GitHub PushEvent at 2014-11-22 02:03:45
Repository: kernel
Actor: lxnay
Payload: {"shas":[["2d2a8385287335071789c88e4df4a516091472d5","66deb1d63f85161cc287ce2bac0c65cb5ae958a7@secunet.com","ip6_tunnel: Use ip6_tnl_dev_init as the ndo_init function.\n\n[ Upstream commit 6c6151daaf2d8dc2046d9926539feed5f66bf74e ]\n\nip6_tnl_dev_init() sets the dev->iflink via a call to\nip6_tnl_link_config(). After that, register_netdevice()\nsets dev->iflink = -1. So we loose the iflink configuration\nfor ipv6 tunnels. Fix this by using ip6_tnl_dev_init() as the\nndo_init function. Then ip6_tnl_dev_init() is called after\ndev->iflink is set to -1 from register_netdevice().\n\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","Steffen Klassert",true],["460ceaa05d35a85502f661a8754d9304c0b941b5","66deb1d63f85161cc287ce2bac0c65cb5ae958a7@secunet.com","gre6: Move the setting of dev->iflink into the ndo_init functions.\n\n[ Upstream commit f03eb128e3f4276f46442d14f3b8f864f3775821 ]\n\nOtherwise it gets overwritten by register_netdev().\n\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","Steffen Klassert",true],["7031dcb018db2a7776c1c31ef156cf8ac8da8a99","9ff04a02a69f376b2b9aeec27187017cbf3cf5f9@redhat.com","net: sctp: fix NULL pointer dereference in af->from_addr_param on malformed packet\n\n[ Upstream commit e40607cbe270a9e8360907cb1e62ddf0736e4864 ]\n\nAn SCTP server doing ASCONF will panic on malformed INIT ping-of-death\nin the form of:\n\n  ------------ INIT[PARAM: SET_PRIMARY_IP] ------------>\n\nWhile the INIT chunk parameter verification dissects through many things\nin order to detect malformed input, it misses to actually check parameters\ninside of parameters. E.g. RFC5061, section 4.2.4 proposes a 'set primary\nIP address' parameter in ASCONF, which has as a subparameter an address\nparameter.\n\nSo an attacker may send a parameter type other than SCTP_PARAM_IPV4_ADDRESS\nor SCTP_PARAM_IPV6_ADDRESS, param_type2af() will subsequently return 0\nand thus sctp_get_af_specific() returns NULL, too, which we then happily\ndereference unconditionally through af->from_addr_param().\n\nThe trace for the log:\n\nBUG: unable to handle kernel NULL pointer dereference at 0000000000000078\nIP: [<ffffffffa01e9c62>] sctp_process_init+0x492/0x990 [sctp]\nPGD 0\nOops: 0000 [#1] SMP\n[...]\nPid: 0, comm: swapper Not tainted 2.6.32-504.el6.x86_64 #1 Bochs Bochs\nRIP: 0010:[<ffffffffa01e9c62>]  [<ffffffffa01e9c62>] sctp_process_init+0x492/0x990 [sctp]\n[...]\nCall Trace:\n <IRQ>\n [<ffffffffa01f2add>] ? sctp_bind_addr_copy+0x5d/0xe0 [sctp]\n [<ffffffffa01e1fcb>] sctp_sf_do_5_1B_init+0x21b/0x340 [sctp]\n [<ffffffffa01e3751>] sctp_do_sm+0x71/0x1210 [sctp]\n [<ffffffffa01e5c09>] ? sctp_endpoint_lookup_assoc+0xc9/0xf0 [sctp]\n [<ffffffffa01e61f6>] sctp_endpoint_bh_rcv+0x116/0x230 [sctp]\n [<ffffffffa01ee986>] sctp_inq_push+0x56/0x80 [sctp]\n [<ffffffffa01fcc42>] sctp_rcv+0x982/0xa10 [sctp]\n [<ffffffffa01d5123>] ? ipt_local_in_hook+0x23/0x28 [iptable_filter]\n [<ffffffff8148bdc9>] ? nf_iterate+0x69/0xb0\n [<ffffffff81496d10>] ? ip_local_deliver_finish+0x0/0x2d0\n [<ffffffff8148bf86>] ? nf_hook_slow+0x76/0x120\n [<ffffffff81496d10>] ? ip_local_deliver_finish+0x0/0x2d0\n[...]\n\nA minimal way to address this is to check for NULL as we do on all\nother such occasions where we know sctp_get_af_specific() could\npossibly return with NULL.\n\nFixes: d6de3097592b (\"[SCTP]: Add the handling of \"Set Primary IP Address\" parameter to INIT\")\nSigned-off-by: Daniel Borkmann <dborkman@redhat.com>\nCc: Vlad Yasevich <vyasevich@gmail.com>\nAcked-by: Neil Horman <nhorman@tuxdriver.