1. 01 8月, 2018 3 次提交
    • L
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · c1d61e7f
      Linus Torvalds 提交于
      Pull SCSI fixes from James Bottomley:
       "Nine fixes, five in the qla2xxx driver, the most serious of which is
        the uninitialized list head crash which can be observed in most
        systems under a sufficiently loaded low memory environment.
      
        The two sg fixes are minor but obvious and two target ones which seem
        reasonable but not high impact"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: qla2xxx: Return error when TMF returns
        scsi: qla2xxx: Fix ISP recovery on unload
        scsi: qla2xxx: Fix driver unload by shutting down chip
        scsi: qla2xxx: Fix NPIV deletion by calling wait_for_sess_deletion
        scsi: qla2xxx: Fix unintialized List head crash
        scsi: sg: update comment for blk_get_request()
        scsi: sg: fix minor memory leak in error path
        scsi: libiscsi: fix possible NULL pointer dereference in case of TMF
        scsi: target: iscsi: cxgbit: fix max iso npdu calculation
      c1d61e7f
    • L
      Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost · 095c3633
      Linus Torvalds 提交于
      Pull virtio fixes from Michael Tsirkin:
       "Some bugfixes that seem important and safe enough to merge at the last
        minute"
      
      * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
        virtio_balloon: fix another race between migration and ballooning
        tools/virtio: add kmalloc_array stub
        tools/virtio: add dma barrier stubs
      095c3633
    • L
      Merge tag 'acpi-urgent-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · c786e405
      Linus Torvalds 提交于
      Pull ACPI fixes from Rafael Wysocki:
       "These fix a recent ACPICA regression affecting control method
        execution at the table level and an earlier hibernation regression in
        the ACPI driver for Intel SoCs (LPSS) that was missed by a previous
        fix in this cycle.
      
        Specifics:
      
         - Fix a recent ACPICA regression introduced by a previous fix that
           caused control method execution at the table level to be mishandled
           by mistake (Erik Schmauss).
      
         - Fix a hibernation regression from the 4.15 cycle in the ACPI driver
           for Intel SoCs (LPSS) that caused the platform firmware to be
           confused during resume from hibernation by the driver's PM quirks
           which was fixed for system-wide suspend/resume (ACPI S3) earlier in
           this cycle, but that previous fix missed the hibernation (ACPI S4)
           case (Rafael Wysocki)"
      
      * tag 'acpi-urgent-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        ACPICA: AML Parser: ignore control method status in module-level code
        ACPI / LPSS: Avoid PM quirks on suspend and resume from hibernation
      c786e405
  2. 31 7月, 2018 16 次提交
  3. 30 7月, 2018 9 次提交
    • J
      virtio_balloon: fix another race between migration and ballooning · 89da619b
      Jiang Biao 提交于
      Kernel panic when with high memory pressure, calltrace looks like,
      
      PID: 21439 TASK: ffff881be3afedd0 CPU: 16 COMMAND: "java"
       #0 [ffff881ec7ed7630] machine_kexec at ffffffff81059beb
       #1 [ffff881ec7ed7690] __crash_kexec at ffffffff81105942
       #2 [ffff881ec7ed7760] crash_kexec at ffffffff81105a30
       #3 [ffff881ec7ed7778] oops_end at ffffffff816902c8
       #4 [ffff881ec7ed77a0] no_context at ffffffff8167ff46
       #5 [ffff881ec7ed77f0] __bad_area_nosemaphore at ffffffff8167ffdc
       #6 [ffff881ec7ed7838] __node_set at ffffffff81680300
       #7 [ffff881ec7ed7860] __do_page_fault at ffffffff8169320f
       #8 [ffff881ec7ed78c0] do_page_fault at ffffffff816932b5
       #9 [ffff881ec7ed78f0] page_fault at ffffffff8168f4c8
          [exception RIP: _raw_spin_lock_irqsave+47]
          RIP: ffffffff8168edef RSP: ffff881ec7ed79a8 RFLAGS: 00010046
          RAX: 0000000000000246 RBX: ffffea0019740d00 RCX: ffff881ec7ed7fd8
          RDX: 0000000000020000 RSI: 0000000000000016 RDI: 0000000000000008
          RBP: ffff881ec7ed79a8 R8: 0000000000000246 R9: 000000000001a098
          R10: ffff88107ffda000 R11: 0000000000000000 R12: 0000000000000000
          R13: 0000000000000008 R14: ffff881ec7ed7a80 R15: ffff881be3afedd0
          ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
      
      It happens in the pagefault and results in double pagefault
      during compacting pages when memory allocation fails.
      
      Analysed the vmcore, the page leads to second pagefault is corrupted
      with _mapcount=-256, but private=0.
      
      It's caused by the race between migration and ballooning, and lock
      missing in virtballoon_migratepage() of virtio_balloon driver.
      This patch fix the bug.
      
      Fixes: e2250429 ("virtio_balloon: introduce migration primitives to balloon pages")
      Cc: stable@vger.kernel.org
      Signed-off-by: NJiang Biao <jiang.biao2@zte.com.cn>
      Signed-off-by: NHuang Chong <huang.chong@zte.com.cn>
      Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
      89da619b
    • A
      can: ems_usb: Fix memory leak on ems_usb_disconnect() · 72c05f32
      Anton Vasilyev 提交于
      ems_usb_probe() allocates memory for dev->tx_msg_buffer, but there
      is no its deallocation in ems_usb_disconnect().
      
