Re: VLA removal (was Re: [RFC 2/2] lustre: use VLA_SAFE)

On 7 March 2018 at 13:09, Linus Torvalds wrote: > On Wed, Mar 7, 2018 at 9:37 AM, Kees Cook wrote: >> >> Building with -Wvla, I see 209 unique locations reported in 60 directories: >> http://paste.ubuntu.com/p/srQxwPQS9s/ > > Ok, that's not

Re: VLA removal (was Re: [RFC 2/2] lustre: use VLA_SAFE)

On 7 March 2018 at 13:09, Linus Torvalds wrote: > On Wed, Mar 7, 2018 at 9:37 AM, Kees Cook wrote: >> >> Building with -Wvla, I see 209 unique locations reported in 60 directories: >> http://paste.ubuntu.com/p/srQxwPQS9s/ > > Ok, that's not so bad. Maybe Greg could even add it to one of those >

RE: [PATCH V2 2/3] efi: Introduce efi_rts_workqueue and some infrastructure to invoke all efi_runtime_services()

+Cc Miguel Ojeda > > > +({ > > > \ > > > + struct efi_runtime_work efi_rts_work; \ > > > + \ > > > + INIT_WORK_ONSTACK(_rts_work.work,

RE: [PATCH V2 2/3] efi: Introduce efi_rts_workqueue and some infrastructure to invoke all efi_runtime_services()

+Cc Miguel Ojeda > > > +({ > > > \ > > > + struct efi_runtime_work efi_rts_work; \ > > > + \ > > > + INIT_WORK_ONSTACK(_rts_work.work,

Re: [PATCH] clk: aspeed: Prevent reset if clock is enabled

On Thu, Mar 8, 2018 at 11:42 AM, Joel Stanley wrote: >> + /* Only reset/enable/unreset if clock is stopped */ >> + regmap_read(gate->map, ASPEED_CLK_STOP_CTRL, ); >> + if (!(reg & clk)) >> + return 0; > > This doesn't generalise to all of the

Re: [PATCH] clk: aspeed: Prevent reset if clock is enabled

On Thu, Mar 8, 2018 at 11:42 AM, Joel Stanley wrote: >> + /* Only reset/enable/unreset if clock is stopped */ >> + regmap_read(gate->map, ASPEED_CLK_STOP_CTRL, ); >> + if (!(reg & clk)) >> + return 0; > > This doesn't generalise to all of the clocks, as some clocks

[PATCH AUTOSEL for 4.4 032/101] NFS: Fix missing pg_cleanup after nfs_pageio_cond_complete()

From: Benjamin Coddington [ Upstream commit 43b7d964ed30dbca5c83c90cb010985b429ec4f9 ] Commit a7d42ddb3099727f58366fa006f850a219cce6c8 ("nfs: add mirroring support to pgio layer") moved pg_cleanup out of the path when there was non-sequental I/O that needed to be flushed.

[PATCH AUTOSEL for 4.4 032/101] NFS: Fix missing pg_cleanup after nfs_pageio_cond_complete()

From: Benjamin Coddington [ Upstream commit 43b7d964ed30dbca5c83c90cb010985b429ec4f9 ] Commit a7d42ddb3099727f58366fa006f850a219cce6c8 ("nfs: add mirroring support to pgio layer") moved pg_cleanup out of the path when there was non-sequental I/O that needed to be flushed. The result is that

[PATCH AUTOSEL for 4.4 034/101] e1000e: fix timing for 82579 Gigabit Ethernet controller

From: Bernd Faust [ Upstream commit 5313eeccd2d7f486be4e5c7560e3e2be239ec8f7 ] After an upgrade to Linux kernel v4.x the hardware timestamps of the 82579 Gigabit Ethernet Controller are different than expected. The values that are being read are almost four times as big as

[PATCH AUTOSEL for 4.4 034/101] e1000e: fix timing for 82579 Gigabit Ethernet controller

From: Bernd Faust [ Upstream commit 5313eeccd2d7f486be4e5c7560e3e2be239ec8f7 ] After an upgrade to Linux kernel v4.x the hardware timestamps of the 82579 Gigabit Ethernet Controller are different than expected. The values that are being read are almost four times as big as before the kernel

[PATCH AUTOSEL for 4.4 035/101] ALSA: hda - Fix headset microphone detection for ASUS N551 and N751

From: Mikhail Paulyshka [ Upstream commit fc7438b1eb12b6c93d7b7a62423779eb5dfc673c ] Headset microphone does not work out of the box on ASUS Nx51 laptops. This patch fixes it. Patch tested on Asus N551 laptop. Asus N751 part is not tested, but according to [1] this laptop uses

[PATCH AUTOSEL for 4.4 036/101] IB/ipoib: Fix deadlock between ipoib_stop and mcast join flow

From: Feras Daoud [ Upstream commit 3e31a490e01a6e67cbe9f6e1df2f3ff0fbf48972 ] Before calling ipoib_stop, rtnl_lock should be taken, then the flow clears the IPOIB_FLAG_ADMIN_UP and IPOIB_FLAG_OPER_UP flags, and waits for mcast completion if IPOIB_MCAST_FLAG_BUSY is set.

