1. 20 4月, 2017 4 次提交
    • C
      nsfs: mark dentry with DCACHE_RCUACCESS · 073c516f
      Cong Wang 提交于
      Andrey reported a use-after-free in __ns_get_path():
      
        spin_lock include/linux/spinlock.h:299 [inline]
        lockref_get_not_dead+0x19/0x80 lib/lockref.c:179
        __ns_get_path+0x197/0x860 fs/nsfs.c:66
        open_related_ns+0xda/0x200 fs/nsfs.c:143
        sock_ioctl+0x39d/0x440 net/socket.c:1001
        vfs_ioctl fs/ioctl.c:45 [inline]
        do_vfs_ioctl+0x1bf/0x1780 fs/ioctl.c:685
        SYSC_ioctl fs/ioctl.c:700 [inline]
        SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691
      
      We are under rcu read lock protection at that point:
      
              rcu_read_lock();
              d = atomic_long_read(&ns->stashed);
              if (!d)
                      goto slow;
              dentry = (struct dentry *)d;
              if (!lockref_get_not_dead(&dentry->d_lockref))
                      goto slow;
              rcu_read_unlock();
      
      but don't use a proper RCU API on the free path, therefore a parallel
      __d_free() could free it at the same time.  We need to mark the stashed
      dentry with DCACHE_RCUACCESS so that __d_free() will be called after all
      readers leave RCU.
      
      Fixes: e149ed2b ("take the targets of /proc/*/ns/* symlinks to separate fs")
      Cc: Alexander Viro <viro@zeniv.linux.org.uk>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Reported-by: NAndrey Konovalov <andreyknvl@google.com>
      Signed-off-by: NCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      073c516f
    • M
      mm: make mm_percpu_wq non freezable · 80d136e1
      Michal Hocko 提交于
      Geert has reported a freeze during PM resume and some additional
      debugging has shown that the device_resume worker cannot make a forward
      progress because it waits for an event which is stuck waiting in
      drain_all_pages:
      
        INFO: task kworker/u4:0:5 blocked for more than 120 seconds.
              Not tainted 4.11.0-rc7-koelsch-00029-g005882e5-dirty #3476
        "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
        kworker/u4:0    D    0     5      2 0x00000000
        Workqueue: events_unbound async_run_entry_fn
          __schedule
          schedule
          schedule_timeout
          wait_for_common
          dpm_wait_for_superior
          device_resume
          async_resume
          async_run_entry_fn
          process_one_work
          worker_thread
          kthread
        [...]
        bash            D    0  1703   1694 0x00000000
          __schedule
          schedule
          schedule_timeout
          wait_for_common
          flush_work
          drain_all_pages
          start_isolate_page_range
          alloc_contig_range
          cma_alloc
          __alloc_from_contiguous
          cma_allocator_alloc
          __dma_alloc
          arm_dma_alloc
          sh_eth_ring_init
          sh_eth_open
          sh_eth_resume
          dpm_run_callback
          device_resume
          dpm_resume
          dpm_resume_end
          suspend_devices_and_enter
          pm_suspend
          state_store
          kernfs_fop_write
          __vfs_write
          vfs_write
          SyS_write
        [...]
        Showing busy workqueues and worker pools:
        [...]
        workqueue mm_percpu_wq: flags=0xc
          pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=0/0
            delayed: drain_local_pages_wq, vmstat_update
          pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=0/0
            delayed: drain_local_pages_wq BAR(1703), vmstat_update
      
      Tetsuo has properly noted that mm_percpu_wq is created as WQ_FREEZABLE
      so it is frozen this early during resume so we are effectively
      deadlocked.  Fix this by dropping WQ_FREEZABLE when creating
      mm_percpu_wq.  We really want to have it operational all the time.
      
      Fixes: ce612879 ("mm: move pcp and lru-pcp draining into single wq")
      Reported-and-tested-by: NGeert Uytterhoeven <geert@linux-m68k.org>
      Debugged-by: NTetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
      Signed-off-by: NMichal Hocko <mhocko@suse.com>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      80d136e1
    • L
      Merge tag 'backlight-for-v4.11' of git://git.linaro.org/people/daniel.thompson/linux · c4bac97b
      Linus Torvalds 提交于
      Pull backlight fix from Daniel Thompson:
       "Normally pull requests for backlight come from Lee Jones (and will
        continue to do so) but the bug fixed here is annoying for few people
        so I'm providing a little holiday cover.
      
