linux-toradex.git, branch v3.18.23

Linux 3.18.23

2015-10-29T02:49:46+00:00

Signed-off-by: Sasha Levin

x86: Init per-cpu shadow copy of CR4 on 32-bit CPUs too

2015-10-28T20:20:25+00:00

[ Upstream commit 5b2bdbc84556774afbe11bcfd24c2f6411cfa92b ]

Commit:

   1e02ce4cccdc ("x86: Store a per-cpu shadow copy of CR4")

added a shadow CR4 such that reads and writes that do not
modify the CR4 execute much faster than always reading the
register itself.

The change modified cpu_init() in common.c, so that the
shadow CR4 gets initialized before anything uses it.

Unfortunately, there's two cpu_init()s in common.c. There's
one for 64-bit and one for 32-bit. The commit only added
the shadow init to the 64-bit path, but the 32-bit path
needs the init too.

Link: http://lkml.kernel.org/r/20150227125208.71c36402@gandalf.local.home Fixes: 1e02ce4cccdc "x86: Store a per-cpu shadow copy of CR4"
Signed-off-by: Steven Rostedt 
Acked-by: Andy Lutomirski 
Cc: Peter Zijlstra (Intel) 
Cc: Linus Torvalds 
Link: http://lkml.kernel.org/r/20150227145019.2bdd4354@gandalf.local.home
Signed-off-by: Ingo Molnar 
Signed-off-by: Sasha Levin

3w-9xxx: don't unmap bounce buffered commands

2015-10-28T07:52:26+00:00

[ Upstream commit 15e3d5a285ab9283136dba34bbf72886d9146706 ]

3w controller don't dma map small single SGL entry commands but instead
bounce buffer them.  Add a helper to identify these commands and don't
call scsi_dma_unmap for them.

Based on an earlier patch from James Bottomley.

Fixes: 118c85 ("3w-9xxx: fix command completion race")
Reported-by: Tóth Attila 
Tested-by: Tóth Attila 
Signed-off-by: Christoph Hellwig 
Acked-by: Adam Radford 
Signed-off-by: James Bottomley 
Signed-off-by: Sasha Levin

fib_rules: Fix dump_rules() not to exit early

2015-10-28T07:52:10+00:00

[ Upstream commit 8ea4b34355189e1f1eacaf2d825f2dce776b3b9c ]

Backports of 41fc014332d9 ("fib_rules: fix fib rule dumps across
multiple skbs") introduced a regression in "ip rule show" - it ends up
dumping the first rule over and over and never exiting, because 3.19
and earlier are missing commit 053c095a82cf ("netlink: make
nlmsg_end() and genlmsg_end() void"), so fib_nl_fill_rule() ends up
returning skb->len (i.e. > 0) in the success case.

Fix this by checking the return code for < 0 instead of != 0.

Signed-off-by: Roland Dreier 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

vfs: Test for and handle paths that are unreachable from their mnt_root

2015-10-28T02:14:58+00:00

[ Upstream commit 397d425dc26da728396e66d392d5dcb8dac30c37 ]

In rare cases a directory can be renamed out from under a bind mount.
In those cases without special handling it becomes possible to walk up
the directory tree to the root dentry of the filesystem and down
from the root dentry to every other file or directory on the filesystem.

Like division by zero .. from an unconnected path can not be given
a useful semantic as there is no predicting at which path component
the code will realize it is unconnected.  We certainly can not match
the current behavior as the current behavior is a security hole.

Therefore when encounting .. when following an unconnected path
return -ENOENT.

- Add a function path_connected to verify path->dentry is reachable
  from path->mnt.mnt_root.  AKA to validate that rename did not do
  something nasty to the bind mount.

  To avoid races path_connected must be called after following a path
  component to it's next path component.

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Al Viro 
Signed-off-by: Sasha Levin

md: flush ->event_work before stopping array.

2015-10-28T02:14:57+00:00

[ Upstream commit ee5d004fd0591536a061451eba2b187092e9127c ]

The 'event_work' worker used by dm-raid may still be running
when the array is stopped.  This can result in an oops.

So flush the workqueue on which it is run after detaching
and before destroying the device.

Reported-by: Heinz Mauelshagen 
Signed-off-by: NeilBrown 
Cc: stable@vger.kernel.org (2.6.38+ please delay 2 weeks after -final release)
Fixes: 9d09e663d550 ("dm: raid456 basic support")
Signed-off-by: Sasha Levin

x86/nmi/64: Fix a paravirt stack-clobbering bug in the NMI code

2015-10-28T02:14:57+00:00

[ Upstream commit 83c133cf11fb0e68a51681447e372489f052d40e ]

The NMI entry code that switches to the normal kernel stack needs to
be very careful not to clobber any extra stack slots on the NMI
stack.  The code is fine under the assumption that SWAPGS is just a
normal instruction, but that assumption isn't really true.  Use
SWAPGS_UNSAFE_STACK instead.