[PATCH AUTOSEL for 4.4 035/101] ALSA: hda - Fix headset microphone detection for ASUS N551 and N751

From: Mikhail Paulyshka [ Upstream commit fc7438b1eb12b6c93d7b7a62423779eb5dfc673c ] Headset microphone does not work out of the box on ASUS Nx51 laptops. This patch fixes it. Patch tested on Asus N551 laptop. Asus N751 part is not tested, but according to [1] this laptop uses the same

[PATCH AUTOSEL for 4.4 036/101] IB/ipoib: Fix deadlock between ipoib_stop and mcast join flow

From: Feras Daoud [ Upstream commit 3e31a490e01a6e67cbe9f6e1df2f3ff0fbf48972 ] Before calling ipoib_stop, rtnl_lock should be taken, then the flow clears the IPOIB_FLAG_ADMIN_UP and IPOIB_FLAG_OPER_UP flags, and waits for mcast completion if IPOIB_MCAST_FLAG_BUSY is set. On the other hand, the

[PATCH AUTOSEL for 4.4 031/101] md/raid10: wait up frozen array in handle_write_completed

From: Guoqing Jiang [ Upstream commit cf25ae78fc50010f66b9be945017796da34c434d ] Since nr_queued is changed, we need to call wake_up here if the array is already frozen and waiting for condition "nr_pending == nr_queued + extra" to be true. And commit 824e47daddbf ("RAID1:

[PATCH AUTOSEL for 4.4 031/101] md/raid10: wait up frozen array in handle_write_completed

From: Guoqing Jiang [ Upstream commit cf25ae78fc50010f66b9be945017796da34c434d ] Since nr_queued is changed, we need to call wake_up here if the array is already frozen and waiting for condition "nr_pending == nr_queued + extra" to be true. And commit 824e47daddbf ("RAID1: avoid unnecessary

[PATCH AUTOSEL for 4.4 037/101] IB/ipoib: Update broadcast object if PKey value was changed in index 0

From: Feras Daoud [ Upstream commit 9a9b8112699d78e7f317019b37f377e90023f3ed ] Update the broadcast address in the priv->broadcast object when the Pkey value changes in index 0, otherwise the multicast GID value will keep the previous value of the PKey, and will not be

[PATCH AUTOSEL for 4.4 037/101] IB/ipoib: Update broadcast object if PKey value was changed in index 0

From: Feras Daoud [ Upstream commit 9a9b8112699d78e7f317019b37f377e90023f3ed ] Update the broadcast address in the priv->broadcast object when the Pkey value changes in index 0, otherwise the multicast GID value will keep the previous value of the PKey, and will not be updated. This leads to

[PATCH v5] usb: core: Add "quirks" parameter for usbcore

Trying quirks in usbcore needs to rebuild the driver or the entire kernel if it's builtin. It can save a lot of time if usbcore has similar ability like "usbhid.quirks=" and "usb-storage.quirks=". Rename the original quirk detection function to "static" as we introduce this new "dynamic"

[PATCH v5] usb: core: Add "quirks" parameter for usbcore

Trying quirks in usbcore needs to rebuild the driver or the entire kernel if it's builtin. It can save a lot of time if usbcore has similar ability like "usbhid.quirks=" and "usb-storage.quirks=". Rename the original quirk detection function to "static" as we introduce this new "dynamic"

[PATCH AUTOSEL for 4.4 041/101] ASoC: Intel: Skylake: Uninitialized variable in probe_codec()

From: Dan Carpenter [ Upstream commit e6a33532affd14c12688c0e9b2e773e8b2550f3b ] My static checker complains that if snd_hdac_bus_get_response() returns -EIO then "res" is uninitialized. Fix this by initializing it to -1 so that the error is handled correctly. Fixes:

[PATCH AUTOSEL for 4.4 038/101] HSI: ssi_protocol: double free in ssip_pn_xmit()

From: Dan Carpenter [ Upstream commit 3026050179a3a9a6f5c892c414b5e36ecf092081 ] If skb_pad() fails then it frees skb and we don't need to free it again at the end of the function. Fixes: dc7bf5d7 ("HSI: Introduce driver for SSI Protocol") Signed-off-by: Dan Carpenter

[PATCH AUTOSEL for 4.4 041/101] ASoC: Intel: Skylake: Uninitialized variable in probe_codec()

From: Dan Carpenter [ Upstream commit e6a33532affd14c12688c0e9b2e773e8b2550f3b ] My static checker complains that if snd_hdac_bus_get_response() returns -EIO then "res" is uninitialized. Fix this by initializing it to -1 so that the error is handled correctly. Fixes: d8c2dab8381d ("ASoC:

[PATCH AUTOSEL for 4.4 038/101] HSI: ssi_protocol: double free in ssip_pn_xmit()

From: Dan Carpenter [ Upstream commit 3026050179a3a9a6f5c892c414b5e36ecf092081 ] If skb_pad() fails then it frees skb and we don't need to free it again at the end of the function. Fixes: dc7bf5d7 ("HSI: Introduce driver for SSI Protocol") Signed-off-by: Dan Carpenter Signed-off-by: Sebastian

[PATCH AUTOSEL for 4.4 039/101] IB/mlx4: Take write semaphore when changing the vma struct