        Fix a single bug in the PWM backlight driver and make it play nice
        with a wider range of GPIO devices. This bug is a regression and was
        independently discovered by Geert Uytterhoevan and Paul Kocialkowski
        (and is tested by both)"
      
      * tag 'backlight-for-v4.11' of git://git.linaro.org/people/daniel.thompson/linux:
        backlight: pwm_bl: Fix GPIO out for unimplemented .get_direction()
      c4bac97b
    • G
      backlight: pwm_bl: Fix GPIO out for unimplemented .get_direction() · 892c7788
      Geert Uytterhoeven 提交于
      Commit 7613c922 ("backlight: pwm_bl: Move the checks for initial
      power state to a separate function") not just moved some code, but made
      slight changes in semantics.
      
      If a gpiochip doesn't implement the optional .get_direction() callback,
      gpiod_get_direction always returns -EINVAL, which is never equal to
      GPIOF_DIR_IN, leading to the GPIO not being configured for output.
      
      To avoid this, invert the test and check for not GPIOF_DIR_OUT instead,
      like the original code did.
      
      This restores the display on r8a7740/armadillo.
      
      Fixes: 7613c922 ("backlight: pwm_bl: Move the checks for initial power state to a separate function")
      Signed-off-by: NGeert Uytterhoeven <geert+renesas@glider.be>
      Reviewed-by: NPeter Ujfalusi <peter.ujfalusi@ti.com>
      Acked-by: NPhilipp Zabel <p.zabel@pengutronix.de>
      Acked-by: NDaniel Thompson <daniel.thompson@linaro.org>
      Signed-off-by: NDaniel Thompson <daniel.thompson@linaro.org>
      892c7788
  2. 19 4月, 2017 9 次提交
  3. 18 4月, 2017 14 次提交
    • L
      Merge branch 'parisc-4.11-5' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux · 20bb78f6
      Linus Torvalds 提交于
      Pull parisc fix from Helge Deller:
       "One patch which fixes get_user() for 64-bit values on 32-bit kernels.
      
        Up to now we lost the upper 32-bits of the returned 64-bit value"
      
      * 'parisc-4.11-5' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
        parisc: Fix get_user() for 64-bit value on 32-bit kernel
      20bb78f6
    • N
      ftrace: Fix function pid filter on instances · d879d0b8
      Namhyung Kim 提交于
      When function tracer has a pid filter, it adds a probe to sched_switch
      to track if current task can be ignored.  The probe checks the
      ftrace_ignore_pid from current tr to filter tasks.  But it misses to
      delete the probe when removing an instance so that it can cause a crash
      due to the invalid tr pointer (use-after-free).
      
      This is easily reproducible with the following:
      
        # cd /sys/kernel/debug/tracing
        # mkdir instances/buggy
        # echo $$ > instances/buggy/set_ftrace_pid
        # rmdir instances/buggy
      
        ============================================================================
        BUG: KASAN: use-after-free in ftrace_filter_pid_sched_switch_probe+0x3d/0x90
        Read of size 8 by task kworker/0:1/17
        CPU: 0 PID: 17 Comm: kworker/0:1 Tainted: G    B           4.11.0-rc3  #198
        Call Trace:
         dump_stack+0x68/0x9f
         kasan_object_err+0x21/0x70
         kasan_report.part.1+0x22b/0x500
         ? ftrace_filter_pid_sched_switch_probe+0x3d/0x90
         kasan_report+0x25/0x30
         __asan_load8+0x5e/0x70
         ftrace_filter_pid_sched_switch_probe+0x3d/0x90
         ? fpid_start+0x130/0x130
         __schedule+0x571/0xce0
         ...
      
      To fix it, use ftrace_clear_pids() to unregister the probe.  As
      instance_rmdir() already updated ftrace codes, it can just free the
      filter safely.
      
