1. 13 Feb, 2019 1 commit
  2. 12 Feb, 2019 5 commits
    • Jens Axboe's avatar
      Merge branch 'md-fixes' of https://github.com/liu-song-6/linux into for-linus · 69306fe1
      Jens Axboe authored
      Pull MD fix from Song
      
      * 'md-fixes' of https://github.com/liu-song-6/linux:
        md/raid1: don't clear bitmap bits on interrupted recovery.
      69306fe1
    • Nate Dailey's avatar
      md/raid1: don't clear bitmap bits on interrupted recovery. · dfcc34c9
      Nate Dailey authored
      sync_request_write no longer submits writes to a Faulty device. This has
      the unfortunate side effect that bitmap bits can be incorrectly cleared
      if a recovery is interrupted (previously, end_sync_write would have
      prevented this). This means the next recovery may not copy everything
      it should, potentially corrupting data.
      
      Add a function for doing the proper md_bitmap_end_sync, called from
      end_sync_write and the Faulty case in sync_request_write.
      
      backport note to 4.14: s/md_bitmap_end_sync/bitmap_end_sync
      Cc: stable@vger.kernel.org 4.14+
      Fixes: 0c9d5b12 ("md/raid1: avoid reusing a resync bio after error handling.")
      Reviewed-by: default avatarJack Wang <jinpu.wang@cloud.ionos.com>
      Tested-by: default avatarJack Wang <jinpu.wang@cloud.ionos.com>
      Signed-off-by: default avatarNate Dailey <nate.dailey@stratus.com>
      Signed-off-by: default avatarSong Liu <songliubraving@fb.com>
      dfcc34c9
    • Yufen Yu's avatar
      floppy: check_events callback should not return a negative number · 96d7cb93
      Yufen Yu authored
      floppy_check_events() is supposed to return bit flags to say which
      events occured. We should return zero to say that no event flags are
      set.  Only BIT(0) and BIT(1) are used in the caller. And .check_events
      interface also expect to return an unsigned int value.
      
      However, after commit a0c80efe, it may return -EINTR (-4u).
      Here, both BIT(0) and BIT(1) are cleared. So this patch shouldn't
      affect runtime, but it obviously is still worth fixing.
      Reviewed-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Fixes: a0c80efe ("floppy: fix lock_fdc() signal handling")
      Signed-off-by: default avatarYufen Yu <yuyufen@huawei.com>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      96d7cb93
    • Keith Busch's avatar
      nvme-pci: add missing unlock for reset error · 4726bcf3
      Keith Busch authored
      The reset work holds a mutex to prevent races with removal modifying the
      same resources, but was unlocking only on success. Unlock on failure
      too.
      
      Fixes: 5c959d73 ("nvme-pci: fix rapid add remove sequence")
      Signed-off-by: default avatarKeith Busch <keith.busch@intel.com>
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      4726bcf3
    • Jianchao Wang's avatar
      blk-mq: insert rq with DONTPREP to hctx dispatch list when requeue · aef1897c
      Jianchao Wang authored
      When requeue, if RQF_DONTPREP, rq has contained some driver
      specific data, so insert it to hctx dispatch list to avoid any
      merge. Take scsi as example, here is the trace event log (no
      io scheduler, because RQF_STARTED would prevent merging),
      
