1. 10 Feb, 2017 3 commits
  2. 09 Feb, 2017 9 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending · 55aac6ef
      Linus Torvalds authored
      Pull SCSI target fixes from Nicholas Bellinger:
       "This target series for v4.10 contains fixes which address a few
        long-standing bugs that DATERA's QA + automation teams have uncovered
        while putting v4.1.y target code into production usage.
      
        We've been running the top three in our nightly automated regression
        runs for the last two months, and the COMPARE_AND_WRITE fix Mr. Gary
        Guo has been manually verifying against a four node ESX cluster this
        past week.
      
        Note all of them have CC' stable tags.
      
        Summary:
      
         - Fix a bug with ESX EXTENDED_COPY + SAM_STAT_RESERVATION_CONFLICT
           status, where target_core_xcopy.c logic was incorrectly returning
           SAM_STAT_CHECK_CONDITION for all non SAM_STAT_GOOD cases (Nixon
           Vincent)
      
         - Fix a TMR LUN_RESET hung task bug while other in-flight TMRs are
           being aborted, before the new one had been dispatched into tmr_wq
           (Rob Millner)
      
         - Fix a long standing double free OOPs, where a dynamically generated
           'demo-mode' NodeACL has multiple sessions associated with it, and
           the /sys/kernel/config/target/$FABRIC/$WWN/ subsequently disables
           demo-mode, but never converts the dynamic ACL into a explicit ACL
           (Rob Millner)
      
         - Fix a long standing reference leak with ESX VAAI COMPARE_AND_WRITE
           when the second phase WRITE COMMIT command fails, resulting in
           CHECK_CONDITION response never being sent and se_cmd->cmd_kref
           never reaching zero (Gary Guo)
      
        Beyond these items on v4.1.y we've reproduced, fixed, and run through
        our regression test suite using iscsi-target exports, there are two
        additional outstanding list items:
      
         - Remove a >= v4.2 RCU conversion BUG_ON that would trigger when
           dynamic node NodeACLs where being converted to explicit NodeACLs.
           The patch drops the BUG_ON to follow how pre RCU conversion worked
           for this special case (Benjamin Estrabaud)
      
         - Add ibmvscsis target_core_fabric_ops->max_data_sg_nent assignment
           to match what IBM's Virtual SCSI hypervisor is already enforcing at
           transport layer. (Bryant Ly + Steven Royer)"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
        ibmvscsis: Add SGL limit
        target: Fix COMPARE_AND_WRITE ref leak for non GOOD status
        target: Fix multi-session dynamic se_node_acl double free OOPs
        target: Fix early transport_generic_handle_tmr abort scenario
        target: Use correct SCSI status during EXTENDED_COPY exception
        target: Don't BUG_ON during NodeACL dynamic -> explicit conversion
      55aac6ef
    • Linus Torvalds's avatar
      Merge tag 'pstore-v4.10-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux · 2b369478
      Linus Torvalds authored
      Pull pstore fix from Kees Cook:
       "Fix pstore regression (boot Oops) when ftrace disabled, from Brian
        Norris"
      
      * tag 'pstore-v4.10-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
        pstore: don't OOPS when there are no ftrace zones
      2b369478
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input · 99378fd2
      Linus Torvalds authored
      Pull input fixes from Dmitry Torokhov:
       "A fix for a crash in uinput, and a fix for build errors when HID-RMI
        is built-in but SERIO is a module"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
        Input: synaptics-rmi4 - select 'SERIO' when needed
        Input: uinput - fix crash when mixing old and new init style
      99378fd2
    • Brian Norris's avatar
      pstore: don't OOPS when there are no ftrace zones · 8672aed7
      Brian Norris authored
      We'll OOPS in ramoops_get_next_prz() if the platform didn't ask for any
      ftrace zones (i.e., cxt->fprzs will be NULL). Let's just skip this
      entire FTRACE section if there's no 'fprzs'.
      
      Regression seen on a coreboot/depthcharge-based Chromebook.
      
