix Wilhelm <fwilhelm@google.com>\nSigned-off-by: Jan Beulich <jbeulich@suse.com>\nReviewed-by: Paul Durrant <paul.durrant@citrix.com>\nTested-by: Paul Durrant <paul.durrant@citrix.com>\nCc: stable@vger.kernel.org [4.7 onwards]\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/2962761863cb161d419c94f3dde7443af0e63c31"},{"sha":"9f14d89a13164552038977e7d1bc5b2e3c31f56a","author":{"name":"Andy Lutomirski","email":"2cc0d0d76de2e6f37b92deeb83c85cb306fc5dc1@kernel.org"},"message":"x86/vdso: Fix asm constraints on vDSO syscall fallbacks\n\ncommit 715bd9d12f84d8f5cc8ad21d888f9bc304a8eb0b upstream.\n\nThe syscall fallbacks in the vDSO have incorrect asm constraints.\nThey are not marked as writing to their outputs -- instead, they are\nmarked as clobbering \"memory\", which is useless.  In particular, gcc\nis smart enough to know that the timespec parameter hasn't escaped,\nso a memory clobber doesn't clobber it.  And passing a pointer as an\nasm *input* does not tell gcc that the pointed-to value is changed.\n\nAdd in the fact that the asm instructions weren't volatile, and gcc\nwas free to omit them entirely unless their sole output (the return\nvalue) is used.  Which it is (phew!), but that stops happening with\nsome upcoming patches.\n\nAs a trivial example, the following code:\n\nvoid test_fallback(struct timespec *ts)\n{\n\tvdso_fallback_gettime(CLOCK_MONOTONIC, ts);\n}\n\ncompiles to:\n\n00000000000000c0 <test_fallback>:\n  c0:   c3                      retq\n\nTo add insult to injury, the RCX and R11 clobbers on 64-bit\nbuilds were missing.\n\nThe \"memory\" clobber is also unnecessary -- no ordering with respect to\nother memory operations is needed, but that's going to be fixed in a\nseparate not-for-stable patch.\n\nFixes: 2aae950b21e4 (\"x86_64: Add vDSO for x86-64 with gettimeofday/clock_gettime/getcpu\")\nSigned-off-by: Andy Lutomirski <luto@kernel.org>\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: stable@vger.kernel.org\nLink: https://lkml.kernel.org/r/2c0231690551989d2fafa60ed0e7b5cc8b403908.1538422295.git.luto@kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/9f14d89a13164552038977e7d1bc5b2e3c31f56a"},{"sha":"1bdd5e26bf24e0d8228d722e6e2af3e1c2340f32","author":{"name":"Andy Lutomirski","email":"2cc0d0d76de2e6f37b92deeb83c85cb306fc5dc1@kernel.org"},"message":"x86/vdso: Fix vDSO syscall fallback asm constraint regression\n\ncommit 02e425668f5c9deb42787d10001a3b605993ad15 upstream.\n\nWhen I added the missing memory outputs, I failed to update the\nindex of the first argument (ebx) on 32-bit builds, which broke the\nfallbacks.  Somehow I must have screwed up my testing or gotten\nlucky.\n\nAdd another test to cover gettimeofday() as well.\n\nSigned-off-by: Andy Lutomirski <luto@kernel.org>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: stable@vger.kernel.org\nFixes: 715bd9d12f84 (\"x86/vdso: Fix asm constraints on vDSO syscall fallbacks\")\nLink: http://lkml.kernel.org/r/21bd45ab04b6d838278fa5bebfa9163eceffa13c.1538608971.git.luto@kernel.org\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/1bdd5e26bf24e0d8228d722e6e2af3e1c2340f32"},{"sha":"4c4cad25a9a6056a8d67a8f06d431f89fcc179b4","author":{"name":"Daniel Drake","email":"b3c7ac1f4c4c45c9f838c275805c43367661d6f7@endlessm.com"},"message":"PCI: Reprogram bridge prefetch registers on resume\n\ncommit 083874549fdfefa629dfa752785e20427dde1511 upstream.