{"push_id":2588512856,"size":88,"distinct_size":0,"ref":"refs/heads/aosp/upstream-linux-4.9.y","head":"2272cdd5d5bf42e3721430ae6076656a42043c34","before":"6ba89b52ba6916bc7a3d390d70951e992c0ca39e","commits":[{"sha":"dbab65be6bdea68b6a201d03334b44a02860dd2c","author":{"name":"Shuah Khan","email":"c62751f8c6ce7eb0639cab80a821801931863a4b@osg.samsung.com"},"message":"usbip: usbip_host: refine probe and disconnect debug msgs to be useful\n\ncommit 28b68acc4a88dcf91fd1dcf2577371dc9bf574cc upstream.\n\nRefine probe and disconnect debug msgs to be useful and say what is\nin progress.\n\nSigned-off-by: Shuah Khan <shuahkh@osg.samsung.com>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/dbab65be6bdea68b6a201d03334b44a02860dd2c"},{"sha":"58c9c70cb7e10599f44a996cc4b481fc5c02ea4f","author":{"name":"Shuah Khan (Samsung OSG)","email":"90afa3c006319543993f3435e7531028bae47985@kernel.org"},"message":"usbip: usbip_host: delete device from busid_table after rebind\n\ncommit 1e180f167d4e413afccbbb4a421b48b2de832549 upstream.\n\nDevice is left in the busid_table after unbind and rebind. Rebind\ninitiates usb bus scan and the original driver claims the device.\nAfter rescan the device should be deleted from the busid_table as\nit no longer belongs to usbip_host.\n\nFix it to delete the device after device_attach() succeeds.\n\nSigned-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/58c9c70cb7e10599f44a996cc4b481fc5c02ea4f"},{"sha":"59ad4f5342dadadbcf9fd67f29fd6a8ed70ab125","author":{"name":"Shuah Khan (Samsung OSG)","email":"90afa3c006319543993f3435e7531028bae47985@kernel.org"},"message":"usbip: usbip_host: run rebind from exit when module is removed\n\ncommit 7510df3f29d44685bab7b1918b61a8ccd57126a9 upstream.\n\nAfter removing usbip_host module, devices it releases are left without\na driver. For example, when a keyboard or a mass storage device are\nbound to usbip_host when it is removed, these devices are no longer\nbound to any driver.\n\nFix it to run device_attach() from the module exit routine to restore\nthe devices to their original drivers. This includes cleanup changes\nand moving device_attach() code to a common routine to be called from\nrebind_store() and usbip_host_exit().\n\nSigned-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/59ad4f5342dadadbcf9fd67f29fd6a8ed70ab125"},{"sha":"f2a6d5f19450086e5cbdac7168d3fc75af32becf","author":{"name":"Shuah Khan (Samsung OSG)","email":"90afa3c006319543993f3435e7531028bae47985@kernel.org"},"message":"usbip: usbip_host: fix NULL-ptr deref and use-after-free errors\n\ncommit 22076557b07c12086eeb16b8ce2b0b735f7a27e7 upstream.\n\nusbip_host updates device status without holding lock from stub probe,\ndisconnect and rebind code paths. When multiple requests to import a\ndevice are received, these unprotected code paths step all over each\nother and drive fails with NULL-ptr deref and use-after-free errors.\n\nThe driver uses a table lock to protect the busid array for adding and\ndeleting busids to the table. However, the probe, disconnect and rebind\npaths get the busid table entry and update the status without holding\nthe busid table lock. Add a new finer grain lock to protect the busid\nentry. This new lock will be held to search and update the busid entry\nfields from get_busid_idx(), add_match_busid() and del_match_busid().\n\nmatch_busid_show() does the same to access the busid entry fields.\n\nget_busid_priv() changed to return the pointer to the busid entry holding\nthe busid lock. stub_probe(), stub_disconnect() and stub_device_rebind()\ncall put_busid_priv() to release the busid lock before returning. This\nchanges fixes the unprotected code paths eliminating the race conditions\nin updating the busid entries.