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","Daniel Borkmann",true],["e79c2487e4e01ccad077252c398627fd99f55924","9ff04a02a69f376b2b9aeec27187017cbf3cf5f9@redhat.com","net: sctp: fix memory leak in auth key management\n\n[ Upstream commit 4184b2a79a7612a9272ce20d639934584a1f3786 ]\n\nA very minimal and simple user space application allocating an SCTP\nsocket, setting SCTP_AUTH_KEY setsockopt(2) on it and then closing\nthe socket again will leak the memory containing the authentication\nkey from user space:\n\nunreferenced object 0xffff8800837047c0 (size 16):\n  comm \"a.out\", pid 2789, jiffies 4296954322 (age 192.258s)\n  hex dump (first 16 bytes):\n    01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [<ffffffff816d7e8e>] kmemleak_alloc+0x4e/0xb0\n    [<ffffffff811c88d8>] __kmalloc+0xe8/0x270\n    [<ffffffffa0870c23>] sctp_auth_create_key+0x23/0x50 [sctp]\n    [<ffffffffa08718b1>] sctp_auth_set_key+0xa1/0x140 [sctp]\n    [<ffffffffa086b383>] sctp_setsockopt+0xd03/0x1180 [sctp]\n    [<ffffffff815bfd94>] sock_common_setsockopt+0x14/0x20\n    [<ffffffff815beb61>] SyS_setsockopt+0x71/0xd0\n    [<ffffffff816e58a9>] system_call_fastpath+0x12/0x17\n    [<ffffffffffffffff>] 0xffffffffffffffff\n\nThis is bad because of two things, we can bring down a machine from\nuser space when auth_enable=1, but also we would leave security sensitive\nkeying material in memory without clearing it after use. The issue is\nthat sctp_auth_create_key() already sets the refcount to 1, but after\nallocation sctp_auth_set_key() does an additional refcount on it, and\nthus leaving it around when we free the socket.\n\nFixes: 65b07e5d0d0 (\"[SCTP]: API updates to suport SCTP-AUTH extensions.\")\nSigned-off-by: Daniel Borkmann <dborkman@redhat.com>\nCc: Vlad Yasevich <vyasevich@gmail.com>\nAcked-by: Neil Horman <nhorman@tuxdriver.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","Daniel Borkmann",true],["e4da88a6dab26f68c5f0e493178f9ef2c23f0d08","9e937ea4018886cd6d1c1e0f727242811f2dccbd@oracle.com","sunvdc: add cdrom and v1.1 protocol support\n\n[ Upstream commit 9bce21828d54a95143f1b74619705c2dd8e88b92 ]\n\nInterpret the media type from v1.1 protocol to support CDROM/DVD.\n\nFor v1.0 protocol, a disk's size continues to be calculated from the\ngeometry returned by the vdisk server. The geometry returned by the server\ncan be less than the actual number of sectors available in the backing\nimage/device due to the rounding in the division used to compute the\ngeometry in the vdisk server.\n\nIn v1.1 protocol a disk's actual size in sectors is returned during the\nhandshake. Use this size when v1.1 protocol is negotiated. Since this size\nwill always be larger than the former geometry computed size, disks created\nunder v1.0 will be forwards compatible to v1.1, but not vice versa.\n\nSigned-off-by: Dwight Engen <dwight.engen@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","Allen Pais",true],["9e23c21149bfdc57aa9d9a35821994dfb0253c40","9e937ea4018886cd6d1c1e0f727242811f2dccbd@oracle.com","sunvdc: compute vdisk geometry from capacity\n\n[ Upstream commit de5b73f08468b4fc5e2f6d1505f650262622f78b ]\n\nThe LDom diskserver doesn't return reliable geometry data. In addition,\nthe types for all fields in the vio_disk_geom are u16, which were being\ntruncated in the cast into the u8's of the Linux struct hd_geometry.\n\nModify vdc_getgeo() to compute the geometry from the disk's capacity in a\nmanner consistent with xen-blkfront::blkif_getgeo().