      Link: http://lkml.kernel.org/r/20170417024430.21194-2-namhyung@kernel.org
      
      Fixes: 0c8916c3 ("tracing: Add rmdir to remove multibuffer instances")
      Cc: Ingo Molnar <mingo@kernel.org>
      Cc: stable@vger.kernel.org
      Reviewed-by: NMasami Hiramatsu <mhiramat@kernel.org>
      Signed-off-by: NNamhyung Kim <namhyung@kernel.org>
      Signed-off-by: NSteven Rostedt (VMware) <rostedt@goodmis.org>
      d879d0b8
    • D
      Merge branch 'bpf-fixes' · acf167f3
      David S. Miller 提交于
      Daniel Borkmann says:
      
      ====================
      Two BPF fixes
      
      The set fixes cb_access and xdp_adjust_head bits in struct bpf_prog,
      that are used for requirement checks on the program rather than f.e.
      heuristics. Thus, for tail calls, we cannot make any assumptions and
      are forced to set them.
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      acf167f3
    • D
      bpf: fix checking xdp_adjust_head on tail calls · c2002f98
      Daniel Borkmann 提交于
      Commit 17bedab2 ("bpf: xdp: Allow head adjustment in XDP prog")
      added the xdp_adjust_head bit to the BPF prog in order to tell drivers
      that the program that is to be attached requires support for the XDP
      bpf_xdp_adjust_head() helper such that drivers not supporting this
      helper can reject the program. There are also drivers that do support
      the helper, but need to check for xdp_adjust_head bit in order to move
      packet metadata prepended by the firmware away for making headroom.
      
      For these cases, the current check for xdp_adjust_head bit is insufficient
      since there can be cases where the program itself does not use the
      bpf_xdp_adjust_head() helper, but tail calls into another program that
      uses bpf_xdp_adjust_head(). As such, the xdp_adjust_head bit is still
      set to 0. Since the first program has no control over which program it
      calls into, we need to assume that bpf_xdp_adjust_head() helper is used
      upon tail calls. Thus, for the very same reasons in cb_access, set the
      xdp_adjust_head bit to 1 when the main program uses tail calls.
      
      Fixes: 17bedab2 ("bpf: xdp: Allow head adjustment in XDP prog")
      Signed-off-by: NDaniel Borkmann <daniel@iogearbox.net>
      Acked-by: NAlexei Starovoitov <ast@kernel.org>
      Cc: Martin KaFai Lau <kafai@fb.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      c2002f98
    • D
      bpf: fix cb access in socket filter programs on tail calls · 6b1bb01b
      Daniel Borkmann 提交于
      Commit ff936a04 ("bpf: fix cb access in socket filter programs")
      added a fix for socket filter programs such that in i) AF_PACKET the
      20 bytes of skb->cb[] area gets zeroed before use in order to not leak
      data, and ii) socket filter programs attached to TCP/UDP sockets need
      to save/restore these 20 bytes since they are also used by protocol
      layers at that time.
      
      The problem is that bpf_prog_run_save_cb() and bpf_prog_run_clear_cb()
      only look at the actual attached program to determine whether to zero
      or save/restore the skb->cb[] parts. There can be cases where the
      actual attached program does not access the skb->cb[], but the program
      tail calls into another program which does access this area. In such
      a case, the zero or save/restore is currently not performed.
      
      Since the programs we tail call into are unknown at verification time
      and can dynamically change, we need to assume that whenever the attached
      program performs a tail call, that later programs could access the
      skb->cb[], and therefore we need to always set cb_access to 1.
      
      Fixes: ff936a04 ("bpf: fix cb access in socket filter programs")
      Signed-off-by: NDaniel Borkmann <daniel@iogearbox.net>
      Acked-by: NAlexei Starovoitov <ast@kernel.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      6b1bb01b
    • F
      ipv6: drop non loopback packets claiming to originate from ::1 · 0aa8c13e
      Florian Westphal 提交于
      We lack a saddr check for ::1. This causes security issues e.g. with acls
      permitting connections from ::1 because of assumption that these originate
      from local machine.
      