\n\nReported-by: Jakub Jirasek\nSigned-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/f2a6d5f19450086e5cbdac7168d3fc75af32becf"},{"sha":"0471d407998b58d1f1cbb4f594fc63f9bf0ec7bb","author":{"name":"Shuah Khan (Samsung OSG)","email":"90afa3c006319543993f3435e7531028bae47985@kernel.org"},"message":"usbip: usbip_host: fix bad unlock balance during stub_probe()\n\ncommit c171654caa875919be3c533d3518da8be5be966e upstream.\n\nstub_probe() calls put_busid_priv() in an error path when device isn't\nfound in the busid_table. Fix it by making put_busid_priv() safe to be\ncalled with null struct bus_id_priv pointer.\n\nThis problem happens when \"usbip bind\" is run without loading usbip_host\ndriver and then running modprobe. The first failed bind attempt unbinds\nthe device from the original driver and when usbip_host is modprobed,\nstub_probe() runs and doesn't find the device in its busid table and calls\nput_busid_priv(0 with null bus_id_priv pointer.\n\nusbip-host 3-10.2: 3-10.2 is not in match_busid table...  skip!\n\n[  367.359679] =====================================\n[  367.359681] WARNING: bad unlock balance detected!\n[  367.359683] 4.17.0-rc4+ #5 Not tainted\n[  367.359685] -------------------------------------\n[  367.359688] modprobe/2768 is trying to release lock (\n[  367.359689]\n==================================================================\n[  367.359696] BUG: KASAN: null-ptr-deref in print_unlock_imbalance_bug+0x99/0x110\n[  367.359699] Read of size 8 at addr 0000000000000058 by task modprobe/2768\n\n[  367.359705] CPU: 4 PID: 2768 Comm: modprobe Not tainted 4.17.0-rc4+ #5\n\nFixes: 22076557b07c (\"usbip: usbip_host: fix NULL-ptr deref and use-after-free errors\") in usb-linus\nSigned-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/0471d407998b58d1f1cbb4f594fc63f9bf0ec7bb"},{"sha":"639a74bf5f4da1c64884ff157ec62fed2798d5d0","author":{"name":"Federico Cuello","email":"f5463b89a471eb176093c6a43e4929b71cf931bf@fedux.com.ar"},"message":"ALSA: usb: mixer: volume quirk for CM102-A+/102S+\n\ncommit 21493316a3c4598f308d5a9fa31cc74639c4caff upstream.\n\nCurrently it's not possible to set volume lower than 26% (it just mutes).\n\nAlso fixes this warning:\n\n  Warning! Unlikely big volume range (=9472), cval->res is probably wrong.\n  [13] FU [PCM Playback Volume] ch = 2, val = -9473/-1/1\n\n, and volume works fine for full range.\n\nSigned-off-by: Federico Cuello <fedux@fedux.com.ar>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/639a74bf5f4da1c64884ff157ec62fed2798d5d0"},{"sha":"e303276bbd9e2c603eee7a5ca14362493728d589","author":{"name":"Hans de Goede","email":"9fa1be1a5b5729e4c6b404f34c9ce49ff4882fd8@redhat.com"},"message":"ALSA: hda: Add Lenovo C50 All in one to the power_save blacklist\n\ncommit c8beccc19b92f5172994c0732db689c08f4f98e5 upstream.\n\nPower-saving is causing loud plops on the Lenovo C50 All in one, add it\nto the blacklist.\n\nBugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1572975\nSigned-off-by: Hans de Goede <hdegoede@redhat.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/e303276bbd9e2c603eee7a5ca14362493728d589"},{"sha":"c5d8237ef6067635ed5cb6b787540c52afe6bc8f","author":{"name":"Wenwen Wang","email":"bafc5a1ee344249d3957e4d34f33647904b567dc@umn.edu"},"message":"ALSA: control: fix a redundant-copy issue\n\ncommit 3f12888dfae2a48741c4caa9214885b3aaf350f9 upstream.\n\nIn snd_ctl_elem_add_compat(), the fields of the struct 'data' need to be\ncopied from the corresponding fields of the struct 'data32' in userspace.\nThis is achieved by invoking copy_from_user() and get_user() functions. The\nproblem here is that the 'type' field is copied twice. One is by\ncopy_from_user() and one is by get_user(). Given that the 'type' field is\nnot used between the two copies, the second copy is *completely* redundant\nand should be removed for better performance and cleanup. Also, these two\ncopies can cause inconsistent data: as the struct 'data32' resides in\nuserspace and a malicious userspace process can race to change the 'type'\nfield between the two copies to cause inconsistent data. Depending on how\nthe data is used in the future, such an inconsistency may cause potential\nsecurity risks.