         kworker/0:1H-339   [000] ...1  2037.209289: block_rq_insert: 8,0 R 4096 () 32768 + 8 [kworker/0:1H]
      scsi_inert_test-1987  [000] ....  2037.220465: block_bio_queue: 8,0 R 32776 + 8 [scsi_inert_test]
      scsi_inert_test-1987  [000] ...2  2037.220466: block_bio_backmerge: 8,0 R 32776 + 8 [scsi_inert_test]
         kworker/0:1H-339   [000] ....  2047.220913: block_rq_issue: 8,0 R 8192 () 32768 + 16 [kworker/0:1H]
      scsi_inert_test-1996  [000] ..s1  2047.221007: block_rq_complete: 8,0 R () 32768 + 8 [0]
      scsi_inert_test-1996  [000] .Ns1  2047.221045: block_rq_requeue: 8,0 R () 32776 + 8 [0]
         kworker/0:1H-339   [000] ...1  2047.221054: block_rq_insert: 8,0 R 4096 () 32776 + 8 [kworker/0:1H]
         kworker/0:1H-339   [000] ...1  2047.221056: block_rq_issue: 8,0 R 4096 () 32776 + 8 [kworker/0:1H]
      scsi_inert_test-1986  [000] ..s1  2047.221119: block_rq_complete: 8,0 R () 32776 + 8 [0]
      
      (32768 + 8) was requeued by scsi_queue_insert and had RQF_DONTPREP.
      Then it was merged with (32776 + 8) and issued. Due to RQF_DONTPREP,
      the sdb only contained the part of (32768 + 8), then only that part
      was completed. The lucky thing was that scsi_io_completion detected
      it and requeued the remaining part. So we didn't get corrupted data.
      However, the requeue of (32776 + 8) is not expected.
      Suggested-by: default avatarJens Axboe <axboe@kernel.dk>
      Signed-off-by: default avatarJianchao Wang <jianchao.w.wang@oracle.com>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      aef1897c
  3. 08 Feb, 2019 3 commits
    • Liu Bo's avatar
      blk-mq: remove duplicated definition of blk_mq_freeze_queue · 26984841
      Liu Bo authored
      As the prototype has been defined in "include/linux/blk-mq.h", the one
      in "block/blk-mq.h" can be removed then.
      Signed-off-by: default avatarLiu Bo <bo.liu@linux.alibaba.com>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      26984841
    • Liu Bo's avatar
      Blk-iolatency: warn on negative inflight IO counter · 391f552a
      Liu Bo authored
      This is to catch any unexpected negative value of inflight IO counter.
      Signed-off-by: default avatarLiu Bo <bo.liu@linux.alibaba.com>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      391f552a
    • Liu Bo's avatar
      blk-iolatency: fix IO hang due to negative inflight counter · 8c772a9b
      Liu Bo authored
      Our test reported the following stack, and vmcore showed that
      ->inflight counter is -1.
      
      [ffffc9003fcc38d0] __schedule at ffffffff8173d95d
      [ffffc9003fcc3958] schedule at ffffffff8173de26
      [ffffc9003fcc3970] io_schedule at ffffffff810bb6b6
      [ffffc9003fcc3988] blkcg_iolatency_throttle at ffffffff813911cb
      [ffffc9003fcc3a20] rq_qos_throttle at ffffffff813847f3
      [ffffc9003fcc3a48] blk_mq_make_request at ffffffff8137468a
      [ffffc9003fcc3b08] generic_make_request at ffffffff81368b49
      [ffffc9003fcc3b68] submit_bio at ffffffff81368d7d
      [ffffc9003fcc3bb8] ext4_io_submit at ffffffffa031be00 [ext4]
      [ffffc9003fcc3c00] ext4_writepages at ffffffffa03163de [ext4]
      [ffffc9003fcc3d68] do_writepages at ffffffff811c49ae
      [ffffc9003fcc3d78] __filemap_fdatawrite_range at ffffffff811b6188
      [ffffc9003fcc3e30] filemap_write_and_wait_range at ffffffff811b6301
      [ffffc9003fcc3e60] ext4_sync_file at ffffffffa030cee8 [ext4]
      [ffffc9003fcc3ea8] vfs_fsync_range at ffffffff8128594b
      [ffffc9003fcc3ee8] do_fsync at ffffffff81285abd
      [ffffc9003fcc3f18] sys_fsync at ffffffff81285d50
      [ffffc9003fcc3f28] do_syscall_64 at ffffffff81003c04
      [ffffc9003fcc3f50] entry_SYSCALL_64_after_swapgs at ffffffff81742b8e
      