      Assuming a source address of ::1 is local seems reasonable.
      RFC4291 doesn't allow such a source address either, so drop such packets.
      Reported-by: NEric Dumazet <edumazet@google.com>
      Signed-off-by: NFlorian Westphal <fw@strlen.de>
      Acked-by: NEric Dumazet <edumazet@google.com>
      Acked-by: NHannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      0aa8c13e
    • D
      Merge branch 'mediatek-tx-bugs' · 71947f0f
      David S. Miller 提交于
      Sean Wang says:
      
      ====================
      mediatek: Fix crash caused by reporting inconsistent skb->len to BQL
      
      Changes since v1:
      - fix inconsistent enumeration which easily causes the potential bug
      
      The series fixes kernel BUG caused by inconsistent SKB length reported
      into BQL. The reason for inconsistent length comes from hardware BUG which
      results in different port number carried on the TXD within the lifecycle of
      SKB. So patch 2) is proposed for use a software way to track which port
      the SKB involving instead of hardware way. And patch 1) is given for another
      issue I found which causes TXD and SKB inconsistency that is not expected
      in the initial logic, so it is also being corrected it in the series.
      
      The log for the kernel BUG caused by the issue is posted as below.
      
      [  120.825955] kernel BUG at ... lib/dynamic_queue_limits.c:26!
      [  120.837684] Internal error: Oops - BUG: 0 [#1] SMP ARM
      [  120.842778] Modules linked in:
      [  120.845811] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.11.0-rc1-191576-gdbcef47 #35
      [  120.853488] Hardware name: Mediatek Cortex-A7 (Device Tree)
      [  120.859012] task: c1007480 task.stack: c1000000
      [  120.863510] PC is at dql_completed+0x108/0x17c
      [  120.867915] LR is at 0x46
      [  120.870512] pc : [<c03c19c8>]    lr : [<00000046>]    psr: 80000113
      [  120.870512] sp : c1001d58  ip : c1001d80  fp : c1001d7c
      [  120.881895] r10: 0000003e  r9 : df6b3400  r8 : 0ed86506
      [  120.887075] r7 : 00000001  r6 : 00000001  r5 : 0ed8654c  r4 : df0135d8
      [  120.893546] r3 : 00000001  r2 : df016800  r1 : 0000fece  r0 : df6b3480
      [  120.900018] Flags: Nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
      [  120.907093] Control: 10c5387d  Table: 9e27806a  DAC: 00000051
      [  120.912789] Process swapper/0 (pid: 0, stack limit = 0xc1000218)
      [  120.918744] Stack: (0xc1001d58 to 0xc1002000)
      
      ....
      
      121.085331] 1fc0: 00000000 c0a52a28 00000000 c10855d4 c1003c58 c0a52a24 c100885c 8000406a
      [  121.093444] 1fe0: 410fc073 00000000 00000000 c1001ff8 8000807c c0a009cc 00000000 00000000
      [  121.101575] [<c03c19c8>] (dql_completed) from [<c04cb010>] (mtk_napi_tx+0x1d0/0x37c)
      [  121.109263] [<c04cb010>] (mtk_napi_tx) from [<c05e28cc>] (net_rx_action+0x24c/0x3b8)
      [  121.116951] [<c05e28cc>] (net_rx_action) from [<c010152c>] (__do_softirq+0xe4/0x35c)
      [  121.124638] [<c010152c>] (__do_softirq) from [<c012a624>] (irq_exit+0xe8/0x150)
      [  121.131895] [<c012a624>] (irq_exit) from [<c017750c>] (__handle_domain_irq+0x70/0xc4)
      [  121.139666] [<c017750c>] (__handle_domain_irq) from [<c0101404>] (gic_handle_irq+0x58/0x9c)
      [  121.147953] [<c0101404>] (gic_handle_irq) from [<c010e18c>] (__irq_svc+0x6c/0x90)
      [  121.155373] Exception stack(0xc1001ef8 to 0xc1001f40)
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      71947f0f
    • S
      net: ethernet: mediatek: fix inconsistency of port number carried in TXD · 134d2152
      Sean Wang 提交于
      Fix port inconsistency on TXD due to hardware BUG that would cause
      different port number is carried on the same TXD between tx_map()
      and tx_unmap() with the iperf test. It would cause confusing BQL
      logic which leads to kernel panic when dual GMAC runs concurrently.
      Signed-off-by: NSean Wang <sean.wang@mediatek.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      134d2152
    • S
      net: ethernet: mediatek: fix inconsistency between TXD and the used buffer · 81d2dd09
      Sean Wang 提交于
      Fix inconsistency between the TXD descriptor and the used buffer that
      would cause unexpected logic at mtk_tx_unmap() during skb housekeeping.
      Signed-off-by: NSean Wang <sean.wang@mediatek.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      81d2dd09
    • G
      net: phy: micrel: fix crash when statistic requested for KSZ9031 phy · bfe72442
      Grygorii Strashko 提交于
      Now the command:
      	ethtool --phy-statistics eth0
      will cause system crash with meassage "Unable to handle kernel NULL pointer
      dereference at virtual address 00000010" from:
      
