[PATCH 4.9 56/83] ext4: avoid potential extra brelse in setup_new_flex_group_blocks()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Vasily Averin commit 9e4028935cca3f9ef9b6a90df9da6f1f94853536 upstream. Currently bh is set to NULL only during first iteration of for cycle, then this pointer is not cleared after end of using

[PATCH 4.9 30/83] MIPS: Loongson-3: Fix BRIDGE irq delivery problem

4.9-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit 360fe725f8849aaddc53475fef5d4a0c439b05ae ] After commit e509bd7da149dc349160 ("genirq: Allow migration of chained interrupts by installing default action") Loongson-3 fails at here:

[PATCH 4.9 58/83] ext4: avoid buffer leak in ext4_orphan_add() after prior errors

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Vasily Averin commit feaf264ce7f8d54582e2f66eb82dd9dd124c94f3 upstream. Fixes: d745a8c20c1f ("ext4: reduce contention on s_orphan_lock") Fixes: 6e3617e579e0 ("ext4: Handle non empty on-disk orp

[PATCH 4.9 48/83] termios, tty/tty_baudrate.c: fix buffer overrun

4.9-stable review patch. If anyone has any objections, please let me know. -- From: H. Peter Anvin commit 991a25194097006ec1e0d2e0814ff920e59e3465 upstream. On architectures with CBAUDEX == 0 (Alpha and PowerPC), the code in tty_baudrate.c does not do any limit checking on th

[PATCH 4.9 53/83] ext4: add missing brelse() update_backups()s error path

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Vasily Averin commit ea0abbb648452cdb6e1734b702b6330a7448fcf8 upstream. Fixes: ac27a0ec112a ("ext4: initial copy of files from ext3") Signed-off-by: Vasily Averin Signed-off-by: Theodore Ts'o

[PATCH 4.9 55/83] ext4: add missing brelse() add_new_gdb_meta_bg()s error path

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Vasily Averin commit 61a9c11e5e7a0dab5381afa5d9d4dd5ebf18f7a0 upstream. Fixes: 01f795f9e0d6 ("ext4: add online resizing support for meta_bg ...") Signed-off-by: Vasily Averin Signed-off-by: Th

[PATCH 4.9 47/83] of, numa: Validate some distance map rules

4.9-stable review patch. If anyone has any objections, please let me know. -- From: John Garry commit 89c38422e072bb453e3045b8f1b962a344c3edea upstream. Currently the NUMA distance map parsing does not validate the distance table for the distance-matrix rules 1-2 in [1]. Howe

[PATCH 4.9 61/83] ext4: fix possible leak of sbi->s_group_desc_leak in error path

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Theodore Ts'o commit 9e463084cdb22e0b56b2dfbc50461020409a5fd3 upstream. Fixes: bfe0a5f47ada ("ext4: add more mount time checks of the superblock") Reported-by: Vasily Averin Signed-off-by: The

[PATCH 4.9 60/83] ext4: avoid possible double brelse() in add_new_gdb() on error path

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Theodore Ts'o commit 4f32c38b4662312dd3c5f113d8bdd459887fb773 upstream. Fixes: b40971426a83 ("ext4: add error checking to calls to ...") Reported-by: Vasily Averin Signed-off-by: Theodore Ts'o

[PATCH 4.9 62/83] ext4: fix possible leak of s_journal_flag_rwsem in error path

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Vasily Averin commit af18e35bfd01e6d65a5e3ef84ffe8b252d1628c5 upstream. Fixes: c8585c6fcaf2 ("ext4: fix races between changing inode journal ...") Signed-off-by: Vasily Averin Signed-off-by: T

[PATCH 4.9 65/83] ext4: fix buffer leak in __ext4_read_dirblock() on error path

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Vasily Averin commit de59fae0043f07de5d25e02ca360f7d57bfa5866 upstream. Fixes: dc6982ff4db1 ("ext4: refactor code to read directory blocks ...") Signed-off-by: Vasily Averin Signed-off-by: The

[PATCH 4.9 73/83] fuse: fix leaked notify reply

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Miklos Szeredi commit 7fabaf303458fcabb694999d6fa772cc13d4e217 upstream. fuse_request_send_notify_reply() may fail if the connection was reset for some reason (e.g. fs was unmounted). Don't le

[PATCH 4.9 74/83] configfs: replace strncpy with memcpy

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Guenter Roeck commit 1823342a1f2b47a4e6f5667f67cd28ab6bc4d6cd upstream. gcc 8.1.0 complains: fs/configfs/symlink.c:67:3: warning: 'strncpy' output truncated before terminating nul copy

[PATCH 4.9 76/83] hugetlbfs: fix kernel BUG at fs/hugetlbfs/inode.c:444!