      The ->inflight counter may be negative (-1) if
      
      1) blk-iolatency was disabled when the IO was issued,
      
      2) blk-iolatency was enabled before this IO reached its endio,
      
      3) the ->inflight counter is decreased from 0 to -1 in endio()
      
      In fact the hang can be easily reproduced by the below script,
      
      H=/sys/fs/cgroup/unified/
      P=/sys/fs/cgroup/unified/test
      
      echo "+io" > $H/cgroup.subtree_control
      mkdir -p $P
      
      echo $$ > $P/cgroup.procs
      
      xfs_io -f -d -c "pwrite 0 4k" /dev/sdg
      
      echo "`cat /sys/block/sdg/dev` target=1000000" > $P/io.latency
      
      xfs_io -f -d -c "pwrite 0 4k" /dev/sdg
      
      This fixes the problem by freezing the queue so that while
      enabling/disabling iolatency, there is no inflight rq running.
      
      Note that quiesce_queue is not needed as this only updating iolatency
      configuration about which dispatching request_queue doesn't care.
      Signed-off-by: default avatarLiu Bo <bo.liu@linux.alibaba.com>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      8c772a9b
  4. 07 Feb, 2019 1 commit
  5. 06 Feb, 2019 7 commits
  6. 31 Jan, 2019 1 commit
    • Jens Axboe's avatar
      ide: ensure atapi sense request aren't preempted · 9a6d5488
      Jens Axboe authored
      There's an issue with how sense requests are handled in IDE. If ide-cd
      encounters an error, it queues a sense request. With how IDE request
      handling is done, this is the next request we need to handle. But it's
      impossible to guarantee this, as another request could come in between
      the sense being queued, and ->queue_rq() being run and handling it. If
      that request ALSO fails, then we attempt to doubly queue the single
      sense request we have.
      
      Since we only support one active request at the time, defer request
      processing when a sense request is queued.
      
      Fixes: 60033520 "ide: convert to blk-mq"
      Reported-by: default avatarHe Zhe <zhe.he@windriver.com>
      Tested-by: default avatarHe Zhe <zhe.he@windriver.com>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      9a6d5488
  7. 30 Jan, 2019 2 commits
  8. 29 Jan, 2019 1 commit
  9. 28 Jan, 2019 2 commits
    • Alexei Naberezhnov's avatar
      md/raid5: fix 'out of memory' during raid cache recovery · 483cbbed
      Alexei Naberezhnov authored
      This fixes the case when md array assembly fails because of raid cache recovery
      unable to allocate a stripe, despite attempts to replay stripes and increase
      cache size. This happens because stripes released by r5c_recovery_replay_stripes
      and raid5_set_cache_size don't become available for allocation immediately.
      Released stripes first are placed on conf->released_stripes list and require
      md thread to merge them on conf->inactive_list before they can be allocated.
      
      Patch allows final allocation attempt during cache recovery to wait for
      new stripes to become availabe for allocation.
      
      Cc: linux-raid@vger.kernel.org
      Cc: Shaohua Li <shli@kernel.org>
      Cc: linux-stable <stable@vger.kernel.org> # 4.10+
      Fixes: b4c625c6 ("md/r5cache: r5cache recovery: part 1")
      Signed-off-by: default avatarAlexei Naberezhnov <anaberezhnov@fb.com>
      Signed-off-by: default avatarSong Liu <songliubraving@fb.com>
      483cbbed
    • Michal Hocko's avatar
      Revert "mm, memory_hotplug: initialize struct pages for the full memory section" · 4aa9fc2a
      Michal Hocko authored
      This reverts commit 2830bf6f.
      