From: Maor Gottlieb [ Upstream commit 22c3653d04bd0c67b75e99d85e0c0bdf83947df5 ] When the driver disassociate user context, it changes the vma to anonymous by setting the vm_ops to null and zap the vma ptes. In order to avoid race in the kernel, we need to take write lock

[PATCH AUTOSEL for 4.4 039/101] IB/mlx4: Take write semaphore when changing the vma struct

From: Maor Gottlieb [ Upstream commit 22c3653d04bd0c67b75e99d85e0c0bdf83947df5 ] When the driver disassociate user context, it changes the vma to anonymous by setting the vm_ops to null and zap the vma ptes. In order to avoid race in the kernel, we need to take write lock before we change the

[PATCH AUTOSEL for 4.4 040/101] IB/mlx4: Change vma from shared to private

From: Maor Gottlieb [ Upstream commit ca37a664a8e4e9988b220988ceb4d79e3316f195 ] Anonymous VMA (->vm_ops == NULL) cannot be shared, otherwise it would lead to SIGBUS. Remove the shared flags from the vma after we change it to be anonymous. This is easily reproduced by

[PATCH AUTOSEL for 4.4 040/101] IB/mlx4: Change vma from shared to private

From: Maor Gottlieb [ Upstream commit ca37a664a8e4e9988b220988ceb4d79e3316f195 ] Anonymous VMA (->vm_ops == NULL) cannot be shared, otherwise it would lead to SIGBUS. Remove the shared flags from the vma after we change it to be anonymous. This is easily reproduced by doing modprobe -r while

Re: [PATCH] thermal: of: Allow selection of thermal governor in DT

On Thu, Mar 8, 2018 at 10:19 AM, Viresh Kumar wrote: > On Wed, Mar 7, 2018 at 4:29 PM, Amit Kucheria > wrote: >> Cpufreq/cpuidle are designed to control a single parameter while >> thermal framework is trying to mitigate heat from several

Re: [PATCH] thermal: of: Allow selection of thermal governor in DT

On Thu, Mar 8, 2018 at 10:19 AM, Viresh Kumar wrote: > On Wed, Mar 7, 2018 at 4:29 PM, Amit Kucheria > wrote: >> Cpufreq/cpuidle are designed to control a single parameter while >> thermal framework is trying to mitigate heat from several disparate >> sources that are throttled in different

[PATCH AUTOSEL for 4.4 033/101] tcp: remove poll() flakes with FastOpen

From: Eric Dumazet [ Upstream commit 0f9fa831aecfc297b7b45d4f046759bcefcf87f0 ] When using TCP FastOpen for an active session, we send one wakeup event from tcp_finish_connect(), right before the data eventually contained in the received SYNACK is queued to

[PATCH AUTOSEL for 4.4 033/101] tcp: remove poll() flakes with FastOpen

From: Eric Dumazet [ Upstream commit 0f9fa831aecfc297b7b45d4f046759bcefcf87f0 ] When using TCP FastOpen for an active session, we send one wakeup event from tcp_finish_connect(), right before the data eventually contained in the received SYNACK is queued to sk->sk_receive_queue. This means

[PATCH AUTOSEL for 4.4 043/101] netfilter: xt_CT: fix refcnt leak on error path

From: Gao Feng [ Upstream commit 470acf55a021713869b9bcc967268ac90c8a0fac ] There are two cases which causes refcnt leak. 1. When nf_ct_timeout_ext_add failed in xt_ct_set_timeout, it should free the timeout refcnt. Now goto the err_put_timeout error handler instead of going

[PATCH AUTOSEL for 4.4 045/101] mmc: host: omap_hsmmc: checking for NULL instead of IS_ERR()

From: Dan Carpenter [ Upstream commit ec5ab8933772c87f24ad62a4a602fe8949f423c2 ] devm_pinctrl_get() returns error pointers, it never returns NULL. Fixes: 455e5cd6f736 ("mmc: omap_hsmmc: Pin remux workaround to support SDIO interrupt on AM335x") Signed-off-by: Dan

[PATCH AUTOSEL for 4.4 043/101] netfilter: xt_CT: fix refcnt leak on error path

From: Gao Feng [ Upstream commit 470acf55a021713869b9bcc967268ac90c8a0fac ] There are two cases which causes refcnt leak. 1. When nf_ct_timeout_ext_add failed in xt_ct_set_timeout, it should free the timeout refcnt. Now goto the err_put_timeout error handler instead of going ahead. 2. When

[PATCH AUTOSEL for 4.4 045/101] mmc: host: omap_hsmmc: checking for NULL instead of IS_ERR()

From: Dan Carpenter [ Upstream commit ec5ab8933772c87f24ad62a4a602fe8949f423c2 ] devm_pinctrl_get() returns error pointers, it never returns NULL. Fixes: 455e5cd6f736 ("mmc: omap_hsmmc: Pin remux workaround to support SDIO interrupt on AM335x") Signed-off-by: Dan Carpenter Reviewed-by:

[PATCH AUTOSEL for 4.4 044/101] openvswitch: Delete conntrack entry clashing with an expectation.