\n\nOn 38+ Intel-based ASUS products, the NVIDIA GPU becomes unusable after S3\nsuspend/resume.  The affected products include multiple generations of\nNVIDIA GPUs and Intel SoCs.  After resume, nouveau logs many errors such\nas:\n\n  fifo: fault 00 [READ] at 0000005555555000 engine 00 [GR] client 04\n        [HUB/FE] reason 4a [] on channel -1 [007fa91000 unknown]\n  DRM: failed to idle channel 0 [DRM]\n\nSimilarly, the NVIDIA proprietary driver also fails after resume (black\nscreen, 100% CPU usage in Xorg process).  We shipped a sample to NVIDIA for\ndiagnosis, and their response indicated that it's a problem with the parent\nPCI bridge (on the Intel SoC), not the GPU.\n\nRuntime suspend/resume works fine, only S3 suspend is affected.\n\nWe found a workaround: on resume, rewrite the Intel PCI bridge\n'Prefetchable Base Upper 32 Bits' register (PCI_PREF_BASE_UPPER32).  In the\ncases that I checked, this register has value 0 and we just have to rewrite\nthat value.\n\nLinux already saves and restores PCI config space during suspend/resume,\nbut this register was being skipped because upon resume, it already has\nvalue 0 (the correct, pre-suspend value).\n\nIntel appear to have previously acknowledged this behaviour and the\nrequirement to rewrite this register:\nhttps://bugzilla.kernel.org/show_bug.cgi?id=116851#c23\n\nBased on that, rewrite the prefetch register values even when that appears\nunnecessary.\n\nWe have confirmed this solution on all the affected models we have in-hands\n(X542UQ, UX533FD, X530UN, V272UN).\n\nAdditionally, this solves an issue where r8169 MSI-X interrupts were broken\nafter S3 suspend/resume on ASUS X441UAR.  This issue was recently worked\naround in commit 7bb05b85bc2d (\"r8169: don't use MSI-X on RTL8106e\").  It\nalso fixes the same issue on RTL6186evl/8111evl on an Aimfor-tech laptop\nthat we had not yet patched.  I suspect it will also fix the issue that was\nworked around in commit 7c53a722459c (\"r8169: don't use MSI-X on\nRTL8168g\").\n\nThomas Martitz reports that this change also solves an issue where the AMD\nRadeon Polaris 10 GPU on the HP Zbook 14u G5 is unresponsive after S3\nsuspend/resume.\n\nLink: https://bugzilla.kernel.org/show_bug.cgi?id=201069\nSigned-off-by: Daniel Drake <drake@endlessm.com>\nSigned-off-by: Bjorn Helgaas <bhelgaas@google.com>\nReviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>\nReviewed-By: Peter Wu <peter@lekensteyn.nl>\nCC: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/4c4cad25a9a6056a8d67a8f06d431f89fcc179b4"},{"sha":"e487b5a7905950926f1bdc1d658fd9ec1151a7cc","author":{"name":"Felix Fietkau","email":"118ed6118e893d16e8c6e0776e0ebc290952c897@nbd.name"},"message":"mac80211: fix setting IEEE80211_KEY_FLAG_RX_MGMT for AP mode keys\n\ncommit 211710ca74adf790b46ab3867fcce8047b573cd1 upstream.\n\nkey->sta is only valid after ieee80211_key_link, which is called later\nin this function. Because of that, the IEEE80211_KEY_FLAG_RX_MGMT is\nnever set when management frame protection is enabled.\n\nFixes: e548c49e6dc6b (\"mac80211: add key flag for management keys\")\nCc: stable@vger.kernel.org\nSigned-off-by: Felix Fietkau <nbd@nbd.name>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/e487b5a7905950926f1bdc1d658fd9ec1151a7cc"},{"sha":"75b66cc009433bff1dd31382d06b9d64d8e1cc25","author":{"name":"Rafael J. Wysocki","email":"27ffc44a8ec6a212fba98cfc3246c6ce8ab131e0@intel.com"},"message":"PM / core: Clear the direct_complete flag on errors\n\ncommit 69e445ab8b66a9f30519842ef18be555d3ee9b51 upstream.