I'm announcing the release of the 3.16.54 kernel. All users of the 3.16 kernel series should upgrade. The updated 3.16.y git tree can be found at: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-3.16.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git The diff from 3.16.53 is attached to this message. Ben. ------------ .../devicetree/bindings/sound/cs42l56.txt | 2 +- Makefile | 2 +- arch/arm/mm/dump.c | 4 +- arch/arm64/kernel/vdso/gettimeofday.S | 3 +- arch/mips/kernel/ptrace.c | 17 ++ arch/parisc/kernel/syscall.S | 6 +- arch/powerpc/kernel/vio.c | 2 + arch/powerpc/platforms/powernv/opal-async.c | 6 +- arch/powerpc/platforms/powernv/setup.c | 2 +- arch/s390/include/asm/switch_to.h | 2 +- arch/s390/kernel/dis.c | 4 +- arch/s390/kernel/early.c | 4 +- arch/s390/kernel/process.c | 1 + arch/s390/kernel/runtime_instr.c | 4 +- arch/x86/include/asm/fixmap.h | 11 +- arch/x86/include/asm/pvclock.h | 15 +- arch/x86/include/asm/vdso.h | 19 +- arch/x86/kernel/alternative.c | 26 +- arch/x86/kernel/kvmclock.c | 16 +- arch/x86/kernel/pvclock.c | 68 ----- arch/x86/kvm/svm.c | 7 + arch/x86/kvm/vmx.c | 4 + arch/x86/kvm/x86.c | 5 +- arch/x86/kvm/x86.h | 2 + arch/x86/lib/x86-opcode-map.txt | 2 +- arch/x86/mm/kaiser.c | 7 +- arch/x86/platform/uv/uv_nmi.c | 1 + arch/x86/vdso/vclock_gettime.c | 103 ++++--- arch/x86/vdso/vdso-layout.lds.S | 45 ++- arch/x86/vdso/vdso2c.c | 15 +- arch/x86/vdso/vdso2c.h | 25 +- arch/x86/vdso/vma.c | 34 ++- block/blk-core.c | 3 + drivers/acpi/apei/ghes.c | 85 +----- drivers/char/ipmi/ipmi_msghandler.c | 10 +- drivers/char/tpm/tpm-dev.c | 6 + drivers/clk/tegra/clk-tegra30.c | 2 +- drivers/clk/ti/clk-dra7-atl.c | 3 +- drivers/crypto/caam/desc.h | 2 +- drivers/gpu/drm/gma500/mdfld_intel_display.c | 2 +- drivers/gpu/drm/i915/intel_bios.c | 2 +- drivers/gpu/drm/i915/intel_display.c | 14 +- drivers/gpu/drm/i915/intel_dp.c | 2 +- drivers/gpu/drm/radeon/atombios_dp.c | 38 ++- drivers/gpu/drm/ttm/ttm_bo_util.c | 1 + drivers/infiniband/hw/mlx4/qp.c | 2 +- drivers/infiniband/hw/mlx5/main.c | 2 + drivers/infiniband/ulp/srp/ib_srp.c | 23 +- drivers/infiniband/ulp/srpt/ib_srpt.c | 9 +- drivers/input/misc/adxl34x.c | 2 +- drivers/iommu/dmar.c | 7 +- drivers/iommu/intel-iommu.c | 10 + drivers/md/bcache/alloc.c | 3 +- drivers/md/bcache/request.c | 10 +- drivers/md/dm-bufio.c | 15 +- drivers/md/dm-table.c | 32 +- drivers/md/dm.c | 12 +- drivers/media/platform/omap/omap_vout.c | 3 +- drivers/media/rc/ir-lirc-codec.c | 9 +- drivers/media/usb/cx231xx/cx231xx-cards.c | 3 +- drivers/mtd/nand/nand_base.c | 9 +- drivers/mtd/nand/omap2.c | 340 ++++++++++++++------- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 56 +--- drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_txrx.c | 2 +- drivers/net/ethernet/intel/i40evf/i40e_txrx.c | 2 +- drivers/net/ethernet/intel/igb/igb_main.c | 2 +- drivers/net/ethernet/intel/igbvf/netdev.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 2 +- drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 2 +- drivers/net/wireless/p54/main.c | 7 +- drivers/net/wireless/rt2x00/rt2x00usb.c | 6 +- drivers/pci/pcie/aer/aerdrv_core.c | 9 +- drivers/platform/x86/sony-laptop.c | 14 +- drivers/rtc/interface.c | 16 +- drivers/scsi/bfa/bfad_debugfs.c | 5 +- drivers/staging/android/ashmem.c | 2 + drivers/staging/lustre/lustre/ptlrpc/sec.c | 2 +- drivers/staging/rtl8188eu/core/rtw_mlme.c | 3 +- drivers/staging/usbip/stub.h | 1 - drivers/staging/usbip/stub_dev.c | 4 +- drivers/staging/usbip/stub_rx.c | 66 ++-- drivers/staging/usbip/stub_tx.c | 13 +- drivers/staging/usbip/usbip_common.h | 1 + drivers/staging/usbip/userspace/Makefile.am | 3 +- .../staging/usbip/userspace/libsrc/vhci_driver.c | 8 +- drivers/staging/usbip/vhci_sysfs.c | 20 +- drivers/target/iscsi/iscsi_target.c | 49 ++- drivers/target/target_core_tmr.c | 10 + drivers/target/target_core_transport.c | 2 + drivers/usb/core/devio.c | 14 + drivers/usb/core/quirks.c | 3 + drivers/usb/serial/garmin_gps.c | 22 +- drivers/usb/serial/metro-usb.c | 11 +- drivers/usb/serial/qcserial.c | 1 + drivers/video/fbdev/udlfb.c | 10 +- fs/9p/vfs_inode.c | 3 + fs/9p/vfs_inode_dotl.c | 3 + fs/autofs4/waitq.c | 16 +- fs/binfmt_elf_fdpic.c | 2 + fs/btrfs/super.c | 4 +- fs/coda/upcall.c | 3 +- fs/ecryptfs/messaging.c | 7 +- fs/ext4/extents.c | 6 +- fs/f2fs/file.c | 5 + fs/f2fs/segment.c | 20 +- fs/isofs/isofs.h | 2 +- fs/isofs/rock.h | 2 +- fs/isofs/util.c | 2 +- fs/nfs/nfs4proc.c | 18 +- fs/nfs/nfs4trace.h | 8 +- fs/nfs/super.c | 2 +- fs/nilfs2/segment.c | 6 +- include/linux/blkdev.h | 1 + include/linux/dmar.h | 1 + include/linux/sched.h | 8 - include/net/sctp/sctp.h | 2 + include/net/sctp/structs.h | 8 +- include/target/target_core_base.h | 2 + kernel/extable.c | 2 + kernel/sched/core.c | 15 - kernel/trace/blktrace.c | 76 ++++- lib/int_sqrt.c | 3 + net/9p/client.c | 3 +- net/9p/trans_virtio.c | 13 +- net/bluetooth/l2cap_core.c | 20 +- net/ipv4/route.c | 14 +- net/l2tp/l2tp_core.c | 21 +- net/l2tp/l2tp_core.h | 3 + net/l2tp/l2tp_eth.c | 101 ++++-- net/l2tp/l2tp_ppp.c | 236 ++++++++------ net/netfilter/xt_TCPMSS.c | 6 +- net/nfc/core.c | 2 +- net/rds/rdma.c | 4 + net/sctp/ipv6.c | 160 +++++----- net/sctp/protocol.c | 12 +- net/sctp/socket.c | 33 +- net/sctp/transport.c | 4 +- net/sctp/ulpevent.c | 2 +- net/wireless/nl80211.c | 26 +- security/apparmor/domain.c | 53 +++- security/integrity/ima/ima_main.c | 4 + sound/core/seq/seq_clientmgr.c | 10 +- sound/core/seq/seq_clientmgr.h | 1 + sound/core/timer_compat.c | 12 +- sound/pci/hda/hda_intel.c | 3 + sound/usb/clock.c | 9 +- sound/usb/mixer.c | 15 +- 148 files changed, 1470 insertions(+), 1021 deletions(-) Alan Stern (1): USB: usbfs: compute urb->actual_length for isochronous Alexander Popov (1): usbip: fix NULL pointer dereference on errors Alexander Potapenko (1): sctp: fully initialize the IPv6 address in sctp_v6_to_addr() Alexander Steffen (1): tpm-dev-common: Reject too short writes Alexandre Belloni (1): rtc: set the alarm to the next expiring timer Andreas Rohner (1): nilfs2: fix race condition that causes file system corruption Andrew F. Davis (1): ASoC: cs42l56: Fix reset GPIO name in example DT binding Andrey Konovalov (1): p54: don't unregister leds when they are not initialized Andy Lutomirski (4): x86, vdso: Move the vvar area before the vdso text x86, vdso, pvclock: Simplify and speed up the vdso pvclock reader x86/vdso: Get pvclock data from the vvar VMA instead of the fixmap x86/vdso: Remove pvclock fixmap machinery Anna Schumaker (1): NFS: Avoid RCU usage in tracepoints Arnd Bergmann (4): drm: gma500: fix logic error Input: adxl34x - do not treat FIFO_MODE() as boolean elf_fdpic: fix unused variable warning isofs: fix timestamps beyond 2027 Bart Van Assche (3): IB/srpt: Do not accept invalid initiator port names IB/srp: Avoid that a cable pull can trigger a kernel crash target/iscsi: Fix iSCSI task reassignment