      Fixes: 2fbea82b ("pstore: Merge per-CPU ftrace records into one")
      Cc: Joel Fernandes <joelaf@google.com>
      Cc: Kees Cook <keescook@chromium.org>
      Signed-off-by: default avatarBrian Norris <briannorris@chromium.org>
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      8672aed7
    • Linus Torvalds's avatar
      Merge tag 'vfio-v4.10-final' of git://github.com/awilliam/linux-vfio · 189addce
      Linus Torvalds authored
      Pull VFIO fix from Alex Williamson:
       "Fix regression in attaching groups to existing container for SPAPR
        IOMMU backend (Alexey Kardashevskiy)"
      
      * tag 'vfio-v4.10-final' of git://github.com/awilliam/linux-vfio:
        vfio/spapr_tce: Set window when adding additional groups to container
      189addce
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm · 59e8f10a
      Linus Torvalds authored
      Pull ARM fixes from Russell King:
       "A couple more fixes for 4.10:
      
         - fix addressing the short regset write issue (Dave Martin)
      
         - fix for LPAE systems which leave a pending imprecise data abort
           before entering the kernel (Alexander Sverdlin)"
      
      * 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm:
        ARM: 8643/3: arm/ptrace: Preserve previous registers for short regset write
        ARM: 8642/1: LPAE: catch pending imprecise abort on unmask
      59e8f10a
    • Linus Torvalds's avatar
      Revert "x86/ioapic: Restore IO-APIC irq_chip retrigger callback" · d966564f
      Linus Torvalds authored
      This reverts commit 020eb3da.
      
      Gabriel C reports that it causes his machine to not boot, and we haven't
      tracked down the reason for it yet.  Since the bug it fixes has been
      around for a longish time, we're better off reverting the fix for now.
      
      Gabriel says:
       "It hangs early and freezes with a lot RCU warnings.
      
        I bisected it down to :
      
        > Ruslan Ruslichenko (1):
        >       x86/ioapic: Restore IO-APIC irq_chip retrigger callback
      
        Reverting this one fixes the problem for me..
      
        The box is a PRIMERGY TX200 S5 , 2 socket , 2 x E5520 CPU(s) installed"
      
      and Ruslan and Thomas are currently stumped.
      Reported-and-bisected-by: default avatarGabriel C <nix.or.die@gmail.com>
      Cc: Ruslan Ruslichenko <rruslich@cisco.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: stable@kernel.org   # for the backport of the original commit
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      d966564f
    • David Daney's avatar
      Revert "hwrng: core - zeroize buffers with random data" · 3b802c94
      David Daney authored
      This reverts commit 2cc75154.
      
      With this commit in place I get on a Cavium ThunderX (arm64) system:
      
