The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
Possible dependencies:
f7e942b5bb35 ("btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()")
e562a8bdf652 ("btrfs: introduce BTRFS_QGROUP_RUNTIME_FLAG_CANCEL_RESCAN")
db5df2541200 ("btrfs: move QUOTA_ENABLED check to rescan_should_stop from btrfs_qgroup_rescan_worker")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From f7e942b5bb35d8e3af54053d19a6bf04143a3955 Mon Sep 17 00:00:00 2001
From: ChenXiaoSong <chenxiaosong2(a)huawei.com>
Date: Wed, 16 Nov 2022 22:23:54 +0800
Subject: [PATCH] btrfs: qgroup: fix sleep from invalid context bug in
btrfs_qgroup_inherit()
Syzkaller reported BUG as follows:
BUG: sleeping function called from invalid context at
include/linux/sched/mm.h:274
Call Trace:
<TASK>
dump_stack_lvl+0xcd/0x134
__might_resched.cold+0x222/0x26b
kmem_cache_alloc+0x2e7/0x3c0
update_qgroup_limit_item+0xe1/0x390
btrfs_qgroup_inherit+0x147b/0x1ee0
create_subvol+0x4eb/0x1710
btrfs_mksubvol+0xfe5/0x13f0
__btrfs_ioctl_snap_create+0x2b0/0x430
btrfs_ioctl_snap_create_v2+0x25a/0x520
btrfs_ioctl+0x2a1c/0x5ce0
__x64_sys_ioctl+0x193/0x200
do_syscall_64+0x35/0x80
Fix this by calling qgroup_dirty() on @dstqgroup, and update limit item in
btrfs_run_qgroups() later outside of the spinlock context.
CC: stable(a)vger.kernel.org # 4.9+
Reviewed-by: Qu Wenruo <wqu(a)suse.com>
Signed-off-by: ChenXiaoSong <chenxiaosong2(a)huawei.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 9334c3157c22..b74105a10f16 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -2951,14 +2951,7 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid,
dstgroup->rsv_rfer = inherit->lim.rsv_rfer;
dstgroup->rsv_excl = inherit->lim.rsv_excl;
- ret = update_qgroup_limit_item(trans, dstgroup);
- if (ret) {
- qgroup_mark_inconsistent(fs_info);
- btrfs_info(fs_info,
- "unable to update quota limit for %llu",
- dstgroup->qgroupid);
- goto unlock;
- }
+ qgroup_dirty(fs_info, dstgroup);
}
if (srcid) {
The patch below does not apply to the 6.0-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
Possible dependencies:
f7e942b5bb35 ("btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()")
e562a8bdf652 ("btrfs: introduce BTRFS_QGROUP_RUNTIME_FLAG_CANCEL_RESCAN")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From f7e942b5bb35d8e3af54053d19a6bf04143a3955 Mon Sep 17 00:00:00 2001
From: ChenXiaoSong <chenxiaosong2(a)huawei.com>
Date: Wed, 16 Nov 2022 22:23:54 +0800
Subject: [PATCH] btrfs: qgroup: fix sleep from invalid context bug in
btrfs_qgroup_inherit()
Syzkaller reported BUG as follows:
BUG: sleeping function called from invalid context at
include/linux/sched/mm.h:274
Call Trace:
<TASK>
dump_stack_lvl+0xcd/0x134
__might_resched.cold+0x222/0x26b
kmem_cache_alloc+0x2e7/0x3c0
update_qgroup_limit_item+0xe1/0x390
btrfs_qgroup_inherit+0x147b/0x1ee0
create_subvol+0x4eb/0x1710
btrfs_mksubvol+0xfe5/0x13f0
__btrfs_ioctl_snap_create+0x2b0/0x430
btrfs_ioctl_snap_create_v2+0x25a/0x520
btrfs_ioctl+0x2a1c/0x5ce0
__x64_sys_ioctl+0x193/0x200
do_syscall_64+0x35/0x80
Fix this by calling qgroup_dirty() on @dstqgroup, and update limit item in
btrfs_run_qgroups() later outside of the spinlock context.
