{"push_id":1921366498,"size":377,"distinct_size":9,"ref":"refs/heads/standard/preempt-rt/intel-x86-32","head":"fb9c8e357b29dde05ad9827b62263cbe9cdabf43","before":"9f6ea4c64575915c45aeeecf8471ffbbf28609fc","commits":[{"sha":"eaae8c8005c1879035252c8a577f0ea7179992a4","author":{"name":"Alexander Popov","email":"a553a607cbdcea38d5c7f4eb348a2ce593158f6d@linux.com"},"message":"tty: n_hdlc: get rid of racy n_hdlc.tbuf\n\ncommit 82f2341c94d270421f383641b7cd670e474db56b upstream.\n\nCurrently N_HDLC line discipline uses a self-made singly linked list for\ndata buffers and has n_hdlc.tbuf pointer for buffer retransmitting after\nan error.\n\nThe commit be10eb7589337e5defbe214dae038a53dd21add8\n(\"tty: n_hdlc add buffer flushing\") introduced racy access to n_hdlc.tbuf.\nAfter tx error concurrent flush_tx_queue() and n_hdlc_send_frames() can put\none data buffer to tx_free_buf_list twice. That causes double free in\nn_hdlc_release().\n\nLet's use standard kernel linked list and get rid of n_hdlc.tbuf:\nin case of tx error put current data buffer after the head of tx_buf_list.\n\nSigned-off-by: Alexander Popov <alex.popov@linux.com>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/eaae8c8005c1879035252c8a577f0ea7179992a4"},{"sha":"d44d2ea6400347393ba2fb64442a4c9739f8c682","author":{"name":"Ian Abbott","email":"494c7f4da2ed9b356b47e2dfeca52bf8ebbb3680@mev.co.uk"},"message":"serial: 8250_pci: Add MKS Tenta SCOM-0800 and SCOM-0801 cards\n\ncommit 1c9c858e2ff8ae8024a3d75d2ed080063af43754 upstream.\n\nThe MKS Instruments SCOM-0800 and SCOM-0801 cards (originally by Tenta\nTechnologies) are 3U CompactPCI serial cards with 4 and 8 serial ports,\nrespectively.  The first 4 ports are implemented by an OX16PCI954 chip,\nand the second 4 ports are implemented by an OX16C954 chip on a local\nbus, bridged by the second PCI function of the OX16PCI954.  The ports\nare jumper-selectable as RS-232 and RS-422/485, and the UARTs use a\nnon-standard oscillator frequency of 20 MHz (base_baud = 1250000).\n\nSigned-off-by: Ian Abbott <abbotti@mev.co.uk>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/d44d2ea6400347393ba2fb64442a4c9739f8c682"},{"sha":"61157eabc44e201a7f100a9a2af354b6bf5fcd3d","author":{"name":"Janosch Frank","email":"ed9db37428c3e0efa3c76bf823cee3f07bc3b207@linux.vnet.ibm.com"},"message":"KVM: s390: Disable dirty log retrieval for UCONTROL guests\n\ncommit e1e8a9624f7ba8ead4f056ff558ed070e86fa747 upstream.\n\nUser controlled KVM guests do not support the dirty log, as they have\nno single gmap that we can check for changes.\n\nAs they have no single gmap, kvm->arch.gmap is NULL and all further\nreferencing to it for dirty checking will result in a NULL\ndereference.\n\nLet's return -EINVAL if a caller tries to sync dirty logs for a\nUCONTROL guest.\n\nFixes: 15f36eb (\"KVM: s390: Add proper dirty bitmap support to S390 kvm.\")\nCc: <stable@vger.kernel.org> # 3.16+\n\nSigned-off-by: Janosch Frank <frankja@linux.vnet.ibm.com>\nReported-by: Martin Schwidefsky <schwidefsky@de.ibm.com>\nReviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>\nSigned-off-by: Christian Borntraeger <borntraeger@de.ibm.com>\nSigned-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/61157eabc44e201a7f100a9a2af354b6bf5fcd3d"},{"sha":"7f422c5aec89da4a580ef4c0427cf3cd22e67644","author":{"name":"Chao Peng","email":"d5dd29c82d80b2f017072bbd3ccca05efa112b2e@linux.intel.com"},"message":"KVM: VMX: use correct vmcs_read/write for guest segment selector/base\n\ncommit 96794e4ed4d758272c486e1529e431efb7045265 upstream.