      $ if=/dev/hwrng bs=256 count=1 | od -t x1 -A x -v > rng-bad.txt
      1+0 records in
      1+0 records out
      256 bytes (256 B) copied, 9.1171e-05 s, 2.8 MB/s
      $ dd if=/dev/hwrng bs=256 count=1 | od -t x1 -A x -v >> rng-bad.txt
      1+0 records in
      1+0 records out
      256 bytes (256 B) copied, 9.6141e-05 s, 2.7 MB/s
      $ cat rng-bad.txt
      000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      000050 00 00 00 00 37 20 46 ae d0 fc 1c 55 25 6e b0 b8
      000060 7c 7e d7 d4 00 0f 6f b2 91 1e 30 a8 fa 3e 52 0e
      000070 06 2d 53 30 be a1 20 0f aa 56 6e 0e 44 6e f4 35
      000080 b7 6a fe d2 52 70 7e 58 56 02 41 ea d1 9c 6a 6a
      000090 d1 bd d8 4c da 35 45 ef 89 55 fc 59 d5 cd 57 ba
      0000a0 4e 3e 02 1c 12 76 43 37 23 e1 9f 7a 9f 9e 99 24
      0000b0 47 b2 de e3 79 85 f6 55 7e ad 76 13 4f a0 b5 41
      0000c0 c6 92 42 01 d9 12 de 8f b4 7b 6e ae d7 24 fc 65
      0000d0 4d af 0a aa 36 d9 17 8d 0e 8b 7a 3b b6 5f 96 47
      0000e0 46 f7 d8 ce 0b e8 3e c6 13 a6 2c b6 d6 cc 17 26
      0000f0 e3 c3 17 8e 9e 45 56 1e 41 ef 29 1a a8 65 c8 3a
      000100
      000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      000050 00 00 00 00 f4 90 65 aa 8b f2 5e 31 01 53 b4 d4
      000060 06 c0 23 a2 99 3d 01 e4 b0 c1 b1 55 0f 80 63 cf
      000070 33 24 d8 3a 1d 5e cd 2c ba c0 d0 18 6f bc 97 46
      000080 1e 19 51 b1 90 15 af 80 5e d1 08 0d eb b0 6c ab
      000090 6a b4 fe 62 37 c5 e1 ee 93 c3 58 78 91 2a d5 23
      0000a0 63 50 eb 1f 3b 84 35 18 cf b2 a4 b8 46 69 9e cf
      0000b0 0c 95 af 03 51 45 a8 42 f1 64 c9 55 fc 69 76 63
      0000c0 98 9d 82 fa 76 85 24 da 80 07 29 fe 4e 76 0c 61
      0000d0 ff 23 94 4f c8 5c ce 0b 50 e8 31 bc 9d ce f4 ca
      0000e0 be ca 28 da e6 fa cc 64 1c ec a8 41 db fe 42 bd
      0000f0 a0 e2 4b 32 b4 52 ba 03 70 8e c1 8e d0 50 3a c6
      000100
      
      To my untrained mental entropy detector, the first several bytes of
      each read from /dev/hwrng seem to not be very random (i.e. all zero).
      
      When I revert the patch (apply this patch), I get back to what we have
      in v4.9, which looks like (much more random appearing):
      