\n\nIf __device_suspend() runs asynchronously (in which case the device\npassed to it is in dpm_suspended_list at that point) and it returns\nearly on an error or pending wakeup, and the power.direct_complete\nflag has been set for the device already, the subsequent\ndevice_resume() will be confused by that and it will call\npm_runtime_enable() incorrectly, as runtime PM has not been\ndisabled for the device by __device_suspend().\n\nTo avoid that, clear power.direct_complete if __device_suspend()\nis not going to disable runtime PM for the device before returning.\n\nFixes: aae4518b3124 (PM / sleep: Mechanism to avoid resuming runtime-suspended devices unnecessarily)\nReported-by: Al Cooper <alcooperx@gmail.com>\nTested-by: Al Cooper <alcooperx@gmail.com>\nReviewed-by: Ulf Hansson <ulf.hansson@linaro.org>\nCc: 3.16+ <stable@vger.kernel.org> # 3.16+\nSigned-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/75b66cc009433bff1dd31382d06b9d64d8e1cc25"},{"sha":"8bf0cc33eddc8d1c5267115f460a3bc4a714ea88","author":{"name":"Joe Thornber","email":"61d5fad70554ae22d57a37634e04f12f58acc678@redhat.com"},"message":"dm cache metadata: ignore hints array being too small during resize\n\ncommit 4561ffca88c546f96367f94b8f1e4715a9c62314 upstream.\n\nCommit fd2fa9541 (\"dm cache metadata: save in-core policy_hint_size to\non-disk superblock\") enabled previously written policy hints to be\nused after a cache is reactivated.  But in doing so the cache\nmetadata's hint array was left exposed to out of bounds access because\non resize the metadata's on-disk hint array wasn't ever extended.\n\nFix this by ignoring that there are no on-disk hints associated with the\nnewly added cache blocks.  An expanded on-disk hint array is later\nrewritten upon the next clean shutdown of the cache.\n\nFixes: fd2fa9541 (\"dm cache metadata: save in-core policy_hint_size to on-disk superblock\")\nCc: stable@vger.kernel.org\nSigned-off-by: Joe Thornber <ejt@redhat.com>\nSigned-off-by: Mike Snitzer <snitzer@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/8bf0cc33eddc8d1c5267115f460a3bc4a714ea88"},{"sha":"47c085c51d35e14d2e85aa10fa6f978b17ad6f9b","author":{"name":"Mike Snitzer","email":"85e533f2e78486213c4d69f71462342ec0c62734@redhat.com"},"message":"dm cache: fix resize crash if user doesn't reload cache table\n\ncommit 5d07384a666d4b2f781dc056bfeec2c27fbdf383 upstream.\n\nA reload of the cache's DM table is needed during resize because\notherwise a crash will occur when attempting to access smq policy\nentries associated with the portion of the cache that was recently\nextended.\n\nThe reason is cache-size based data structures in the policy will not be\nresized, the only way to safely extend the cache is to allow for a\nproper cache policy initialization that occurs when the cache table is\nloaded.  For example the smq policy's space_init(), init_allocator(),\ncalc_hotspot_params() must be sized based on the extended cache size.\n\nThe fix for this is to disallow cache resizes of this pattern:\n1) suspend \"cache\" target's device\n2) resize the fast device used for the cache\n3) resume \"cache\" target's device\n\nInstead, the last step must be a full reload of the cache's DM table.