\n\nSigned-off-by: Dwight Engen <dwight.engen@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","Allen Pais",true],["5cf61378accedc6acd5923f3b00bc945be1a9d29","1793d65cf7b9eefb2bb8f5bee9a4b8ba782c26da@oracle.com","sunvdc: limit each sg segment to a page\n\n[ Upstream commit 5eed69ffd248c9f68f56c710caf07db134aef28b ]\n\nldc_map_sg() could fail its check that the number of pages referred to\nby the sg scatterlist was <= the number of cookies.\n\nThis fixes the issue by doing a similar thing to the xen-blkfront driver,\nensuring that the scatterlist will only ever contain a segment count <=\nport->ring_cookies, and each segment will be page aligned, and <= page\nsize. This ensures that the scatterlist is always mappable.\n\nOrabug: 19347817\nOraBZ: 15945\n\nSigned-off-by: Dwight Engen <dwight.engen@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","Dwight Engen",true],["891b60578feb65bdc55b69948ce98fea7ca88b1f","1793d65cf7b9eefb2bb8f5bee9a4b8ba782c26da@oracle.com","vio: fix reuse of vio_dring slot\n\n[ Upstream commit d0aedcd4f14a22e23b313f42b7e6e6ebfc0fbc31 ]\n\nvio_dring_avail() will allow use of every dring entry, but when the last\nentry is allocated then dr->prod == dr->cons which is indistinguishable from\nthe ring empty condition. This causes the next allocation to reuse an entry.\nWhen this happens in sunvdc, the server side vds driver begins nack'ing the\nmessages and ends up resetting the ldc channel. This problem does not effect\nsunvnet since it checks for < 2.\n\nThe fix here is to just never allocate the very last dring slot so that full\nand empty are not the same condition. The request start path was changed to\ncheck for the ring being full a bit earlier, and to stop the blk_queue if\nthere is no space left. The blk_queue will be restarted once the ring is\nonly half full again. The number of ring entries was increased to 512 which\nmatches the sunvnet and Solaris vdc drivers, and greatly reduces the\nfrequency of hitting the ring full condition and the associated blk_queue\nstop/starting. The checks in sunvent were adjusted to account for\nvio_dring_avail() returning 1 less.\n\nOrabug: 19441666\nOraBZ: 14983\n\nSigned-off-by: Dwight Engen <dwight.engen@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","Dwight Engen",true],["df6329d2eb252866542b9efaef34b2e0d777e649","1793d65cf7b9eefb2bb8f5bee9a4b8ba782c26da@oracle.com","sunvdc: don't call VD_OP_GET_VTOC\n\n[ Upstream commit 85b0c6e62c48bb9179fd5b3e954f362fb346cbd5 ]\n\nThe VD_OP_GET_VTOC operation will succeed only if the vdisk backend has a\nVTOC label, otherwise it will fail. In particular, it will return error\n48 (ENOTSUP) if the disk has an EFI label. VTOC disk labels are already\nhandled by directly reading the disk in block/partitions/sun.c (enabled by\nCONFIG_SUN_PARTITION which defaults to y on SPARC). Since port->label is\nunused in the driver, remove the call and the field.\n\nSigned-off-by: Dwight Engen <dwight.engen@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","Dwight Engen",true],["865db7fbbcf2651989b0134a6babb8b093b53a61","fe08d3c717adf2ae63592e4c9aec6e3e404d8e3e@davemloft.net","sparc64: Fix crashes in schizo_pcierr_intr_other().