\n\nGuest segment selector is 16 bit field and guest segment base is natural\nwidth field. Fix two incorrect invocations accordingly.\n\nWithout this patch, build fails when aggressive inlining is used with ICC.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Chao Peng <chao.p.peng@linux.intel.com>\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/7f422c5aec89da4a580ef4c0427cf3cd22e67644"},{"sha":"7d9a72f5eb8cebb246891d628cdf83e8f7edb4c8","author":{"name":"Dmitry Tunin","email":"b5922c3d2ee22bac788d9506f4abbf6a1cbf83f3@gmail.com"},"message":"Bluetooth: Add another AR3012 04ca:3018 device\n\ncommit 441ad62d6c3f131f1dbd7dcdd9cbe3f74dbd8501 upstream.\n\nT:  Bus=01 Lev=01 Prnt=01 Port=07 Cnt=04 Dev#=  5 Spd=12  MxCh= 0\nD:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1\nP:  Vendor=04ca ProdID=3018 Rev=00.01\nC:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA\nI:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb\nI:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb\n\nSigned-off-by: Dmitry Tunin <hanipouspilot@gmail.com>\nSigned-off-by: Marcel Holtmann <marcel@holtmann.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/7d9a72f5eb8cebb246891d628cdf83e8f7edb4c8"},{"sha":"e1b323f8b65e1371cc44391b43b92a750cf19da3","author":{"name":"Julian Wiedmann","email":"174a9fc5b810c717cf9467d55c8d87e214886168@linux.vnet.ibm.com"},"message":"s390/qdio: clear DSCI prior to scanning multiple input queues\n\ncommit 1e4a382fdc0ba8d1a85b758c0811de3a3631085e upstream.\n\nFor devices with multiple input queues, tiqdio_call_inq_handlers()\niterates over all input queues and clears the device's DSCI\nduring each iteration. If the DSCI is re-armed during one\nof the later iterations, we therefore do not scan the previous\nqueues again.\nThe re-arming also raises a new adapter interrupt. But its\nhandler does not trigger a rescan for the device, as the DSCI\nhas already been erroneously cleared.\nThis can result in queue stalls on devices with multiple\ninput queues.\n\nFix it by clearing the DSCI just once, prior to scanning the queues.\n\nAs the code is moved in front of the loop, we also need to access\nthe DSCI directly (ie irq->dsci) instead of going via each queue's\nparent pointer to the same irq. This is not a functional change,\nand a follow-up patch will clean up the other users.\n\nIn practice, this bug only affects CQ-enabled HiperSockets devices,\nie. devices with sysfs-attribute \"hsuid\" set. Setting a hsuid is\nneeded for AF_IUCV socket applications that use HiperSockets\ncommunication.\n\nFixes: 104ea556ee7f (\"qdio: support asynchronous delivery of storage blocks\")\nCc: <stable@vger.kernel.org> # v3.2+\nReviewed-by: Ursula Braun <ubraun@linux.vnet.ibm.com>\nSigned-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>\nSigned-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>\nSigned-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/e1b323f8b65e1371cc44391b43b92a750cf19da3"},{"sha":"b3e8ded18f8e9ee6c6840141d1c596f44fdd9b96","author":{"name":"Gerald Schaefer","email":"d0150e0ca5486e3210c1f22bd7f99391fe0f34d3@de.ibm.com"},"message":"s390/dcssblk: fix device size calculation in dcssblk_direct_access()\n\ncommit a63f53e34db8b49675448d03ae324f6c5bc04fe6 upstream.