\n\nFixes: 66a636356 (\"dm cache: add stochastic-multi-queue (smq) policy\")\nCc: stable@vger.kernel.org\nSigned-off-by: Mike Snitzer <snitzer@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/47c085c51d35e14d2e85aa10fa6f978b17ad6f9b"},{"sha":"90a7afb91bf00d2979527d181b2ed90336d4a133","author":{"name":"Mathias Nyman","email":"2d4473c5e67eb83655334d4e9a7757f781607241@linux.intel.com"},"message":"xhci: Add missing CAS workaround for Intel Sunrise Point xHCI\n\ncommit ffe84e01bb1b38c7eb9c6b6da127a6c136d251df upstream.\n\nThe workaround for missing CAS bit is also needed for xHC on Intel\nsunrisepoint PCH. For more details see:\n\nIntel 100/c230 series PCH specification update Doc #332692-006 Errata #8\n\nCc: <stable@vger.kernel.org>\nSigned-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/90a7afb91bf00d2979527d181b2ed90336d4a133"},{"sha":"343ec21925bcc0ca339b998f3c2613e202a8fc6e","author":{"name":"Chunfeng Yun","email":"9aad631af980cb5b78ae7d35665ca13787ed9585@mediatek.com"},"message":"usb: xhci-mtk: resume USB3 roothub first\n\ncommit 555df5820e733cded7eb8d0bf78b2a791be51d75 upstream.\n\nGive USB3 devices a better chance to enumerate at USB3 speeds if\nthey are connected to a suspended host.\nPorting from \"671ffdff5b13 xhci: resume USB 3 roothub first\"\n\nCc: <stable@vger.kernel.org>\nSigned-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>\nSigned-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/343ec21925bcc0ca339b998f3c2613e202a8fc6e"},{"sha":"71ef91bfe8647cdb232b9746f8bc213edd32cde7","author":{"name":"Johan Hovold","email":"759412786bc533369b22377bf83fb9056c5b25b2@kernel.org"},"message":"USB: serial: simple: add Motorola Tetra MTP6550 id\n\ncommit f5fad711c06e652f90f581fc7c2caee327c33d31 upstream.\n\nAdd device-id for the Motorola Tetra radio MTP6550.\n\nBus 001 Device 004: ID 0cad:9012 Motorola CGISS\nDevice Descriptor:\n  bLength                18\n  bDescriptorType         1\n  bcdUSB               2.00\n  bDeviceClass            0 (Defined at Interface level)\n  bDeviceSubClass         0\n  bDeviceProtocol         0\n  bMaxPacketSize0        64\n  idVendor           0x0cad Motorola CGISS\n  idProduct          0x9012\n  bcdDevice           24.16\n  iManufacturer           1 Motorola Solutions, Inc.\n  iProduct                2 TETRA PEI interface\n  iSerial                 0\n  bNumConfigurations      1\n  Configuration Descriptor:\n    bLength                 9\n    bDescriptorType         2\n    wTotalLength           55\n    bNumInterfaces          2\n    bConfigurationValue     1\n    iConfiguration          3 Generic Serial config\n    bmAttributes         0x80\n      (Bus Powered)\n    MaxPower              500mA\n    Interface Descriptor:\n      bLength                 9\n      bDescriptorType         4\n      bInterfaceNumber        0\n      bAlternateSetting       0\n      bNumEndpoints           2\n      bInterfaceClass       255 Vendor Specific Class\n      bInterfaceSubClass      0\n      bInterfaceProtocol      0\n      iInterface              0\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x81  EP 1 IN\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval               0\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x01  EP 1 OUT\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n    Interface Descriptor:\n      bLength                 9\n      