linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org, Denis Kirjanov <kda@linux-powerpc.org>,
	"David Sterba" <dsterba@suse.com>,
	"Filipe Manana" <fdmanana@suse.com>,
	"Josef Bacik" <josef@toxicpanda.com>
Subject: [PATCH 3.16 119/245] Btrfs: fix infinite loop during nocow writeback due to race
Date: Fri, 24 Apr 2020 00:05:46 +0100	[thread overview]
Message-ID: <lsq.1587683028.361896157@decadent.org.uk> (raw)
In-Reply-To: <lsq.1587683027.831233700@decadent.org.uk>

3.16.83-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Filipe Manana <fdmanana@suse.com>

commit de7999afedff02c6631feab3ea726a0e8f8c3d40 upstream.

When starting writeback for a range that covers part of a preallocated
extent, due to a race with writeback for another range that also covers
another part of the same preallocated extent, we can end up in an infinite
loop.

Consider the following example where for inode 280 we have two dirty
ranges:

  range A, from 294912 to 303103, 8192 bytes
  range B, from 348160 to 438271, 90112 bytes

and we have the following file extent item layout for our inode:

  leaf 38895616 gen 24544 total ptrs 29 free space 13820 owner 5
      (...)
      item 27 key (280 108 200704) itemoff 14598 itemsize 53
          extent data disk bytenr 0 nr 0 type 1 (regular)
          extent data offset 0 nr 94208 ram 94208
      item 28 key (280 108 294912) itemoff 14545 itemsize 53
          extent data disk bytenr 10433052672 nr 81920 type 2 (prealloc)
          extent data offset 0 nr 81920 ram 81920

Then the following happens:

1) Writeback starts for range B (from 348160 to 438271), execution of
   run_delalloc_nocow() starts;

2) The first iteration of run_delalloc_nocow()'s whil loop leaves us at
   the extent item at slot 28, pointing to the prealloc extent item
   covering the range from 294912 to 376831. This extent covers part of
   our range;

3) An ordered extent is created against that extent, covering the file
   range from 348160 to 376831 (28672 bytes);

4) We adjust 'cur_offset' to 376832 and move on to the next iteration of
   the while loop;

5) The call to btrfs_lookup_file_extent() leaves us at the same leaf,
   pointing to slot 29, 1 slot after the last item (the extent item
   we processed in the previous iteration);

6) Because we are a slot beyond the last item, we call btrfs_next_leaf(),
   which releases the search path before doing a another search for the
   last key of the leaf (280 108 294912);

7) Right after btrfs_next_leaf() released the path, and before it did
   another search for the last key of the leaf, writeback for the range
   A (from 294912 to 303103) completes (it was previously started at
   some point);

8) Upon completion of the ordered extent for range A, the prealloc extent
   we previously found got split into two extent items, one covering the
   range from 294912 to 303103 (8192 bytes), with a type of regular extent
   (and no longer prealloc) and another covering the range from 303104 to
   376831 (73728 bytes), with a type of prealloc and an offset of 8192
   bytes. So our leaf now has the following layout:

     leaf 38895616 gen 24544 total ptrs 31 free space 13664 owner 5
         (...)
         item 27 key (280 108 200704) itemoff 14598 itemsize 53
             extent data disk bytenr 0 nr 0 type 1
             extent data offset 0 nr 8192 ram 94208
         item 28 key (280 108 208896) itemoff 14545 itemsize 53
             extent data disk bytenr 10433142784 nr 86016 type 1
             extent data offset 0 nr 86016 ram 86016
         item 29 key (280 108 294912) itemoff 14492 itemsize 53
             extent data disk bytenr 10433052672 nr 81920 type 1
             extent data offset 0 nr 8192 ram 81920
         item 30 key (280 108 303104) itemoff 14439 itemsize 53
             extent data disk bytenr 10433052672 nr 81920 type 2
             extent data offset 8192 nr 73728 ram 81920