      The underlying assumption that one sparse section belongs into a single
      numa node doesn't hold really. Robert Shteynfeld has reported a boot
      failure. The boot log was not captured but his memory layout is as
      follows:
      
        Early memory node ranges
          node   1: [mem 0x0000000000001000-0x0000000000090fff]
          node   1: [mem 0x0000000000100000-0x00000000dbdf8fff]
          node   1: [mem 0x0000000100000000-0x0000001423ffffff]
          node   0: [mem 0x0000001424000000-0x0000002023ffffff]
      
      This means that node0 starts in the middle of a memory section which is
      also in node1.  memmap_init_zone tries to initialize padding of a
      section even when it is outside of the given pfn range because there are
      code paths (e.g.  memory hotplug) which assume that the full worth of
      memory section is always initialized.
      
      In this particular case, though, such a range is already intialized and
      most likely already managed by the page allocator.  Scribbling over
      those pages corrupts the internal state and likely blows up when any of
      those pages gets used.
      Reported-by: default avatarRobert Shteynfeld <robert.shteynfeld@gmail.com>
      Fixes: 2830bf6f ("mm, memory_hotplug: initialize struct pages for the full memory section")
      Cc: stable@kernel.org
      Signed-off-by: default avatarMichal Hocko <mhocko@suse.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      4aa9fc2a
  10. 27 Jan, 2019 14 commits
    • Linus Torvalds's avatar
      Linux 5.0-rc4 · f17b5f06
      Linus Torvalds authored
      f17b5f06
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 8a5f0605
      Linus Torvalds authored
      Pull x86 fixes from Thomas Gleixner:
       "A set of fixes for x86:
      
         - Fix the swapped outb() parameters in the KASLR code
      
         - Fix the PKEY handling at fork which missed to preserve the pkey
           state for the child. Comes with a test case to validate that.
      
         - Fix the entry stack handling for XEN PV to respect that XEN PV
           systems enter the function already on the current thread stack and
           not on the trampoline.
      
         - Fix kexec load failure caused by using a stale value when the
           kexec_buf structure is reused for subsequent allocations.
      
         - Fix a bogus sizeof() in the memory encryption code
      
         - Enforce PCI dependency for the Intel Low Power Subsystem
      
         - Enforce PCI_LOCKLESS_CONFIG when PCI is enabled"
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/Kconfig: Select PCI_LOCKLESS_CONFIG if PCI is enabled
        x86/entry/64/compat: Fix stack switching for XEN PV
        x86/kexec: Fix a kexec_file_load() failure
        x86/mm/mem_encrypt: Fix erroneous sizeof()
        x86/selftests/pkeys: Fork() to check for state being preserved
        x86/pkeys: Properly copy pkey state at fork()
        x86/kaslr: Fix incorrect i8254 outb() parameters
        x86/intel/lpss: Make PCI dependency explicit
      8a5f0605
    • Linus Torvalds's avatar
      Merge branch 'x86-timers-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 351e1aa6
      Linus Torvalds authored
      Pull x86 timer fixes from Thomas Gleixner:
       "Two commits which were missed to be sent during the merge window.
      
         - The TSC calibration fix turns out to be more urgent as recent
           Skylake-X systems seem to have massive trouble with calibration
           disturbance. This should go back into stable for that reason and it
           the risk of breakage is rather low.
      
         - Drop an unused define"
      
      * 'x86-timers-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/hpet: Remove unused FSEC_PER_NSEC define
        x86/tsc: Make calibration refinement more robust
      351e1aa6
    • Linus Torvalds's avatar
      Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · f907bb4c
      Linus Torvalds authored
      Pull timer fix from Thomas Glexiner:
       "A single regression fix to address the unintended breakage of posix
        cpu timers.
      