CC: stable(a)vger.kernel.org # 4.9+
Reviewed-by: Qu Wenruo <wqu(a)suse.com>
Signed-off-by: ChenXiaoSong <chenxiaosong2(a)huawei.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 9334c3157c22..b74105a10f16 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -2951,14 +2951,7 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid,
dstgroup->rsv_rfer = inherit->lim.rsv_rfer;
dstgroup->rsv_excl = inherit->lim.rsv_excl;
- ret = update_qgroup_limit_item(trans, dstgroup);
- if (ret) {
- qgroup_mark_inconsistent(fs_info);
- btrfs_info(fs_info,
- "unable to update quota limit for %llu",
- dstgroup->qgroupid);
- goto unlock;
- }
+ qgroup_dirty(fs_info, dstgroup);
}
if (srcid) {
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
Possible dependencies:
418ffb9e3cf6 ("btrfs: free btrfs_path before copying inodes to userspace")
e3059ec06b9f ("btrfs: sink iterator parameter to btrfs_ioctl_logical_to_ino")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 418ffb9e3cf6c4e2574d3a732b724916684bd133 Mon Sep 17 00:00:00 2001
From: Anand Jain <anand.jain(a)oracle.com>
Date: Thu, 10 Nov 2022 11:36:28 +0530
Subject: [PATCH] btrfs: free btrfs_path before copying inodes to userspace
btrfs_ioctl_logical_to_ino() frees the search path after the userspace
copy from the temp buffer @inodes. Which potentially can lead to a lock
splat.
Fix this by freeing the path before we copy @inodes to userspace.
CC: stable(a)vger.kernel.org # 4.19+
Signed-off-by: Anand Jain <anand.jain(a)oracle.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 89b8d14cb68c..b595f2c6dfc9 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -4282,21 +4282,20 @@ static long btrfs_ioctl_logical_to_ino(struct btrfs_fs_info *fs_info,
size = min_t(u32, loi->size, SZ_16M);
}
- path = btrfs_alloc_path();
- if (!path) {
- ret = -ENOMEM;
- goto out;
- }
-
inodes = init_data_container(size);
if (IS_ERR(inodes)) {
ret = PTR_ERR(inodes);
- inodes = NULL;
- goto out;
+ goto out_loi;
}
+ path = btrfs_alloc_path();
+ if (!path) {
+ ret = -ENOMEM;
+ goto out;
+ }
ret = iterate_inodes_from_logical(loi->logical, fs_info, path,
inodes, ignore_offset);
+ btrfs_free_path(path);
if (ret == -EINVAL)
ret = -ENOENT;
if (ret < 0)
@@ -4308,7 +4307,6 @@ static long btrfs_ioctl_logical_to_ino(struct btrfs_fs_info *fs_info,
ret = -EFAULT;
out:
- btrfs_free_path(path);
kvfree(inodes);
out_loi:
kfree(loi);
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
Possible dependencies:
418ffb9e3cf6 ("btrfs: free btrfs_path before copying inodes to userspace")
e3059ec06b9f ("btrfs: sink iterator parameter to btrfs_ioctl_logical_to_ino")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 418ffb9e3cf6c4e2574d3a732b724916684bd133 Mon Sep 17 00:00:00 2001
From: Anand Jain <anand.jain(a)oracle.com>
Date: Thu, 10 Nov 2022 11:36:28 +0530
Subject: [PATCH] btrfs: free btrfs_path before copying inodes to userspace
btrfs_ioctl_logical_to_ino() frees the search path after the userspace
copy from the temp buffer @inodes. Which potentially can lead to a lock
splat.
Fix this by freeing the path before we copy @inodes to userspace.