handling Ben Hutchings (2): usbip: tools: Install all headers needed for libusbip development Linux 3.16.54 Ben Seri (1): Bluetooth: Prevent stack info leak from the EFS element. Bernhard Rosenkraenzer (1): USB: Add delay-init quirk for Corsair K70 LUX keyboards Boshi Wang (1): ima: fix hash algorithm initialization Brent Taylor (1): mtd: nand: Fix writing mtdoops to nand flash. Brian King (6): ixgbe: Fix skb list corruption on Power systems i40e: Use smp_rmb rather than read_barrier_depends ixgbevf: Use smp_rmb rather than read_barrier_depends igbvf: Use smp_rmb rather than read_barrier_depends igb: Use smp_rmb rather than read_barrier_depends i40evf: Use smp_rmb rather than read_barrier_depends Christian König (1): drm/ttm: once more fix ttm_buffer_object_transfer Chuck Lever (1): nfs: Fix ugly referral attributes Colin Ian King (3): rtc: interface: ignore expired timers when enqueuing new timers btrfs: avoid null pointer dereference on fs_info when calling btrfs_crit staging: rtl8188eu: avoid a null dereference on pmlmepriv Coly Li (2): bcache: check ca->alloc_thread initialized before wake up it bcache: only permit to recovery read error when cache device is clean Corey Minyard (1): ipmi: fix unsigned long underflow Dan Carpenter (2): scsi: bfa: integer overflow in debugfs eCryptfs: use after free in ecryptfs_release_messaging() Dongho Sim (1): f2fs: remove redundant lines in allocate_data_block Doug Berger (1): net: bcmgenet: enable loopback during UniMAC sw_reset Douglas Fischer (1): USB: serial: qcserial: add pid/vid for Sierra Wireless EM7355 fw update Eric Biggers (1): dm bufio: fix integer overflow when limiting maximum cache size Eric Dumazet (1): netfilter: xt_TCPMSS: add more sanity tests on tcph->doff Eric W. Biederman (1): net/sctp: Always set scope_id in sctp_inet6_skb_msgname Gabriele Paoloni (1): PCI/AER: Report non-fatal errors only to the affected endpoint Guenter Roeck (1): kaiser: Set _PAGE_NX only if supported Guillaume Nault (5): l2tp: ensure sessions are freed after their PPPOL2TP socket l2tp: don't register sessions in l2tp_session_create() l2tp: initialise l2tp_eth sessions before registering them l2tp: protect sock pointer of struct pppol2tp_session with RCU l2tp: initialise PPP sessions before registering them Heiko Carstens (2): s390/runtime instrumention: fix possible memory corruption s390: fix transactional execution control register handling Hou Tao (1): dm: fix race between dm_get_from_kobject() and __dm_destroy() Ingo Molnar (1): x86/platform/uv: Include clocksource.h for clocksource_touch_watchdog() Jaegeuk Kim (1): f2fs: expose some sectors to user in inline data or dentry case James Morse (2): ACPI / APEI: Replace ioremap_page_range() with fixmap ACPI / APEI: Remove ghes_ioremap_area Jan Harkes (1): coda: fix 'kernel memory exposure attempt' in fsync Jani Nikula (1): drm/i915/bios: parse DDI ports also for CHV for HDMI DDC pin and DP AUX channel Jason Gunthorpe (1): sctp: Fixup v4mapped behaviour to comply with Sock API Jens Axboe (1): blktrace: fix unlocked access to init/start-stop/teardown Joerg Roedel (1): iommu/vt-d: Don't register bus-notifier under dmar_global_lock Johan Hovold (5): USB: serial: garmin_gps: fix I/O after failed probe and remove USB: serial: garmin_gps: fix memory leak on probe errors USB: serial: metro-usb: stop I/O after failed open NFC: fix device-allocation error return clk: ti: dra7-atl-clock: fix child-node