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Mike Kravetz commit 5e41540c8a0f0e98c337dda8b391e5dda0cde7cf upstream. This bug has been experienced several times by the Oracle DB team. The BUG is in remove_inode_hugepages() as follows:

[PATCH 4.9 33/83] xtensa: fix boot parameters address translation

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Max Filippov commit 40dc948f234b73497c3278875eb08a01d5854d3f upstream. The bootloader may pass physical address of the boot parameters structure to the MMUv3 kernel in the register a2. Code in

[PATCH 4.9 80/83] drm/i915/hdmi: Add HDMI 2.0 audio clock recovery N values

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Clint Taylor commit 6503493145cba4413ecd3d4d153faeef4a1e9b85 upstream. HDMI 2.0 594Mhz modes were incorrectly selecting 25.200Mhz Automatic N value mode instead of HDMI specification values. V

[PATCH 4.9 68/83] mount: Prevent MNT_DETACH from disconnecting locked mounts

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Eric W. Biederman commit 9c8e0a1b683525464a2abe9fb4b54404a50ed2b4 upstream. Timothy Baldwin wrote: > As per mount_namespaces(7) unprivileged users should not be able to look > under mount poi

[PATCH 4.9 67/83] mount: Dont allow copying MNT_UNBINDABLE|MNT_LOCKED mounts

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Eric W. Biederman commit df7342b240185d58d3d9665c0bbf0a0f5570ec29 upstream. Jonathan Calmels from NVIDIA reported that he's able to bypass the mount visibility security check in place in the Li

[PATCH 4.9 71/83] rtc: hctosys: Add missing range error reporting

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Maciej W. Rozycki commit 7ce9a992ffde8ce93d5ae5767362a5c7389ae895 upstream. Fix an issue with the 32-bit range error path in `rtc_hctosys' where no error code is set and consequently the succes

[PATCH 4.9 83/83] ovl: check whiteout in ovl_create_over_whiteout()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Miklos Szeredi commit 5e1275808630ea3b2c97c776f40e475017535f72 upstream. Kaixuxia repors that it's possible to crash overlayfs by removing the whiteout on the upper layer before creating a dire

[PATCH 4.9 37/83] libceph: bump CEPH_MSG_MAX_DATA_LEN

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Ilya Dryomov commit 94e6992bb560be8bffb47f287194adf070b57695 upstream. If the read is large enough, we end up spinning in the messenger: libceph: osd0 192.168.122.1:6801 io error libceph:

[PATCH 4.9 28/83] parisc: Fix exported address of os_hpmc handler

4.9-stable review patch. If anyone has any objections, please let me know. -- [ Upstream commit 99a3ae51d557d8e38a7aece65678a31f9db215ee ] In the C-code we need to put the physical address of the hpmc handler in the interrupt vector table (IVA) in order to get HPMCs working. Si

[PATCH 4.9 81/83] drm/i915/execlists: Force write serialisation into context image vs execution

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Chris Wilson commit 0a823e8fd4fd67726697854578f3584ee3a49b1d upstream. Ensure that the writes into the context image are completed prior to the register mmio to trigger execution. Although prev

[PATCH 4.9 72/83] fuse: fix use-after-free in fuse_direct_IO()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Lukas Czerner commit ebacb81273599555a7a19f7754a1451206a5fc4f upstream. In async IO blocking case the additional reference to the io is taken for it to survive fuse_aio_complete(). In non block

[PATCH 4.9 82/83] KVM: arm64: Fix caching of host MDCR_EL2 value

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Mark Rutland commit da5a3ce66b8bb51b0ea8a89f42aac153903f90fb upstream. At boot time, KVM stashes the host MDCR_EL2 value, but only does this when the kernel is not running in hyp mode (i.e. is

