Skip to content
  1. Apr 04, 2015
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.dk/linux-block · 57a9d89d
      Linus Torvalds authored
      Pull block layer fix from Jens Axboe:
       "Just one patch in this pull request, fixing a regression caused by a
        'mathematically correct' change to lcm()"
      
      * 'for-linus' of git://git.kernel.dk/linux-block:
        block: fix blk_stack_limits() regression due to lcm() change
      57a9d89d
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 567cfea9
      Linus Torvalds authored
      Pull x86 fixes from Ingo Molnar:
       "Misc fixes: a SYSRET single-stepping fix, a dmi-scan robustization
        fix, a reboot quirk and a kgdb fixlet"
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        kgdb/x86: Fix reporting of 'si' in kgdb on x86_64
        x86/asm/entry/64: Disable opportunistic SYSRET if regs->flags has TF set
        x86/reboot: Add ASRock Q1900DC-ITX mainboard reboot quirk
        MAINTAINERS: Change the x86 microcode loader maintainer
        firmware: dmi_scan: Prevent dmi_num integer overflow
      567cfea9
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · ec2e76b4
      Linus Torvalds authored
      Pull perf fixes from Ingo Molnar:
       "Two x86 Intel PMU constraint handling fixes"
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf/x86/intel: Fix Haswell CYCLE_ACTIVITY.* counter constraints
        perf/x86/intel: Filter branches for PEBS event
      ec2e76b4
    • Linus Torvalds's avatar
      Merge tag 'devicetree-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/glikely/linux · ccc20a33
      Linus Torvalds authored
      Pull devicetree fix from Grant Likely:
       "Simple bugfix for bad device tree data on the PA-Semi platform"
      
      * tag 'devicetree-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/glikely/linux:
        drivers/of: Add empty ranges quirk for PA-Semi
      ccc20a33
    • Linus Torvalds's avatar
      Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6 · b010a0f7
      Linus Torvalds authored
      Pull CIFS fixes from Steve French:
       "A set of small cifs fixes fixing a memory leak, kernel oops, and
        infinite loop (and some spotted by Coverity)"
      
      * 'for-next' of git://git.samba.org/sfrench/cifs-2.6:
        Fix warning
        Fix another dereference before null check warning
        CIFS: session servername can't be null
        Fix warning on impossible comparison
        Fix coverity warning
        Fix dereference before null check warning
        Don't ignore errors on encrypting password in SMBTcon
        Fix warning on uninitialized buftype
        cifs: potential memory leaks when parsing mnt opts
        cifs: fix use-after-free bug in find_writable_file
        cifs: smb2_clone_range() - exit on unhandled error
      b010a0f7
  2. Apr 03, 2015
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · 8f778bbc
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "One drm core fix, one exynos regression fix, two sets of radeon fixes
        (Alex was a bit behind last week), and two i915 fixes.
      
        Nothing too serious we seem to have calmed down i915 since last week"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        drm/radeon: fix wait in radeon_mn_invalidate_range_start
        drm/radeon: add extra check in radeon_ttm_tt_unpin_userptr
        drm: Exynos: Respect framebuffer pitch for FIMD/Mixer
        drm/i915: Reject the colorkey ioctls for primary and cursor planes
        drm/i915: Skip allocating shadow batch for 0-length batches
        drm/radeon: programm the VCE fw BAR as well
        drm/radeon: always dump the ring content if it's available
        radeon: Do not directly dereference pointers to BIOS area.
        drm/radeon/dpm: fix 120hz handling harder
        drm/edid: set ELD for firmware and debugfs override EDIDs
      8f778bbc
    • Linus Torvalds's avatar
      Merge tag 'irqchip-fixes-4.0-2' of git://git.infradead.org/users/jcooper/linux · 4e8a4830
      Linus Torvalds authored
      Pull irqchip fixes from Jason Cooper:
       "This is the second round of fixes for irqchip.  It contains some fixes
        found while the arm64 guys were writing the kvm gicv3 its emulation.
      