9) After btrfs_next_leaf() returns, we have our path pointing to that same
   leaf and at slot 30, since it has a key we didn't have before and it's
   the first key greater then the key that was previously the last key of
   the leaf (key (280 108 294912));

10) The extent item at slot 30 covers the range from 303104 to 376831
    which is in our target range, so we process it, despite having already
    created an ordered extent against this extent for the file range from
    348160 to 376831. This is because we skip to the next extent item only
    if its end is less than or equals to the start of our delalloc range,
    and not less than or equals to the current offset ('cur_offset');

11) As a result we compute 'num_bytes' as:

    num_bytes = min(end + 1, extent_end) - cur_offset;
              = min(438271 + 1, 376832) - 376832 = 0

12) We then call create_io_em() for a 0 bytes range starting at offset
    376832;

13) Then create_io_em() enters an infinite loop because its calls to
    btrfs_drop_extent_cache() do nothing due to the 0 length range
    passed to it. So no existing extent maps that cover the offset
    376832 get removed, and therefore calls to add_extent_mapping()
    return -EEXIST, resulting in an infinite loop. This loop from
    create_io_em() is the following:

    do {
        btrfs_drop_extent_cache(BTRFS_I(inode), em->start,
                                em->start + em->len - 1, 0);
        write_lock(&em_tree->lock);
        ret = add_extent_mapping(em_tree, em, 1);
        write_unlock(&em_tree->lock);
        /*
         * The caller has taken lock_extent(), who could race with us
         * to add em?
         */
    } while (ret == -EEXIST);

Also, each call to btrfs_drop_extent_cache() triggers a warning because
the start offset passed to it (376832) is smaller then the end offset
(376832 - 1) passed to it by -1, due to the 0 length:

  [258532.052621] ------------[ cut here ]------------
  [258532.052643] WARNING: CPU: 0 PID: 9987 at fs/btrfs/file.c:602 btrfs_drop_extent_cache+0x3f4/0x590 [btrfs]
  (...)
  [258532.052672] CPU: 0 PID: 9987 Comm: fsx Tainted: G        W         5.4.0-rc7-btrfs-next-64 #1
  [258532.052673] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-0-ga698c8995f-prebuilt.qemu.org 04/01/2014
  [258532.052691] RIP: 0010:btrfs_drop_extent_cache+0x3f4/0x590 [btrfs]
  (...)
  [258532.052695] RSP: 0018:ffffb4be0153f860 EFLAGS: 00010287
  [258532.052700] RAX: ffff975b445ee360 RBX: ffff975b44eb3e08 RCX: 0000000000000000
  [258532.052700] RDX: 0000000000038fff RSI: 0000000000039000 RDI: ffff975b445ee308
  [258532.052700] RBP: 0000000000038fff R08: 0000000000000000 R09: 0000000000000001
  [258532.052701] R10: ffff975b513c5c10 R11: 00000000e3c0cfa9 R12: 0000000000039000
  [258532.052703] R13: ffff975b445ee360 R14: 00000000ffffffef R15: ffff975b445ee308
  [258532.052705] FS:  00007f86a821de80(0000) GS:ffff975b76a00000(0000) knlGS:0000000000000000
  [258532.052707] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  [258532.052708] CR2: 00007fdacf0f3ab4 CR3: 00000001f9d26002 CR4: 00000000003606f0
  [258532.052712] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  [258532.052717] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  [258532.052717] Call Trace:
  [258532.052718]  ? preempt_schedule_common+0x32/0x70
  [258532.052722]  ? ___preempt_schedule+0x16/0x20
  [258532.052741]  create_io_em+0xff/0x180 [btrfs]
  [258532.052767]  run_delalloc_nocow+0x942/0xb10 [btrfs]
  [258532.052791]  btrfs_run_delalloc_range+0x30b/0x520 [btrfs]
  [258532.052812]  ? find_lock_delalloc_range+0x221/0x250 [btrfs]
  [258532.052834]  writepage_delalloc+0xe4/0x140 [btrfs]
  [258532.052855]  __extent_writepage+0x110/0x4e0 [btrfs]
  [258532.052876]  extent_write_cache_pages+0x21c/0x480 [btrfs]
  [258532.052906]  extent_writepages+0x52/0xb0 [btrfs]
  [258532.052911]  do_writepages+0x23/0x80
  [258532.052915]  __filemap_fdatawrite_range+0xd2/0x110
  [258532.052938]  btrfs_fdatawrite_range+0x1b/0x50 [btrfs]
  [258532.052954]  start_ordered_ops+0x57/0xa0 [btrfs]
  [258532.052973]  ? btrfs_sync_file+0x225/0x490 [btrfs]
  [258532.052988]  btrfs_sync_file+0x225/0x490 [btrfs]
  [258532.052997]  __x64_sys_msync+0x199/0x200
  [258532.053004]  do_syscall_64+0x5c/0x250
  [258532.053007]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
  [258532.053010] RIP: 0033:0x7f86a7dfd760
  (...)
  [258532.053014] RSP: 002b:00007ffd99af0368 EFLAGS: 00000246 ORIG_RAX: 000000000000001a
  [258532.053016] RAX: ffffffffffffffda RBX: 0000000000000ec9 RCX: 00007f86a7dfd760
  [258532.053017] RDX: 0000000000000004 RSI: 000000000000836c RDI: 00007f86a8221000
  [258532.053019] RBP: 0000000000021ec9 R08: 0000000000000003 R09: 00007f86a812037c
  [258532.053020] R10: 0000000000000001 R11: 0000000000000246 R12: 00000000000074a3
  [258532.053021] R13: 00007f86a8221000 R14: 000000000000836c R15: 0000000000000001
  [258532.053032] irq event stamp: 1653450494
  [258532.053035] hardirqs last  enabled at (1653450493): [<ffffffff9dec69f9>] _raw_spin_unlock_irq+0x29/0x50
  [258532.053037] hardirqs last disabled at (1653450494): [<ffffffff9d4048ea>] trace_hardirqs_off_thunk+0x1a/0x20
  [258532.053039] softirqs last  enabled at (1653449852): [<ffffffff9e200466>] __do_softirq+0x466/0x6bd
  [258532.053042] softirqs last disabled at (1653449845): [<ffffffff9d4c8a0c>] irq_exit+0xec/0x120
  [258532.053043] ---[ end trace 8476fce13d9ce20a ]---

Which results in flooding dmesg/syslog since btrfs_drop_extent_cache()
uses WARN_ON() and not WARN_ON_ONCE().

So fix this issue by changing run_delalloc_nocow()'s loop to move to the
next extent item when the current extent item ends at at offset less than
or equals to the current offset instead of the start offset.

Fixes: 80ff385665b7fc ("Btrfs: update nodatacow code v2")
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -1283,7 +1283,11 @@ next_slot:
 				btrfs_file_extent_num_bytes(leaf, fi);
 			disk_num_bytes =
 				btrfs_file_extent_disk_num_bytes(leaf, fi);
-			if (extent_end <= start) {
+			/*
+			 * If the extent we got ends before our current offset,
+			 * skip to the next extent.
+			 */
+			if (extent_end <= cur_offset) {
 				path->slots[0]++;
 				goto next_slot;
 			}


  parent reply	other threads:[~2020-04-23 23:07 UTC|newest]