[PATCH 4.9 34/83] clk: s2mps11: Fix matching when built as module and DT node contains compatible

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Krzysztof Kozlowski commit 8985167ecf57f97061599a155bb9652c84ea4913 upstream. When driver is built as module and DT node contains clocks compatible (e.g. "samsung,s2mps11-clk"), the module will

[PATCH 4.9 75/83] lib/ubsan.c: dont mark __ubsan_handle_builtin_unreachable as noreturn

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann commit 1c23b4108d716cc848b38532063a8aca4f86add8 upstream. gcc-8 complains about the prototype for this function: lib/ubsan.c:432:1: error: ignoring attribute 'noreturn' in decl

[PATCH 4.9 35/83] clk: at91: Fix division by zero in PLL recalc_rate()

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Ronald Wahl commit 0f5cb0e6225cae2f029944cb8c74617aab6ddd49 upstream. Commit a982e45dc150 ("clk: at91: PLL recalc_rate() now using cached MUL and DIV values") removed a check that prevents a di

[PATCH 4.9 79/83] drm/dp_mst: Check if primary mstb is null

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Stanislav Lisovskiy commit 23d8003907d094f77cf959228e2248d6db819fa7 upstream. Unfortunately drm_dp_get_mst_branch_device which is called from both drm_dp_mst_handle_down_rep and drm_dp_mst_hand

[PATCH 4.9 70/83] nfsd: COPY and CLONE operations require the saved filehandle to be set

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Scott Mayhew commit 01310bb7c9c98752cc763b36532fab028e0f8f81 upstream. Make sure we have a saved filehandle, otherwise we'll oops with a null pointer dereference in nfs4_preprocess_stateid_op()

[PATCH 4.9 66/83] mount: Retest MNT_LOCKED in do_umount

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Eric W. Biederman commit 25d202ed820ee347edec0bf3bf553544556bf64b upstream. It was recently pointed out that the one instance of testing MNT_LOCKED outside of the namespace_sem is in ksys_umoun

[PATCH 4.9 32/83] xtensa: make sure bFLT stack is 16 byte aligned

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Max Filippov commit 0773495b1f5f1c5e23551843f87b5ff37e7af8f7 upstream. Xtensa ABI requires stack alignment to be at least 16. In noMMU configuration ARCH_SLAB_MINALIGN is used to align stack. M

[PATCH 4.9 78/83] drm/rockchip: Allow driver to be shutdown on reboot/kexec

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Marc Zyngier commit 7f3ef5dedb146e3d5063b6845781ad1bb59b92b5 upstream. Leaving the DRM driver enabled on reboot or kexec has the annoying effect of leaving the display generating transactions w

[PATCH 4.9 77/83] mm: migration: fix migration of huge PMD shared pages

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Mike Kravetz commit 017b1660df89f5fb4bfe66c34e35f7d2031100c7 upstream. The page migration code employs try_to_unmap() to try and unmap the source page. This is accomplished by using rmap_walk

[PATCH 4.9 69/83] sunrpc: correct the computation for page_ptr when truncating

4.9-stable review patch. If anyone has any objections, please let me know. -- From: Frank Sorenson commit 5d7a5bcb67c70cbc904057ef52d3fcfeb24420bb upstream. When truncating the encode buffer, the page_ptr is getting advanced, causing the next page to be skipped while encoding.

[PATCH 4.4 001/160] bcache: fix miss key refill->end in writeback

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Tang Junhui commit 2d6cb6edd2c7fb4f40998895bda45006281b1ac5 upstream. refill->end record the last key of writeback, for example, at the first time, keys (1,128K) to (1,1024K) are flush to the b

[PATCH 4.4 011/160] x86/kconfig: Fall back to ticket spinlocks

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Daniel Wagner Sebastian writes: """ We reproducibly observe cache line starvation on a Core2Duo E6850 (2 cores), a i5-6400 SKL (4 cores) and on a NXP LS2044A ARM Cortex-A72 (4 cores). The prob

[PATCH 4.4 012/160] sparc: Fix single-pcr perf event counter management.