\n\nSince commit dd22f551 \"block: Change direct_access calling convention\",\nthe device size calculation in dcssblk_direct_access() is off-by-one.\nThis results in bdev_direct_access() always returning -ENXIO because the\nreturned value is not page aligned.\n\nFix this by adding 1 to the dev_sz calculation.\n\nFixes: dd22f551 (\"block: Change direct_access calling convention\")\nCc: <stable@vger.kernel.org> # 4.0+\nSigned-off-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>\nSigned-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>\nSigned-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/b3e8ded18f8e9ee6c6840141d1c596f44fdd9b96"},{"sha":"a35d74c9c4a09d43697f4b35f8942602cb805a35","author":{"name":"Michael Holzheu","email":"b314df21e46473b2ba84dc59375d30b15cf9dee0@linux.vnet.ibm.com"},"message":"s390/kdump: Use \"LINUX\" ELF note name instead of \"CORE\"\n\ncommit a4a81d8eebdc1d209d034f62a082a5131e4242b5 upstream.\n\nIn binutils/libbfd (bfd/elf.c) it is enforced that all s390 specific ELF\nnotes like e.g. NT_S390_PREFIX or NT_S390_CTRS have \"LINUX\" specified\nas note name. Otherwise the notes are ignored.\n\nFor /proc/vmcore we currently use \"CORE\" for these notes.\n\nUp to now this has not been a real problem because the dump analysis tool\n\"crash\" does not check the note name. But it will break all programs that\nuse libbfd for processing ELF notes.\n\nSo fix this and use \"LINUX\" for all s390 specific notes to comply with\nlibbfd.\n\nCc: stable@vger.kernel.org # v4.4+\nReported-by: Philipp Rudo <prudo@linux.vnet.ibm.com>\nReviewed-by: Philipp Rudo <prudo@linux.vnet.ibm.com>\nSigned-off-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>\nSigned-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>\nSigned-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/a35d74c9c4a09d43697f4b35f8942602cb805a35"},{"sha":"64deb4069c4b4a6d175380fc674bd5ababde4f90","author":{"name":"Peter Oberparleiter","email":"3d4711de476a07c41c9749202e1f5e6ab3759611@linux.vnet.ibm.com"},"message":"s390/chsc: Add exception handler for CHSC instruction\n\ncommit 77759137248f34864a8f7a58bbcebfcf1047504a upstream.\n\nPrevent kernel crashes due to unhandled exceptions raised by the CHSC\ninstruction which may for example be triggered by invalid ioctl data.\n\nFixes: 64150adf89df (\"s390/cio: Introduce generic synchronous CHSC IOCTL\")\nCc: <stable@vger.kernel.org> # v3.11+\nSigned-off-by: Peter Oberparleiter <oberpar@linux.vnet.ibm.com>\nReviewed-by: Sebastian Ott <sebott@linux.vnet.ibm.com>\nReviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>\nSigned-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>\nSigned-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/64deb4069c4b4a6d175380fc674bd5ababde4f90"},{"sha":"bb318913c8ab254f0bbaf10870c0abb5e40e95cc","author":{"name":"Martin Schwidefsky","email":"9888847d934b0a2b68638ec948181961d68813c8@de.ibm.com"},"message":"s390: TASK_SIZE for kernel threads\n\ncommit fb94a687d96c570d46332a4a890f1dcb7310e643 upstream.\n\nReturn a sensible value if TASK_SIZE if called from a kernel thread.