        GICv3 ITS:
          - Small batch of fixes discovered while writing the kvm ITS emulation"
      
      * tag 'irqchip-fixes-4.0-2' of git://git.infradead.org/users/jcooper/linux:
        irqchip: gicv3-its: Use non-cacheable accesses when no shareability
        irqchip: gicv3-its: Fix PROP/PEND and BASE/CBASE confusion
        irqchip: gicv3-its: Fix device ID encoding
        irqchip: gicv3-its: Fix encoding of collection's target redistributor
      4e8a4830
    • Dave Airlie's avatar
      Merge branch 'drm-fixes-4.0' of git://people.freedesktop.org/~agd5f/linux into drm-fixes · 51b52fac
      Dave Airlie authored
      Just two small fixes for radeon, both destined for stable.
      
      * 'drm-fixes-4.0' of git://people.freedesktop.org/~agd5f/linux:
        drm/radeon: fix wait in radeon_mn_invalidate_range_start
        drm/radeon: add extra check in radeon_ttm_tt_unpin_userptr
      51b52fac
    • Dave Airlie's avatar
      Merge branch 'exynos-drm-fixes' of... · 165b11bf
      Dave Airlie authored
      Merge branch 'exynos-drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes
      
      Fix display on issue to Exynos5250 based Snow(1366x768) board.
      
      * 'exynos-drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos:
        drm: Exynos: Respect framebuffer pitch for FIMD/Mixer
      165b11bf
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2015-04-02' of git://anongit.freedesktop.org/drm-intel into drm-fixes · 3fa50dc3
      Dave Airlie authored
      one oops fixes and a 0-length allocation fix from next backported.
      
      * tag 'drm-intel-fixes-2015-04-02' of git://anongit.freedesktop.org/drm-intel:
        drm/i915: Reject the colorkey ioctls for primary and cursor planes
        drm/i915: Skip allocating shadow batch for 0-length batches
      3fa50dc3
    • Dave Airlie's avatar
      Merge tag 'topic/drm-fixes-2015-04-02' of git://anongit.freedesktop.org/drm-intel into drm-fixes · c7d74874
      Dave Airlie authored
      Here's a single drm core fix, cc: stable, that affects i915
      users.
      
      * tag 'topic/drm-fixes-2015-04-02' of git://anongit.freedesktop.org/drm-intel:
        drm/edid: set ELD for firmware and debugfs override EDIDs
      c7d74874
    • Linus Torvalds's avatar
      Merge tag 'stable/for-linus-4.0-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip · b0838b15
      Linus Torvalds authored
      Pull xen regression fixes from David Vrabel:
       "Fix two regressions in the balloon driver's use of memory hotplug when
        used in a PV guest"
      
      * tag 'stable/for-linus-4.0-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
        xen/balloon: before adding hotplugged memory, set frames to invalid
        x86/xen: prepare p2m list for memory hotplug
      b0838b15
    • Linus Torvalds's avatar
      Merge tag 'powerpc-4.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mpe/linux · 1d514333
      Linus Torvalds authored
      Pull powerpc fix from Michael Ellerman:
       "Fix memory corruption by pnv_alloc_idle_core_states"
      
      * tag 'powerpc-4.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mpe/linux:
        powerpc: fix memory corruption by pnv_alloc_idle_core_states
      1d514333
    • Linus Torvalds's avatar
      Merge tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband · 06459fc0
      Linus Torvalds authored
      Pull infiniband/rdma fix from Roland Dreier:
       "Fix for exploitable integer overflow in uverbs interface"
      
      * tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
        IB/uverbs: Prevent integer overflow in ib_umem_get address arithmetic
      06459fc0
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dma · 0a481279
      Linus Torvalds authored
      Pull dmaengine fixes from Vinod Koul:
       "This time we have addition of caps for jz4740 which fixes intentional
        warning at boot.  Then we have memory leak issues in drivers using
        virt-dma by Peter on few drive"
      