\n\n[ Upstream commit 7da89a2a3776442a57e918ca0b8678d1b16a7072 ]\n\nMeelis Roos reports crashes during bootup on a V480 that look like\nthis:\n\n====================\n[   61.300577] PCI: Scanning PBM /pci@9,600000\n[   61.304867] schizo f009b070: PCI host bridge to bus 0003:00\n[   61.310385] pci_bus 0003:00: root bus resource [io  0x7ffe9000000-0x7ffe9ffffff] (bus address [0x0000-0xffffff])\n[   61.320515] pci_bus 0003:00: root bus resource [mem 0x7fb00000000-0x7fbffffffff] (bus address [0x00000000-0xffffffff])\n[   61.331173] pci_bus 0003:00: root bus resource [bus 00]\n[   61.385344] Unable to handle kernel NULL pointer dereference\n[   61.390970] tsk->{mm,active_mm}->context = 0000000000000000\n[   61.396515] tsk->{mm,active_mm}->pgd = fff000b000002000\n[   61.401716]               \\|/ ____ \\|/\n[   61.401716]               \"@'/ .. \\`@\"\n[   61.401716]               /_| \\__/ |_\\\n[   61.401716]                  \\__U_/\n[   61.416362] swapper/0(0): Oops [#1]\n[   61.419837] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.18.0-rc1-00422-g2cc9188-dirty #24\n[   61.427975] task: fff000b0fd8e9c40 ti: fff000b0fd928000 task.ti: fff000b0fd928000\n[   61.435426] TSTATE: 0000004480e01602 TPC: 00000000004455e4 TNPC: 00000000004455e8 Y: 00000000    Not tainted\n[   61.445230] TPC: <schizo_pcierr_intr+0x104/0x560>\n[   61.449897] g0: 0000000000000000 g1: 0000000000000000 g2: 0000000000a10f78 g3: 000000000000000a\n[   61.458563] g4: fff000b0fd8e9c40 g5: fff000b0fdd82000 g6: fff000b0fd928000 g7: 000000000000000a\n[   61.467229] o0: 000000000000003d o1: 0000000000000000 o2: 0000000000000006 o3: fff000b0ffa5fc7e\n[   61.475894] o4: 0000000000060000 o5: c000000000000000 sp: fff000b0ffa5f3c1 ret_pc: 00000000004455cc\n[   61.484909] RPC: <schizo_pcierr_intr+0xec/0x560>\n[   61.489500] l0: fff000b0fd8e9c40 l1: 0000000000a20800 l2: 0000000000000000 l3: 000000000119a430\n[   61.498164] l4: 0000000001742400 l5: 00000000011cfbe0 l6: 00000000011319c0 l7: fff000b0fd8ea348\n[   61.506830] i0: 0000000000000000 i1: fff000b0fdb34000 i2: 0000000320000000 i3: 0000000000000000\n[   61.515497] i4: 00060002010b003f i5: 0000040004e02000 i6: fff000b0ffa5f481 i7: 00000000004a9920\n[   61.524175] I7: <handle_irq_event_percpu+0x40/0x140>\n[   61.529099] Call Trace:\n[   61.531531]  [00000000004a9920] handle_irq_event_percpu+0x40/0x140\n[   61.537681]  [00000000004a9a58] handle_irq_event+0x38/0x80\n[   61.543145]  [00000000004ac77c] handle_fasteoi_irq+0xbc/0x200\n[   61.548860]  [00000000004a9084] generic_handle_irq+0x24/0x40\n[   61.554500]  [000000000042be0c] handler_irq+0xac/0x100\n====================\n\nThe problem is that pbm->pci_bus->self is NULL.\n\nThis code is trying to go through the standard PCI config space\ninterfaces to read the PCI controller's PCI_STATUS register.\n\nThis doesn't work, because we more often than not do not enumerate\nthe PCI controller as a bonafide PCI device during the OF device\nnode scan.  Therefore bus->self remains NULL.\n\nExisting common code for PSYCHO and PSYCHO-like PCI controllers\nhandles this properly, by doing the config space access directly.\n\nDo the same here, pbm->pci_ops->{read,write}().\n\nReported-by: Meelis Roos <mroos@linux.ee>\nTested-by: Meelis Roos <mroos@linux.ee>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","David S. Miller",true],["134712463afbd65c6b11193cd8000c83fc5b3a1b","fe08d3c717adf2ae63592e4c9aec6e3e404d8e3e@davemloft.net","sparc64: Do irq_{enter,exit}() around generic_smp_call_function*().\n\n[ Upstream commit ab5c780913bca0a5763ca05dd5c2cb5cb08ccb26 ]\n\nOtherwise rcu_irq_{enter,exit}() do not happen and we get dumps like:\n\n====================\n[  188.275021] ===============================\n[  188.309351] [ INFO: suspicious RCU usage. ]\n[  188.343737] 3.18.0-rc3-00068-g20f3963-dirty #54 Not tainted\n[  188.394786] -------------------------------\n[  188.429170] include/linux/rcupdate.h:883 rcu_read_lock() used\nillegally while idle!