Thread overview: 260+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-04-23 23:03 [PATCH 3.16 000/245] 3.16.83-rc1 review Ben Hutchings
2020-04-23 23:03 ` [PATCH 3.16 001/245] mwifiex: fix unbalanced locking in mwifiex_process_country_ie() Ben Hutchings
2020-04-23 23:03 ` [PATCH 3.16 002/245] libertas: Fix two buffer overflows at parsing bss descriptor Ben Hutchings
2020-04-23 23:03 ` [PATCH 3.16 003/245] libertas: don't exit from lbs_ibss_join_existing() with RCU read lock held Ben Hutchings
2020-04-23 23:03 ` [PATCH 3.16 004/245] libertas: make lbs_ibss_join_existing() return error code on rates overflow Ben Hutchings
2020-04-23 23:03 ` [PATCH 3.16 005/245] mwifiex: fix probable memory corruption while processing TDLS frame Ben Hutchings
2020-04-23 23:03 ` [PATCH 3.16 006/245] mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame() Ben Hutchings
2020-04-23 23:03 ` [PATCH 3.16 007/245] cfg80211/mac80211: make ieee80211_send_layer2_update a public function Ben Hutchings
2020-04-23 23:03 ` [PATCH 3.16 008/245] mac80211: Do not send Layer 2 Update frame before authorization Ben Hutchings
2020-04-23 23:03 ` [PATCH 3.16 009/245] x86/microcode/AMD: Add support for fam17h microcode loading Ben Hutchings
2020-04-23 23:03 ` [PATCH 3.16 010/245] ext4: wait for existing dio workers in ext4_alloc_file_blocks() Ben Hutchings
2020-04-23 23:03 ` [PATCH 3.16 011/245] ext4: only call ext4_truncate when size <= isize Ben Hutchings
2020-04-23 23:03 ` [PATCH 3.16 012/245] ext4: update c/mtime on truncate up Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 013/245] quota: fix wrong condition in is_quota_modification() Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 014/245] ext4: fix races between page faults and hole punching Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 015/245] ext4: move unlocked dio protection from ext4_alloc_file_blocks() Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 016/245] ext4: fix races between buffered IO and collapse / insert range Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 017/245] ext4: fix races of writeback with punch hole and zero range Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 018/245] Btrfs: fix wrong max inline data size limit Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 019/245] btrfs: new define for the inline extent data start Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 020/245] btrfs: kill extent_buffer_page helper Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 021/245] btrfs: cleanup, rename a few variables in btrfs_read_sys_array Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 022/245] btrfs: add more checks to btrfs_read_sys_array Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 023/245] btrfs: cleanup, stop casting for extent_map->lookup everywhere Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 024/245] btrfs: handle invalid num_stripes in sys_array Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 025/245] btrfs: Enhance chunk validation check Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 026/245] Btrfs: add validadtion checks for chunk loading Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 027/245] Btrfs: check inconsistence between chunk and block group Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 028/245] Btrfs: fix em leak in find_first_block_group Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 029/245] Btrfs: detect corruption when non-root leaf has zero item Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 030/245] Btrfs: check btree node's nritems Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 031/245] Btrfs: fix BUG_ON in btrfs_mark_buffer_dirty Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 032/245] Btrfs: memset to avoid stale content in btree node block Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 033/245] Btrfs: improve check_node to avoid reading corrupted nodes Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 034/245] Btrfs: kill BUG_ON in run_delayed_tree_ref Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 035/245] Btrfs: memset to avoid stale content in btree leaf Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 036/245] Btrfs: fix emptiness check for dirtied extent buffers at check_leaf() Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 037/245] btrfs: struct-funcs, constify readers Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 038/245] btrfs: Refactor check_leaf function for later expansion Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 039/245] btrfs: Check if item pointer overlaps with the item itself Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 040/245] btrfs: Add sanity check for EXTENT_DATA when reading out leaf Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 041/245] btrfs: Add checker for EXTENT_CSUM Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 042/245] btrfs: Move leaf and node validation checker to tree-checker.c Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 043/245] btrfs: tree-checker: Enhance btrfs_check_node output Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 044/245] btrfs: tree-checker: Fix false panic for sanity test Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 045/245] btrfs: tree-checker: Add checker for dir item Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 046/245] btrfs: tree-checker: use %zu format string for size_t Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 047/245] btrfs: tree-check: reduce stack consumption in check_dir_item Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 048/245] btrfs: tree-checker: Verify block_group_item Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 049/245] btrfs: tree-checker: Detect invalid and empty essential trees Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 050/245] btrfs: validate