~sforshee/+git/ubuntu-yakkety:y-inprogress

Last commit made on 2016-10-20
Get this branch:
git clone -b y-inprogress https://git.launchpad.net/~sforshee/+git/ubuntu-yakkety
Only Seth Forshee can upload to this branch. If you are Seth Forshee please log in for upload directions.

Branch merges

Branch information

Name:
y-inprogress
Repository:
lp:~sforshee/+git/ubuntu-yakkety

Recent commits

37ee9e5... by Seth Forshee

Stash insertchanges

a3e8125... by Colin Ian King

UBUNTU: SAUCE: KEYS: ensure xbuf is large enough to fix buffer overflow in proc_keys_show (LP: #1634496)

BugLink: http://bugs.launchpad.net/bugs/1634496

CVE-2016-7042

When stack protect is enabled xbuf is too small for timeout data causing a
buffer overflow and a stack protector corruption report.

OriginalAuthor: Vladis Dronov <email address hidden>
OriginalLocation: https://bugzilla.redhat.com/attachment.cgi?id=1200212&action=diff

Signed-off-by: Colin Ian King <email address hidden>
Acked-by: Tim Gardner <email address hidden>
Signed-off-by: Seth Forshee <email address hidden>

accff6b... by Seth Forshee

Revert "UBUNTU: SAUCE: (no-up) If zone is so small that watermarks are the same, stop zone balance."

BugLink: http://bugs.launchpad.net/bugs/1632894

This reverts commit 6d748af3bb9d0b670e7d72da11faaf79a45120f5,
which was errantly deemed appropriate to yakkety but is not
needed.

Signed-off-by: Seth Forshee <email address hidden>
Acked-by: Jay Vosburgh <email address hidden>
Acked-by: Brad Figg <email address hidden>

aa36b3f... by Andy Whitcroft

UBUNTU: SAUCE: (no-up) dm raid: fix compat_features validation

In ecbfb9f118bce4 ("dm raid: add raid level takeover support") a new
compatible feature flag was added. Validation for these compat_features
was added but this only passes for new raid mappings with this feature
flag. This causes previously created raid mappings to be failed at
import.

Check compat_features for the only valid combination.

Fixes: ecbfb9f118bce4 ("dm raid: add raid level takeover support")
Cc: <email address hidden> # v4.8
Signed-off-by: Andy Whitcroft <email address hidden>
Signed-off-by: Heinz Mauelshagen <email address hidden>
Signed-off-by: Mike Snitzer <email address hidden>

BugLink: http://bugs.launchpad.net/bugs/1631298
Signed-off-by: Andy Whitcroft <email address hidden>
Acked-by: Stefan Bader <email address hidden>
Acked-by: Colin Ian King <email address hidden>
Signed-off-by: Seth Forshee <email address hidden>

9c08508... by Gavin Guo

UBUNTU: SAUCE: (no-up) If zone is so small that watermarks are the same, stop zone balance.

BugLink: http://bugs.launchpad.net/bugs/1518457

On an AWS t2.micro instance (Xeon E5-2670, 991MiB of memory).
Occasionally (about once a day), kswapd0 falls into a busy loop and
spins on 100% CPU usage indefinitely. Reject to do the zone balance
when the memory is too small.

Signed-off-by: Dan Streetman <email address hidden>
Signed-off-by: Gavin Guo <email address hidden>
Tested-by: Jay Vosburgh <email address hidden>
Acked-by: Leann Ogasawara <email address hidden>
Acked-by: Brad Figg <email address hidden>
Signed-off-by: Seth Forshee <email address hidden>

cada85b... by Paul Mackerras <email address hidden>

UBUNTU: SAUCE: (no-up) powerpc/64: Fix incorrect return value from __copy_tofrom_user

BugLink: http://bugs.launchpad.net/bugs/1632462

Debugging a data corruption issue with virtio-net/vhost-net led to
the observation that __copy_tofrom_user was occasionally returning
a value 16 larger than it should. Since the return value from
__copy_tofrom_user is the number of bytes not copied, this means
that __copy_tofrom_user can occasionally return a value larger
than the number of bytes it was asked to copy. In turn this can
cause higher-level copy functions such as copy_page_to_iter_iovec
to corrupt memory by copying data into the wrong memory locations.

It turns out that the failing case involves a fault on the store
at label 79, and at that point the first unmodified byte of the
destination is at R3 + 16. Consequently the exception handler
for that store needs to add 16 to R3 before using it to work out
how many bytes were not copied, but in this one case it was not
adding the offset to R3. To fix it, this moves the label 179 to
the point where we add 16 to R3. I have checked manually all the
exception handlers for the loads and stores in this code and the
rest of them are correct (it would be excellent to have an
automated test of all the exception cases).

Signed-off-by: Paul Mackerras <email address hidden>
Signed-off-by: Seth Forshee <email address hidden>
Acked-by: Leann Ogasawara <email address hidden>
Acked-by: Brad Figg <email address hidden>

2a272ad... by Laurent Dufour

UBUNTU: SAUCE: (no-up) powerpc/pseries: Fix stack corruption in htpe code

BugLink: http://bugs.launchpad.net/bugs/1628976

https://patchwork.kernel.org/patch/9364805/

This commit fixes a stack corruption in the pseries specific code dealing
with the huge pages.