CC: stable(a)vger.kernel.org # 4.19+
Signed-off-by: Anand Jain <anand.jain(a)oracle.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 89b8d14cb68c..b595f2c6dfc9 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -4282,21 +4282,20 @@ static long btrfs_ioctl_logical_to_ino(struct btrfs_fs_info *fs_info,
size = min_t(u32, loi->size, SZ_16M);
}
- path = btrfs_alloc_path();
- if (!path) {
- ret = -ENOMEM;
- goto out;
- }
-
inodes = init_data_container(size);
if (IS_ERR(inodes)) {
ret = PTR_ERR(inodes);
- inodes = NULL;
- goto out;
+ goto out_loi;
}
+ path = btrfs_alloc_path();
+ if (!path) {
+ ret = -ENOMEM;
+ goto out;
+ }
ret = iterate_inodes_from_logical(loi->logical, fs_info, path,
inodes, ignore_offset);
+ btrfs_free_path(path);
if (ret == -EINVAL)
ret = -ENOENT;
if (ret < 0)
@@ -4308,7 +4307,6 @@ static long btrfs_ioctl_logical_to_ino(struct btrfs_fs_info *fs_info,
ret = -EFAULT;
out:
- btrfs_free_path(path);
kvfree(inodes);
out_loi:
kfree(loi);
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
Possible dependencies:
418ffb9e3cf6 ("btrfs: free btrfs_path before copying inodes to userspace")
e3059ec06b9f ("btrfs: sink iterator parameter to btrfs_ioctl_logical_to_ino")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 418ffb9e3cf6c4e2574d3a732b724916684bd133 Mon Sep 17 00:00:00 2001
From: Anand Jain <anand.jain(a)oracle.com>
Date: Thu, 10 Nov 2022 11:36:28 +0530
Subject: [PATCH] btrfs: free btrfs_path before copying inodes to userspace
btrfs_ioctl_logical_to_ino() frees the search path after the userspace
copy from the temp buffer @inodes. Which potentially can lead to a lock
splat.
Fix this by freeing the path before we copy @inodes to userspace.
CC: stable(a)vger.kernel.org # 4.19+
Signed-off-by: Anand Jain <anand.jain(a)oracle.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 89b8d14cb68c..b595f2c6dfc9 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -4282,21 +4282,20 @@ static long btrfs_ioctl_logical_to_ino(struct btrfs_fs_info *fs_info,
size = min_t(u32, loi->size, SZ_16M);
}
- path = btrfs_alloc_path();
- if (!path) {
- ret = -ENOMEM;
- goto out;
- }
-
inodes = init_data_container(size);
if (IS_ERR(inodes)) {
ret = PTR_ERR(inodes);
- inodes = NULL;
- goto out;
+ goto out_loi;
}
+ path = btrfs_alloc_path();
+ if (!path) {
+ ret = -ENOMEM;
+ goto out;
+ }
ret = iterate_inodes_from_logical(loi->logical, fs_info, path,
inodes, ignore_offset);
+ btrfs_free_path(path);
if (ret == -EINVAL)
ret = -ENOENT;
if (ret < 0)
@@ -4308,7 +4307,6 @@ static long btrfs_ioctl_logical_to_ino(struct btrfs_fs_info *fs_info,
ret = -EFAULT;
out:
- btrfs_free_path(path);
kvfree(inodes);
out_loi:
kfree(loi);
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
Possible dependencies:
418ffb9e3cf6 ("btrfs: free btrfs_path before copying inodes to userspace")
e3059ec06b9f ("btrfs: sink iterator parameter to btrfs_ioctl_logical_to_ino")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 418ffb9e3cf6c4e2574d3a732b724916684bd133 Mon Sep 17 00:00:00 2001
From: Anand Jain <anand.jain(a)oracle.com>
Date: Thu, 10 Nov 2022 11:36:28 +0530
Subject: [PATCH] btrfs: free btrfs_path before copying inodes to userspace
btrfs_ioctl_logical_to_ino() frees the search path after the userspace
copy from the temp buffer @inodes. Which potentially can lead to a lock
splat.
Fix this by freeing the path before we copy @inodes to userspace.