type when reading a chunk Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 051/245] btrfs: Check that each block group has corresponding chunk at mount time Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 052/245] btrfs: Verify that every chunk has corresponding block group " Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 053/245] btrfs: tree-checker: Check level for leaves and nodes Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 054/245] btrfs: tree-checker: Fix misleading group system information Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 055/245] btrfs: ensure that a DUP or RAID1 block group has exactly two stripes Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 056/245] dm: do not override error code returned from dm_get_device() Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 057/245] dm flakey: return -EINVAL on interval bounds error in flakey_ctr() Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 058/245] dm flakey: fix reads to be issued if drop_writes configured Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 059/245] dm flakey: check for null arg_name in parse_features() Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 060/245] x86/pti/efi: broken conversion from efi to kernel page table Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 061/245] batman-adv: Fix DAT candidate selection on little endian systems Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 062/245] netfilter: ctnetlink: netns exit must wait for callbacks Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 063/245] taskstats: fix data-race Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 064/245] dm btree: increase rebalance threshold in __rebalance2() Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 065/245] dm thin metadata: Add support for a pre-commit callback Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 066/245] pinctrl: baytrail: Relax GPIO request rules Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 067/245] pinctrl: baytrail: Clear interrupt triggering from pins that are in GPIO mode Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 068/245] pinctrl: baytrail: Rework interrupt handling Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 069/245] pinctrl: baytrail: Serialize all register access Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 070/245] pinctrl: baytrail: Really serialize all register accesses Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 071/245] netfilter: nf_tables: missing sanitization in data from userspace Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 072/245] netfilter: nf_tables: validate NFT_DATA_VALUE after nft_data_init() Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 073/245] netfilter: bridge: make sure to pull arp header in br_nf_forward_arp() Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 074/245] HID: uhid: Fix returning EPOLLOUT from uhid_char_poll Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 075/245] gpio: Fix error message on out-of-range GPIO in lookup table Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 076/245] neighbour: remove neigh_cleanup() method Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 077/245] bonding: fix bond_neigh_init() Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 078/245] af_packet: set defaule value for tmo Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 079/245] ACPI: PM: Avoid attaching ACPI PM domain to certain devices Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 080/245] scsi: iscsi: qla4xxx: fix double free in probe Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 081/245] staging: gigaset: fix general protection fault on probe Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 082/245] staging: gigaset: fix illegal free on probe errors Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 083/245] staging: gigaset: add endpoint-type sanity check Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 084/245] usb: core: urb: fix URB structure initialization function Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 085/245] usb: mon: Fix a deadlock in usbmon between mmap and read Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 086/245] USB: serial: io_edgeport: fix epic endpoint lookup Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 087/245] USB: idmouse: fix interface sanity checks Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 088/245] USB: adutux: fix interface sanity check Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 089/245] USB: atm: ueagle-atm: add missing endpoint check Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 090/245] staging: rtl8188eu: fix interface sanity check Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 091/245] staging: rtl8712: " Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 092/245] gpiolib: fix up emulated open drain outputs Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 093/245] virtio-balloon: fix managed page counts when migrating pages between zones Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 094/245] HID: Fix slab-out-of-bounds read in hid_field_extract Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 095/245] xhci: handle some XHCI_TRUST_TX_LENGTH quirks cases as default behaviour Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 096/245] xhci: make sure interrupts are restored to correct state Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 097/245] usb: dwc3: pci: Add PCI ID for Intel Braswell Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 098/245] usb: dwc3: pci: add support for Intel Sunrise Point PCH Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 099/245] usb: dwc3: pci: add support for Intel Broxton SOC Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 100/245] usb: dwc3: pci: add ID for one more Intel