From: Jarno Rajahalme [ Upstream commit cf5d70918877c6a6655dc1e92e2ebb661ce904fd ] Conntrack helpers do not check for a potentially clashing conntrack entry when creating a new expectation. Also, nf_conntrack_in() will check expectations (via init_conntrack()) only if a

[PATCH AUTOSEL for 4.4 044/101] openvswitch: Delete conntrack entry clashing with an expectation.

From: Jarno Rajahalme [ Upstream commit cf5d70918877c6a6655dc1e92e2ebb661ce904fd ] Conntrack helpers do not check for a potentially clashing conntrack entry when creating a new expectation. Also, nf_conntrack_in() will check expectations (via init_conntrack()) only if a conntrack entry can not

[PATCH AUTOSEL for 4.4 047/101] qlcnic: fix unchecked return value

From: Pan Bian [ Upstream commit 91ec701a553cb3de470fd471c6fefe3ad1125455 ] Function pci_find_ext_capability() may return 0, which is an invalid address. In function qlcnic_sriov_virtid_fn(), its return value is used without validation. This may result in invalid memory

[PATCH AUTOSEL for 4.4 047/101] qlcnic: fix unchecked return value

From: Pan Bian [ Upstream commit 91ec701a553cb3de470fd471c6fefe3ad1125455 ] Function pci_find_ext_capability() may return 0, which is an invalid address. In function qlcnic_sriov_virtid_fn(), its return value is used without validation. This may result in invalid memory access bugs. This patch

linux-next: Tree for Mar 8

Hi all, Changes since 20180307: The sunxi tree gained a build failure so I used the version from next-20180307. The drm tree gained a conflict against the drm-misc-fixes tree. The mfd tree gained a conflict against Linus' tree. The akpm-current tree gained a build failure for which I reverted

linux-next: Tree for Mar 8

Hi all, Changes since 20180307: The sunxi tree gained a build failure so I used the version from next-20180307. The drm tree gained a conflict against the drm-misc-fixes tree. The mfd tree gained a conflict against Linus' tree. The akpm-current tree gained a build failure for which I reverted

[PATCH AUTOSEL for 4.4 042/101] Fix driver usage of 128B WQEs when WQ_CREATE is V1.

From: James Smart [ Upstream commit 3f247de750b8dd8f50a2c1390e2a1238790a9dff ] There are two versions of a structure for queue creation and setup that the driver shares with FW. The driver was only treating as version 0. Verify WQ_CREATE with 128B WQEs in V0 and V1. Code

[PATCH AUTOSEL for 4.4 042/101] Fix driver usage of 128B WQEs when WQ_CREATE is V1.

From: James Smart [ Upstream commit 3f247de750b8dd8f50a2c1390e2a1238790a9dff ] There are two versions of a structure for queue creation and setup that the driver shares with FW. The driver was only treating as version 0. Verify WQ_CREATE with 128B WQEs in V0 and V1. Code review of another bug

[PATCH AUTOSEL for 4.4 048/101] scsi: mac_esp: Replace bogus memory barrier with spinlock

From: Finn Thain [ Upstream commit 4da2b1eb230ba4ad19b58984dc52e05b1073df5f ] Commit da244654c66e ("[SCSI] mac_esp: fix for quadras with two esp chips") added mac_scsi_esp_intr() to handle the IRQ lines from a pair of on-board ESP chips (a normal shared IRQ did not

[PATCH AUTOSEL for 4.4 052/101] mt7601u: check return value of alloc_skb

From: Pan Bian [ Upstream commit 5fb01e91daf84ad1e50edfcf63116ecbe31e7ba7 ] Function alloc_skb() will return a NULL pointer if there is no enough memory. However, in function mt7601u_mcu_msg_alloc(), its return value is not validated before it is used. This patch fixes it.

[PATCH AUTOSEL for 4.4 050/101] NFS: don't try to cross a mountpount when there isn't one there.

From: NeilBrown [ Upstream commit 99bbf6ecc694dfe0b026e15359c5aa2a60b97a93 ] consider the sequence of commands: mkdir -p /import/nfs /import/bind /import/etc mount --bind / /import/bind mount --make-private /import/bind mount --bind /import/etc /import/bind/etc exportfs -o

[PATCH AUTOSEL for 4.4 048/101] scsi: mac_esp: Replace bogus memory barrier with spinlock

From: Finn Thain [ Upstream commit 4da2b1eb230ba4ad19b58984dc52e05b1073df5f ] Commit da244654c66e ("[SCSI] mac_esp: fix for quadras with two esp chips") added mac_scsi_esp_intr() to handle the IRQ lines from a pair of on-board ESP chips (a normal shared IRQ did not work). Proper mutual

[PATCH AUTOSEL for 4.4 052/101] mt7601u: check return value of alloc_skb

From: Pan Bian [ Upstream commit 5fb01e91daf84ad1e50edfcf63116ecbe31e7ba7 ] Function alloc_skb() will return a NULL pointer if there is no enough memory. However, in function mt7601u_mcu_msg_alloc(), its return value is not validated before it is used. This patch fixes it. Signed-off-by: Pan

[PATCH AUTOSEL for 4.4 050/101] NFS: don't try to cross a mountpount when there isn't one there.