bDescriptorType         4\n      bInterfaceNumber        1\n      bAlternateSetting       0\n      bNumEndpoints           2\n      bInterfaceClass       255 Vendor Specific Class\n      bInterfaceSubClass      0\n      bInterfaceProtocol      0\n      iInterface              0\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x82  EP 2 IN\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval               0\n      Endpoint Descriptor:\n        bLength                 7\n        bDescriptorType         5\n        bEndpointAddress     0x02  EP 2 OUT\n        bmAttributes            2\n          Transfer Type            Bulk\n          Synch Type               None\n          Usage Type               Data\n        wMaxPacketSize     0x0200  1x 512 bytes\n        bInterval               0\nDevice Qualifier (for other device speed):\n  bLength                10\n  bDescriptorType         6\n  bcdUSB               2.00\n  bDeviceClass            0 (Defined at Interface level)\n  bDeviceSubClass         0\n  bDeviceProtocol         0\n  bMaxPacketSize0        64\n  bNumConfigurations      1\nDevice Status:     0x0000\n  (Bus Powered)\n\nReported-by: Hans Hult <hanshult35@gmail.com>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/71ef91bfe8647cdb232b9746f8bc213edd32cde7"},{"sha":"381d8ecd1058f739d34969d940a9ad5c19befa40","author":{"name":"Dmitry Safonov","email":"bed3f98d0a894717be46c58ffa90302af9946688@arista.com"},"message":"tty: Drop tty->count on tty_reopen() failure\n\ncommit fe32416790093b31364c08395727de17ec96ace1 upstream.\n\nIn case of tty_ldisc_reinit() failure, tty->count should be decremented\nback, otherwise we will never release_tty().\nTetsuo reported that it fixes noisy warnings on tty release like:\n  pts pts4033: tty_release: tty->count(10529) != (#fd's(7) + #kopen's(0))\n\nFixes: commit 892d1fa7eaae (\"tty: Destroy ldisc instance on hangup\")\n\nCc: stable@vger.kernel.org # v4.6+\nCc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nCc: Jiri Slaby <jslaby@suse.com>\nReviewed-by: Jiri Slaby <jslaby@suse.cz>\nTested-by: Jiri Slaby <jslaby@suse.com>\nTested-by: Mark Rutland <mark.rutland@arm.com>\nTested-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>\nSigned-off-by: Dmitry Safonov <dima@arista.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/381d8ecd1058f739d34969d940a9ad5c19befa40"},{"sha":"a57f5010e8e72537acdc36166a2f9adc483ab60d","author":{"name":"Guenter Roeck","email":"ba324ca7b1c77fc20bb970d5aff6eea9377918a5@roeck-us.net"},"message":"of: unittest: Disable interrupt node tests for old world MAC systems\n\ncommit 8894891446c9380709451b99ab45c5c53adfd2fc upstream.\n\nOn systems with OF_IMAP_OLDWORLD_MAC set in of_irq_workarounds, the\ndevicetree interrupt parsing code is different, causing unit tests of\ndevicetree interrupt nodes to fail. Due to a bug in unittest code, which\ntries to dereference an uninitialized pointer, this results in a crash.