Broxton platform Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 101/245] usb: dwc3: pci: add Intel Kabylake PCI ID Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 102/245] usb: dwc3: pci: add Intel Gemini Lake " Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 103/245] usb: dwc3: pci: add Intel Cannonlake PCI IDs Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 104/245] usb: dwc3: pci: add support for Intel IceLake Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 105/245] usb: dwc3: pci: add support for Comet Lake PCH ID Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 106/245] usb: dwc3: pci: Add Support for Intel Elkhart Lake Devices Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 107/245] usb: dwc3: pci: add support for TigerLake Devices Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 108/245] usb: dwc3: pci: add ID for the Intel Comet Lake -H variant Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 109/245] tty: serial: msm_serial: Fix lockup for sysrq and oops Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 110/245] IB/mlx4: Avoid executing gid task when device is being removed Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 111/245] IB/mlx4: Follow mirror sequence of device add during device removal Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 112/245] HID: hid-input: clear unmapped usages Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 113/245] btrfs: do not call synchronize_srcu() in inode_tree_del Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 114/245] Btrfs: fix removal logic of the tree mod log that leads to use-after-free issues Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 115/245] btrfs: abort transaction after failed inode updates in create_subvol Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 116/245] btrfs: handle ENOENT in btrfs_uuid_tree_iterate Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 117/245] btrfs: skip log replay on orphaned roots Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 118/245] btrfs: do not leak reloc root if we fail to read the fs root Ben Hutchings
2020-04-23 23:05 ` Ben Hutchings [this message]
2020-04-23 23:05 ` [PATCH 3.16 120/245] btrfs: Remove redundant btrfs_release_path from btrfs_unlink_subvol Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 121/245] btrfs: do not delete mismatched root refs Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 122/245] btrfs: check rw_devices, not num_devices for balance Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 123/245] ext4: check for directory entries too close to block end Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 124/245] powerpc/irq: fix stack overflow verification Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 125/245] 6pack,mkiss: fix possible deadlock Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 126/245] tcp: do not send empty skb from tcp_write_xmit() Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 127/245] ALSA: pcm: Avoid possible info leaks from PCM stream buffers Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 128/245] ALSA: hda/ca0132 - Avoid endless loop Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 129/245] ASoC: wm8962: fix lambda value Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 130/245] tty: link tty and port before configuring it as console Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 131/245] USB: EHCI: Do not return -EPIPE when hub is disconnected Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 132/245] usbip: Fix error path of vhci_recv_ret_submit() Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 133/245] kvm: x86: Host feature SSBD doesn't imply guest feature SPEC_CTRL_SSBD Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 134/245] net: stmmac: 16KB buffer must be 16 byte aligned Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 135/245] net: stmmac: Enable 16KB buffer size Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 136/245] netfilter: ebtables: convert BUG_ONs to WARN_ONs Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 137/245] netfilter: ebtables: compat: reject all padding in matches/watchers Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 138/245] platform/x86: hp-wmi: Make buffer for HPWMI_FEATURE2_QUERY 128 bytes Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 139/245] mod_devicetable: fix PHY module format Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 140/245] x86/efistub: Disable paging at mixed mode entry Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 141/245] ALSA: ice1724: Fix sleep-in-atomic in Infrasonic Quartet support code Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 142/245] locks: print unsigned ino in /proc/locks Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 143/245] netfilter: arp_tables: init netns pointer in xt_tgchk_param struct Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 144/245] tty: always relink the port Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 145/245] USB: core: fix check for duplicate endpoints Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 146/245] USB: core: add endpoint-blacklist quirk Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 147/245] USB: quirks: blacklist duplicate ep on Sound Devices USBPre2 Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 148/245] usb: musb: dma: Correct parameter passed to IRQ handler Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 149/245] can: gs_usb: gs_usb_probe(): use descriptors of current altsetting Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 150/245] can: mscan: mscan_rx_poll(): fix rx path lockup when returning from polling to irq mode Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 151/245] tcp: fix "old stuff" D-SACK causing SACK to be treated as