From: NeilBrown [ Upstream commit 99bbf6ecc694dfe0b026e15359c5aa2a60b97a93 ] consider the sequence of commands: mkdir -p /import/nfs /import/bind /import/etc mount --bind / /import/bind mount --make-private /import/bind mount --bind /import/etc /import/bind/etc exportfs -o

[PATCH AUTOSEL for 4.4 054/101] Btrfs: send, fix file hole not being preserved due to inline extent

From: Filipe Manana [ Upstream commit e1cbfd7bf6dabdac561c75d08357571f44040a45 ] Normally we don't have inline extents followed by regular extents, but there's currently at least one harmless case where this happens. For example, when the page size is 4Kb and compression is

[PATCH AUTOSEL for 4.4 054/101] Btrfs: send, fix file hole not being preserved due to inline extent

From: Filipe Manana [ Upstream commit e1cbfd7bf6dabdac561c75d08357571f44040a45 ] Normally we don't have inline extents followed by regular extents, but there's currently at least one harmless case where this happens. For example, when the page size is 4Kb and compression is enabled: $

Re: [PATCH v8 1/5] iommu/arm-smmu: Destroy domain context in failure path

On Wed, Mar 7, 2018 at 5:50 PM, Robin Murphy wrote: > On 02/03/18 10:10, Vivek Gautam wrote: >> >> If we fail after initializing domain_context, we should destroy >> the context to free up resources. > > > Have another think about why the "problem" this patch caters for

Re: [PATCH v8 1/5] iommu/arm-smmu: Destroy domain context in failure path

On Wed, Mar 7, 2018 at 5:50 PM, Robin Murphy wrote: > On 02/03/18 10:10, Vivek Gautam wrote: >> >> If we fail after initializing domain_context, we should destroy >> the context to free up resources. > > > Have another think about why the "problem" this patch caters for cannot ever > happen

[PATCH AUTOSEL for 4.4 056/101] mfd: palmas: Reset the POWERHOLD mux during power off

From: Keerthy [ Upstream commit 85fdaf8eb9bbec1f0f8a52fd5d85659d60738816 ] POWERHOLD signal has higher priority over the DEV_ON bit. So power off will not happen if the POWERHOLD is held high. Hence reset the MUX to GPIO_7 mode to release the POWERHOLD and the DEV_ON bit to

[PATCH AUTOSEL for 4.4 053/101] rndis_wlan: add return value validation

From: Pan Bian [ Upstream commit 9dc7efd3978aa67ae598129d2a3f240b390ce508 ] Function create_singlethread_workqueue() will return a NULL pointer if there is no enough memory, and its return value should be validated before using. However, in function rndis_wlan_bind(), its

[PATCH AUTOSEL for 4.4 056/101] mfd: palmas: Reset the POWERHOLD mux during power off

From: Keerthy [ Upstream commit 85fdaf8eb9bbec1f0f8a52fd5d85659d60738816 ] POWERHOLD signal has higher priority over the DEV_ON bit. So power off will not happen if the POWERHOLD is held high. Hence reset the MUX to GPIO_7 mode to release the POWERHOLD and the DEV_ON bit to take effect to

[PATCH AUTOSEL for 4.4 053/101] rndis_wlan: add return value validation

From: Pan Bian [ Upstream commit 9dc7efd3978aa67ae598129d2a3f240b390ce508 ] Function create_singlethread_workqueue() will return a NULL pointer if there is no enough memory, and its return value should be validated before using. However, in function rndis_wlan_bind(), its return value is not

[PATCH AUTOSEL for 4.4 058/101] staging: unisys: visorhba: fix s-Par to boot with option CONFIG_VMAP_STACK set to y

From: Sameer Wadgaonkar [ Upstream commit 3c2bf0bd08123f3497bd3e84bd9088c937b0cb40 ] The root issue is that we are not allowed to have items on the stack being passed to "DMA" like operations. In this case we have a vmcall and an inline completion of scsi command.

[PATCH AUTOSEL for 4.4 058/101] staging: unisys: visorhba: fix s-Par to boot with option CONFIG_VMAP_STACK set to y

From: Sameer Wadgaonkar [ Upstream commit 3c2bf0bd08123f3497bd3e84bd9088c937b0cb40 ] The root issue is that we are not allowed to have items on the stack being passed to "DMA" like operations. In this case we have a vmcall and an inline completion of scsi command. This patch fixes the issue by

[PATCH AUTOSEL for 4.4 049/101] infiniband/uverbs: Fix integer overflows

From: Vlad Tsyrklevich [ Upstream commit 4f7f4dcfff2c19debbcdbcc861c325610a15e0c5 ] The 'num_sge' variable is verfied to be smaller than the 'sge_count' variable; however, since both are user-controlled it's possible to cause an integer overflow for the kmalloc multiply on

[PATCH AUTOSEL for 4.4 049/101] infiniband/uverbs: Fix integer overflows

From: Vlad Tsyrklevich [ Upstream commit 4f7f4dcfff2c19debbcdbcc861c325610a15e0c5 ] The 'num_sge' variable is verfied to be smaller than the 'sge_count' variable; however, since both are user-controlled it's possible to cause an integer overflow for the kmalloc multiply on 32-bit platforms

[PATCH AUTOSEL for 4.4 051/101] iio: st_pressure: st_accel: Initialise sensor platform data properly

From: Shrirang Bagul [ Upstream commit 7383d44b84c94aaca4bf695a6bd8a69f2295ef1a ] This patch fixes the sensor platform data initialisation for st_pressure and st_accel device drivers. Without this patch, the driver fails to register the sensors when the user

[PATCH AUTOSEL for 4.4 051/101] iio: st_pressure: st_accel: Initialise sensor platform data properly

From: Shrirang Bagul [ Upstream commit 7383d44b84c94aaca4bf695a6bd8a69f2295ef1a ] This patch fixes the sensor platform data initialisation for st_pressure and st_accel device drivers. Without this patch, the driver fails to register the sensors when the user removes and re-loads the driver. 1.