4.4-stable review patch. If anyone has any objections, please let me know. -- From: "David S. Miller" [ Upstream commit cfdc3170d214046b9509183fe9b9544dc644d40b ] It is important to clear the hw->state value for non-stopped events when they are added into the PMU. Otherwise w

[PATCH 4.4 013/160] x86/fpu: Remove second definition of fpu in __fpu__restore_sig()

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Sebastian Andrzej Siewior [ Upstream commit 6aa676761d4c1acfa31320e55fa1f83f3fcbbc7a ] Commit: c5bedc6847c3b ("x86/fpu: Get rid of PF_USED_MATH usage, convert it to fpu->fpstate_active") i

[PATCH 4.4 010/160] x86/corruption-check: Fix panic in memory_corruption_check() when boot option without value is provided

4.4-stable review patch. If anyone has any objections, please let me know. -- From: He Zhe commit ccde460b9ae5c2bd5e4742af0a7f623c2daad566 upstream. memory_corruption_check[{_period|_size}]()'s handlers do not check input argument before passing it to kstrtoul() or simple_strt

[PATCH 4.4 015/160] selftests: ftrace: Add synthetic event syntax testcase

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Masami Hiramatsu [ Upstream commit ba0e41ca81b935b958006c7120466e2217357827 ] Add a testcase to check the syntax and field types for synthetic_events interface. Link: http://lkml.kernel.org/r

[PATCH 4.4 002/160] hwmon: (pmbus) Fix page count auto-detection.

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Dmitry Bazhenov commit e7c6a55606b5c46b449d76588968b4d8caae903f upstream. Devices with compatible="pmbus" field have zero initial page count, and pmbus_clear_faults() being called before the pa

[PATCH 4.4 021/160] perf tools: Cleanup trace-event-info tdata leak

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Sanskriti Sharma [ Upstream commit faedbf3fd19f2511a39397f76359e4cc6ee93072 ] Free tracing_data structure in tracing_data_get() error paths. Fixes the following coverity complaint: Error: R

[PATCH 4.4 022/160] mmc: sdhci-pci-o2micro: Add quirk for O2 Micro dev 0x8620 rev 0x01

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Yu Zhao [ Upstream commit 5169894982bb67486d93cc1e10151712bb86bcb6 ] This device reports SDHCI_CLOCK_INT_STABLE even though it's not ready to take SDHCI_CLOCK_CARD_EN. The symptom is that readi

[PATCH 4.4 016/160] locking/lockdep: Fix debug_locks off performance problem

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Waiman Long [ Upstream commit 9506a7425b094d2f1d9c877ed5a78f416669269b ] It was found that when debug_locks was turned off because of a problem found by the lockdep code, the system performance

Re: [PATCH 0/2] PCI/AER: Consistently use _OSC to determine who owns AER

On Mon, Nov 19, 2018 at 11:53:05AM -0500, Tyler Baicar wrote: > On Thu, Nov 15, 2018 at 8:49 PM Sinan Kaya wrote: > > > > On 11/15/2018 3:16 PM, Alexandru Gagniuc wrote: > > > I've asked around a few people at Dell and they unanimously agree that > > > _OSC is the correct way to determine ownershi

[PATCH 4.4 003/160] jffs2: free jffs2_sb_info through jffs2_kill_sb()

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Hou Tao commit 92e2921f7eee63450a5f953f4b15dc6210219430 upstream. When an invalid mount option is passed to jffs2, jffs2_parse_options() will fail and jffs2_sb_info will be freed, but then jffs

[PATCH 4.4 017/160] ataflop: fix error handling during setup

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Omar Sandoval [ Upstream commit 71327f547ee3a46ec5c39fdbbd268401b2578d0e ] Move queue allocation next to disk allocation to fix a couple of issues: - If add_disk() hasn't been called, we shoul

[PATCH 4.4 014/160] net: qla3xxx: Remove overflowing shift statement

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Nathan Chancellor [ Upstream commit 8c3bf9b62b667456a57aefcf1689e826df146159 ] Clang currently warns: drivers/net/ethernet/qlogic/qla3xxx.c:384:24: warning: signed shift result (0xF) r