D-SACK Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 152/245] vxlan: fix tos value before xmit Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 153/245] tracing: Have stack tracer compile when MCOUNT_INSN_SIZE is not defined Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 154/245] ftrace: Avoid potential division by zero in function profiler Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 155/245] staging: rtl8188eu: Add device code for TP-Link TL-WN727N v5.21 Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 156/245] kernel/trace: Fix do not unregister tracepoints when register sched_migrate_task fail Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 157/245] kobject: Export kobject_get_unless_zero() Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 158/245] chardev: Avoid potential use-after-free in 'chrdev_open()' Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 159/245] sctp: free cmd->obj.chunk for the unprocessed SCTP_CMD_REPLY Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 160/245] vlan: vlan_changelink() should propagate errors Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 161/245] net: stmmac: dwmac-sunxi: Allow all RGMII modes Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 162/245] pkt_sched: fq: avoid hang when quantum 0 Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 163/245] pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 164/245] macvlan: do not assume mac_header is set in macvlan_broadcast() Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 165/245] netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 166/245] ixgbevf: Remove limit of 10 entries for unicast filter list Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 167/245] scsi: sd: Clear sdkp->protection_type if disk is reformatted without PI Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 168/245] scsi: enclosure: Fix stale device oops with hot replug Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 169/245] hidraw: Return EPOLLOUT from hidraw_poll Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 170/245] HID: hidraw: Fix returning " Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 171/245] HID: hidraw, uhid: Always report EPOLLOUT Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 172/245] Input: aiptek - fix endpoint sanity check Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 173/245] Input: gtco " Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 174/245] Input: sur40 - fix interface sanity checks Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 175/245] platform/x86: asus-wmi: Fix keyboard brightness cannot be set to 0 Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 176/245] iio: buffer: align the size of scan bytes to size of the largest element Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 177/245] USB: serial: simple: Add Motorola Solutions TETRA MTP3xxx and MTP85xx Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 178/245] netfilter: fix a use-after-free in mtype_destroy() Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 179/245] netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 180/245] ALSA: usb-audio: add implicit fb quirk for Axe-Fx II Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 181/245] ALSA: usb-audio: simplify set_sync_ep_implicit_fb_quirk Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 182/245] ALSA: usb-audio: fix sync-ep altsetting sanity check Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 183/245] USB: serial: opticon: fix control-message timeouts Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 184/245] r8152: add missing endpoint sanity check Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 185/245] usb: core: hub: Improved device recognition on remote wakeup Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 186/245] Fix built-in early-load Intel microcode alignment Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 187/245] ALSA: seq: Fix racy access for queue timer in proc read Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 188/245] scsi: fnic: fix invalid stack access Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 189/245] block: fix an integer overflow in logical block size Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 190/245] macvlan: use skb_reset_mac_header() in macvlan_queue_xmit() Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 191/245] Input: keyspan-remote - fix control-message timeouts Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 192/245] USB: serial: suppress driver bind attributes Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 193/245] USB: serial: ch341: handle unbound port at reset_resume Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 194/245] USB: serial: io_edgeport: handle unbound ports on URB completion Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 195/245] USB: serial: io_edgeport: add missing active-port sanity check Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 196/245] USB: serial: keyspan: handle unbound ports Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 197/245] USB: serial: quatech2: " Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 198/245] hwmon: (adt7475) Make volt2reg return same reg as reg2volt input Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 199/245] ARM: 8950/1: ftrace/recordmcount: filter relocation types Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 200/245] mmc: sdhci: fix minimum clock rate for v3 controller Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 201/245] can, slip: Protect tty->disc_data in write_wakeup and close with RCU Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 202/245] net: sonic: return NETDEV_TX_OK if failed to map buffer Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 203/245] net/sonic: Add mutual exclusion for accessing shared state Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 204/245] net/sonic: Use MMIO accessors Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 205/245] net/sonic: Fix receive buffer handling Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 206/245] net/sonic: Quiesce SONIC before re-initializing descriptor memory Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 207/245] net_sched: fix datalen for ematch Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 208/245] namei: allow restricted O_CREAT of FIFOs and regular files Ben Hutchings