This is part of a fix for some random crashes that Sasha saw.

Fixes: 9b6e6a8334d5 ("x86/nmi/64: Switch stacks on userspace NMI entry")
Reported-and-tested-by: Sasha Levin 
Signed-off-by: Andy Lutomirski 
Cc: stable@vger.kernel.org
Link: http://lkml.kernel.org/r/974bc40edffdb5c2950a5c4977f821a446b76178.1442791737.git.luto@kernel.org
Signed-off-by: Thomas Gleixner 
Signed-off-by: Sasha Levin

Revert "iio: bmg160: IIO_BUFFER and IIO_TRIGGERED_BUFFER are required"

2015-10-28T02:14:56+00:00

[ Upstream commit HEAD ]

This reverts commit 279c039ca63acbd69e69d6d7ddfed50346fb2185 which was
commit 06d2f6ca5a38abe92f1f3a132b331eee773868c3 upstream as it should
not have been applied.

Reported-by: Luis Henriques 
Cc: Markus Pargmann 
Cc: Srinivas Pandruvada 
Cc: Jonathan Cameron 
Signed-off-by: Greg Kroah-Hartman 

(cherry picked from commit 934d9b907aeec5f344ca801ed7361551199dfc69)
Signed-off-by: Sasha Levin

net: Fix skb_set_peeked use-after-free bug

2015-10-28T02:14:55+00:00

[ Upstream commit a0a2a6602496a45ae838a96db8b8173794b5d398 ]

The commit 738ac1ebb96d02e0d23bc320302a6ea94c612dec ("net: Clone
skb before setting peeked flag") introduced a use-after-free bug
in skb_recv_datagram.  This is because skb_set_peeked may create
a new skb and free the existing one.  As it stands the caller will
continue to use the old freed skb.

This patch fixes it by making skb_set_peeked return the new skb
(or the old one if unchanged).

Fixes: 738ac1ebb96d ("net: Clone skb before setting peeked flag")
Reported-by: Brenden Blanco 
Signed-off-by: Herbert Xu 
Tested-by: Brenden Blanco 
Reviewed-by: Konstantin Khlebnikov 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

mm: check if section present during memory block registering

2015-10-28T02:14:54+00:00

[ Upstream commit 04697858d89e4bf2650364f8d6956e2554e8ef88 ]

Tony Luck found on his setup, if memory block size 512M will cause crash
during booting.

  BUG: unable to handle kernel paging request at ffffea0074000020
  IP: get_nid_for_pfn+0x17/0x40
  PGD 128ffcb067 PUD 128ffc9067 PMD 0
  Oops: 0000 [#1] SMP
  Modules linked in:
  CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.2.0-rc8 #1
  ...
  Call Trace:
     ? register_mem_sect_under_node+0x66/0xe0
     register_one_node+0x17b/0x240
     ? pci_iommu_alloc+0x6e/0x6e
     topology_init+0x3c/0x95
     do_one_initcall+0xcd/0x1f0

The system has non continuous RAM address:
 BIOS-e820: [mem 0x0000001300000000-0x0000001cffffffff] usable
 BIOS-e820: [mem 0x0000001d70000000-0x0000001ec7ffefff] usable
 BIOS-e820: [mem 0x0000001f00000000-0x0000002bffffffff] usable
 BIOS-e820: [mem 0x0000002c18000000-0x0000002d6fffefff] usable
 BIOS-e820: [mem 0x0000002e00000000-0x00000039ffffffff] usable

So there are start sections in memory block not present.  For example:

    memory block : [0x2c18000000, 0x2c20000000) 512M

first three sections are not present.

The current register_mem_sect_under_node() assume first section is
present, but memory block section number range [start_section_nr,
end_section_nr] would include not present section.

For arch that support vmemmap, we don't setup memmap for struct page
area within not present sections area.

So skip the pfn range that belong to absent section.

[akpm@linux-foundation.org: simplification]
[rientjes@google.com: more simplification]
Fixes: bdee237c0343 ("x86: mm: Use 2GB memory block size on large memory x86-64 systems")
Fixes: 982792c782ef ("x86, mm: probe memory block size for generic x86 64bit")
Signed-off-by: Yinghai Lu 
Signed-off-by: David Rientjes 
Reported-by: Tony Luck 
Tested-by: Tony Luck 
Cc: Greg KH 
Cc: Ingo Molnar 
Tested-by: David Rientjes 
Cc: 	[3.15+]
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 

Signed-off-by: Sasha Levin