\n[  188.505235]\nother info that might help us debug this:\n\n[  188.554230]\nRCU used illegally from idle CPU!\nrcu_scheduler_active = 1, debug_locks = 0\n[  188.637587] RCU used illegally from extended quiescent state!\n[  188.690684] 3 locks held by swapper/7/0:\n[  188.721932]  #0:  (&x->wait#11){......}, at: [<0000000000495de8>] complete+0x8/0x60\n[  188.797994]  #1:  (&p->pi_lock){-.-.-.}, at: [<000000000048510c>] try_to_wake_up+0xc/0x400\n[  188.881343]  #2:  (rcu_read_lock){......}, at: [<000000000048a910>] select_task_rq_fair+0x90/0xb40\n[  188.973043]stack backtrace:\n[  188.993879] CPU: 7 PID: 0 Comm: swapper/7 Not tainted 3.18.0-rc3-00068-g20f3963-dirty #54\n[  189.076187] Call Trace:\n[  189.089719]  [0000000000499360] lockdep_rcu_suspicious+0xe0/0x100\n[  189.147035]  [000000000048a99c] select_task_rq_fair+0x11c/0xb40\n[  189.202253]  [00000000004852d8] try_to_wake_up+0x1d8/0x400\n[  189.252258]  [000000000048554c] default_wake_function+0xc/0x20\n[  189.306435]  [0000000000495554] __wake_up_common+0x34/0x80\n[  189.356448]  [00000000004955b4] __wake_up_locked+0x14/0x40\n[  189.406456]  [0000000000495e08] complete+0x28/0x60\n[  189.448142]  [0000000000636e28] blk_end_sync_rq+0x8/0x20\n[  189.496057]  [0000000000639898] __blk_mq_end_request+0x18/0x60\n[  189.550249]  [00000000006ee014] scsi_end_request+0x94/0x180\n[  189.601286]  [00000000006ee334] scsi_io_completion+0x1d4/0x600\n[  189.655463]  [00000000006e51c4] scsi_finish_command+0xc4/0xe0\n[  189.708598]  [00000000006ed958] scsi_softirq_done+0x118/0x140\n[  189.761735]  [00000000006398ec] __blk_mq_complete_request_remote+0xc/0x20\n[  189.827383]  [00000000004c75d0] generic_smp_call_function_single_interrupt+0x150/0x1c0\n[  189.906581]  [000000000043e514] smp_call_function_single_client+0x14/0x40\n====================\n\nBased almost entirely upon a patch by Paul E. McKenney.\n\nReported-by: Meelis Roos <mroos@linux.ee>\nTested-by: Meelis Roos <mroos@linux.ee>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","David S. Miller",true],["96920746658f98dbdaccc90ab818443471accc89","b15c342f1de186996bcca5e1a23cd684d2fadb32@gaisler.com","sparc32: Implement xchg and atomic_xchg using ATOMIC_HASH locks\n\n[ Upstream commit 1a17fdc4f4ed06b63fac1937470378a5441a663a ]\n\nAtomicity between xchg and cmpxchg cannot be guaranteed when xchg is\nimplemented with a swap and cmpxchg is implemented with locks.\nWithout this, e.g. mcs_spin_lock and mcs_spin_unlock are broken.\n\nSigned-off-by: Andreas Larsson <andreas@gaisler.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","Andreas Larsson",true],["89b27dc7ce6465ca4cec9603b7d5fcdc678f30f9","2cc0d0d76de2e6f37b92deeb83c85cb306fc5dc1@amacapital.net","x86, x32, audit: Fix x32's AUDIT_ARCH wrt audit\n\ncommit 81f49a8fd7088cfcb588d182eeede862c0e3303e upstream.\n\nis_compat_task() is the wrong check for audit arch; the check should\nbe is_ia32_task(): x32 syscalls should be AUDIT_ARCH_X86_64, not\nAUDIT_ARCH_I386.\n\nCONFIG_AUDITSYSCALL is currently incompatible with x32, so this has\nno visible effect.\n\nSigned-off-by: Andy Lutomirski <luto@amacapital.net>\nLink: http://lkml.kernel.org/r/a0138ed8c709882aec06e4acc30bfa9b623b8717.1409954077.git.luto@amacapital.net\nSigned-off-by: H. Peter Anvin <hpa@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","Andy Lutomirski",true],["bd501a2eb28282b657555b32acbc65b6c102af1d","84cd5483a2f9acd1c37251cba7c2908448f221b8@suse.cz","audit: keep inode pinned\n\ncommit 799b601451b21ebe7af0e6e8f6e2ccd4683c5064 upstream.