\n\nThis gets us around an issue with copy_mount_options that does a magic\nsize calculation \"TASK_SIZE - (unsigned long)data\" while in a kernel\nthread and data pointing to kernel space.\n\nCc: <stable@vger.kernel.org>\nSigned-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>\nSigned-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/bb318913c8ab254f0bbaf10870c0abb5e40e95cc"},{"sha":"e936795084d3f9961e58793630b147774f862f8e","author":{"name":"Heiko Carstens","email":"b2244c494cfb2f2e9003288a5a0aae79bf12423b@de.ibm.com"},"message":"s390: make setup_randomness work\n\ncommit da8fd820f389a0e29080b14c61bf5cf1d8ef5ca1 upstream.\n\nCommit bcfcbb6bae64 (\"s390: add system information as device\nrandomness\") intended to add some virtual machine specific information\nto the randomness pool.\n\nUnfortunately it uses the page allocator before it is ready to use. In\nresult the page allocator always returns NULL and the setup_randomness\nfunction never adds anything to the randomness pool.\n\nTo fix this use memblock_alloc and memblock_free instead.\n\nFixes: bcfcbb6bae64 (\"s390: add system information as device randomness\")\nSigned-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>\nSigned-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>\nSigned-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/e936795084d3f9961e58793630b147774f862f8e"},{"sha":"7006fe7139f66553723abdb6558811b35ab6411d","author":{"name":"Heiko Carstens","email":"b2244c494cfb2f2e9003288a5a0aae79bf12423b@de.ibm.com"},"message":"s390: use correct input data address for setup_randomness\n\ncommit 4920e3cf77347d7d7373552d4839e8d832321313 upstream.\n\nThe current implementation of setup_randomness uses the stack address\nand therefore the pointer to the SYSIB 3.2.2 block as input data\naddress. Furthermore the length of the input data is the number of\nvirtual-machine description blocks which is typically one.\n\nThis means that typically a single zero byte is fed to\nadd_device_randomness.\n\nFix both of these and use the address of the first virtual machine\ndescription block as input data address and also use the correct\nlength.\n\nFixes: bcfcbb6bae64 (\"s390: add system information as device randomness\")\nSigned-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>\nSigned-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>\nSigned-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/7006fe7139f66553723abdb6558811b35ab6411d"},{"sha":"3c20ea7dd380da8dfcb399b935f764acca61a5e8","author":{"name":"Thomas Petazzoni","email":"8184181a894e706105679bbf6797daaadfd8a66a@free-electrons.com"},"message":"net: mvpp2: fix DMA address calculation in mvpp2_txq_inc_put()\n\ncommit 239a3b663647869330955ec59caac0100ef9b60a upstream.\n\nWhen TX descriptors are filled in, the buffer DMA address is split\nbetween the tx_desc->buf_phys_addr field (high-order bits) and\ntx_desc->packet_offset field (5 low-order bits).\n\nHowever, when we re-calculate the DMA address from the TX descriptor in\nmvpp2_txq_inc_put(), we do not take tx_desc->packet_offset into\naccount. This means that when the DMA address is not aligned on a 32\nbytes boundary, we end up calling dma_unmap_single() with a DMA address\nthat was not the one returned by dma_map_single().\n\nThis inconsistency is detected by the kernel when DMA_API_DEBUG is\nenabled. We fix this problem by properly calculating the DMA address in\nmvpp2_txq_inc_put().