\n\nOF: /testcase-data/phandle-tests/consumer-a: arguments longer than property\nUnable to handle kernel paging request for data at address 0x00bc616e\nFaulting instruction address: 0xc08e9468\nOops: Kernel access of bad area, sig: 11 [#1]\nBE PREEMPT PowerMac\nModules linked in:\nCPU: 0 PID: 1 Comm: swapper Not tainted 4.14.72-rc1-yocto-standard+ #1\ntask: cf8e0000 task.stack: cf8da000\nNIP:  c08e9468 LR: c08ea5bc CTR: c08ea5ac\nREGS: cf8dbb50 TRAP: 0300   Not tainted  (4.14.72-rc1-yocto-standard+)\nMSR:  00001032 <ME,IR,DR,RI>  CR: 82004044  XER: 00000000\nDAR: 00bc616e DSISR: 40000000\nGPR00: c08ea5bc cf8dbc00 cf8e0000 c13ca517 c13ca517 c13ca8a0 00000066 00000002\nGPR08: 00000063 00bc614e c0b05865 000affff 82004048 00000000 c00047f0 00000000\nGPR16: c0a80000 c0a9cc34 c13ca517 c0ad1134 05ffffff 000affff c0b05860 c0abeef8\nGPR24: cecec278 cecec278 c0a8c4d0 c0a885e0 c13ca8a0 05ffffff c13ca8a0 c13ca517\n\nNIP [c08e9468] device_node_gen_full_name+0x30/0x15c\nLR [c08ea5bc] device_node_string+0x190/0x3c8\nCall Trace:\n[cf8dbc00] [c007f670] trace_hardirqs_on_caller+0x118/0x1fc (unreliable)\n[cf8dbc40] [c08ea5bc] device_node_string+0x190/0x3c8\n[cf8dbcb0] [c08eb794] pointer+0x25c/0x4d0\n[cf8dbd00] [c08ebcbc] vsnprintf+0x2b4/0x5ec\n[cf8dbd60] [c08ec00c] vscnprintf+0x18/0x48\n[cf8dbd70] [c008e268] vprintk_store+0x4c/0x22c\n[cf8dbda0] [c008ecac] vprintk_emit+0x94/0x130\n[cf8dbdd0] [c008ff54] printk+0x5c/0x6c\n[cf8dbe10] [c0b8ddd4] of_unittest+0x2220/0x26f8\n[cf8dbea0] [c0004434] do_one_initcall+0x4c/0x184\n[cf8dbf00] [c0b4534c] kernel_init_freeable+0x13c/0x1d8\n[cf8dbf30] [c0004814] kernel_init+0x24/0x118\n[cf8dbf40] [c0013398] ret_from_kernel_thread+0x5c/0x64\n\nThe problem was observed when running a qemu test for the g3beige machine\nwith devicetree unittests enabled.\n\nDisable interrupt node tests on affected systems to avoid both false\nunittest failures and the crash.\n\nWith this patch in place, unittest on the affected system passes with\nthe following message.\n\n\tdt-test ### end of unittest - 144 passed, 0 failed\n\nFixes: 53a42093d96ef (\"of: Add device tree selftests\")\nSigned-off-by: Guenter Roeck <linux@roeck-us.net>\nReviewed-by: Frank Rowand <frank.rowand@sony.com>\nSigned-off-by: Rob Herring <robh@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/a57f5010e8e72537acdc36166a2f9adc483ab60d"},{"sha":"b469713e0c0cf3dadc9bbc59e9fd6780e1853c5a","author":{"name":"Theodore Ts'o","email":"4ed386e0495d3e109932df055831d9ec2f824927@mit.edu"},"message":"ext4: add corruption check in ext4_xattr_set_entry()\n\ncommit 5369a762c882c0b6e9599e4ebbb3a9ba9eee7e2d upstream.\n\nIn theory this should have been caught earlier when the xattr list was\nverified, but in case it got missed, it's simple enough to add check\nto make sure we don't overrun the xattr buffer.\n\nThis addresses CVE-2018-10879.\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=200001\n\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nReviewed-by: Andreas Dilger <adilger@dilger.ca>\n[bwh: Backported to 3.16:\n - Add inode parameter to ext4_xattr_set_entry() and update callers\n - Return -EIO instead of -EFSCORRUPTED on error\n - Adjust context]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\n[adjusted context for 4.9]\nSigned-off-by: Daniel Rosenberg <drosen@google.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/b469713e0c0cf3dadc9bbc59e9fd6780e1853c5a"},{"sha":"0050338e0d3c3e3047507c4998b132e52baafc44","author":{"name":"Theodore Ts'o","email":"4ed386e0495d3e109932df055831d9ec2f824927@mit.edu"},"message":"ext4: always verify the magic number in xattr blocks\n\ncommit 513f86d73855ce556ea9522b6bfd79f87356dc3a upstream.\n\nIf there an inode points to a block which is also some other type of\nmetadata block (such as a block allocation bitmap), the\nbuffer_verified flag can be set when it was validated as that other\nmetadata block type; however, it would make a really terrible external\nattribute block.  