[PATCH 4.4 020/160] perf tools: Free temporary sys string in read_event_files()

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Sanskriti Sharma [ Upstream commit 1e44224fb0528b4c0cc176bde2bb31e9127eb14b ] For each system in a given pevent, read_event_files() reads in a temporary 'sys' string. Be sure to free this stri

[PATCH 4.4 019/160] tun: Consistently configure generic netdev params via rtnetlink

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Serhey Popovych [ Upstream commit df52eab23d703142c766ac00bdb8db19d71238d0 ] Configuring generic network device parameters on tun will fail in presence of IFLA_INFO_KIND attribute in IFLA_LINKI

[PATCH 4.4 039/160] uio: ensure class is registered before devices

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Alexandre Belloni [ Upstream commit ae61cf5b9913027c6953a79ed3894da4f47061bd ] When both uio and the uio drivers are built in the kernel, it is possible for a driver to register devices before

[PATCH 4.4 006/160] parisc: Fix address in HPMC IVA

4.4-stable review patch. If anyone has any objections, please let me know. -- From: John David Anglin commit 1138b6718ff74d2a934459643e3754423d23b5e2 upstream. Helge noticed that the address of the os_hpmc handler was not being correctly calculated in the hpmc macro. As a res

[PATCH 4.4 037/160] usb: chipidea: Prevent unbalanced IRQ disable

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Loic Poulain [ Upstream commit 8b97d73c4d72a2abf58f8e49062a7ee1e5f1334e ] The ChipIdea IRQ is disabled before scheduling the otg work and re-enabled on otg work completion. However if the job i

[PATCH 4.4 007/160] parisc: Fix map_pages() to not overwrite existing pte entries

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Helge Deller commit 3c229b3f2dd8133f61bb81d3cb018be92f4bba39 upstream. Fix a long-existing small nasty bug in the map_pages() implementation which leads to overwriting already written pte entri

[PATCH 4.4 000/160] 4.4.164-stable review

This is the start of the stable review cycle for the 4.4.164 release. There are 160 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed Nov 21 16:25:20 UTC 2018. Anything recei

[PATCH 4.4 038/160] driver/dma/ioat: Call del_timer_sync() without holding prep_lock

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Waiman Long [ Upstream commit cfb03be6c7e8a1591285849c361d67b09f5149f7 ] The following lockdep splat was observed: [ 1222.241750] == [ 1222.

[PATCH 4.4 005/160] ipmi: Fix timer race with module unload

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Jan Glauber commit 0711e8c1b4572d076264e71b0002d223f2666ed7 upstream. Please note that below oops is from an older kernel, but the same race seems to be present in the upstream kernel too. ---

[PATCH 4.4 004/160] pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Maciej S. Szmigiero commit 95691e3eddc41da2d1cd3cca51fecdfb46bd85bc upstream. Currently, "disable_clkrun" yenta_socket module parameter is only implemented for TI CardBus bridges. Add also an i

[PATCH 4.4 008/160] ALSA: hda - Add mic quirk for the Lenovo G50-30 (17aa:3905)

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Jeremy Cline commit e7bb6ad5685f05685dd8a6a5eda7bfcd14d5f95b upstream. The Lenovo G50-30, like other G50 models, has a Conexant codec that requires a quirk for its inverted stereo dmic. Bugzil

[PATCH 4.4 034/160] tpm: suppress transmit cmd error logs when TPM 1.2 is disabled/deactivated

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Javier Martinez Canillas [ Upstream commit 0d6d0d62d9505a9816716aa484ebd0b04c795063 ] For TPM 1.2 chips the system setup utility allows to set the TPM device in one of the following states:

[PATCH 4.4 009/160] ALSA: ca0106: Disable IZD on SB0570 DAC to fix audio pops

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Alex Stanoev commit ac237c28d5ac1b241d58b1b7b4b9fa10efb22fb5 upstream. The Creative Audigy SE (SB0570) card currently exhibits an audible pop whenever playback is stopped or resumed, or during