\n\nCc: <stable@vger.kernel.org>\nSigned-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/3c20ea7dd380da8dfcb399b935f764acca61a5e8"},{"sha":"55730c566d1122ee2fb8fa1e9593a7f4bbda368a","author":{"name":"Andrew Donnellan","email":"88f9fbfa5a7fc0c41e284752e169a16d1d6535b0@au1.ibm.com"},"message":"cxl: Prevent read/write to AFU config space while AFU not configured\n\ncommit 14a3ae34bfd0bcb1cc12d55b06a8584c11fac6fc upstream.\n\nDuring EEH recovery, we deconfigure all AFUs whilst leaving the\ncorresponding vPHB and virtual PCI device in place.\n\nIf something attempts to interact with the AFU's PCI config space (e.g.\nrunning lspci) after the AFU has been deconfigured and before it's\nreconfigured, cxl_pcie_{read,write}_config() will read invalid values from\nthe deconfigured struct cxl_afu and proceed to Oops when they try to\ndereference pointers that have been set to NULL during deconfiguration.\n\nAdd a rwsem to struct cxl_afu so we can prevent interaction with config\nspace while the AFU is deconfigured.\n\nReported-by: Pradipta Ghosh <pradghos@in.ibm.com>\nSuggested-by: Frederic Barrat <fbarrat@linux.vnet.ibm.com>\nCc: stable@vger.kernel.org # v4.9+\nSigned-off-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>\nSigned-off-by: Vaibhav Jain <vaibhav@linux.vnet.ibm.com>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/55730c566d1122ee2fb8fa1e9593a7f4bbda368a"},{"sha":"521cf3b703599ca97b2e87bd0ef579d122598def","author":{"name":"Gavin Li","email":"5bf00c93c9250d44d769b81890fa6584403ae7e0@thegavinli.com"},"message":"brcmfmac: fix incorrect event channel deduction\n\ncommit 8e290cecdd0178f3d4cf7d463c51dc7e462843b4 upstream.\n\nbrcmf_sdio_fromevntchan() was being called on the the data frame\nrather than the software header, causing some frames to be\nmischaracterized as on the event channel rather than the data channel.\n\nThis fixes a major performance regression (due to dropped packets). With\nthis patch the download speed jumped from 1Mbit/s back up to 40MBit/s due\nto the sheer amount of packets being incorrectly processed.\n\nFixes: c56caa9db8ab (\"brcmfmac: screening firmware event packet\")\nSigned-off-by: Gavin Li <git@thegavinli.com>\nCc: <stable@vger.kernel.org> # 4.7+\nAcked-by: Arend van Spriel <arend.vanspriel@broadcom.com>\n[kvalo@codeaurora.org: improve commit logs based on email discussion]\nSigned-off-by: Kalle Valo <kvalo@codeaurora.org>\nSigned-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/521cf3b703599ca97b2e87bd0ef579d122598def"},{"sha":"77563b9714b90fedc70f0916d1a9c88c94ce92c1","author":{"name":"Eric W. Biederman","email":"e4ccc9f9b54eebd6cb8fc7643b8083f628b68ff2@xmission.com"},"message":"mnt: Tuck mounts under others instead of creating shadow/side mounts.\n\ncommit 1064f874abc0d05eeed8993815f584d847b72486 upstream.\n\nEver since mount propagation was introduced in cases where a mount in\npropagated to parent mount mountpoint pair that is already in use the\ncode has placed the new mount behind the old mount in the mount hash\ntable.\n\nThis implementation detail is problematic as it allows creating\narbitrary length mount hash chains.\n\nFurthermore it invalidates the constraint maintained elsewhere in the\nmount code that a parent mount and a mountpoint pair will have exactly\none mount upon them.  