\n\nFor above reasons, we should take out the second copy.\n\nSigned-off-by: Wenwen Wang <wang6495@umn.edu>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/c5d8237ef6067635ed5cb6b787540c52afe6bc8f"},{"sha":"a436539bc16fdc6cb69cfa069ca0388df8d53d4b","author":{"name":"Andy Shevchenko","email":"74f0c009df510614346aa771cd21959b78cdb413@linux.intel.com"},"message":"spi: pxa2xx: Allow 64-bit DMA\n\ncommit efc4a13724b852ddaa3358402a8dec024ffbcb17 upstream.\n\nCurrently the 32-bit device address only is supported for DMA. However,\nstarting from Intel Sunrisepoint PCH the DMA address of the device FIFO\ncan be 64-bit.\n\nChange the respective variable to be compatible with DMA engine\nexpectations, i.e. to phys_addr_t.\n\nFixes: 34cadd9c1bcb (\"spi: pxa2xx: Add support for Intel Sunrisepoint\")\nSigned-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/a436539bc16fdc6cb69cfa069ca0388df8d53d4b"},{"sha":"1c384327383de13223186ec138c57cb49fa1efea","author":{"name":"Kamal Dasu","email":"c38ab074b9b7f49b5ec5c771c853ef0fd1b69a17@gmail.com"},"message":"spi: bcm-qspi: Avoid setting MSPI_CDRAM_PCS for spi-nor master\n\ncommit 5eb9a07a4ae1008b67d8bcd47bddb3dae97456b7 upstream.\n\nAdded fix for probing of spi-nor device non-zero chip selects. Set\nMSPI_CDRAM_PCS (peripheral chip select) with spi master for MSPI\ncontroller and not for MSPI/BSPI spi-nor master controller. Ensure\nsetting of cs bit in chip select register on chip select change.\n\nFixes: fa236a7ef24048 (\"spi: bcm-qspi: Add Broadcom MSPI driver\")\nSigned-off-by: Kamal Dasu <kdasu.kdev@gmail.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/1c384327383de13223186ec138c57cb49fa1efea"},{"sha":"ad04996f0bb0a2bfc8468c04dacc40aed76de8ae","author":{"name":"Kamal Dasu","email":"c38ab074b9b7f49b5ec5c771c853ef0fd1b69a17@gmail.com"},"message":"spi: bcm-qspi: Always read and set BSPI_MAST_N_BOOT_CTRL\n\ncommit 602805fb618b018b7a41fbb3f93c1992b078b1ae upstream.\n\nAlways confirm the BSPI_MAST_N_BOOT_CTRL bit when enabling\nor disabling BSPI transfers.\n\nFixes: 4e3b2d236fe00 (\"spi: bcm-qspi: Add BSPI spi-nor flash controller driver\")\nSigned-off-by: Kamal Dasu <kdasu.kdev@gmail.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/ad04996f0bb0a2bfc8468c04dacc40aed76de8ae"},{"sha":"9488d11728a6d945ce589cac6b6760cdb361e9c6","author":{"name":"Andre Przywara","email":"94eb15b8f54b8e37c3f8d338296201be47dc5c3e@arm.com"},"message":"KVM: arm/arm64: VGIC/ITS: protect kvm_read_guest() calls with SRCU lock\n\ncommit bf308242ab98b5d1648c3663e753556bef9bec01 upstream.\n\nkvm_read_guest() will eventually look up in kvm_memslots(), which requires\neither to hold the kvm->slots_lock or to be inside a kvm->srcu critical\nsection.\nIn contrast to x86 and s390 we don't take the SRCU lock on every guest\nexit, so we have to do it individually for each kvm_read_guest() call.\n\nProvide a wrapper which does that and use that everywhere.\n\nNote that ending the SRCU critical section before returning from the\nkvm_read_guest() wrapper is safe, because the data has been *copied*, so\nwe don't need to rely on valid references to the memslot anymore.\n\nCc: Stable <stable@vger.kernel.org> # 4.8+\nReported-by: Jan Glauber <jan.glauber@caviumnetworks.com>\nSigned-off-by: Andre Przywara <andre.przywara@arm.com>\nAcked-by: Christoffer Dall <christoffer.dall@arm.com>\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/9488d11728a6d945ce589cac6b6760cdb361e9c6"},{"sha":"0c8b8d37c85805ebc47a3e6a5f799bad4de8328e","author":{"name":"Benjamin Herrenschmidt","email":"a7089bb6e7e92505d88aaff006cbdd60cc9120b6@kernel.crashing.org"},"message":"powerpc: Don't preempt_disable() in show_cpuinfo()\n\ncommit 349524bc0da698ec77f2057cf4a4948eb6349265 upstream.