\n\nAudit rules disappear when an inode they watch is evicted from the cache.\nThis is likely not what we want.\n\nThe guilty commit is \"fsnotify: allow marks to not pin inodes in core\",\nwhich didn't take into account that audit_tree adds watches with a zero\nmask.\n\nAdding any mask should fix this.\n\nFixes: 90b1e7a57880 (\"fsnotify: allow marks to not pin inodes in core\")\nSigned-off-by: Miklos Szeredi <mszeredi@suse.cz>\nSigned-off-by: Paul Moore <pmoore@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","Miklos Szeredi",true],["4886eb4a453cb51598a9e3796c095e94dd552e5b","af7b4e6415680475ee07b1acca54a307146b8392@intel.com","ahci: Add Device IDs for Intel Sunrise Point PCH\n\ncommit 690000b930456a98663567d35dd5c54b688d1e3f upstream.\n\nThis patch adds the AHCI-mode SATA Device IDs for the Intel Sunrise Point PCH.\n\nSigned-off-by: James Ralston <james.d.ralston@intel.com>\nSigned-off-by: Tejun Heo <tj@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","James Ralston",true],["9921a2d59ae1ad736ef4e6abf2a67d961e74a95c","546b05909706652891a87f7bfe385ae147f61f91@kernel.org","ahci: disable MSI instead of NCQ on Samsung pci-e SSDs on macbooks\n\ncommit 66a7cbc303f4d28f201529b06061944d51ab530c upstream.\n\nSamsung pci-e SSDs on macbooks failed miserably on NCQ commands, so\n67809f85d31e (\"ahci: disable NCQ on Samsung pci-e SSDs on macbooks\")\ndisabled NCQ on them.  It turns out that NCQ is fine as long as MSI is\nnot used, so let's turn off MSI and leave NCQ on.\n\nSigned-off-by: Tejun Heo <tj@kernel.org>\nLink: https://bugzilla.kernel.org/show_bug.cgi?id=60731\nTested-by: <dorin@i51.org>\nTested-by: Imre Kaloz <kaloz@openwrt.org>\nFixes: 67809f85d31e (\"ahci: disable NCQ on Samsung pci-e SSDs on macbooks\")\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","Tejun Heo",true],["9a262b4b21aaebe6323b2b8362465ca796f12768","4596b3305151c7ee743192a95d394341e3d3b644@suse.de","ALSA: usb-audio: Fix memory leak in FTU quirk\n\ncommit 1a290581ded60e87276741f8ca97b161d2b226fc upstream.\n\nM-audio FastTrack Ultra quirk doesn't release the kzalloc'ed memory.\nThis patch adds the private_free callback to release it properly.\n\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","Takashi Iwai",true],["86800fc632fd29ff30d557fcf1fbd76d2416c483","8c5ea195856807f4f02a6e0749c87ea6b7375f38@gmail.com","xtensa: re-wire umount syscall to sys_oldumount\n\ncommit 2651cc6974d47fc43bef1cd8cd26966e4f5ba306 upstream.\n\nUserspace actually passes single parameter (path name) to the umount\nsyscall, so new umount just fails. Fix it by requesting old umount\nsyscall implementation and re-wiring umount to it.\n\nSigned-off-by: Max Filippov <jcmvbkbc@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","Max Filippov",true],["8169b2b999c9e0e196fdf8e96668f535ae648e5f","152d4c5bebf13a5b809d42b4d789cf9d887e6698@redhat.com","libceph: do not crash on large auth tickets\n\ncommit aaef31703a0cf6a733e651885bfb49edc3ac6774 upstream.