       (kszphy_get_stats) from [<c069f1d8>] (ethtool_get_phy_stats+0xd8/0x210)
       (ethtool_get_phy_stats) from [<c06a0738>] (dev_ethtool+0x5b8/0x228c)
       (dev_ethtool) from [<c06b5484>] (dev_ioctl+0x3fc/0x964)
       (dev_ioctl) from [<c0679f7c>] (sock_ioctl+0x170/0x2c0)
       (sock_ioctl) from [<c02419d4>] (do_vfs_ioctl+0xa8/0x95c)
       (do_vfs_ioctl) from [<c02422c4>] (SyS_ioctl+0x3c/0x64)
       (SyS_ioctl) from [<c0107d60>] (ret_fast_syscall+0x0/0x44)
      
      The reason: phy_driver structure for KSZ9031 phy has no .probe() callback
      defined. As result, struct phy_device *phydev->priv pointer will not be
      initializes (null).
      This issue will affect also following phys:
       KSZ8795, KSZ886X, KSZ8873MLL, KSZ9031, KSZ9021, KSZ8061, KS8737
      
      Fix it by:
      - adding .probe() = kszphy_probe() callback to KSZ9031, KSZ9021
      phys. The kszphy_probe() can be re-used as it doesn't do any phy specific
      settings.
      - removing statistic callbacks from other phys (KSZ8795, KSZ886X,
      KSZ8873MLL, KSZ8061, KS8737) as they doesn't have corresponding
      statistic counters.
      
      Fixes: 2b2427d0 ("phy: micrel: Add ethtool statistics counters")
      Signed-off-by: NGrygorii Strashko <grygorii.strashko@ti.com>
      Reviewed-by: NAndrew Lunn <andrew@lunn.ch>
      Reviewed-by: NFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      bfe72442
    • D
      net: vrf: Fix setting NLM_F_EXCL flag when adding l3mdev rule · 426c87ca
      David Ahern 提交于
      Only need 1 l3mdev FIB rule. Fix setting NLM_F_EXCL in the nlmsghdr.
      
      Fixes: 1aa6c4f6 ("net: vrf: Add l3mdev rules on first device create")
      Signed-off-by: NDavid Ahern <dsa@cumulusnetworks.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      426c87ca
    • G
      net: thunderx: Fix set_max_bgx_per_node for 81xx rgx · b47a57a2
      George Cherian 提交于
      Add the PCI_SUBSYS_DEVID_81XX_RGX and use the same to set
      the max bgx per node count.
      
      This fixes the issue intoduced by following commit
      78aacb6f net: thunderx: Fix invalid mac addresses for node1 interfaces
      With this commit the max_bgx_per_node for 81xx is set as 2 instead of 3
      because of which num_vfs is always calculated as zero.
      Signed-off-by: NGeorge Cherian <george.cherian@cavium.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      b47a57a2
    • W
      net-timestamp: avoid use-after-free in ip_recv_error · 1862d620
      Willem de Bruijn 提交于
      Syzkaller reported a use-after-free in ip_recv_error at line
      
          info->ipi_ifindex = skb->dev->ifindex;
      
      This function is called on dequeue from the error queue, at which
      point the device pointer may no longer be valid.
      
      Save ifindex on enqueue in __skb_complete_tx_timestamp, when the
      pointer is valid or NULL. Store it in temporary storage skb->cb.
      