Making it hard to deal with and to talk about\nthis special case in the mount code.\n\nModify mount propagation to notice when there is already a mount at\nthe parent mount and mountpoint where a new mount is propagating to\nand place that preexisting mount on top of the new mount.\n\nModify unmount propagation to notice when a mount that is being\nunmounted has another mount on top of it (and no other children), and\nto replace the unmounted mount with the mount on top of it.\n\nMove the MNT_UMUONT test from __lookup_mnt_last into\n__propagate_umount as that is the only call of __lookup_mnt_last where\nMNT_UMOUNT may be set on any mount visible in the mount hash table.\n\nThese modifications allow:\n - __lookup_mnt_last to be removed.\n - attach_shadows to be renamed __attach_mnt and its shadow\n   handling to be removed.\n - commit_tree to be simplified\n - copy_tree to be simplified\n\nThe result is an easier to understand tree of mounts that does not\nallow creation of arbitrary length hash chains in the mount hash table.\n\nThe result is also a very slight userspace visible difference in semantics.\nThe following two cases now behave identically, where before order\nmattered:\n\ncase 1: (explicit user action)\n\tB is a slave of A\n\tmount something on A/a , it will propagate to B/a\n\tand than mount something on B/a\n\ncase 2: (tucked mount)\n\tB is a slave of A\n\tmount something on B/a\n\tand than mount something on A/a\n\nHistroically umount A/a would fail in case 1 and succeed in case 2.\nNow umount A/a succeeds in both configurations.\n\nThis very small change in semantics appears if anything to be a bug\nfix to me and my survey of userspace leads me to believe that no programs\nwill notice or care of this subtle semantic change.\n\nv2: Updated to mnt_change_mountpoint to not call dput or mntput\nand instead to decrement the counts directly.  It is guaranteed\nthat there will be other references when mnt_change_mountpoint is\ncalled so this is safe.\n\nv3: Moved put_mountpoint under mount_lock in attach_recursive_mnt\n    As the locking in fs/namespace.c changed between v2 and v3.\n\nv4: Reworked the logic in propagate_mount_busy and __propagate_umount\n    that detects when a mount completely covers another mount.\n\nv5: Removed unnecessary tests whose result is alwasy true in\n    find_topper and attach_recursive_mnt.\n\nv6: Document the user space visible semantic difference.\n\nCc: stable@vger.kernel.org\nFixes: b90fa9ae8f51 (\"[PATCH] shared mount handling: bind and rbind\")\nTested-by: Andrei Vagin <avagin@virtuozzo.com>\nSigned-off-by: \"Eric W. Biederman\" <ebiederm@xmission.com>\nSigned-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/77563b9714b90fedc70f0916d1a9c88c94ce92c1"},{"sha":"f54cae186e6ebe4fbd94295e8f489050973e0a7a","author":{"name":"Feras Daoud","email":"005832ac8f0780bc0fab40c8ce2d77cdbb2c5097@mellanox.com"},"message":"IB/ipoib: Fix deadlock between rmmod and set_mode\n\ncommit 0a0007f28304cb9fc87809c86abb80ec71317f20 upstream.\n\nWhen calling set_mode from sys/fs, the call flow locks the sys/fs lock\nfirst and then tries to lock rtnl_lock (when calling ipoib_set_mod).\nOn the other hand, the rmmod call flow takes the rtnl_lock first\n(when calling unregister_netdev) and then tries to take the sys/fs\nlock. Deadlock a->b, b->a.