\n\nLarge (greater than 32k, the value of PAGE_ALLOC_COSTLY_ORDER) auth\ntickets will have their buffers vmalloc'ed, which leads to the\nfollowing crash in crypto:\n\n[   28.685082] BUG: unable to handle kernel paging request at ffffeb04000032c0\n[   28.686032] IP: [<ffffffff81392b42>] scatterwalk_pagedone+0x22/0x80\n[   28.686032] PGD 0\n[   28.688088] Oops: 0000 [#1] PREEMPT SMP\n[   28.688088] Modules linked in:\n[   28.688088] CPU: 0 PID: 878 Comm: kworker/0:2 Not tainted 3.17.0-vm+ #305\n[   28.688088] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007\n[   28.688088] Workqueue: ceph-msgr con_work\n[   28.688088] task: ffff88011a7f9030 ti: ffff8800d903c000 task.ti: ffff8800d903c000\n[   28.688088] RIP: 0010:[<ffffffff81392b42>]  [<ffffffff81392b42>] scatterwalk_pagedone+0x22/0x80\n[   28.688088] RSP: 0018:ffff8800d903f688  EFLAGS: 00010286\n[   28.688088] RAX: ffffeb04000032c0 RBX: ffff8800d903f718 RCX: ffffeb04000032c0\n[   28.688088] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8800d903f750\n[   28.688088] RBP: ffff8800d903f688 R08: 00000000000007de R09: ffff8800d903f880\n[   28.688088] R10: 18df467c72d6257b R11: 0000000000000000 R12: 0000000000000010\n[   28.688088] R13: ffff8800d903f750 R14: ffff8800d903f8a0 R15: 0000000000000000\n[   28.688088] FS:  00007f50a41c7700(0000) GS:ffff88011fc00000(0000) knlGS:0000000000000000\n[   28.688088] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n[   28.688088] CR2: ffffeb04000032c0 CR3: 00000000da3f3000 CR4: 00000000000006b0\n[   28.688088] Stack:\n[   28.688088]  ffff8800d903f698 ffffffff81392ca8 ffff8800d903f6e8 ffffffff81395d32\n[   28.688088]  ffff8800dac96000 ffff880000000000 ffff8800d903f980 ffff880119b7e020\n[   28.688088]  ffff880119b7e010 0000000000000000 0000000000000010 0000000000000010\n[   28.688088] Call Trace:\n[   28.688088]  [<ffffffff81392ca8>] scatterwalk_done+0x38/0x40\n[   28.688088]  [<ffffffff81392ca8>] scatterwalk_done+0x38/0x40\n[   28.688088]  [<ffffffff81395d32>] blkcipher_walk_done+0x182/0x220\n[   28.688088]  [<ffffffff813990bf>] crypto_cbc_encrypt+0x15f/0x180\n[   28.688088]  [<ffffffff81399780>] ? crypto_aes_set_key+0x30/0x30\n[   28.688088]  [<ffffffff8156c40c>] ceph_aes_encrypt2+0x29c/0x2e0\n[   28.688088]  [<ffffffff8156d2a3>] ceph_encrypt2+0x93/0xb0\n[   28.688088]  [<ffffffff8156d7da>] ceph_x_encrypt+0x4a/0x60\n[   28.688088]  [<ffffffff8155b39d>] ? ceph_buffer_new+0x5d/0xf0\n[   28.688088]  [<ffffffff8156e837>] ceph_x_build_authorizer.isra.6+0x297/0x360\n[   28.688088]  [<ffffffff8112089b>] ? kmem_cache_alloc_trace+0x11b/0x1c0\n[   28.688088]  [<ffffffff8156b496>] ? ceph_auth_create_authorizer+0x36/0x80\n[   28.688088]  [<ffffffff8156ed83>] ceph_x_create_authorizer+0x63/0xd0\n[   28.688088]  [<ffffffff8156b4b4>] ceph_auth_create_authorizer+0x54/0x80\n[   28.688088]  [<ffffffff8155f7c0>] get_authorizer+0x80/0xd0\n[   28.688088]  [<ffffffff81555a8b>] prepare_write_connect+0x18b/0x2b0\n[   28.688088]  [<ffffffff81559289>] try_read+0x1e59/0x1f10\n\nThis is because we set up crypto scatterlists as if all buffers were\nkmalloc'ed.  Fix it.\n\nSigned-off-by: Ilya Dryomov <idryomov@redhat.com>\nReviewed-by: Sage Weil <sage@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","Ilya Dryomov",true],["597b38963392a700288552da78db8f4f3d088d21","643a80aaf16a8332d6a70921c14d4bb265446494@intel.com","iwlwifi: configure the LTR\n\ncommit 9180ac50716a097a407c6d7e7e4589754a922260 upstream.\n\nThe LTR is the handshake between the device and the root\ncomplex about the latency allowed when the bus exits power\nsave. This configuration was missing and this led to high\nlatency in the link power up. The end user could experience\nhigh latency in the network because of this.\n\nSigned-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","Emmanuel Grumbach",true]],"size":73,"ref":"refs/heads/3.10","head":"bdf8a56850ce23e2460edd5539ae98f1f19f1f27"}