      It is safe to reference skb->dev here, as called from device drivers
      or dev_queue_xmit. The exception is when called from tcp_ack_tstamp;
      in that case it is NULL and ifindex is set to 0 (invalid).
      
      Do not return a pktinfo cmsg if ifindex is 0. This maintains the
      current behavior of not returning a cmsg if skb->dev was NULL.
      
      On dequeue, the ipv4 path will cast from sock_exterr_skb to
      in_pktinfo. Both have ifindex as their first element, so no explicit
      conversion is needed. This is by design, introduced in commit
      0b922b7a ("net: original ingress device index in PKTINFO"). For
      ipv6 ip6_datagram_support_cmsg converts to in6_pktinfo.
      
      Fixes: 829ae9d6 ("net-timestamp: allow reading recv cmsg on errqueue with origin tstamp")
      Reported-by: NAndrey Konovalov <andreyknvl@google.com>
      Signed-off-by: NWillem de Bruijn <willemb@google.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      1862d620
    • W
      ipv4: fix a deadlock in ip_ra_control · 1215e51e
      WANG Cong 提交于
      Similar to commit 87e9f031
      ("ipv4: fix a potential deadlock in mcast getsockopt() path"),
      there is a deadlock scenario for IP_ROUTER_ALERT too:
      
             CPU0                    CPU1
             ----                    ----
        lock(rtnl_mutex);
                                     lock(sk_lock-AF_INET);
                                     lock(rtnl_mutex);
        lock(sk_lock-AF_INET);
      
      Fix this by always locking RTNL first on all setsockopt() paths.
      
      Note, after this patch ip_ra_lock is no longer needed either.
      Reported-by: NDmitry Vyukov <dvyukov@google.com>
      Tested-by: NAndrey Konovalov <andreyknvl@google.com>
      Signed-off-by: NCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      1215e51e
  4. 17 4月, 2017 8 次提交
    • B
      sfc: limit the number of receive queues · 271a8b42
      Bert Kenward 提交于
      The number of rx queues is determined by the rss_cpus parameter
      or the cpu topology. If that is higher than EFX_MAX_RX_QUEUES the
      driver can corrupt state.
      
      Fixes: 8ceee660 ("New driver "sfc" for Solarstorm SFC4000 controller.")
      Signed-off-by: NBert Kenward <bkenward@solarflare.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      271a8b42
    • L
      Linux 4.11-rc7 · 4f7d029b
      Linus Torvalds 提交于
      4f7d029b
    • L
      Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · 7395ca0f
      Linus Torvalds 提交于
      Pull ARM SoC fixes from Olof Johansson:
       "Again, a batch that's been sitting a couple of weeks, mostly because
        I anticipated a bit more material but it didn't show up -- which is
        good.
      
        These are all your garden variety fixes for ARM platforms.
      
        The most visible issue fixed here is probably the SMP reset issue on
        OMAP, the rest are minor stuff"
      
      * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
        arm64: allwinner: a64: add pmu0 regs for USB PHY
        ARM: OMAP2+: omap_device: Sync omap_device and pm_runtime after probe defer
        reset: add exported __reset_control_get, return NULL if optional
        ARM: orion5x: only call into phylib when available
        ARM: omap2+: Revert omap-smp.c changes resetting CPU1 during boot
        ARM: dts: am335x-evmsk: adjust mmc2 param to allow suspend
        ARM: dts: ti: fix PCI bus dtc warnings
        ARM: dts: am335x-baltos: disable EEE for Atheros 8035 PHY
        ARM: dts: OMAP3: Fix MFG ID EEPROM
        ARM: sun8i: a33: add operating-points-v2 property to all nodes
        ARM: sun8i: a33: remove highest OPP to fix CPU crashes
      7395ca0f
    • L
      Merge branch 'for-linus' of git://git.kernel.dk/linux-block · a86f106f
      Linus Torvalds 提交于
      Pull block fixes from Jens Axboe:
       "Four small fixes.
      