\n\nThis causes warnings from cpufreq mutex code. This is also rather\nunnecessary and ineffective. If we really want to prevent concurrent\nunplug, we could take the unplug read lock but I don't see this being\ncritical.\n\nFixes: cd77b5ce208c (\"powerpc/powernv/cpufreq: Fix the frequency read by /proc/cpuinfo\")\nSigned-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nAcked-by: Michal Suchanek <msuchanek@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/0c8b8d37c85805ebc47a3e6a5f799bad4de8328e"},{"sha":"20a30619b3315c1f11565cfbc0dbe2ea92a8a003","author":{"name":"Waiman Long","email":"a123fdd9fb50e93f03393cfddab9c182b4164439@hpe.com"},"message":"signals: avoid unnecessary taking of sighand->siglock\n\ncommit c7be96af89d4b53211862d8599b2430e8900ed92 upstream.\n\nWhen running certain database workload on a high-end system with many\nCPUs, it was found that spinlock contention in the sigprocmask syscalls\nbecame a significant portion of the overall CPU cycles as shown below.\n\n  9.30%  9.30%  905387  dataserver  /proc/kcore 0x7fff8163f4d2\n  [k] _raw_spin_lock_irq\n            |\n            ---_raw_spin_lock_irq\n               |\n               |--99.34%-- __set_current_blocked\n               |          sigprocmask\n               |          sys_rt_sigprocmask\n               |          system_call_fastpath\n               |          |\n               |          |--50.63%-- __swapcontext\n               |          |          |\n               |          |          |--99.91%-- upsleepgeneric\n               |          |\n               |          |--49.36%-- __setcontext\n               |          |          ktskRun\n\nLooking further into the swapcontext function in glibc, it was found that\nthe function always call sigprocmask() without checking if there are\nchanges in the signal mask.\n\nA check was added to the __set_current_blocked() function to avoid taking\nthe sighand->siglock spinlock if there is no change in the signal mask.\nThis will prevent unneeded spinlock contention when many threads are\ntrying to call sigprocmask().\n\nWith this patch applied, the spinlock contention in sigprocmask() was\ngone.\n\nLink: http://lkml.kernel.org/r/1474979209-11867-1-git-send-email-Waiman.Long@hpe.com\nSigned-off-by: Waiman Long <Waiman.Long@hpe.com>\nAcked-by: Oleg Nesterov <oleg@redhat.com>\nCc: Ingo Molnar <mingo@kernel.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: Stas Sergeev <stsp@list.ru>\nCc: Scott J Norton <scott.norton@hpe.com>\nCc: Douglas Hatch <doug.hatch@hpe.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Mel Gorman <mgorman@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/20a30619b3315c1f11565cfbc0dbe2ea92a8a003"},{"sha":"1af681da78b748eba17ad244d08e8bbe1980bf5c","author":{"name":"Steven Rostedt (VMware)","email":"43232e92d70cc7aa53504ad0397085ee47bad87f@goodmis.org"},"message":"tracing/x86/xen: Remove zero data size trace events trace_xen_mmu_flush_tlb{_all}\n\ncommit 45dd9b0666a162f8e4be76096716670cf1741f0e upstream.\n\nDoing an audit of trace events, I discovered two trace events in the xen\nsubsystem that use a hack to create zero data size trace events. This is not\nwhat trace events are for. Trace events add memory footprint overhead, and\nif all you need to do is see if a function is hit or not, simply make that\nfunction noinline and use function tracer filtering.\n\nWorse yet, the hack used was:\n\n __array(char, x, 0)\n\nWhich creates a static string of zero in length. There's assumptions about\nsuch constructs in ftrace that this is a dynamic string that is nul\nterminated. This is not the case with these tracepoints and can cause\nproblems in various parts of ftrace.