2020-04-24 13:52   ` Solar Designer
2020-04-24 15:13     ` Ben Hutchings
2020-04-24 17:38       ` Solar Designer
2020-04-23 23:07 ` [PATCH 3.16 209/245] do_last(): fetch directory ->i_mode and ->i_uid before it's too late Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 210/245] vfs: fix do_last() regression Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 211/245] blktrace: re-write setting q->blk_trace Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 212/245] blktrace: Protect q->blk_trace with RCU Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 213/245] blktrace: fix dereference after null check Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 214/245] Input: add safety guards to input_set_keycode() Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 215/245] staging: android: ashmem: Disallow ashmem memory from being remapped Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 216/245] net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 217/245] KVM: nVMX: Don't emulate instructions in guest mode Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 218/245] vgacon: Fix a UAF in vgacon_invert_region Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 219/245] tty: vt: Fix !TASK_RUNNING diagnostic warning from paste_selection() Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 220/245] vt: selection, handle pending signals in paste_selection Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 221/245] vt: selection, close sel_buffer race Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 222/245] vt: selection, push console lock down Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 223/245] vt: selection, push sel_lock up Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 224/245] floppy: check FDC index for errors before assigning it Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 225/245] vhost: Check docket sk_family instead of call getname Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 226/245] mm: mempolicy: require at least one nodeid for MPOL_PREFERRED Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 227/245] media: ov519: add missing endpoint sanity checks Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 228/245] media: stv06xx: add missing descriptor " Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 229/245] media: xirlink_cit: " Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 230/245] ptp: do not explicitly set drvdata in ptp_clock_register() Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 231/245] ptp: use is_visible method to hide unused attributes Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 232/245] ptp: create "pins" together with the rest of attributes Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 233/245] chardev: add helper function to register char devs with a struct device Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 234/245] ptp: Fix pass zero to ERR_PTR() in ptp_clock_register Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 235/245] ptp: fix the race between the release of ptp_clock and cdev Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 236/245] ptp: free ptp device pin descriptors properly Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 237/245] [media] media-devnode: just return 0 instead of using a var Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 238/245] [media] media: Fix media_open() to clear filp->private_data in error leg Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 239/245] [media] drivers/media/media-devnode: clear private_data before put_device() Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 240/245] [media] media-devnode: add missing mutex lock in error handler Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 241/245] [media] media-devnode: fix namespace mess Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 242/245] [media] media-device: dynamically allocate struct media_devnode Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 243/245] [media] media: fix use-after-free in cdev_put() when app exits after driver unbind Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 244/245] [media] media: fix media devnode ioctl/syscall and unregister race Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 245/245] slcan: Don't transmit uninitialized stack data in padding Ben Hutchings
2020-04-23 23:59 ` [PATCH 3.16 000/245] 3.16.83-rc1 review Jann Horn
2020-04-24 13:43   ` Ben Hutchings
2020-04-24 14:49 ` Guenter Roeck
2020-04-24 15:13   ` Ben Hutchings
2020-04-24 15:47 ` [PATCH 3.16 000/247] 3.16.83-rc2 review Ben Hutchings
2020-04-24 15:51   ` [PATCH 3.16 246/247] futex: Fix inode life-time issue Ben Hutchings
2020-04-24 15:56     ` Peter Zijlstra
2020-04-24 16:31       ` Ben Hutchings
2020-04-24 15:51   ` [PATCH 3.16 247/247] futex: Unbreak futex hashing Ben Hutchings
2020-04-24 17:48   ` [PATCH 3.16 000/247] 3.16.83-rc2 review Guenter Roeck
2020-04-24 17:54     ` Ben Hutchings

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=lsq.1587683028.361896157@decadent.org.uk \
    --to=ben@decadent.org.uk \
    --cc=akpm@linux-foundation.org \
    --cc=dsterba@suse.com \
    --cc=fdmanana@suse.com \
    --cc=josef@toxicpanda.com \
    --cc=kda@linux-powerpc.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).