        This is caused by a new sanity check in the common code, which fails
        for posix cpu timers under certain conditions because the posix cpu
        timer code never updates the variable which is checked"
      
      * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        posix-cpu-timers: Unbreak timer rearming
      f907bb4c
    • Linus Torvalds's avatar
      Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 98810518
      Linus Torvalds authored
      Pull locking fixes from Thomas Gleixner:
       "A small series of fixes which all address possible missed wakeups:
      
         - Document and fix the wakeup ordering of wake_q
      
         - Add the missing barrier in rcuwait_wake_up(), which was documented
           in the comment but missing in the code
      
         - Fix the possible missed wakeups in the rwsem and futex code"
      
      * 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        locking/rwsem: Fix (possible) missed wakeup
        futex: Fix (possible) missed wakeup
        sched/wake_q: Fix wakeup ordering for wake_q
        sched/wake_q: Document wake_q_add()
        sched/wait: Fix rcuwait_wake_up() ordering
      98810518
    • Linus Torvalds's avatar
      Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 0d484375
      Linus Torvalds authored
      Pull irq fixes from Thomas Gleixner:
       "A small set of fixes for the interrupt subsystem:
      
         - Fix a double increment in the irq descriptor allocator which
           resulted in a sanity check only being done for every second
           affinity mask
      
         - Add a missing device tree translation in the stm32-exti driver.
           Without that the interrupt association is completely wrong.
      
         - Initialize the mutex in the GIC-V3 MBI driver
      
         - Fix the alignment for aliasing devices in the GIC-V3-ITS driver so
           multi MSI allocations work correctly
      
         - Ensure that the initial affinity of a interrupt is not empty at
           startup time.
      
         - Drop bogus include in the madera irq chip driver
      
         - Fix KernelDoc regression"
      
      * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        irqchip/gic-v3-its: Align PCI Multi-MSI allocation on their size
        genirq/irqdesc: Fix double increment in alloc_descs()
        genirq: Fix the kerneldoc comment for struct irq_affinity_desc
        irqchip/madera: Drop GPIO includes
        irqchip/gic-v3-mbi: Fix uninitialized mbi_lock
        irqchip/stm32-exti: Add domain translate function
        genirq: Make sure the initial affinity is not empty
      0d484375
    • Linus Torvalds's avatar
      Merge tag 'edac_fix_for_5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp · 98354243
      Linus Torvalds authored
      Pull EDAC fix from Borislav Petkov:
       "Fix persistent register offsets of altera_edac, from Thor Thayer"
      
      * tag 'edac_fix_for_5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp:
        EDAC, altera: Fix S10 persistent register offset
      98354243
    • Linus Torvalds's avatar
      Merge tag 'for-linus-20190127' of git://git.kernel.dk/linux-block · 419967d5
      Linus Torvalds authored
      Pull block revert from Jens Axboe:
       "Silly error snuck into a patch from the last series, let's do a revert
        to avoid a potential use-after-free"
      
      * tag 'for-linus-20190127' of git://git.kernel.dk/linux-block:
        Revert "block: cover another queue enter recursion via BIO_QUEUE_ENTERED"
      419967d5
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 1fc7f56d
      Linus Torvalds authored
      Pull KVM fixes from Paolo Bonzini:
       "Quite a few fixes for x86: nested virtualization save/restore, AMD
        nested virtualization and virtual APIC, 32-bit fixes, an important fix
        to restore operation on older processors, and a bunch of hyper-v
        bugfixes. Several are marked stable.
      