      $ dd if=/dev/hwrng bs=256 count=1 | od -t x1 -A x -v > rng-good.txt
      1+0 records in
      1+0 records out
      256 bytes (256 B) copied, 0.000252233 s, 1.0 MB/s
      $ dd if=/dev/hwrng bs=256 count=1 | od -t x1 -A x -v >> rng-good.txt
      1+0 records in
      1+0 records out
      256 bytes (256 B) copied, 0.000113571 s, 2.3 MB/s
      $ cat rng-good.txt
      000000 75 d1 2d 19 68 1f d2 26 a1 49 22 61 66 e8 09 e5
      000010 e0 4e 10 d0 1a 2c 45 5d 59 04 79 8e e2 b7 2c 2e
      000020 e8 ad da 34 d5 56 51 3d 58 29 c7 7a 8e ed 22 67
      000030 f9 25 b9 fb c6 b7 9c 35 1f 84 21 35 c1 1d 48 34
      000040 45 7c f6 f1 57 63 1a 88 38 e8 81 f0 a9 63 ad 0e
      000050 be 5d 3e 74 2e 4e cb 36 c2 01 a8 14 e1 38 e1 bb
      000060 23 79 09 56 77 19 ff 98 e8 44 f3 27 eb 6e 0a cb
      000070 c9 36 e3 2a 96 13 07 a0 90 3f 3b bd 1d 04 1d 67
      000080 be 33 14 f8 02 c2 a4 02 ab 8b 5b 74 86 17 f0 5e
      000090 a1 d7 aa ef a6 21 7b 93 d1 85 86 eb 4e 8c d0 4c
      0000a0 56 ac e4 45 27 44 84 9f 71 db 36 b9 f7 47 d7 b3
      0000b0 f2 9c 62 41 a3 46 2b 5b e3 80 63 a4 35 b5 3c f4
      0000c0 bc 1e 3a ad e4 59 4a 98 6c e8 8d ff 1b 16 f8 52
      0000d0 05 5c 2f 52 2a 0f 45 5b 51 fb 93 97 a4 49 4f 06
      0000e0 f3 a0 d1 1e ba 3d ed a7 60 8f bb 84 2c 21 94 2d
      0000f0 b3 66 a6 61 1e 58 30 24 85 f8 c8 18 c3 77 00 22
      000100
      000000 73 ca cc a1 d9 bb 21 8d c3 5c f3 ab 43 6d a7 a4
      000010 4a fd c5 f4 9c ba 4a 0f b1 2e 19 15 4e 84 26 e0
      000020 67 c9 f2 52 4d 65 1f 81 b7 8b 6d 2b 56 7b 99 75
      000030 2e cd d0 db 08 0c 4b df f3 83 c6 83 00 2e 2b b8
      000040 0f af 61 1d f2 02 35 74 b5 a4 6f 28 f3 a1 09 12
      000050 f2 53 b5 d2 da 45 01 e5 12 d6 46 f8 0b db ed 51
      000060 7b f4 0d 54 e0 63 ea 22 e2 1d d0 d6 d0 e7 7e e0
      000070 93 91 fb 87 95 43 41 28 de 3d 8b a3 a8 8f c4 9e
      000080 30 95 12 7a b2 27 28 ff 37 04 2e 09 7c dd 7c 12
      000090 e1 50 60 fb 6d 5f a8 65 14 40 89 e3 4c d2 87 8f
      0000a0 34 76 7e 66 7a 8e 6b a3 fc cf 38 52 2e f9 26 f0
      0000b0 98 63 15 06 34 99 b2 88 4f aa d8 14 88 71 f1 81
      0000c0 be 51 11 2b f4 7e a0 1e 12 b2 44 2e f6 8d 84 ea
      0000d0 63 82 2b 66 b3 9a fd 08 73 5a c2 cc ab 5a af b1
      0000e0 88 e3 a6 80 4b fc db ed 71 e0 ae c0 0a a4 8c 35
      0000f0 eb 89 f9 8a 4b 52 59 6f 09 7c 01 3f 56 e7 c7 bf
      000100
      Signed-off-by: default avatarDavid Daney <david.daney@cavium.com>
      Acked-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      3b802c94
    • Linus Torvalds's avatar
      Merge branch 'akpm' (patches from Andrew) · 507053d2
      Linus Torvalds authored
      Merge fixes from Andrew Morton:
       "4 fixes"
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>:
        mm/slub.c: fix random_seq offset destruction
        cpumask: use nr_cpumask_bits for parsing functions
        mm: avoid returning VM_FAULT_RETRY from ->page_mkwrite handlers
        kernel/ucount.c: mark user_header with kmemleak_ignore()
      507053d2
  3. 08 Feb, 2017 24 commits
  4. 07 Feb, 2017 4 commits
    • Arnd Bergmann's avatar
      Input: synaptics-rmi4 - select 'SERIO' when needed · 413d3732
      Arnd Bergmann authored
      With CONFIG_SERIO=m, we get a build error for the rmi4-f03 driver,
      added in linux-4.10:
      
      warning: (HID_RMI) selects RMI4_F03 which has unmet direct dependencies (!UML && INPUT && RMI4_CORE && (SERIO=y || RMI4_CORE=SERIO))
      drivers/input/built-in.o: In function `rmi_f03_attention':
      rmi_f03.c:(.text+0xcfe0): undefined reference to `serio_interrupt'
      rmi_f03.c:(.text+0xd055): undefined reference to `serio_interrupt'
      drivers/input/built-in.o: In function `rmi_f03_remove':
      rmi_f03.c:(.text+0xd115): undefined reference to `serio_unregister_port'
      drivers/input/built-in.o: In function `rmi_f03_probe':
      rmi_f03.c:(.text+0xd209): undefined reference to `__serio_register_port'
      
      An earlier patch tried to fix this, but missed the HID_RMI driver that
      does a 'select' on the F03 backend.
      
      This adds a hidden Kconfig symbol that enforces 'serio' to be enabled
      when RMI4-F03 is, which covers all cases.
      
      Fixes: d7ddad0a ("Input: synaptics-rmi4 - fix F03 build error when serio is module")
      Fixes: c5e8848f ("Input: synaptics-rmi4 - add support for F03")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      413d3732
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 926af627
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Load correct firmware in rtl8192ce wireless driver, from Jurij
          Smakov.
      