The reason why we use the verified flag is to avoid\nconstantly reverifying the block.  However, it doesn't take much\noverhead to make sure the magic number of the xattr block is correct,\nand this will avoid potential crashes.\n\nThis addresses CVE-2018-10879.\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=200001\n\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nReviewed-by: Andreas Dilger <adilger@dilger.ca>\n[Backported to 4.9: adjust context]\nSigned-off-by: Daniel Rosenberg <drosen@google.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/0050338e0d3c3e3047507c4998b132e52baafc44"},{"sha":"35b80e75a642b6bebda61571176e46b43de0d5dd","author":{"name":"Prateek Sood","email":"28154d6a07d9106b5eb2a7f87209b6a593200917@codeaurora.org"},"message":"cgroup: Fix deadlock in cpu hotplug path\n\ncommit 116d2f7496c51b2e02e8e4ecdd2bdf5fb9d5a641 upstream.\n\nDeadlock during cgroup migration from cpu hotplug path when a task T is\nbeing moved from source to destination cgroup.\n\nkworker/0:0\ncpuset_hotplug_workfn()\n   cpuset_hotplug_update_tasks()\n      hotplug_update_tasks_legacy()\n        remove_tasks_in_empty_cpuset()\n          cgroup_transfer_tasks() // stuck in iterator loop\n            cgroup_migrate()\n              cgroup_migrate_add_task()\n\nIn cgroup_migrate_add_task() it checks for PF_EXITING flag of task T.\nTask T will not migrate to destination cgroup. css_task_iter_start()\nwill keep pointing to task T in loop waiting for task T cg_list node\nto be removed.\n\nTask T\ndo_exit()\n  exit_signals() // sets PF_EXITING\n  exit_task_namespaces()\n    switch_task_namespaces()\n      free_nsproxy()\n        put_mnt_ns()\n          drop_collected_mounts()\n            namespace_unlock()\n              synchronize_rcu()\n                _synchronize_rcu_expedited()\n                  schedule_work() // on cpu0 low priority worker pool\n                  wait_event() // waiting for work item to execute\n\nTask T inserted a work item in the worklist of cpu0 low priority\nworker pool. It is waiting for expedited grace period work item\nto execute. This work item will only be executed once kworker/0:0\ncomplete execution of cpuset_hotplug_workfn().\n\nkworker/0:0 ==> Task T ==>kworker/0:0\n\nIn case of PF_EXITING task being migrated from source to destination\ncgroup, migrate next available task in source cgroup.\n\nSigned-off-by: Prateek Sood <prsood@codeaurora.org>\nSigned-off-by: Tejun Heo <tj@kernel.org>\n[AmitP: Upstream commit cherry-pick failed, so I picked the\n        backported changes from CAF/msm-4.9 tree instead:\n        https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=49b74f1696417b270c89cd893ca9f37088928078]\nSigned-off-by: Amit Pundir <amit.pundir@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/35b80e75a642b6bebda61571176e46b43de0d5dd"},{"sha":"bbb4cc291ccd34511189829b69f8f9ce4c6bd2ef","author":{"name":"Carl Huang","email":"aa272d2af31f380d1624a6b56835b74efb15180c@codeaurora.org"},"message":"ath10k: fix use-after-free in ath10k_wmi_cmd_send_nowait\n\ncommit 9ef0f58ed7b4a55da4a64641d538e0d9e46579ac upstream.