linux-stable.git, branch v3.12.72

Linux 3.12.72

2017-03-14T13:14:18+00:00

drivers: hv: Turn off write permission on the hypercall page

2017-03-13T20:40:52+00:00

commit 372b1e91343e657a7cc5e2e2bcecd5140ac28119 upstream.

The hypercall page only needs to be executable but currently it is setup to
be writable as well. Fix the issue.

Signed-off-by: K. Y. Srinivasan 
Acked-by: Kees Cook 
Reported-by: Stephen Hemminger 
Tested-by: Stephen Hemminger 
Signed-off-by: Jiri Slaby

fat: fix using uninitialized fields of fat_inode/fsinfo_inode

2017-03-13T20:40:51+00:00

commit c0d0e351285161a515396b7b1ee53ec9ffd97e3c upstream.

Recently fallocate patch was merged and it uses
MSDOS_I(inode)->mmu_private at fat_evict_inode().  However,
fat_inode/fsinfo_inode that was introduced in past didn't initialize
MSDOS_I(inode) properly.

With those combinations, it became the cause of accessing random entry
in FAT area.

Link: http://lkml.kernel.org/r/87pohrj4i8.fsf@mail.parknet.co.jp
Signed-off-by: OGAWA Hirofumi 
Reported-by: Moreno Bartalucci 
Tested-by: Moreno Bartalucci 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Jiri Slaby

drm/ttm: Make sure BOs being swapped out are cacheable

2017-03-13T20:40:51+00:00

commit 239ac65fa5ffab71adf66e642750f940e7241d99 upstream.

The current caching state may not be tt_cached, even though the
placement contains TTM_PL_FLAG_CACHED, because placement can contain
multiple caching flags. Trying to swap out such a BO would trip up the

	BUG_ON(ttm->caching_state != tt_cached);

in ttm_tt_swapout.

Signed-off-by: Michel Dänzer 
Reviewed-by: Thomas Hellstrom 
Reviewed-by: Christian König .
Reviewed-by: Sinclair Yeh 
Signed-off-by: Christian König 
Signed-off-by: Jiri Slaby

drm/ast: Fix test for VGA enabled

2017-03-13T20:40:50+00:00

commit 905f21a49d388de3e99438235f3301cabf0c0ef4 upstream.

The test to see if VGA was already enabled is doing an unnecessary
second test from a register that may or may not have been initialized
to a valid value. Remove it.

Signed-off-by: Y.C. Chen 
Signed-off-by: Benjamin Herrenschmidt 
Acked-by: Joel Stanley 
Tested-by: Y.C. Chen 
Signed-off-by: Dave Airlie 
Signed-off-by: Jiri Slaby

mac80211: flush delayed work when entering suspend

2017-03-13T20:40:49+00:00

commit a9e9200d8661c1a0be8c39f93deb383dc940de35 upstream.

The issue was found when entering suspend and resume.
It triggers a warning in:
mac80211/key.c: ieee80211_enable_keys()
...
WARN_ON_ONCE(sdata->crypto_tx_tailroom_needed_cnt ||
             sdata->crypto_tx_tailroom_pending_dec);
...

It points out sdata->crypto_tx_tailroom_pending_dec isn't cleaned up successfully
in a delayed_work during suspend. Add a flush_delayed_work to fix it.

Signed-off-by: Matt Chen 
Signed-off-by: Johannes Berg 
Signed-off-by: Jiri Slaby

xtensa: move parse_tag_fdt out of #ifdef CONFIG_BLK_DEV_INITRD

2017-03-13T20:40:48+00:00

commit 4ab18701c66552944188dbcd0ce0012729baab84 upstream.

FDT tag parsing is not related to whether BLK_DEV_INITRD is configured
or not, move it out of the corresponding #ifdef/#endif block.
This fixes passing external FDT to the kernel configured w/o
BLK_DEV_INITRD support.

Signed-off-by: Max Filippov 
Signed-off-by: Jiri Slaby

nlm: Ensure callback code also checks that the files match

2017-03-13T20:40:48+00:00

commit 251af29c320d86071664f02c76f0d063a19fefdf upstream.

It is not sufficient to just check that the lock pids match when
granting a callback, we also need to ensure that we're granting
the callback on the right file.

Reported-by: Pankaj Singh 
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Trond Myklebust 
Signed-off-by: Anna Schumaker 
Signed-off-by: Jiri Slaby

ktest: Fix child exit code processing

2017-03-13T20:40:47+00:00

commit 32677207dcc5e594254b7fb4fb2352b1755b1d5b upstream.

The child_exit errno needs to be shifted by 8 bits to compare against the
return values for the bisect variables.

Fixes: c5dacb88f0a64 ("ktest: Allow overriding bisect test results")
Signed-off-by: Steven Rostedt (VMware) 
Signed-off-by: Jiri Slaby

IB/ipoib: Fix deadlock between rmmod and set_mode

2017-03-13T20:40:46+00:00

commit 0a0007f28304cb9fc87809c86abb80ec71317f20 upstream.

When calling set_mode from sys/fs, the call flow locks the sys/fs lock
first and then tries to lock rtnl_lock (when calling ipoib_set_mod).
On the other hand, the rmmod call flow takes the rtnl_lock first
(when calling unregister_netdev) and then tries to take the sys/fs
lock. Deadlock a->b, b->a.

The problem starts when ipoib_set_mod frees it's rtnl_lck and tries
to get it after that.

    set_mod:
    [] ? check_preempt_curr+0x6d/0x90
    [] __mutex_lock_slowpath+0x13e/0x180
    [] ? __rtnl_unlock+0x15/0x20
    [] mutex_lock+0x2b/0x50
    [] rtnl_lock+0x15/0x20
    [] ipoib_set_mode+0x97/0x160 [ib_ipoib]
    [] set_mode+0x3b/0x80 [ib_ipoib]
    [] dev_attr_store+0x20/0x30
    [] sysfs_write_file+0xe5/0x170
    [] vfs_write+0xb8/0x1a0
    [] sys_write+0x51/0x90
    [] system_call_fastpath+0x16/0x1b

    rmmod:
    [] ? put_dec+0x10c/0x110
    [] ? number+0x2ee/0x320
    [] schedule_timeout+0x215/0x2e0
    [] ? vsnprintf+0x484/0x5f0
    [] ? string+0x40/0x100
    [] wait_for_common+0x123/0x180
    [] ? default_wake_function+0x0/0x20
    [] ? ifind_fast+0x5e/0xb0
    [] wait_for_completion+0x1d/0x20
    [] sysfs_addrm_finish+0x228/0x270
    [] sysfs_remove_dir+0xa3/0xf0
    [] kobject_del+0x16/0x40
    [] device_del+0x184/0x1e0
    [] netdev_unregister_kobject+0xab/0xc0
    [] rollback_registered+0xae/0x130
    [] unregister_netdevice+0x22/0x70
    [] unregister_netdev+0x1e/0x30
    [] ipoib_remove_one+0xe0/0x120 [ib_ipoib]
    [] ib_unregister_device+0x4f/0x100 [ib_core]
    [] mlx4_ib_remove+0x41/0x180 [mlx4_ib]
    [] mlx4_remove_device+0x71/0x90 [mlx4_core]

Fixes: 862096a8bbf8 ("IB/ipoib: Add more rtnl_link_ops callbacks")
Cc: Or Gerlitz 
Signed-off-by: Feras Daoud 
Signed-off-by: Erez Shitrit 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Jiri Slaby