       2) Fix leak of tx_ring and tx_cq due to overwriting in mlx4 driver,
          from Martin KaFai Lau.
      
       3) Need to reference count PHY driver module when it is attached, from
          Mao Wenan.
      
       4) Don't do zero length vzalloc() in ethtool register dump, from
          Stanislaw Gruszka.
      
       5) Defer net_disable_timestamp() to a workqueue to get out of locking
          issues, from Eric Dumazet.
      
       6) We cannot drop the SKB dst when IP options refer to them, fix also
          from Eric Dumazet.
      
       7) Incorrect packet header offset calculations in ip6_gre, again from
          Eric Dumazet.
      
       8) Missing tcp_v6_restore_cb() causes use-after-free, from Eric too.
      
       9) tcp_splice_read() can get into an infinite loop with URG, and hey
          it's from Eric once more.
      
      10) vnet_hdr_sz can change asynchronously, so read it once during
          decision making in macvtap and tun, from Willem de Bruijn.
      
      11) Can't use kernel stack for DMA transfers in USB networking drivers,
          from Ben Hutchings.
      
      12) Handle csum errors properly in UDP by calling the proper destructor,
          from Eric Dumazet.
      
      13) For non-deterministic softirq run when scheduling NAPI from a
          workqueue in mlx4, from Benjamin Poirier.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (28 commits)
        sctp: check af before verify address in sctp_addr_id2transport
        sctp: avoid BUG_ON on sctp_wait_for_sndbuf
        mlx4: Invoke softirqs after napi_reschedule
        udp: properly cope with csum errors
        catc: Use heap buffer for memory size test
        catc: Combine failure cleanup code in catc_probe()
        rtl8150: Use heap buffers for all register access
        pegasus: Use heap buffers for all register access
        macvtap: read vnet_hdr_size once
        tun: read vnet_hdr_sz once
        tcp: avoid infinite loop in tcp_splice_read()
        hns: avoid stack overflow with CONFIG_KASAN
        ipv6: Fix IPv6 packet loss in scenarios involving roaming + snooping switches
        ipv6: tcp: add a missing tcp_v6_restore_cb()
        nl80211: Fix mesh HT operation check
        mac80211: Fix adding of mesh vendor IEs
        mac80211: Allocate a sync skcipher explicitly for FILS AEAD
        mac80211: Fix FILS AEAD protection in Association Request frame
        ip6_gre: fix ip6gre_err() invalid reads
        netlabel: out of bound access in cipso_v4_validate()
        ...
      926af627
    • Hugh Dickins's avatar
      mm: fix KPF_SWAPCACHE in /proc/kpageflags · b6789123
      Hugh Dickins authored
      Commit 6326fec1 ("mm: Use owner_priv bit for PageSwapCache, valid
      when PageSwapBacked") aliased PG_swapcache to PG_owner_priv_1 (and
      depending on PageSwapBacked being true).
      
      As a result, the KPF_SWAPCACHE bit in '/proc/kpageflags' should now be
      synthesized, instead of being shown on unrelated pages which just happen
      to have PG_owner_priv_1 set.
      Signed-off-by: default avatarHugh Dickins <hughd@google.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Nicholas Piggin <npiggin@gmail.com>
      Cc: Wu Fengguang <fengguang.wu@intel.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b6789123
    • Xin Long's avatar
      sctp: check af before verify address in sctp_addr_id2transport · 912964ea
      Xin Long authored
      Commit 6f29a130 ("sctp: sctp_addr_id2transport should verify the
      addr before looking up assoc") invoked sctp_verify_addr to verify the
      addr.
      
      But it didn't check af variable beforehand, once users pass an address
      with family = 0 through sockopt, sctp_get_af_specific will return NULL
      and NULL pointer dereference will be caused by af->sockaddr_len.
      
      This patch is to fix it by returning NULL if af variable is NULL.
      
      Fixes: 6f29a130 ("sctp: sctp_addr_id2transport should verify the addr before looking up assoc")
      Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
      Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      912964ea