In __pSeries_lpar_hugepage_invalidate() the buffer used to pass arguments
to the hypervisor is not large enough. This leads to a stack corruption
where a previously saved register could be corrupted leading to unexpected
result in the caller, like the following panic:

Oops: Kernel access of bad area, sig: 11 [#1]
SMP NR_CPUS=2048 NUMA pSeries
Modules linked in: virtio_balloon ip_tables x_tables autofs4
virtio_blk 8139too virtio_pci virtio_ring 8139cp virtio
CPU: 11 PID: 1916 Comm: mmstress Not tainted 4.8.0 #76
task: c000000005394880 task.stack: c000000005570000
NIP: c00000000027bf6c LR: c00000000027bf64 CTR: 0000000000000000
REGS: c000000005573820 TRAP: 0300 Not tainted (4.8.0)
MSR: 8000000000009033 <SF,EE,ME,IR,DR,RI,LE> CR: 84822884 XER:
20000000
CFAR: c00000000010a924 DAR: 420000000014e5e0 DSISR: 40000000 SOFTE: 1
GPR00: c00000000027bf64 c000000005573aa0 c000000000e02800 c000000004447964
GPR04: c00000000404de18 c000000004d38810 00000000042100f5 00000000f5002104
GPR08: e0000000f5002104 0000000000000001 042100f5000000e0 00000000042100f5
GPR12: 0000000000002200 c00000000fe02c00 c00000000404de18 0000000000000000
GPR16: c1ffffffffffe7ff 00003fff62000000 420000000014e5e0 00003fff63000000
GPR20: 0008000000000000 c0000000f7014800 0405e600000000e0 0000000000010000
GPR24: c000000004d38810 c000000004447c10 c00000000404de18 c000000004447964
GPR28: c000000005573b10 c000000004d38810 00003fff62000000 420000000014e5e0
NIP [c00000000027bf6c] zap_huge_pmd+0x4c/0x470
LR [c00000000027bf64] zap_huge_pmd+0x44/0x470
Call Trace:
[c000000005573aa0] [c00000000027bf64] zap_huge_pmd+0x44/0x470 (unreliable)
[c000000005573af0] [c00000000022bbd8] unmap_page_range+0xcf8/0xed0
[c000000005573c30] [c00000000022c2d4] unmap_vmas+0x84/0x120
[c000000005573c80] [c000000000235448] unmap_region+0xd8/0x1b0
[c000000005573d80] [c0000000002378f0] do_munmap+0x2d0/0x4c0
[c000000005573df0] [c000000000237be4] SyS_munmap+0x64/0xb0
[c000000005573e30] [c000000000009560] system_call+0x38/0x108
Instruction dump:
fbe1fff8 fb81ffe0 7c7f1b78 7ca32b78 7cbd2b78 f8010010 7c9a2378 f821ffb1
7cde3378 4bfffea9 7c7b1b79 41820298 <e87f0000> 48000130 7fa5eb78 7fc4f378

Most of the time, the bug is surfacing in a caller up in the stack from
__pSeries_lpar_hugepage_invalidate() which is quite confusing.

This bug is pending since v3.11 but was hidden if a caller of the
caller of __pSeries_lpar_hugepage_invalidate() has pushed the corruped
register (r18 in this case) in the stack and is not using it until
restoring it. GCC 6.2.0 seems to raise it more frequently.

This commit also change the definition of the parameter buffer in
pSeries_lpar_flush_hash_range() to rely on the global define
PLPAR_HCALL9_BUFSIZE (no functional change here).

Fixes: 1a5272866f87 ("powerpc: Optimize hugepage invalidate")
Cc: <email address hidden>
Cc: Aneesh Kumar K.V <email address hidden>
Signed-off-by: Laurent Dufour <email address hidden>
Reviewed-by: Aneesh Kumar K.V <email address hidden>
Acked-by: Balbir Singh <email address hidden>
Signed-off-by: Tim Gardner <email address hidden>
Acked-by: Seth Forshee <email address hidden>
Acked-by: Leann Ogasawara <email address hidden>
Signed-off-by: Seth Forshee <email address hidden>

dbdeb28... by Brian King

scsi: ibmvfc: Fix I/O hang when port is not mapped

BugLink: http://bugs.launchpad.net/bugs/1632116

If a VFC port gets unmapped in the VIOS, it may not respond with a CRQ
init complete following H_REG_CRQ. If this occurs, we can end up having
called scsi_block_requests and not a resulting unblock until the init
complete happens, which may never occur, and we end up hanging I/O
requests. This patch ensures the host action stay set to
IBMVFC_HOST_ACTION_TGT_DEL so we move all rports into devloss state and
unblock unless we receive an init complete.

Cc: <email address hidden>
Signed-off-by: Brian King <email address hidden>
Acked-by: Tyrel Datwyler <email address hidden>
Signed-off-by: Martin K. Petersen <email address hidden>
(cherry picked from linux-next commit 07d0e9a847401ffd2f09bd450d41644cd090e81d)
Signed-off-by: Tim Gardner <email address hidden>
Acked-by: Seth Forshee <email address hidden>
Acked-by: Leann Ogasawara <email address hidden>
Signed-off-by: Seth Forshee <email address hidden>

4f77b94... by Tim Gardner

UBUNTU: [Config] Enable live patching on powerpc/ppc64el

BugLink: http://bugs.launchpad.net/bugs/1626983

Signed-off-by: Tim Gardner <email address hidden>
Acked-by: Leann Ogasawara <email address hidden>
Acked-by: Brad Figg <email address hidden>
Signed-off-by: Seth Forshee <email address hidden>

ac471bc... by Tim Gardner

UBUNTU: [Config] CONFIG_AUFS_XATTR=y

BugLink: http://bugs.launchpad.net/bugs/1557776

Signed-off-by: Tim Gardner <email address hidden>
Acked-by: Leann Ogasawara <email address hidden>
Acked-by: Brad Figg <email address hidden>
Signed-off-by: Seth Forshee <email address hidden>