CC: stable(a)vger.kernel.org # 4.19+
Signed-off-by: Anand Jain <anand.jain(a)oracle.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 89b8d14cb68c..b595f2c6dfc9 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -4282,21 +4282,20 @@ static long btrfs_ioctl_logical_to_ino(struct btrfs_fs_info *fs_info,
size = min_t(u32, loi->size, SZ_16M);
}
- path = btrfs_alloc_path();
- if (!path) {
- ret = -ENOMEM;
- goto out;
- }
-
inodes = init_data_container(size);
if (IS_ERR(inodes)) {
ret = PTR_ERR(inodes);
- inodes = NULL;
- goto out;
+ goto out_loi;
}
+ path = btrfs_alloc_path();
+ if (!path) {
+ ret = -ENOMEM;
+ goto out;
+ }
ret = iterate_inodes_from_logical(loi->logical, fs_info, path,
inodes, ignore_offset);
+ btrfs_free_path(path);
if (ret == -EINVAL)
ret = -ENOENT;
if (ret < 0)
@@ -4308,7 +4307,6 @@ static long btrfs_ioctl_logical_to_ino(struct btrfs_fs_info *fs_info,
ret = -EFAULT;
out:
- btrfs_free_path(path);
kvfree(inodes);
out_loi:
kfree(loi);
Hi,
[ Marc, can you help reviewing? Esp. the first patch? ]
This series of backports from upstream to stable 5.15 and 5.10 fixes an issue
we're seeing on AWS ARM instances where attaching an EBS volume (which is a
nvme device) to the instance after offlining CPUs causes the device to take
several minutes to show up and eventually nvme kworkers and other threads start
getting stuck.
This series fixes the issue for 5.15.79 and 5.10.155. I can't reproduce it
on 5.4. Also, I couldn't reproduce this on x86 even w/ affected kernels.
An easy reproducer is:
1. Start an ARM instance with 32 CPUs
2. Once the instance is booted, offline all CPUs but CPU 0. Eg:
# for i in $(seq 1 32); do chcpu -d $i; done
3. Once the CPUs are offline, attach an EBS volume
4. Watch lsblk and dmesg in the instance
Eventually, you get this stack trace:
[ 71.842974] pci 0000:00:1f.0: [1d0f:8061] type 00 class 0x010802
[ 71.843966] pci 0000:00:1f.0: reg 0x10: [mem 0x00000000-0x00003fff]
[ 71.845149] pci 0000:00:1f.0: PME# supported from D0 D1 D2 D3hot D3cold
[ 71.846694] pci 0000:00:1f.0: BAR 0: assigned [mem 0x8011c000-0x8011ffff]
[ 71.848458] ACPI: \_SB_.PCI0.GSI3: Enabled at IRQ 38
[ 71.850852] nvme nvme1: pci function 0000:00:1f.0
[ 71.851611] nvme 0000:00:1f.0: enabling device (0000 -> 0002)
[ 135.887787] nvme nvme1: I/O 22 QID 0 timeout, completion polled
[ 197.328276] nvme nvme1: I/O 23 QID 0 timeout, completion polled
[ 197.329221] nvme nvme1: 1/0/0 default/read/poll queues
[ 243.408619] INFO: task kworker/u64:2:275 blocked for more than 122 seconds.
[ 243.409674] Not tainted 5.15.79 #1
[ 243.410270] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 243.411389] task:kworker/u64:2 state:D stack: 0 pid: 275 ppid: 2 flags:0x00000008
[ 243.412602] Workqueue: events_unbound async_run_entry_fn
[ 243.413417] Call trace:
[ 243.413797] __switch_to+0x15c/0x1a4
[ 243.414335] __schedule+0x2bc/0x990
[ 243.414849] schedule+0x68/0xf8
[ 243.415334] schedule_timeout+0x184/0x340
[ 243.415946] wait_for_completion+0xc8/0x220
[ 243.416543] __flush_work.isra.43+0x240/0x2f0
[ 243.417179] flush_work+0x20/0x2c
[ 243.417666] nvme_async_probe+0x20/0x3c
[ 243.418228] async_run_entry_fn+0x3c/0x1e0
[ 243.418858] process_one_work+0x1bc/0x460
[ 243.419437] worker_thread+0x164/0x528
[ 243.420030] kthread+0x118/0x124
[ 243.420517] ret_from_fork+0x10/0x20
[ 258.768771] nvme nvme1: I/O 20 QID 0 timeout, completion polled
[ 320.209266] nvme nvme1: I/O 21 QID 0 timeout, completion polled
For completion, I tested the same test-case on x86 with this series applied
on 5.15.79 and 5.10.155 as well. It works as expected.