\n\nThe problem starts when ipoib_set_mod frees it's rtnl_lck and tries\nto get it after that.\n\n    set_mod:\n    [<ffffffff8104f2bd>] ? check_preempt_curr+0x6d/0x90\n    [<ffffffff814fee8e>] __mutex_lock_slowpath+0x13e/0x180\n    [<ffffffff81448655>] ? __rtnl_unlock+0x15/0x20\n    [<ffffffff814fed2b>] mutex_lock+0x2b/0x50\n    [<ffffffff81448675>] rtnl_lock+0x15/0x20\n    [<ffffffffa02ad807>] ipoib_set_mode+0x97/0x160 [ib_ipoib]\n    [<ffffffffa02b5f5b>] set_mode+0x3b/0x80 [ib_ipoib]\n    [<ffffffff8134b840>] dev_attr_store+0x20/0x30\n    [<ffffffff811f0fe5>] sysfs_write_file+0xe5/0x170\n    [<ffffffff8117b068>] vfs_write+0xb8/0x1a0\n    [<ffffffff8117ba81>] sys_write+0x51/0x90\n    [<ffffffff8100b0f2>] system_call_fastpath+0x16/0x1b\n\n    rmmod:\n    [<ffffffff81279ffc>] ? put_dec+0x10c/0x110\n    [<ffffffff8127a2ee>] ? number+0x2ee/0x320\n    [<ffffffff814fe6a5>] schedule_timeout+0x215/0x2e0\n    [<ffffffff8127cc04>] ? vsnprintf+0x484/0x5f0\n    [<ffffffff8127b550>] ? string+0x40/0x100\n    [<ffffffff814fe323>] wait_for_common+0x123/0x180\n    [<ffffffff81060250>] ? default_wake_function+0x0/0x20\n    [<ffffffff8119661e>] ? ifind_fast+0x5e/0xb0\n    [<ffffffff814fe43d>] wait_for_completion+0x1d/0x20\n    [<ffffffff811f2e68>] sysfs_addrm_finish+0x228/0x270\n    [<ffffffff811f2fb3>] sysfs_remove_dir+0xa3/0xf0\n    [<ffffffff81273f66>] kobject_del+0x16/0x40\n    [<ffffffff8134cd14>] device_del+0x184/0x1e0\n    [<ffffffff8144e59b>] netdev_unregister_kobject+0xab/0xc0\n    [<ffffffff8143c05e>] rollback_registered+0xae/0x130\n    [<ffffffff8143c102>] unregister_netdevice+0x22/0x70\n    [<ffffffff8143c16e>] unregister_netdev+0x1e/0x30\n    [<ffffffffa02a91b0>] ipoib_remove_one+0xe0/0x120 [ib_ipoib]\n    [<ffffffffa01ed95f>] ib_unregister_device+0x4f/0x100 [ib_core]\n    [<ffffffffa021f5e1>] mlx4_ib_remove+0x41/0x180 [mlx4_ib]\n    [<ffffffffa01ab771>] mlx4_remove_device+0x71/0x90 [mlx4_core]\n\nFixes: 862096a8bbf8 (\"IB/ipoib: Add more rtnl_link_ops callbacks\")\nCc: <stable@vger.kernel.org> # v3.6+\nCc: Or Gerlitz <ogerlitz@mellanox.com>\nSigned-off-by: Feras Daoud <ferasda@mellanox.com>\nSigned-off-by: Erez Shitrit <erezsh@mellanox.com>\nSigned-off-by: Leon Romanovsky <leon@kernel.org>\nSigned-off-by: Doug Ledford <dledford@redhat.com>\nSigned-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/f54cae186e6ebe4fbd94295e8f489050973e0a7a"},{"sha":"63129c2502c117c6ad884892c56a3a8bfacbf3fc","author":{"name":"Leon Romanovsky","email":"4cc6c8126a09f19997c8c85dc47ba9d3a9808d4a@mellanox.com"},"message":"IB/mlx5: Fix out-of-bound access\n\ncommit 0fd27a88c2e4f548937fd7d93fc6e65c4ad7c278 upstream.\n\nWhen we initialize buffer to create SRQ in kernel,\nthe number of pages was less than actually used in\nfollowing mlx5_fill_page_array().\n\nFixes: e126ba97dba9 (\"mlx5: Add driver for Mellanox Connect-IB adapters\")\nCc: <stable@vger.kernel.org> # v3.10+\nSigned-off-by: Leon Romanovsky <leonro@mellanox.com>\nReviewed-by: Eli Cohen <eli@mellanox.com>\nSigned-off-by: Leon Romanovsky <leon@kernel.org>\nSigned-off-by: Doug Ledford <dledford@redhat.com>\nSigned-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/63129c2502c117c6ad884892c56a3a8bfacbf3fc"},{"sha":"f3572a0ce31f3990f0499ac334bb8044e5dcf8bf","author":{"name":"Bart Van Assche","email":"b8a13ad2fc8473e67a34a68acf4216fb1fa3477b@sandisk.com"},"message":"IB/SRP: Avoid using IB_MR_TYPE_SG_GAPS\n\ncommit d6c58dc40fec35ff6cdb350b53bce0fcf9143709 upstream.