      Found by Linux Driver Verification project (linuxtesting.org).
      Signed-off-by: NAnton Vasilyev <vasilyev@ispras.ru>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NMarc Kleine-Budde <mkl@pengutronix.de>
      72c05f32
    • L
      Linux 4.18-rc7 · acb18725
      Linus Torvalds 提交于
      acb18725
    • J
      openvswitch: meter: Fix setting meter id for new entries · 25432eba
      Justin Pettit 提交于
      The meter code would create an entry for each new meter.  However, it
      would not set the meter id in the new entry, so every meter would appear
      to have a meter id of zero.  This commit properly sets the meter id when
      adding the entry.
      
      Fixes: 96fbc13d ("openvswitch: Add meter infrastructure")
      Signed-off-by: NJustin Pettit <jpettit@ovn.org>
      Cc: Andy Zhou <azhou@ovn.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      25432eba
    • L
      Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 · 3cfb6772
      Linus Torvalds 提交于
      Pull ext4 fixes from Ted Ts'o:
       "Some miscellaneous ext4 fixes for 4.18; one fix is for a regression
        introduced in 4.18-rc4.
      
        Sorry for the late-breaking pull. I was originally going to wait for
        the next merge window, but Eric Whitney found a regression introduced
        in 4.18-rc4, so I decided to push out the regression plus the other
        fixes now. (The other commits have been baking in linux-next since
        early July)"
      
      * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
        ext4: fix check to prevent initializing reserved inodes
        ext4: check for allocation block validity with block group locked
        ext4: fix inline data updates with checksums enabled
        ext4: clear mmp sequence number when remounting read-only
        ext4: fix false negatives *and* false positives in ext4_check_descriptors()
      3cfb6772
    • D
      netlink: Do not subscribe to non-existent groups · 7acf9d42
      Dmitry Safonov 提交于
      Make ABI more strict about subscribing to group > ngroups.
      Code doesn't check for that and it looks bogus.
      (one can subscribe to non-existing group)
      Still, it's possible to bind() to all possible groups with (-1)
      
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Herbert Xu <herbert@gondor.apana.org.au>
      Cc: Steffen Klassert <steffen.klassert@secunet.com>
      Cc: netdev@vger.kernel.org
      Signed-off-by: NDmitry Safonov <dima@arista.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      7acf9d42
    • L
      squashfs: be more careful about metadata corruption · 01cfb793
      Linus Torvalds 提交于
      Anatoly Trosinenko reports that a corrupted squashfs image can cause a
      kernel oops.  It turns out that squashfs can end up being confused about
      negative fragment lengths.
      
      The regular squashfs_read_data() does check for negative lengths, but
      squashfs_read_metadata() did not, and the fragment size code just
      blindly trusted the on-disk value.  Fix both the fragment parsing and
      the metadata reading code.
      Reported-by: NAnatoly Trosinenko <anatoly.trosinenko@gmail.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: Phillip Lougher <phillip@squashfs.org.uk>
      Cc: stable@kernel.org
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      01cfb793
    • T
      ext4: fix check to prevent initializing reserved inodes · 50122847
      Theodore Ts'o 提交于
      Commit 8844618d: "ext4: only look at the bg_flags field if it is
      valid" will complain if block group zero does not have the
      EXT4_BG_INODE_ZEROED flag set.  Unfortunately, this is not correct,
      since a freshly created file system has this flag cleared.  It gets
      almost immediately after the file system is mounted read-write --- but
      the following somewhat unlikely sequence will end up triggering a
      false positive report of a corrupted file system:
      
         mkfs.ext4 /dev/vdc
         mount -o ro /dev/vdc /vdc
         mount -o remount,rw /dev/vdc
      
      Instead, when initializing the inode table for block group zero, test
      to make sure that itable_unused count is not too large, since that is
      the case that will result in some or all of the reserved inodes
      getting cleared.
      
      This fixes the failures reported by Eric Whiteney when running
      generic/230 and generic/231 in the the nojournal test case.
      
      Fixes: 8844618d ("ext4: only look at the bg_flags field if it is valid")
      Reported-by: NEric Whitney <enwlinux@gmail.com>
      Signed-off-by: NTheodore Ts'o <tytso@mit.edu>
      50122847
    • E
      NET: stmmac: align DMA stuff to largest cache line length · 9939a46d
      Eugeniy Paltsev 提交于
      As for today STMMAC_ALIGN macro (which is used to align DMA stuff)
      relies on L1 line length (L1_CACHE_BYTES).
      This isn't correct in case of system with several cache levels
      which might have L1 cache line length smaller than L2 line. This
      can lead to sharing one cache line between DMA buffer and other
      data, so we can lose this data while invalidate DMA buffer before
      DMA transaction.
      
      Fix that by using SMP_CACHE_BYTES instead of L1_CACHE_BYTES for
      aligning.
      Signed-off-by: NEugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      9939a46d
  4. 29 7月, 2018 12 次提交