Thanks,
Marc Zyngier (4):
genirq/msi: Shutdown managed interrupts with unsatifiable affinities
genirq: Always limit the affinity to online CPUs
irqchip/gic-v3: Always trust the managed affinity provided by the core
code
genirq: Take the proposed affinity at face value if force==true
drivers/irqchip/irq-gic-v3-its.c | 2 +-
kernel/irq/manage.c | 31 +++++++++++++++++++++++--------
kernel/irq/msi.c | 7 +++++++
3 files changed, 31 insertions(+), 9 deletions(-)
--
2.37.1
> On Fri, Oct 28, 2022 at 02:51:43PM +0000, Dominic Jones wrote:
> > Updating the machine's kernel from v5.19.x to v6.0.x causes the machine to not
> > successfully boot. The machine boots successfully (and exhibits stable operation)
> > with version v5.19.17 and multiple earlier releases in the 5.19 line. Multiple releases
> > from the 6.0 line (including 6.0.0, 6.0.3, and 6.0.5), with no other changes to the
> > software environment, do not boot. Instead, the machine hangs after loading services
> > but before presenting a display manager; the machine instead shows repetitive hard
> > drive activity at this point and then no apparent activity.
> >
> > ''uname'' output for the machine successfully running v5.19.17 is:
> >
> > Linux [MACHINE_NAME] 5.19.17 #1 SMP PREEMPT_DYNAMIC Mon Oct 24 13:32:29 2022 i686 Intel(R) Atom(TM) CPU N270 @ 1.60GHz GenuineIntel GNU/Linux
> >
> > The machine is an OCZ Neutrino netbook, running a custom OS build largely similar to
> > LFS development. The kernel update uses ''make olddefconfig''.
>
> Can you use 'git bisect' to find the offending change that causes this
> to happen?
Bisection is complete. Here's what it returned.
---
3a194f3f8ad01bce00bd7174aaba1563bcc827eb is the first bad commit
commit 3a194f3f8ad01bce00bd7174aaba1563bcc827eb
Author: Naoya Horiguchi <naoya.horiguchi(a)nec.com>
Date: Thu Jul 14 13:24:14 2022 +0900
mm/hugetlb: make pud_huge() and follow_huge_pud() aware of non-present pud entry
follow_pud_mask() does not support non-present pud entry now. As long as
I tested on x86_64 server, follow_pud_mask() still simply returns
no_page_table() for non-present_pud_entry() due to pud_bad(), so no severe
user-visible effect should happen. But generally we should call
follow_huge_pud() for non-present pud entry for 1GB hugetlb page.
Update pud_huge() and follow_huge_pud() to handle non-present pud entries.
The changes are similar to previous works for pud entries commit
e66f17ff7177 ("mm/hugetlb: take page table lock in follow_huge_pmd()") and
commit cbef8478bee5 ("mm/hugetlb: pmd_huge() returns true for non-present
hugepage").
Link: https://lkml.kernel.org/r/20220714042420.1847125-3-naoya.horiguchi@linux.dev
Signed-off-by: Naoya Horiguchi <naoya.horiguchi(a)nec.com>
Reviewed-by: Miaohe Lin <linmiaohe(a)huawei.com>
Reviewed-by: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: David Hildenbrand <david(a)redhat.com>
Cc: kernel test robot <lkp(a)intel.com>
Cc: Liu Shixin <liushixin2(a)huawei.com>
Cc: Muchun Song <songmuchun(a)bytedance.com>
Cc: Oscar Salvador <osalvador(a)suse.de>
Cc: Yang Shi <shy828301(a)gmail.com>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
arch/x86/mm/hugetlbpage.c | 8 +++++++-
mm/hugetlb.c | 32 ++++++++++++++++++++++++++++++--
2 files changed, 37 insertions(+), 3 deletions(-)
---
Dominic
This is the start of the stable review cycle for the 4.9.328 release.