[PATCH 4.4 035/160] ext4: fix argument checking in EXT4_IOC_MOVE_EXT

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Theodore Ts'o [ Upstream commit f18b2b83a727a3db208308057d2c7945f368e625 ] If the starting block number of either the source or destination file exceeds the EOF, EXT4_IOC_MOVE_EXT should return

[PATCH 4.4 033/160] scsi: megaraid_sas: fix a missing-check bug

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Wenwen Wang [ Upstream commit 47db7873136a9c57c45390a53b57019cf73c8259 ] In megasas_mgmt_compat_ioctl_fw(), to handle the structure compat_megasas_iocpacket 'cioc', a user-space structure megas

[PATCH 4.4 024/160] x86: boot: Fix EFI stub alignment

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Ben Hutchings [ Upstream commit 9c1442a9d039a1a3302fa93e9a11001c5f23b624 ] We currently align the end of the compressed image to a multiple of 16. However, the PE-COFF header included in the E

[PATCH 4.4 046/160] xen: fix race in xen_qlock_wait()

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Juergen Gross commit 2ac2a7d4d9ff4e01e36f9c3d116582f6f655ab47 upstream. In the following situation a vcpu waiting for a lock might not be woken up from xen_poll_irq(): CPU 1:CP

[PATCH 4.4 051/160] gfs2_meta: ->mount() can get NULL dev_name

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Al Viro commit 3df629d873f8683af6f0d34dfc743f637966d483 upstream. get in sync with mount_bdev() handling of the same Reported-by: syzbot+c54f8e94e6bba03b0...@syzkaller.appspotmail.com Cc: sta.

[PATCH 4.4 025/160] pinctrl: qcom: spmi-mpp: Fix err handling of pmic_mpp_set_mux

4.4-stable review patch. If anyone has any objections, please let me know. -- From: YueHaibing [ Upstream commit 69f8455f6cc78fa6cdf80d0105d7a748106271dc ] 'ret' should be returned while pmic_mpp_write_mode_ctl fails. Fixes: 0e948042c420 ("pinctrl: qcom: spmi-mpp: Implement s

[PATCH 4.4 043/160] ALSA: hda: Check the non-cached stream buffers more explicitly

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Takashi Iwai [ Upstream commit 78c9be61c3a5cd9e2439fd27a5ffad73a81958c7 ] Introduce a new flag, uc_buffer, to indicate that the controller requires the non-cached pages for stream buffers, eith

[PATCH 4.4 040/160] scsi: lpfc: Correct soft lockup when running mds diagnostics

4.4-stable review patch. If anyone has any objections, please let me know. -- From: James Smart [ Upstream commit 0ef01a2d95fd62bb4f536e7ce4d5e8e74b97a244 ] When running an mds diagnostic that passes frames with the switch, soft lockups are detected. The driver is in a CQE pro

[PATCH 4.4 041/160] signal: Always deliver the kernels SIGKILL and SIGSTOP to a pid namespace init

4.4-stable review patch. If anyone has any objections, please let me know. -- From: "Eric W. Biederman" [ Upstream commit 3597dfe01d12f570bc739da67f857fd222a3ea66 ] Instead of playing whack-a-mole and changing SEND_SIG_PRIV to SEND_SIG_FORCED throughout the kernel to ensure a

[PATCH 4.4 050/160] jbd2: fix use after free in jbd2_log_do_checkpoint()

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Jan Kara commit ccd3c4373eacb044eb3832966299d13d2631f66f upstream. The code cleaning transaction's lists of checkpoint buffers has a bug where it increases bh refcount only after releasing jour

[PATCH 4.4 042/160] dmaengine: dma-jz4780: Return error if not probed from DT

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Paul Cercueil [ Upstream commit 54f919a04cf221bc1601d1193682d4379dacacbd ] The driver calls clk_get() with the clock name set to NULL, which means that the driver could only work when probed fr

[PATCH 4.4 044/160] xen-swiotlb: use actually allocated size on check physical continuous

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Joe Jin commit 7250f422da0480d8512b756640f131b9b893ccda upstream. xen_swiotlb_{alloc,free}_coherent() allocate/free memory based on the order of the pages and not size argument (bytes). This is