\n\nNuke the trace events!\n\nLink: http://lkml.kernel.org/r/20180509144605.5a220327@gandalf.local.home\n\nCc: stable@vger.kernel.org\nFixes: 95a7d76897c1e (\"xen/mmu: Use Xen specific TLB flush instead of the generic one.\")\nReviewed-by: Juergen Gross <jgross@suse.com>\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/1af681da78b748eba17ad244d08e8bbe1980bf5c"},{"sha":"f32bb2aad27e5dac434a8fa1e12b1d6c25fe49f8","author":{"name":"Florian Westphal","email":"cef439e78636cdab99cd2923826c5065a0743e5b@strlen.de"},"message":"netfilter: nf_tables: can't fail after linking rule into active rule list\n\ncommit 569ccae68b38654f04b6842b034aa33857f605fe upstream.\n\nrules in nftables a free'd using kfree, but protected by rcu, i.e. we\nmust wait for a grace period to elapse.\n\nNormal removal patch does this, but nf_tables_newrule() doesn't obey\nthis rule during error handling.\n\nIt calls nft_trans_rule_add() *after* linking rule, and, if that\nfails to allocate memory, it unlinks the rule and then kfree() it --\nthis is unsafe.\n\nSwitch order -- first add rule to transaction list, THEN link it\nto public list.\n\nNote: nft_trans_rule_add() uses GFP_KERNEL; it will not fail so this\nis not a problem in practice (spotted only during code review).\n\nFixes: 0628b123c96d12 (\"netfilter: nfnetlink: add batch support and use it from nf_tables\")\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/f32bb2aad27e5dac434a8fa1e12b1d6c25fe49f8"},{"sha":"895c53e10b91432d0e9a9662448f0c7fc40f79e1","author":{"name":"Alexander Monakov","email":"866e0609322e56f5df31cacb2e900e3c3d15d360@ispras.ru"},"message":"i2c: designware: fix poll-after-enable regression\n\ncommit 06cb616b1bca7080824acfedb3d4c898e7a64836 upstream.\n\nNot all revisions of DW I2C controller implement the enable status register.\nOn platforms where that's the case (e.g. BG2CD and SPEAr ARM SoCs), waiting\nfor enable will time out as reading the unimplemented register yields zero.\n\nIt was observed that reading the IC_ENABLE_STATUS register once suffices to\navoid getting it stuck on Bay Trail hardware, so replace polling with one\ndummy read of the register.\n\nFixes: fba4adbbf670 (\"i2c: designware: must wait for enable\")\nSigned-off-by: Alexander Monakov <amonakov@ispras.ru>\nTested-by: Ben Gardner <gardner.ben@gmail.com>\nAcked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>\nSigned-off-by: Wolfram Sang <wsa@the-dreams.de>\nCc: stable@kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/895c53e10b91432d0e9a9662448f0c7fc40f79e1"},{"sha":"96c83fb2de4d45a9da51668e4a2f9aa0ac2c74ba","author":{"name":"Nicholas Piggin","email":"24829078df5003d9dd1dd871ca2aeb0b1cf95ef4@gmail.com"},"message":"powerpc/powernv: Fix NVRAM sleep in invalid context when crashing\n\ncommit c1d2a31397ec51f0370f6bd17b19b39152c263cb upstream.\n\nSimilarly to opal_event_shutdown, opal_nvram_write can be called in\nthe crash path with irqs disabled. Special case the delay to avoid\nsleeping in invalid context.\n\nFixes: 3b8070335f75 (\"powerpc/powernv: Fix OPAL NVRAM driver OPAL_BUSY loops\")\nCc: stable@vger.kernel.org # v3.2\nSigned-off-by: Nicholas Piggin <npiggin@gmail.com>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/96c83fb2de4d45a9da51668e4a2f9aa0ac2c74ba"},{"sha":"270693b978f345c34509676c0729d72c19b6d87e","author":{"name":"Pavel Tatashin","email":"ce4eadb5041f9f427a24f3b8daac1a18b8c25b6e@oracle.com"},"message":"mm: don't allow deferred pages with NEED_PER_CPU_KM\n\ncommit ab1e8d8960b68f54af42b6484b5950bd13a4054b upstream.\n\nIt is unsafe to do virtual to physical translations before mm_init() is\ncalled if struct page is needed in order to determine the memory section\nnumber (see SECTION_IN_PAGE_FLAGS).  