[PATCH AUTOSEL for 4.4 055/101] mac80211: don't parse encrypted management frames in ieee80211_frame_acked

From: Emmanuel Grumbach [ Upstream commit cf147085fdda044622973a12e4e06f1c753ab677 ] ieee80211_frame_acked is called when a frame is acked by the peer. In case this is a management frame, we check if this an SMPS frame, in which case we can update our antenna

RE: [PATCH V2 2/3] efi: Introduce efi_rts_workqueue and some infrastructure to invoke all efi_runtime_services()

> > +({ \ > > + struct efi_runtime_work efi_rts_work; \ > > + \ > > + INIT_WORK_ONSTACK(_rts_work.work, efi_call_rts);\ > > +

[PATCH AUTOSEL for 4.4 060/101] mmc: sdhci-of-esdhc: limit SD clock for ls1012a/ls1046a

From: yangbo lu [ Upstream commit a627f025eb0534052ff451427c16750b3530634c ] The ls1046a datasheet specified that the max SD clock frequency for eSDHC SDR104/HS200 was 167MHz, and the ls1012a datasheet specified it's 125MHz for ls1012a. So this patch is to add the limitation.

[PATCH AUTOSEL for 4.4 055/101] mac80211: don't parse encrypted management frames in ieee80211_frame_acked

From: Emmanuel Grumbach [ Upstream commit cf147085fdda044622973a12e4e06f1c753ab677 ] ieee80211_frame_acked is called when a frame is acked by the peer. In case this is a management frame, we check if this an SMPS frame, in which case we can update our antenna configuration. When we parse the

RE: [PATCH V2 2/3] efi: Introduce efi_rts_workqueue and some infrastructure to invoke all efi_runtime_services()

> > +({ \ > > + struct efi_runtime_work efi_rts_work; \ > > + \ > > + INIT_WORK_ONSTACK(_rts_work.work, efi_call_rts);\ > > +

[PATCH AUTOSEL for 4.4 060/101] mmc: sdhci-of-esdhc: limit SD clock for ls1012a/ls1046a

From: yangbo lu [ Upstream commit a627f025eb0534052ff451427c16750b3530634c ] The ls1046a datasheet specified that the max SD clock frequency for eSDHC SDR104/HS200 was 167MHz, and the ls1012a datasheet specified it's 125MHz for ls1012a. So this patch is to add the limitation. Signed-off-by:

[PATCH AUTOSEL for 4.4 064/101] drm/nouveau/kms: Increase max retries in scanout position queries.

From: Mario Kleiner [ Upstream commit 60b95d709525e3ce1c51e1fc93175dcd1755d345 ] So far we only allowed for 1 retry and just failed the query - and thereby high precision vblank timestamping - if we did not get a reasonable result, as such a failure wasn't considered

[PATCH AUTOSEL for 4.4 065/101] bnx2x: Align RX buffers

From: Scott Wood [ Upstream commit 9b70de6d0266888b3743f03802502e43131043c8 ] The bnx2x driver is not providing proper alignment on the receive buffers it passes to build_skb(), causing skb_shared_info to be misaligned. skb_shared_info contains an atomic, and while PPC

[PATCH AUTOSEL for 4.4 064/101] drm/nouveau/kms: Increase max retries in scanout position queries.

From: Mario Kleiner [ Upstream commit 60b95d709525e3ce1c51e1fc93175dcd1755d345 ] So far we only allowed for 1 retry and just failed the query - and thereby high precision vblank timestamping - if we did not get a reasonable result, as such a failure wasn't considered all too horrible. There are

[PATCH AUTOSEL for 4.4 065/101] bnx2x: Align RX buffers

From: Scott Wood [ Upstream commit 9b70de6d0266888b3743f03802502e43131043c8 ] The bnx2x driver is not providing proper alignment on the receive buffers it passes to build_skb(), causing skb_shared_info to be misaligned. skb_shared_info contains an atomic, and while PPC normally supports

[PATCH AUTOSEL for 4.4 063/101] ACPI / PMIC: xpower: Fix power_table addresses

From: Hans de Goede [ Upstream commit 2bde7c32b1db162692f05c6be066b5bcd3d9fdbe ] The power table addresses should be contiguous, but there was a hole where 0x34 was missing. On most devices this is not a problem as addresses above 0x34 are used for the BUC# convertors which

[PATCH AUTOSEL for 4.4 063/101] ACPI / PMIC: xpower: Fix power_table addresses

From: Hans de Goede [ Upstream commit 2bde7c32b1db162692f05c6be066b5bcd3d9fdbe ] The power table addresses should be contiguous, but there was a hole where 0x34 was missing. On most devices this is not a problem as addresses above 0x34 are used for the BUC# convertors which are not used in the