        Three of them fix the same error in NVMe, in loop, fc, and rdma
        respectively.  The last fix from Ming fixes a regression in this
        series, where our bvec gap logic was wrong and causes an oops on
        NVMe for certain conditions"
      
      * 'for-linus' of git://git.kernel.dk/linux-block:
        block: fix bio_will_gap() for first bvec with offset
        nvme-fc: Fix sqsize wrong assignment based on ctrl MQES capability
        nvme-rdma: Fix sqsize wrong assignment based on ctrl MQES capability
        nvme-loop: Fix sqsize wrong assignment based on ctrl MQES capability
      a86f106f
    • O
      Merge tag 'omap-for-v4.11/fixes-rc6-signed' of... · e2647b6d
      Olof Johansson 提交于
      Merge tag 'omap-for-v4.11/fixes-rc6-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes
      
      Regression fix for omap interconnect code for deferred probe.
      Without this fix we can get PM related warnings for devices that
      use deferred probe. If necessary, this fix can wait for the
      v4.12 merge window no problem.
      
      * tag 'omap-for-v4.11/fixes-rc6-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
        ARM: OMAP2+: omap_device: Sync omap_device and pm_runtime after probe defer
        ARM: omap2+: Revert omap-smp.c changes resetting CPU1 during boot
        ARM: dts: am335x-evmsk: adjust mmc2 param to allow suspend
        ARM: dts: ti: fix PCI bus dtc warnings
        ARM: dts: am335x-baltos: disable EEE for Atheros 8035 PHY
        ARM: dts: OMAP3: Fix MFG ID EEPROM
      Signed-off-by: NOlof Johansson <olof@lixom.net>
      e2647b6d
    • L
      Merge branch 'for-4.11-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup · 11c994d9
      Linus Torvalds 提交于
      Pull cgroup fix from Tejun Heo:
       "Unfortunately, the commit to fix the cgroup mount race in the previous
        pull request can lead to hangs.
      
        The original bug has been around for a while and isn't too likely to
        be triggered in usual use cases. Revert the commit for now"
      
      * 'for-4.11-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
        Revert "cgroup: avoid attaching a cgroup root to two different superblocks"
      11c994d9
    • L
      Merge tag 'tty-4.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · 032aaf3f
      Linus Torvalds 提交于
      Pull tty fix from Greg KH:
       "Here is a single tty core revert for a patch that was reported to
        cause problems.
      
        The original issue is one that we have lived with for decades, so
        trying to scramble to fix the fix in time for 4.11-final does not make
        sense due to the fragility of the tty ldisc layer. Just reverting it
        makes sense for now"
      
      * tag 'tty-4.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        Revert "tty: don't panic on OOM in tty_set_ldisc()"
      032aaf3f
    • L
      Merge tag 'trace-v4.11-rc5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · 48538861
      Linus Torvalds 提交于
      Pull ftrace fix from Steven Rostedt:
       "While rewriting the function probe code, I stumbled over a long
        standing bug. This bug has been there sinc function tracing was added
        way back when. But my new development depends on this bug being fixed,
        and it should be fixed regardless as it causes ftrace to disable
        itself when triggered, and a reboot is required to enable it again.
      
        The bug is that the function probe does not disable itself properly if
        there's another probe of its type still enabled. For example:
      
           # cd /sys/kernel/debug/tracing
           # echo schedule:traceoff > set_ftrace_filter
           # echo do_IRQ:traceoff > set_ftrace_filter
           # echo \!do_IRQ:traceoff > /debug/tracing/set_ftrace_filter
           # echo do_IRQ:traceoff > set_ftrace_filter
      
        The above registers two traceoff probes (one for schedule and one for
        do_IRQ, and then removes do_IRQ.
      
        But since there still exists one for schedule, it is not done
        properly. When adding do_IRQ back, the breakage in the accounting is
        noticed by the ftrace self tests, and it causes a warning and disables
        ftrace"
      
      * tag 'trace-v4.11-rc5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        ftrace: Fix removing of second function probe
      48538861
  5. 16 4月, 2017 5 次提交
    • T
      Revert "cgroup: avoid attaching a cgroup root to two different superblocks" · 330c4186
      Tejun Heo 提交于
      This reverts commit bfb0b80d.
      