\n\nThe skb may be freed in tx completion context before\ntrace_ath10k_wmi_cmd is called. This can be easily captured when\nKASAN(Kernel Address Sanitizer) is enabled. The fix is to move\ntrace_ath10k_wmi_cmd before the send operation. As the ret has no\nmeaning in trace_ath10k_wmi_cmd then, so remove this parameter too.\n\nSigned-off-by: Carl Huang <cjhuang@codeaurora.org>\nTested-by: Brian Norris <briannorris@chromium.org>\nReviewed-by: Brian Norris <briannorris@chromium.org>\nSigned-off-by: Kalle Valo <kvalo@codeaurora.org>\nSigned-off-by: Amit Pundir <amit.pundir@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/bbb4cc291ccd34511189829b69f8f9ce4c6bd2ef"},{"sha":"0e9b8dfbc3f6668b0616b8c5f9a83fa32fadc475","author":{"name":"Yu Wang","email":"8f3d93efcc117b35eabadd7222457788eaeb5b0e@codeaurora.org"},"message":"ath10k: fix kernel panic issue during pci probe\n\ncommit 50e79e25250bf928369996277e85b00536b380c7 upstream.\n\nIf device gone during chip reset, ar->normal_mode_fw.board is not\ninitialized, but ath10k_debug_print_hwfw_info() will try to access its\nmember, which will cause 'kernel NULL pointer' issue. This was found\nusing a faulty device (pci link went down sometimes) in a random\ninsmod/rmmod/other-op test.\nTo fix it, check ar->normal_mode_fw.board before accessing the member.\n\npci 0000:02:00.0: BAR 0: assigned [mem 0xf7400000-0xf75fffff 64bit]\nath10k_pci 0000:02:00.0: enabling device (0000 -> 0002)\nath10k_pci 0000:02:00.0: pci irq msi oper_irq_mode 2 irq_mode 0 reset_mode 0\nath10k_pci 0000:02:00.0: failed to read device register, device is gone\nath10k_pci 0000:02:00.0: failed to wait for target init: -5\nath10k_pci 0000:02:00.0: failed to warm reset: -5\nath10k_pci 0000:02:00.0: firmware crashed during chip reset\nath10k_pci 0000:02:00.0: firmware crashed! (uuid 5d018951-b8e1-404a-8fde-923078b4423a)\nath10k_pci 0000:02:00.0: (null) target 0x00000000 chip_id 0x00340aff sub 0000:0000\nath10k_pci 0000:02:00.0: kconfig debug 1 debugfs 1 tracing 1 dfs 1 testmode 1\nath10k_pci 0000:02:00.0: firmware ver  api 0 features  crc32 00000000\n...\nBUG: unable to handle kernel NULL pointer dereference at 00000004\n...\nCall Trace:\n [<fb4e7882>] ath10k_print_driver_info+0x12/0x20 [ath10k_core]\n [<fb62b7dd>] ath10k_pci_fw_crashed_dump+0x6d/0x4d0 [ath10k_pci]\n [<fb629f07>] ? ath10k_pci_sleep.part.19+0x57/0xc0 [ath10k_pci]\n [<fb62c8ee>] ath10k_pci_hif_power_up+0x14e/0x1b0 [ath10k_pci]\n [<c10477fb>] ? do_page_fault+0xb/0x10\n [<fb4eb934>] ath10k_core_register_work+0x24/0x840 [ath10k_core]\n [<c18a00d8>] ? netlbl_unlhsh_remove+0x178/0x410\n [<c10477f0>] ? __do_page_fault+0x480/0x480\n [<c1068e44>] process_one_work+0x114/0x3e0\n [<c1069d07>] worker_thread+0x37/0x4a0\n [<c106e294>] kthread+0xa4/0xc0\n [<c1069cd0>] ? create_worker+0x180/0x180\n [<c106e1f0>] ? kthread_park+0x50/0x50\n [<c18ab4f7>] ret_from_fork+0x1b/0x28\n Code: 78 80 b8 50 09 00 00 00 75 5d 8d 75 94 c7 44 24 08 aa d7 52 fb c7 44 24 04 64 00 00 00\n 89 34 24 e8 82 52 e2 c5 8b 83 dc 08 00 00 <8b> 50 04 8b 08 31 c0 e8 20 57 e3 c5 89 44 24 10 8b 83 58 09 00\n EIP: [<fb4e7754>]-\n ath10k_debug_print_board_info+0x34/0xb0 [ath10k_core]\n SS:ESP 0068:f4921d90\n CR2: 0000000000000004\n\nSigned-off-by: Yu Wang <yyuwang@codeaurora.org>\nSigned-off-by: Kalle Valo <kvalo@codeaurora.org>\n[AmitP: Minor rebasing for 4.14.y and 4.9.y]\nSigned-off-by: Amit Pundir <amit.pundir@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/0e9b8dfbc3f6668b0616b8c5f9a83fa32fadc475"}]}
{"actor":{"display_login":"Noltari"}}