[PATCH AUTOSEL for 4.4 067/101] Input: twl4030-pwrbutton - use correct device for irq request

From: Sebastian Reichel [ Upstream commit 3071e9dd6cd3f2290d770117330f2c8b2e9a97e4 ] The interrupt should be requested for the platform device and not for the input device. Fixes: 7f9ce649d267 ("Input: twl4030-pwrbutton - simplify driver using devm_*")

[PATCH AUTOSEL for 4.4 067/101] Input: twl4030-pwrbutton - use correct device for irq request

From: Sebastian Reichel [ Upstream commit 3071e9dd6cd3f2290d770117330f2c8b2e9a97e4 ] The interrupt should be requested for the platform device and not for the input device. Fixes: 7f9ce649d267 ("Input: twl4030-pwrbutton - simplify driver using devm_*") Signed-off-by: Sebastian Reichel

RE: [PATCH V2 3/3] efi: Use efi_rts_workqueue to invoke EFI Runtime Services

> >> > pstore writes could potentially be invoked in interrupt context and > >> > it uses set_variable<>() and query_variable_info<>() to store logs. > >> > If we invoke efi_runtime_services() through efi_rts_wq while in > >> > atomic() kernel issues a warning ("scheduling wile in atomic") and >

[PATCH AUTOSEL for 4.4 066/101] power: supply: pda_power: move from timer to delayed_work

From: Michael Trimarchi [ Upstream commit 633e8799ddc09431be2744c4a1efdbda13af2b0b ] This changed is needed to avoid locking problem during boot as shown: <5>[8.824096] Registering SWP/SWPB emulation handler <6>[8.977294] clock: disabling unused clocks to

[PATCH AUTOSEL for 4.4 062/101] ipmi/watchdog: fix wdog hang on panic waiting for ipmi response

From: Robert Lippert [ Upstream commit 2c1175c2e8e5487233cabde358a19577562ac83e ] Commit c49c097610fe ("ipmi: Don't call receive handler in the panic context") means that the panic_recv_free is not called during a panic and the atomic count does not drop to 0. Fix this by

RE: [PATCH V2 3/3] efi: Use efi_rts_workqueue to invoke EFI Runtime Services

> >> > pstore writes could potentially be invoked in interrupt context and > >> > it uses set_variable<>() and query_variable_info<>() to store logs. > >> > If we invoke efi_runtime_services() through efi_rts_wq while in > >> > atomic() kernel issues a warning ("scheduling wile in atomic") and >

[PATCH AUTOSEL for 4.4 066/101] power: supply: pda_power: move from timer to delayed_work

From: Michael Trimarchi [ Upstream commit 633e8799ddc09431be2744c4a1efdbda13af2b0b ] This changed is needed to avoid locking problem during boot as shown: <5>[8.824096] Registering SWP/SWPB emulation handler <6>[8.977294] clock: disabling unused clocks to save power <3>[9.108154]

[PATCH AUTOSEL for 4.4 062/101] ipmi/watchdog: fix wdog hang on panic waiting for ipmi response

From: Robert Lippert [ Upstream commit 2c1175c2e8e5487233cabde358a19577562ac83e ] Commit c49c097610fe ("ipmi: Don't call receive handler in the panic context") means that the panic_recv_free is not called during a panic and the atomic count does not drop to 0. Fix this by only expecting one

[PATCH AUTOSEL for 4.4 071/101] video: fbdev: udlfb: Fix buffer on stack

From: Maksim Salau [ Upstream commit 45f580c42e5c125d55dbd8099750a1998de3d917 ] Allocate buffers on HEAP instead of STACK for local array that is to be sent using usb_control_msg(). Signed-off-by: Maksim Salau Cc: Bernie Thompson

[PATCH AUTOSEL for 4.4 071/101] video: fbdev: udlfb: Fix buffer on stack

From: Maksim Salau [ Upstream commit 45f580c42e5c125d55dbd8099750a1998de3d917 ] Allocate buffers on HEAP instead of STACK for local array that is to be sent using usb_control_msg(). Signed-off-by: Maksim Salau Cc: Bernie Thompson Cc: Geert Uytterhoeven Signed-off-by: Bartlomiej

[PATCH AUTOSEL for 4.4 061/101] ARM: DRA7: clockdomain: Change the CLKTRCTRL of CM_PCIE_CLKSTCTRL to SW_WKUP

From: Kishon Vijay Abraham I [ Upstream commit 2c949ce38f4e81d7487f165fa3b8f77d74a2a6c4 ] The PCIe programming sequence in TRM suggests CLKSTCTRL of PCIe should be set to SW_WKUP. There are no issues when CLKSTCTRL is set to HW_AUTO in RC mode. However in EP mode, the host system

[PATCH AUTOSEL for 4.4 070/101] tcm_fileio: Prevent information leak for short reads

From: Dmitry Monakhov [ Upstream commit f11b55d13563e9428c88c873f4f03a6bef11ec0a ] If we failed to read data from backing file (probably because some one truncate file under us), we must zerofill cmd's data, otherwise it will be returned as is. Most likely cmd's data are