This is because only in mm_init()\nwe initialize struct pages for all the allocated memory when deferred\nstruct pages are used.\n\nMy recent fix in commit c9e97a1997 (\"mm: initialize pages on demand\nduring boot\") exposed this problem, because it greatly reduced number of\npages that are initialized before mm_init(), but the problem existed\neven before my fix, as Fengguang Wu found.\n\nBelow is a more detailed explanation of the problem.\n\nWe initialize struct pages in four places:\n\n1. Early in boot a small set of struct pages is initialized to fill the\n   first section, and lower zones.\n\n2. During mm_init() we initialize \"struct pages\" for all the memory that\n   is allocated, i.e reserved in memblock.\n\n3. Using on-demand logic when pages are allocated after mm_init call\n   (when memblock is finished)\n\n4. After smp_init() when the rest free deferred pages are initialized.\n\nThe problem occurs if we try to do va to phys translation of a memory\nbetween steps 1 and 2.  Because we have not yet initialized struct pages\nfor all the reserved pages, it is inherently unsafe to do va to phys if\nthe translation itself requires access of \"struct page\" as in case of\nthis combination: CONFIG_SPARSE && !CONFIG_SPARSE_VMEMMAP\n\nThe following path exposes the problem:\n\n  start_kernel()\n   trap_init()\n    setup_cpu_entry_areas()\n     setup_cpu_entry_area(cpu)\n      get_cpu_gdt_paddr(cpu)\n       per_cpu_ptr_to_phys(addr)\n        pcpu_addr_to_page(addr)\n         virt_to_page(addr)\n          pfn_to_page(__pa(addr) >> PAGE_SHIFT)\n\nWe disable this path by not allowing NEED_PER_CPU_KM with deferred\nstruct pages feature.\n\nThe problems are discussed in these threads:\n  http://lkml.kernel.org/r/20180418135300.inazvpxjxowogyge@wfg-t540p.sh.intel.com\n  http://lkml.kernel.org/r/20180419013128.iurzouiqxvcnpbvz@wfg-t540p.sh.intel.com\n  http://lkml.kernel.org/r/20180426202619.2768-1-pasha.tatashin@oracle.com\n\nLink: http://lkml.kernel.org/r/20180515175124.1770-1-pasha.tatashin@oracle.com\nFixes: 3a80a7fa7989 (\"mm: meminit: initialise a subset of struct pages if CONFIG_DEFERRED_STRUCT_PAGE_INIT is set\")\nSigned-off-by: Pavel Tatashin <pasha.tatashin@oracle.com>\nAcked-by: Michal Hocko <mhocko@suse.com>\nReviewed-by: Andrew Morton <akpm@linux-foundation.org>\nCc: Steven Sistare <steven.sistare@oracle.com>\nCc: Daniel Jordan <daniel.m.jordan@oracle.com>\nCc: Mel Gorman <mgorman@techsingularity.net>\nCc: Fengguang Wu <fengguang.wu@intel.com>\nCc: Dennis Zhou <dennisszhou@gmail.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/270693b978f345c34509676c0729d72c19b6d87e"},{"sha":"252bbeb9688a3c6ede9ea997e93ecb5d05e60209","author":{"name":"Julian Wiedmann","email":"a70165cc435925071a1d5d2715fcc7eb04666fa4@linux.ibm.com"},"message":"s390/qdio: fix access to uninitialized qdio_q fields\n\ncommit e521813468f786271a87e78e8644243bead48fad upstream.\n\nEver since CQ/QAOB support was added, calling qdio_free() straight after\nqdio_alloc() results in qdio_release_memory() accessing uninitialized\nmemory (ie. q->u.out.use_cq and q->u.out.aobs). Followed by a\nkmem_cache_free() on the random AOB addresses.\n\nFor older kernels that don't have 6e30c549f6ca, the same applies if\nqdio_establish() fails in the DEV_STATE_ONLINE check.\n\nWhile initializing q->u.out.use_cq would be enough to fix this\nparticular bug, the more future-proof change is to just zero-alloc the\nwhole struct.\n\nFixes: 104ea556ee7f (\"qdio: support asynchronous delivery of storage blocks\")\nCc: <stable@vger.kernel.org> #v3.2+\nSigned-off-by: Julian Wiedmann <jwi@linux.ibm.com>\nSigned-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/252bbeb9688a3c6ede9ea997e93ecb5d05e60209"}]}
{"actor":{"display_login":"Jackeagle"}}