There are 42 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 15 Sep 2022 14:03:27 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.328-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.328-rc1
NeilBrown <neilb(a)suse.de>
SUNRPC: use _bh spinlocking on ->transport_lock
Yang Ling <gnaygnil(a)gmail.com>
MIPS: loongson32: ls1c: Fix hang during startup
Johan Hovold <johan+linaro(a)kernel.org>
usb: dwc3: fix PHY disable sequence
Toke Høiland-Jørgensen <toke(a)toke.dk>
sch_sfb: Also store skb len before calling child enqueue
Neal Cardwell <ncardwell(a)google.com>
tcp: fix early ETIMEDOUT after spurious non-SACK RTO
Dan Carpenter <dan.carpenter(a)oracle.com>
tipc: fix shift wrapping bug in map_get()
Toke Høiland-Jørgensen <toke(a)toke.dk>
sch_sfb: Don't assume the skb is still around after enqueueing to child
David Leadbeater <dgl(a)dgl.cx>
netfilter: nf_conntrack_irc: Fix forged IP logic
Harsh Modi <harshmodi(a)google.com>
netfilter: br_netfilter: Drop dst references before setting.
Isaac J. Manjarres <isaacmanjarres(a)google.com>
driver core: Don't probe devices after bus_type.match() probe deferral
Sreekanth Reddy <sreekanth.reddy(a)broadcom.com>
scsi: mpt3sas: Fix use-after-free warning
Dongxiang Ke <kdx.glider(a)gmail.com>
ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface()
Pattara Teerapong <pteerapong(a)chromium.org>
ALSA: aloop: Fix random zeros in capture data when using jiffies timer
Tasos Sahanidis <tasos(a)tasossah.com>
ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc()
Yang Yingliang <yangyingliang(a)huawei.com>
fbdev: chipsfb: Add missing pci_disable_device() in chipsfb_pci_init()
Helge Deller <deller(a)gmx.de>
parisc: Add runtime check to prevent PA2.0 kernels on PA1.x machines
Li Qiong <liqiong(a)nfschina.com>
parisc: ccio-dma: Handle kmalloc failure in ccio_init_resources()
Zhenneng Li <lizhenneng(a)kylinos.cn>
drm/radeon: add a force flush to delay work when radeon
Yee Lee <yee.lee(a)mediatek.com>
Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()"
Linus Torvalds <torvalds(a)linux-foundation.org>
fs: only do a memory barrier for the first set_buffer_uptodate()
Takashi Iwai <tiwai(a)suse.de>
ALSA: seq: Fix data-race at module auto-loading
Takashi Iwai <tiwai(a)suse.de>
ALSA: seq: oss: Fix data-race for max_midi_devs access
Miquel Raynal <miquel.raynal(a)bootlin.com>
net: mac802154: Fix a condition in the receive path
Siddh Raman Pant <code(a)siddh.me>
wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected
Krishna Kurapati <quic_kriskura(a)quicinc.com>
usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS
Alan Stern <stern(a)rowland.harvard.edu>
USB: core: Prevent nested device-reset calls
Josh Poimboeuf <jpoimboe(a)kernel.org>
s390: fix nospec table alignments
Gerald Schaefer <gerald.schaefer(a)linux.ibm.com>
s390/hugetlb: fix prepare_hugepage_range() check for 2 GB hugepages
Witold Lipieta <witold.lipieta(a)thaumatec.com>
usb-storage: Add ignore-residue quirk for NXP PN7462AU
Thierry GUIBERT <thierry.guibert(a)croix-rouge.fr>
USB: cdc-acm: Add Icom PMR F3400 support (0c26:0020)
Slark Xiao <slark_xiao(a)163.com>
USB: serial: option: add support for Cinterion MV32-WA/WB RmNet mode
Yan Xinyu <sdlyyxy(a)bupt.edu.cn>
USB: serial: option: add support for OPPO R11 diag port
Johan Hovold <johan(a)kernel.org>
USB: serial: cp210x: add Decagon UCA device id
Mathias Nyman <mathias.nyman(a)linux.intel.com>
xhci: Add grace period after xHC start to prevent premature runtime suspend.