        There are also fixes for GCC warnings and for a GCC/objtool interaction"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        KVM: x86: Mark expected switch fall-throughs
        KVM: x86: fix TRACE_INCLUDE_PATH and remove -I. header search paths
        KVM: selftests: check returned evmcs version range
        x86/kvm/hyper-v: nested_enable_evmcs() sets vmcs_version incorrectly
        KVM: VMX: Move vmx_vcpu_run()'s VM-Enter asm blob to a helper function
        kvm: selftests: Fix region overlap check in kvm_util
        kvm: vmx: fix some -Wmissing-prototypes warnings
        KVM: nSVM: clear events pending from svm_complete_interrupts() when exiting to L1
        svm: Fix AVIC incomplete IPI emulation
        svm: Add warning message for AVIC IPI invalid target
        KVM: x86: WARN_ONCE if sending a PV IPI returns a fatal error
        KVM: x86: Fix PV IPIs for 32-bit KVM host
        x86/kvm/hyper-v: recommend using eVMCS only when it is enabled
        x86/kvm/hyper-v: don't recommend doing reset via synthetic MSR
        kvm: x86/vmx: Use kzalloc for cached_vmcs12
        KVM: VMX: Use the correct field var when clearing VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL
        KVM: x86: Fix single-step debugging
        x86/kvm/hyper-v: don't announce GUEST IDLE MSR support
      1fc7f56d
    • Linus Torvalds's avatar
      Merge tag 'dma-mapping-5.0-2' of git://git.infradead.org/users/hch/dma-mapping · c180f1b0
      Linus Torvalds authored
      Pull dma-mapping fix from Christoph Hellwig:
       "Fix a xen-swiotlb regression on arm64"
      
      * tag 'dma-mapping-5.0-2' of git://git.infradead.org/users/hch/dma-mapping:
        arm64/xen: fix xen-swiotlb cache flushing
      c180f1b0
    • Linus Torvalds's avatar
      Merge tag 'libnvdimm-fixes-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm · 6a2651b5
      Linus Torvalds authored
      Pull libnvdimm fixes from Dan Williams:
       "A fix for namespace label support for non-Intel NVDIMMs that implement
        the ACPI standard label method.
      
        This has apparently never worked and could wait for v5.1. However it
        has enough visibility with hardware vendors [1] and distro bug
        trackers [2], and low enough risk that I decided it should go in for
        -rc4. The other fixups target the new, for v5.0, nvdimm security
        functionality. The larger init path fixup closes a memory leak and a
        potential userspace lockup due to missed notifications.
      
          [1] https://github.com/pmem/ndctl/issues/78
          [2] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1811785
      
        These have all soaked in -next for a week with no reported issues.
      
        Summary:
      
         - Fix support for NVDIMMs that implement the ACPI standard label
           methods.
      
         - Fix error handling for security overwrite (memory leak / userspace
           hang condition), and another one-line security cleanup"
      
      * tag 'libnvdimm-fixes-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
        acpi/nfit: Fix command-supported detection
        acpi/nfit: Block function zero DSMs
        libnvdimm/security: Require nvdimm_security_setup_events() to succeed
        nfit_test: fix security state pull for nvdimm security nfit_test
      6a2651b5
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input · 78e372e6
      Linus Torvalds authored
      Pull input fixes from Dmitry Torokhov:
       "A fixup for the input_event fix for y2038 Sparc64, and couple other
        minor fixes"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
        Input: input_event - fix the CONFIG_SPARC64 mixup
        Input: olpc_apsp - assign priv->dev earlier
        Input: uinput - fix undefined behavior in uinput_validate_absinfo()
        Input: raspberrypi-ts - fix link error
        Input: xpad - add support for SteelSeries Stratus Duo
        Input: input_event - provide override for sparc64
      78e372e6
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 037222ad
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Count ttl-dropped frames properly in mac80211, from Bob Copeland.
      
       2) Integer overflow in ktime handling of bcm can code, from Oliver
          Hartkopp.
      
       3) Fix RX desc handling wrt. hw checksumming in ravb, from Simon
          Horman.
      
       4) Various hash key fixes in hv_netvsc, from Haiyang Zhang.
      
       5) Use after free in ax25, from Eric Dumazet.
      
       6) Several fixes to the SSN support in SCTP, from Xin Long.
      
       7) Do not process frames after a NAPI reschedule in ibmveth, from
          Thomas Falcon.
      