      * 'fixes' of git://git.infradead.org/users/vkoul/slave-dma:
        dmaengine: moxart-dma: Fix memory leak when stopping a running transfer
        dmaengine: bcm2835-dma: Fix memory leak when stopping a running transfer
        dmaengine: omap-dma: Fix memory leak when terminating running transfer
        dmaengine: edma: fix memory leak when terminating running transfers
        dmaengine: jz4740: Define capabilities
      0a481279
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 8172ba51
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix use-after-free with mac80211 RX A-MPDU reorder timer, from
          Johannes Berg.
      
       2) iwlwifi leaks memory every module load/unload cycles, fix from Larry
          Finger.
      
       3) Need to use for_each_netdev_safe() in rtnl_group_changelink()
          otherwise we can crash, from WANG Cong.
      
       4) mlx4 driver does register_netdev() too early in the probe sequence,
          from Ido Shamay.
      
       5) Don't allow router discovery hop limit to decrease the interface's
          hop limit, from D.S. Ljungmark.
      
       6) tx_packets and tx_bytes improperly accounted for certain classes of
          USB network devices, fix from Ben Hutchings.
      
       7) ip{6}mr_rules_init() mistakenly use plain kfree to release the ipmr
          tables in the error path, they must instead use ip{6}mr_free_table().
          Fix from WANG Cong.
      
       8) cxgb4 doesn't properly quiesce all RX activity before unregistering
          the netdevice.  Fix from Hariprasad Shenai.
      
       9) Fix hash corruptions in ipvlan driver, from Jiri Benc.
      
      10) nla_memcpy(), like a real memcpy, should fully initialize the
          destination buffer, even if the source attribute is smaller.  Fix
          from Jiri Benc.
      
      11) Fix wrong error code returned from iucv_sock_sendmsg().  We should
          use whatever sock_alloc_send_skb() put into 'err'.  From Eugene
          Crosser.
      
      12) Fix slab object leak on module unload in TIPC, from Ying Xue.
      
      13) Need a READ_ONCE() when reading the cached RX socket route in
          tcp_v{4,6}_early_demux().  From Michal Kubecek.
      
      14) Still too many problems with TPC support in the ath9k driver, so
          disable it for now.  From Felix Fietkau.
      
      15) When in AP mode the rtlwifi driver can leak DMA mappings, fix from
          Larry Finger.
      
      16) Missing kzalloc() failure check in gs_usb CAN driver, from Colin Ian
          King.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (52 commits)
        cxgb4: Fix to dump devlog, even if FW is crashed
        cxgb4: Firmware macro changes for fw verison 1.13.32.0
        bnx2x: Fix kdump when iommu=on
        bnx2x: Fix kdump on 4-port device
        mac80211: fix RX A-MPDU session reorder timer deletion
        MAINTAINERS: Update Intel Wired Ethernet Driver info
        tipc: fix a slab object leak
        net/usb/r8152: add device id for Lenovo TP USB 3.0 Ethernet
        af_iucv: fix AF_IUCV sendmsg() errno
        openvswitch: Return vport module ref before destruction
        netlink: pad nla_memcpy dest buffer with zeroes
        bonding: Bonding Overriding Configuration logic restored.
        ipvlan: fix check for IP addresses in control path
        ipvlan: do not use rcu operations for address list
        ipvlan: protect against concurrent link removal
        ipvlan: fix addr hash list corruption
        net: fec: setup right value for mdio hold time
        net: tcp6: fix double call of tcp_v6_fill_cb()
        cxgb4vf: Fix sparse warnings
        netns: don't clear nsid too early on removal
        ...
      8172ba51
    • Shachar Raindel's avatar
      IB/uverbs: Prevent integer overflow in ib_umem_get address arithmetic · 8494057a
      Shachar Raindel authored
      
      
      Properly verify that the resulting page aligned end address is larger
      than both the start address and the length of the memory area requested.
      