[PATCH AUTOSEL for 4.4 069/101] ia64: fix module loading for gcc-5.4

From: Sergei Trofimovich [ Upstream commit a25fb8508c1b80dce742dbeaa4d75a1e9f2c5617 ] Starting from gcc-5.4+ gcc generates MLX instructions in more cases to refer local symbols: https://gcc.gnu.org/PR60465 That caused ia64 module loader to choke on such instructions:

[PATCH AUTOSEL for 4.4 061/101] ARM: DRA7: clockdomain: Change the CLKTRCTRL of CM_PCIE_CLKSTCTRL to SW_WKUP

From: Kishon Vijay Abraham I [ Upstream commit 2c949ce38f4e81d7487f165fa3b8f77d74a2a6c4 ] The PCIe programming sequence in TRM suggests CLKSTCTRL of PCIe should be set to SW_WKUP. There are no issues when CLKSTCTRL is set to HW_AUTO in RC mode. However in EP mode, the host system is not able to

[PATCH AUTOSEL for 4.4 070/101] tcm_fileio: Prevent information leak for short reads

From: Dmitry Monakhov [ Upstream commit f11b55d13563e9428c88c873f4f03a6bef11ec0a ] If we failed to read data from backing file (probably because some one truncate file under us), we must zerofill cmd's data, otherwise it will be returned as is. Most likely cmd's data are unitialized pages from

[PATCH AUTOSEL for 4.4 069/101] ia64: fix module loading for gcc-5.4

From: Sergei Trofimovich [ Upstream commit a25fb8508c1b80dce742dbeaa4d75a1e9f2c5617 ] Starting from gcc-5.4+ gcc generates MLX instructions in more cases to refer local symbols: https://gcc.gnu.org/PR60465 That caused ia64 module loader to choke on such instructions: fuse: invalid

[PATCH AUTOSEL for 4.4 072/101] sm501fb: don't return zero on failure path in sm501fb_start()

From: Alexey Khoroshilov [ Upstream commit dc85e9a87420613b3129d5cc5ecd79c58351c546 ] If fbmem iomemory mapping failed, sm501fb_start() breaks off initialization, deallocates resources, but returns zero. As a result, double deallocation can happen in sm501fb_stop().

[PATCH AUTOSEL for 4.4 074/101] cifs: small underflow in cnvrtDosUnixTm()

From: Dan Carpenter [ Upstream commit 564277eceeca01e02b1ef3e141cfb939184601b4 ] January is month 1. There is no zero-th month. If someone passes a zero month then it means we read from one space before the start of the total_days_of_prev_months[] array. We may as

[PATCH AUTOSEL for 4.4 068/101] md/raid10: skip spare disk as 'first' disk

From: Shaohua Li [ Upstream commit b506335e5d2b4ec687dde392a3bdbf7601778f1d ] Commit 6f287ca(md/raid10: reset the 'first' at the end of loop) ignores a case in reshape, the first rdev could be a spare disk, which shouldn't be accounted as the first disk since it doesn't include the

[PATCH AUTOSEL for 4.4 072/101] sm501fb: don't return zero on failure path in sm501fb_start()

From: Alexey Khoroshilov [ Upstream commit dc85e9a87420613b3129d5cc5ecd79c58351c546 ] If fbmem iomemory mapping failed, sm501fb_start() breaks off initialization, deallocates resources, but returns zero. As a result, double deallocation can happen in sm501fb_stop(). Found by Linux Driver

[PATCH AUTOSEL for 4.4 074/101] cifs: small underflow in cnvrtDosUnixTm()

From: Dan Carpenter [ Upstream commit 564277eceeca01e02b1ef3e141cfb939184601b4 ] January is month 1. There is no zero-th month. If someone passes a zero month then it means we read from one space before the start of the total_days_of_prev_months[] array. We may as well also be strict about

[PATCH AUTOSEL for 4.4 068/101] md/raid10: skip spare disk as 'first' disk

From: Shaohua Li [ Upstream commit b506335e5d2b4ec687dde392a3bdbf7601778f1d ] Commit 6f287ca(md/raid10: reset the 'first' at the end of loop) ignores a case in reshape, the first rdev could be a spare disk, which shouldn't be accounted as the first disk since it doesn't include the offset info.

[PATCH AUTOSEL for 4.4 075/101] rtc: ds1374: wdt: Fix issue with timeout scaling from secs to wdt ticks

From: Moritz Fischer [ Upstream commit 453d0744f6c6ca3f9749b8c57c2e85b5b9f52514 ] The issue is that the internal counter that triggers the watchdog reset is actually running at 4096 Hz instead of 1Hz, therefore the value given by userland (in sec) needs to be multiplied by 4096

[PATCH AUTOSEL for 4.4 075/101] rtc: ds1374: wdt: Fix issue with timeout scaling from secs to wdt ticks

From: Moritz Fischer [ Upstream commit 453d0744f6c6ca3f9749b8c57c2e85b5b9f52514 ] The issue is that the internal counter that triggers the watchdog reset is actually running at 4096 Hz instead of 1Hz, therefore the value given by userland (in sec) needs to be multiplied by 4096 to get the

<    4   5   6   7   8   9   10   11   12   13   >