       8) Fix NLA_POLICY_NESTED arguments, from Johannes Berg.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (42 commits)
        qed: Revert error handling changes.
        cfg80211: extend range deviation for DMG
        cfg80211: reg: remove warn_on for a normal case
        mac80211: Add attribute aligned(2) to struct 'action'
        mac80211: don't initiate TDLS connection if station is not associated to AP
        nl80211: fix NLA_POLICY_NESTED() arguments
        ibmveth: Do not process frames after calling napi_reschedule
        net: dev_is_mac_header_xmit() true for ARPHRD_RAWIP
        net: usb: asix: ax88772_bind return error when hw_reset fail
        MAINTAINERS: Update cavium networking drivers
        net/mlx4_core: Fix error handling when initializing CQ bufs in the driver
        net/mlx4_core: Add masking for a few queries on HCA caps
        sctp: set flow sport from saddr only when it's 0
        sctp: set chunk transport correctly when it's a new asoc
        sctp: improve the events for sctp stream adding
        sctp: improve the events for sctp stream reset
        ip_tunnel: Make none-tunnel-dst tunnel port work with lwtunnel
        ax25: fix possible use-after-free
        sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe
        hv_netvsc: fix typos in code comments
        ...
      037222ad
    • Jens Axboe's avatar
      Revert "block: cover another queue enter recursion via BIO_QUEUE_ENTERED" · 947b7ac1
      Jens Axboe authored
      We can't touch a bio after ->make_request_fn(), for all we know it could
      already have been completed by the time this function returns.
      
      This reverts commit 698cef17.
      
      Reported-by: syzbot+4df6ca820108fd248943@syzkaller.appspotmail.com
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      947b7ac1
  11. 26 Jan, 2019 3 commits
    • Linus Torvalds's avatar
      Merge tag '5.0-rc3-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 · 7c2614bf
      Linus Torvalds authored
      Pull smb3 fixes from Steve French:
       "A set of small smb3 fixes, some fixing various crediting issues
        discovered during xfstest runs, five for stable"
      
      * tag '5.0-rc3-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6:
        cifs: print CIFSMaxBufSize as part of /proc/fs/cifs/DebugData
        smb3: add credits we receive from oplock/break PDUs
        CIFS: Fix mounts if the client is low on credits
        CIFS: Do not assume one credit for async responses
        CIFS: Fix credit calculations in compound mid callback
        CIFS: Fix credit calculation for encrypted reads with errors
        CIFS: Fix credits calculations for reads with errors
        CIFS: Do not reconnect TCP session in add_credits()
        smb3: Cleanup license mess
        CIFS: Fix possible hang during async MTU reads and writes
        cifs: fix memory leak of an allocated cifs_ntsd structure
      7c2614bf
    • Linus Torvalds's avatar
      Merge tag 'vfio-v5.0-rc4' of git://github.com/awilliam/linux-vfio · 2580acb2
      Linus Torvalds authored
      Pull VFIO fixes from Alex Williamson:
      
       - cleanup licenses in new files (Thomas Gleixner)
      
       - cleanup new compiler warnings (Alexey Kardashevskiy)
      
      * tag 'vfio-v5.0-rc4' of git://github.com/awilliam/linux-vfio:
        vfio-pci/nvlink2: Fix ancient gcc warnings
        vfio/pci: Cleanup license mess
      2580acb2
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 7930851e
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "Six fixes, all of which appear to have user visible consequences.
      
        The DMA one is a regression fix from the merge window and of the
        others, four are driver specific and one specific to the target code"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: ufs: Use explicit access size in ufshcd_dump_regs
        scsi: tcmu: fix use after free
        scsi: csiostor: fix NULL pointer dereference in csio_vport_set_state()
        scsi: lpfc: nvmet: avoid hang / use-after-free when destroying targetport
        scsi: lpfc: nvme: avoid hang / use-after-free when destroying localport
        scsi: communicate max segment size to the DMA mapping code
      7930851e