Armin Wolf <W_Armin(a)gmx.de>
hwmon: (gpio-fan) Fix array out of bounds access
Niek Nooijens <niek.nooijens(a)omron.com>
USB: serial: ftdi_sio: add Omron CS1W-CIF31 device id
Helge Deller <deller(a)gmx.de>
vt: Clear selection before changing the font
Dan Carpenter <dan.carpenter(a)oracle.com>
staging: rtl8712: fix use after free bugs
Shenwei Wang <shenwei.wang(a)nxp.com>
serial: fsl_lpuart: RS485 RTS polariy is inverse
Dan Carpenter <dan.carpenter(a)oracle.com>
wifi: cfg80211: debugfs: fix return type in ht40allow_map_read()
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
platform/x86: pmc_atom: Fix SLP_TYPx bitfield mask
Letu Ren <fantasquex(a)gmail.com>
fbdev: fb_pm2fb: Avoid potential divide by zero error
-------------
Diffstat:
Makefile | 4 +--
arch/mips/loongson32/ls1c/board.c | 1 -
arch/parisc/kernel/head.S | 43 +++++++++++++++++++++++++++-
arch/s390/include/asm/hugetlb.h | 6 ++--
arch/s390/kernel/vmlinux.lds.S | 1 +
arch/x86/include/asm/pmc_atom.h | 6 ++--
arch/x86/platform/atom/pmc_atom.c | 2 +-
drivers/base/dd.c | 10 +++++++
drivers/gpu/drm/radeon/radeon_device.c | 3 ++
drivers/hwmon/gpio-fan.c | 3 ++
drivers/parisc/ccio-dma.c | 11 +++++--
drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 +-
drivers/staging/rtl8712/rtl8712_cmd.c | 36 -----------------------
drivers/tty/serial/fsl_lpuart.c | 4 +--
drivers/tty/vt/vt.c | 12 +++++---
drivers/usb/class/cdc-acm.c | 3 ++
drivers/usb/core/hub.c | 10 +++++++
drivers/usb/dwc3/core.c | 20 ++++++-------
drivers/usb/gadget/function/storage_common.c | 6 ++--
drivers/usb/host/xhci-hub.c | 11 +++++++
drivers/usb/host/xhci.c | 4 ++-
drivers/usb/host/xhci.h | 2 +-
drivers/usb/serial/cp210x.c | 1 +
drivers/usb/serial/ftdi_sio.c | 2 ++
drivers/usb/serial/ftdi_sio_ids.h | 6 ++++
drivers/usb/serial/option.c | 11 +++++++
drivers/usb/storage/unusual_devs.h | 7 +++++
drivers/video/fbdev/chipsfb.c | 1 +
drivers/video/fbdev/pm2fb.c | 5 ++++
include/linux/buffer_head.h | 11 +++++++
include/linux/usb.h | 2 ++
mm/kmemleak.c | 8 +++---
net/bridge/br_netfilter_hooks.c | 2 ++
net/bridge/br_netfilter_ipv6.c | 1 +
net/ipv4/tcp_input.c | 25 +++++++++++-----
net/mac80211/ibss.c | 4 +++
net/mac802154/rx.c | 2 +-
net/netfilter/nf_conntrack_irc.c | 5 ++--
net/sched/sch_sfb.c | 13 +++++----
net/sunrpc/xprt.c | 4 +--
net/tipc/monitor.c | 2 +-
net/wireless/debugfs.c | 3 +-
sound/core/seq/oss/seq_oss_midi.c | 2 ++
sound/core/seq/seq_clientmgr.c | 12 ++++----
sound/drivers/aloop.c | 7 +++--
sound/pci/emu10k1/emupcm.c | 2 +-
sound/usb/stream.c | 2 +-
47 files changed, 236 insertions(+), 104 deletions(-)