      Both the start and length arguments for ib_umem_get are controlled by
      the user. A misbehaving user can provide values which will cause an
      integer overflow when calculating the page aligned end address.
      
      This overflow can cause also miscalculation of the number of pages
      mapped, and additional logic issues.
      
      Addresses: CVE-2014-8159
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarShachar Raindel <raindel@mellanox.com>
      Signed-off-by: default avatarJack Morgenstein <jackm@mellanox.com>
      Signed-off-by: default avatarOr Gerlitz <ogerlitz@mellanox.com>
      Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
      8494057a
  3. Apr 02, 2015
  4. Apr 01, 2015
    • Johannes Berg's avatar
      mac80211: fix RX A-MPDU session reorder timer deletion · 788211d8
      Johannes Berg authored
      
      
      There's an issue with the way the RX A-MPDU reorder timer is
      deleted that can cause a kernel crash like this:
      
       * tid_rx is removed - call_rcu(ieee80211_free_tid_rx)
       * station is destroyed
       * reorder timer fires before ieee80211_free_tid_rx() runs,
         accessing the station, thus potentially crashing due to
         the use-after-free
      
      The station deletion is protected by synchronize_net(), but
      that isn't enough -- ieee80211_free_tid_rx() need not have
      run when that returns (it deletes the timer.) We could use
      rcu_barrier() instead of synchronize_net(), but that's much
      more expensive.
      
      Instead, to fix this, add a field tracking that the session
      is being deleted. In this case, the only re-arming of the
      timer happens with the reorder spinlock held, so make that
      code not rearm it if the session is being deleted and also
      delete the timer after setting that field. This ensures the
      timer cannot fire after ___ieee80211_stop_rx_ba_session()
      returns, which fixes the problem.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      788211d8
    • Stefan Lippers-Hollmann's avatar
      x86/reboot: Add ASRock Q1900DC-ITX mainboard reboot quirk · 80313b30
      Stefan Lippers-Hollmann authored
      
      
      The ASRock Q1900DC-ITX mainboard (Baytrail-D) hangs randomly in
      both BIOS and UEFI mode while rebooting unless reboot=pci is
      used. Add a quirk to reboot via the pci method.
      
      The problem is very intermittent and hard to debug, it might succeed
      rebooting just fine 40 times in a row - but fails half a dozen times
      the next day. It seems to be slightly less common in BIOS CSM mode
      than native UEFI (with the CSM disabled), but it does happen in either
      mode. Since I've started testing this patch in late january, rebooting
      has been 100% reliable.
      
      Most of the time it already hangs during POST, but occasionally it
      might even make it through the bootloader and the kernel might even
      start booting, but then hangs before the mode switch. The same symptoms
      occur with grub-efi, gummiboot and grub-pc, just as well as (at least)
      kernel 3.16-3.19 and 4.0-rc6 (I haven't tried older kernels than 3.16).
      Upgrading to the most current mainboard firmware of the ASRock
      Q1900DC-ITX, version 1.20, does not improve the situation.
      
      ( Searching the web seems to suggest that other Bay Trail-D mainboards
        might be affected as well. )
      --
      Signed-off-by: default avatarStefan Lippers-Hollmann <s.l-h@gmx.de>
      Cc: <stable@vger.kernel.org>
      Cc: Matt Fleming <matt.fleming@intel.com>
      Link: http://lkml.kernel.org/r/20150330224427.0fb58e42@mir
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      80313b30
    • Steve French's avatar
      Fix warning · 4c5930e8
      Steve French authored
      
      
      Coverity reports a warning due to unitialized attr structure in one
      code path.
      
      Reported by Coverity (CID 728535)
      
      Signed-off-by: default avatarSteve French <smfrench@gmail.com>
      Reviewed-by: default avatarJeff Layton <jlayton@samba.org>
      4c5930e8