[PATCH 4.4 047/160] xen: make xen_qlock_wait() nestable

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Juergen Gross commit a856531951dc8094359dfdac21d59cee5969c18e upstream. xen_qlock_wait() isn't safe for nested calls due to interrupts. A call of xen_qlock_kick() might be ignored in case a dee

[PATCH 4.4 026/160] kprobes: Return error if we fail to reuse kprobe instead of BUG_ON()

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Masami Hiramatsu [ Upstream commit 819319fc93461c07b9cdb3064f154bd8cfd48172 ] Make reuse_unused_kprobe() to return error code if it fails to reuse unused kprobe for optprobe instead of calling

[PATCH 4.4 054/160] PCI: Add Device IDs for Intel GPU "spurious interrupt" quirk

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Bin Meng commit d0c9606b31a21028fb5b753c8ad79626292accfd upstream. Add Device IDs to the Intel GPU "spurious interrupt" quirk table. For these devices, unplugging the VGA cable and plugging it

[PATCH 4.4 048/160] net/ipv4: defensive cipso option parsing

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Stefan Nuernberger commit 076ed3da0c9b2f88d9157dbe7044a45641ae369e upstream. commit 40413955ee26 ("Cipso: cipso_v4_optptr enter infinite loop") fixed a possible infinite loop in the IP option p

[PATCH 4.4 052/160] ext4: initialize retries variable in ext4_da_write_inline_data_begin()

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Lukas Czerner commit 625ef8a3acd111d5f496d190baf99d1a815bd03e upstream. Variable retries is not initialized in ext4_da_write_inline_data_begin() which can lead to nondeterministic number of ret

[PATCH 4.4 045/160] tpm: Restore functionality to xen vtpm driver.

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Dr. Greg Wettstein commit e487a0f52301293152a6f8c4e217f2a11dd808e3 upstream. Functionality of the xen-tpmfront driver was lost secondary to the introduction of xenbus multi-page support in comm

[PATCH 4.4 056/160] crypto: lrw - Fix out-of bounds access on counter overflow

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Ondrej Mosnacek commit fbe1a850b3b1522e9fc22319ccbbcd2ab05328d2 upstream. When the LRW block counter overflows, the current implementation returns 128 as the index to the precomputed multiplica

[PATCH 4.4 053/160] HID: hiddev: fix potential Spectre v1

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Breno Leitao commit f11274396a538b31bc010f782e05c2ce3f804c13 upstream. uref->usage_index can be indirectly controlled by userspace, hence leading to a potential exploitation of the Spectre vari

[PATCH 4.4 055/160] signal/GenWQE: Fix sending of SIGKILL

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Eric W. Biederman commit 0ab93e9c99f8208c0a1a7b7170c827936268c996 upstream. The genweq_add_file and genwqe_del_file by caching current without using reference counting embed the assumption that

[PATCH 4.4 049/160] libnvdimm: Hold reference on parent while scheduling async init

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Alexander Duyck commit b6eae0f61db27748606cc00dafcfd1e2c032f0a5 upstream. Unlike asynchronous initialization in the core we have not yet associated the device with the parent, and as such the d

[PATCH 4.4 057/160] ima: fix showing large violations or runtime_measurements_count

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Eric Biggers commit 1e4c8dafbb6bf72fb5eca035b861e39c5896c2b7 upstream. The 12 character temporary buffer is not necessarily long enough to hold a 'long' value. Increase it. Signed-off-by: Eri

[PATCH 4.4 029/160] pinctrl: spmi-mpp: Fix pmic_mpp_config_get() to be compliant

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Douglas Anderson [ Upstream commit 0d5b476f8f57fcb06c45fe27681ac47254f63fd2 ] If you look at "pinconf-groups" in debugfs for ssbi-mpp you'll notice it looks like nonsense. The problem is fairl

[PATCH 4.4 058/160] hugetlbfs: dirty pages as they are added to pagecache

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Mike Kravetz commit 22146c3ce98962436e401f7b7016a6f664c9ffb5 upstream. Some test systems were experiencing negative huge page reserve counts and incorrect file block counts. This was traced to

[PATCH 4.4 061/160] iio: adc: at91: fix wrong channel number in triggered buffer mode