\n\nTests have shown that the following error message is reported when\nusing SG-GAPS registration with an mlx5 adapter:\n\nscsi host1: ib_srp: failed RECV status WR flushed (5) for CQE ffff880bd4270eb0\n00000000 00000000 00000000 00000000\n00000000 00000000 00000000 00000000\n00000000 00000000 00000000 00000000\n00000000 0f007806 2500002a ad9fafd1\nscsi host1: ib_srp: reconnect succeeded\nmlx5_0:dump_cqe:262:(pid 7369): dump error cqe\n00000000 00000000 00000000 00000000\n00000000 00000000 00000000 00000000\n00000000 00000000 00000000 00000000\n00000000 0f007806 25000032 00105dd0\nscsi host1: ib_srp: failed FAST REG status memory management operation error (6) for CQE ffff880b92860138\n\nHence avoid using SG-GAPS memory registrations. Additionally,\nalways configure the blk_queue_virt_boundary() to avoid to trigger\na mapping failure when using adapters that support SG-GAPS (e.g.\nmlx5).\n\nFixes: commit ad8e66b4a801 (\"IB/srp: fix mr allocation when the device supports sg gaps\")\nFixes: commit 509c5f33f4f6 (\"IB/srp: Prevent mapping failures\")\nReported-by: Laurence Oberman <loberman@redhat.com>\nSigned-off-by: Bart Van Assche <bart.vanassche@sandisk.com>\nCc: Israel Rukshin <israelr@mellanox.com>\nCc: Max Gurtovoy <maxg@mellanox.com>\nCc: Leon Romanovsky <leonro@mellanox.com>\nCc: Mark Bloch <markb@mellanox.com>\nCc: Yuval Shaia <yuval.shaia@oracle.com>\nCc: <stable@vger.kernel.org> # 4.7+\nSigned-off-by: Doug Ledford <dledford@redhat.com>\nSigned-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/f3572a0ce31f3990f0499ac334bb8044e5dcf8bf"},{"sha":"24960d72feeb57ac194df3ec5a39610ea35fbf01","author":{"name":"Bart Van Assche","email":"b8a13ad2fc8473e67a34a68acf4216fb1fa3477b@sandisk.com"},"message":"IB/srp: Avoid that duplicate responses trigger a kernel bug\n\ncommit 6cb72bc1b40bb2c1750ee7a5ebade93bed49a5fb upstream.\n\nAfter srp_process_rsp() returns there is a short time during which\nthe scsi_host_find_tag() call will return a pointer to the SCSI\ncommand that is being completed. If during that time a duplicate\nresponse is received, avoid that the following call stack appears:\n\nBUG: unable to handle kernel NULL pointer dereference at           (null)\nIP: srp_recv_done+0x450/0x6b0 [ib_srp]\nOops: 0000 [#1] SMP\nCPU: 10 PID: 0 Comm: swapper/10 Not tainted 4.10.0-rc7-dbg+ #1\nCall Trace:\n <IRQ>\n __ib_process_cq+0x4b/0xd0 [ib_core]\n ib_poll_handler+0x1d/0x70 [ib_core]\n irq_poll_softirq+0xba/0x120\n __do_softirq+0xba/0x4c0\n irq_exit+0xbe/0xd0\n smp_apic_timer_interrupt+0x38/0x50\n apic_timer_interrupt+0x90/0xa0\n </IRQ>\nRIP: srp_recv_done+0x450/0x6b0 [ib_srp] RSP: ffff88046f483e20\n\nSigned-off-by: Bart Van Assche <bart.vanassche@sandisk.com>\nCc: Israel Rukshin <israelr@mellanox.com>\nCc: Max Gurtovoy <maxg@mellanox.com>\nCc: Laurence Oberman <loberman@redhat.com>\nCc: Steve Feeley <Steve.Feeley@sandisk.com>\nCc: <stable@vger.kernel.org>\nReviewed-by: Leon Romanovsky <leonro@mellanox.com>\nSigned-off-by: Doug Ledford <dledford@redhat.com>\nSigned-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/24960d72feeb57ac194df3ec5a39610ea35fbf01"}]}
{"actor":{"display_login":"mseaster-wr"}}