      Andrei reports CRIU test hangs with the patch applied.  The bug fixed
      by the patch isn't too likely to trigger in actual uses.  Revert the
      patch for now.
      Signed-off-by: NTejun Heo <tj@kernel.org>
      Reported-by: NAndrei Vagin <avagin@virtuozzo.com>
      Link: http://lkml.kernel.org/r/20170414232737.GC20350@outlook.office365.com
      330c4186
    • H
      parisc: Fix get_user() for 64-bit value on 32-bit kernel · 3f795cef
      Helge Deller 提交于
      This fixes a bug in which the upper 32-bits of a 64-bit value which is
      read by get_user() was lost on a 32-bit kernel.
      While touching this code, split out pre-loading of %sr2 space register
      and clean up code indent.
      
      Cc: <stable@vger.kernel.org> # v4.9+
      Signed-off-by: NHelge Deller <deller@gmx.de>
      3f795cef
    • L
      Merge branch 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm · d5ff0814
      Linus Torvalds 提交于
      Pull nvdimm fixes from Dan Williams:
       "A small crop of lockdep, sleeping while atomic, and other fixes /
        band-aids in advance of the full-blown reworks targeting the next
        merge window. The largest change here is "libnvdimm: fix blk free
        space accounting" which deletes a pile of buggy code that better
        testing would have caught before merging. The next change that is
        borderline too big for a late rc is switching the device-dax locking
        from rcu to srcu, I couldn't think of a smaller way to make that fix.
      
        The __copy_user_nocache fix will have a full replacement in 4.12 to
        move those pmem special case considerations into the pmem driver. The
        "libnvdimm: band aid btt vs clear poison locking" commit admits that
        our error clearing support for btt went in broken, so we just disable
        it in 4.11 and -stable. A replacement / full fix is in the pipeline
        for 4.12
      
        Some of these would have been caught earlier had DEBUG_ATOMIC_SLEEP
        been enabled on my development station. I wonder if we should have:
      
            config DEBUG_ATOMIC_SLEEP
              default PROVE_LOCKING
      
        ...since I mistakenly thought I got both with PROVE_LOCKING=y.
      
        These have received a build success notification from the 0day robot,
        and some have appeared in a -next release with no reported issues"
      
      * 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
        x86, pmem: fix broken __copy_user_nocache cache-bypass assumptions
        device-dax: switch to srcu, fix rcu_read_lock() vs pte allocation
        libnvdimm: band aid btt vs clear poison locking
        libnvdimm: fix reconfig_mutex, mmap_sem, and jbd2_handle lockdep splat
        libnvdimm: fix blk free space accounting
        acpi, nfit, libnvdimm: fix interleave set cookie calculation (64-bit comparison)
      d5ff0814
    • L
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 403a39f8
      Linus Torvalds 提交于
      Pull SCSI fixes from James Bottomley:
       "This is seven small fixes which are all for user visible issues that
        fortunately only occur in rare circumstances.
      
        The most serious is the sr one in which QEMU can cause us to read
        beyond the end of a buffer (I don't think it's exploitable, but just
        in case).
      
        The next is the sd capacity fix which means all non 512 byte sector
        drives greater than 2TB fail to be correctly sized.
      
        The rest are either in new drivers (qedf) or on error legs"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: ipr: do not set DID_PASSTHROUGH on CHECK CONDITION
        scsi: aacraid: fix PCI error recovery path
        scsi: sd: Fix capacity calculation with 32-bit sector_t
        scsi: qla2xxx: Add fix to read correct register value for ISP82xx.
        scsi: qedf: Fix crash due to unsolicited FIP VLAN response.
        scsi: sr: Sanity check returned mode data
        scsi: sd: Consider max_xfer_blocks if opt_xfer_blocks is unusable
      403a39f8
    • L
      Merge branch 'parisc-4.11-4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux · be84a46c
      Linus Torvalds 提交于
      Pull parisc fix from Helge Deller:
       "Mikulas Patocka fixed a few bugs in our new pa_memcpy() assembler
        function, e.g. one bug made the kernel unbootable if source and
        destination address are the same"
      
      * 'parisc-4.11-4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
        parisc: fix bugs in pa_memcpy
      be84a46c