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Eugen Hristev commit aea835f2dc8a682942b859179c49ad1841a6c8b9 upstream. When channels are registered, the hardware channel number is not the actual iio channel number. This is because the drive

[PATCH 4.4 028/160] pinctrl: qcom: spmi-mpp: Fix drive strength setting

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Stephen Boyd [ Upstream commit 89c68b102f13f123aaef22b292526d6b92501334 ] It looks like we parse the drive strength setting here, but never actually write it into the hardware to update it. Par

[PATCH 4.4 027/160] ACPI / LPSS: Add alternative ACPI HIDs for Cherry Trail DMA controllers

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Hans de Goede [ Upstream commit 240714061c58e6b1abfb3322398a7634151c06cb ] Bay and Cherry Trail DSTDs represent a different set of devices depending on which OS the device think it is booting.

[PATCH 4.4 060/160] iio: adc: at91: fix acking DRDY irq on simple conversions

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Eugen Hristev commit bc1b45326223e7e890053cf6266357adfa61942d upstream. When doing simple conversions, the driver did not acknowledge the DRDY irq. If this irq status is not acked, it will be l

[PATCH 4.4 059/160] kbuild: fix kernel/bounds.c W=1 warning

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Arnd Bergmann commit 6a32c2469c3fbfee8f25bcd20af647326650a6cf upstream. Building any configuration with 'make W=1' produces a warning: kernel/bounds.c:16:6: warning: no previous prototype for

[PATCH 4.4 030/160] pinctrl: ssbi-gpio: Fix pm8xxx_pin_config_get() to be compliant

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Douglas Anderson [ Upstream commit b432414b996d32a1bd9afe2bd595bd5729c1477f ] If you look at "pinconf-groups" in debugfs for ssbi-gpio you'll notice it looks like nonsense. The problem is fair

[PATCH 4.4 062/160] w1: omap-hdq: fix missing bus unregister at removal

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Andreas Kemnade commit a007734618fee1bf35556c04fa498d41d42c7301 upstream. The bus master was not removed after unloading the module or unbinding the driver. That lead to oopses like this [ 12

[PATCH 4.4 031/160] ath10k: schedule hardware restart if WMI command times out

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Martin Willi [ Upstream commit a9911937e7d332761e8c4fcbc7ba0426bdc3956f ] When running in AP mode, ath10k sometimes suffers from TX credit starvation. The issue is hard to reproduce and shows u

[PATCH 4.4 032/160] scsi: esp_scsi: Track residual for PIO transfers

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Finn Thain [ Upstream commit fd47d919d0c336e7c22862b51ee94927ffea227a ] If a target disconnects during a PIO data transfer the command may fail when the target reconnects: scsi host1: DMA leng

[PATCH 4.4 023/160] Bluetooth: btbcm: Add entry for BCM4335C0 UART bluetooth

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Christian Hewitt [ Upstream commit a357ea098c9605f60d92a66a9073f56ce25726da ] This patch adds the device ID for the AMPAK AP6335 combo module used in the 1st generation WeTek Hub Android/LibreE

[PATCH 4.4 073/160] MIPS: OCTEON: fix out of bounds array access on CN68XX

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Aaro Koskinen commit c0fae7e2452b90c31edd2d25eb3baf0c76b400ca upstream. The maximum number of interfaces is returned by cvmx_helper_get_number_of_interfaces(), and the value is used to access i

[PATCH 4.4 064/160] smb3: do not attempt cifs operation in smb3 query info error path

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Steve French commit 1e77a8c204c9d1b655c61751b8ad0fde22421dbb upstream. If backupuid mount option is sent, we can incorrectly retry (on access denied on query info) with a cifs (FindFirst) opera

[PATCH 4.4 078/160] media: em28xx: fix input name for Terratec AV 350

4.4-stable review patch. If anyone has any objections, please let me know. -- From: Mauro Carvalho Chehab commit 15644bfa195bd166d0a5ed76ae2d587f719c3dac upstream. Instead of using a register value, use an AMUX name, as otherwise VIDIOC_G_AUDIO would fail. Cc: sta...@vger.ker

<    1   2   3   4   5   6   7   8   9   10   >