lookups Johannes Berg (1): nl80211: don't expose wdev->ssid for most interfaces John David Anglin (1): parisc: Fix validity check of pointer size argument in new CAS implementation John Johansen (1): apparmor: ensure that undecidable profile attachments fail Joshua Watt (1): NFS: Fix typo in nomigration mount option Juerg Haefliger (1): Revert "x86: kvmclock: Disable use from vDSO if KPTI is enabled" Ladi Prosek (1): KVM: nVMX: set IDTR and GDTR limits when loading L1 host state Ladislav Michl (1): video: udlfb: Fix read EDID timeout Lepton Wu (1): kaiser: Set _PAGE_NX only if supported Maciej W. Rozycki (1): MIPS: Fix an n32 core file generation regset support regression Majd Dibbiny (1): IB/mlx5: Assign send CQ and recv CQ of UMR QP Manasi Navare (1): drm/i915/edp: Get the Panel Power Off timestamp after panel is off Mark Bloch (1): IB/mlx4: Increase maximal message size under UD QP Mark Rutland (1): arm64: vdso: fix clock_getres for 4GiB-aligned res Markus Elfring (2): media: omap_vout: Fix a possible null pointer dereference in omap_vout_open() platform/x86: sony-laptop: Fix error handling in sony_nc_setup_rfkill() Masami Hiramatsu (1): x86/decoder: Add new TEST instruction pattern Mauro Carvalho Chehab (1): cx231xx: Fix the max number of interfaces Michał Mirosław (1): clk: tegra: Fix cclk_lp divisor register Mike Snitzer (1): dm: discard support requires all targets in a table support discards Mohamed Ghannam (2): RDS: Heap OOB write in rds_message_alloc_sgs() RDS: null pointer dereference in rds_atomic_free_op Nadav Amit (2): staging: lustre: ptlrpc: kfree used instead of kvfree KVM: vmx: Inject #GP on invalid PAT CR Nathan Lynch (1): arm64: vdso: minor ABI fix for clock_getres NeilBrown (2): autofs: don't fail mount for transient error autofs: fix careless error in recent commit Nicholas Bellinger (3): target: Avoid early CMD_T_PRE_EXECUTE failures during ABORT_TASK iscsi-target: Make TASK_REASSIGN use proper se_cmd->cmd_kref iscsi-target: Fix non-immediate TMR reference leak Paolo Bonzini (2): KVM: SVM: obey guest PAT x86: pvclock: Really remove the sched notifier for cross-cpu migrations Peter Ujfalusi (1): clk: ti: dra7-atl-clock: Fix of_node reference counting Peter Zijlstra (1): lib/int_sqrt: optimize small argument Philip Derrin (1): ARM: 8721/1: mm: dump: check hardware RO bit for LPAE Radu Alexe (1): crypto: caam - fix incorrect define Roger Quadros (1): mtd: nand: omap2: Fix subpage write Roman Kapl (1): drm/radeon: fix atombios on big endian Sean Young (1): media: rc: check for integer overflow Shriya (1): powerpc/powernv/cpufreq: Fix the frequency read by /proc/cpuinfo Shuah Khan (4): usbip: fix stub_rx: get_pipe() to validate endpoint number usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input usbip: prevent vhci_hcd driver from leaking a socket pointer address usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer Stanislaw Gruszka (1): rt2x00usb: mark device removed when get ENOENT usb error Takashi Iwai (5): ALSA: timer: Remove kernel warning at compat ioctl error paths ALSA: usb-audio: Add sanity checks to FE parser ALSA: usb-audio: Fix potential out-of-bound access at parsing SU ALSA: usb-audio: Add sanity checks in v2 clock parsers ALSA: seq: Make ioctls race-free Theodore Ts'o (1): ext4: fix interaction between i_size, fallocate, and delalloc after a crash Tuomas Tynkkynen (2): fs/9p: Compare qid.path in v9fs_test_inode net/9p: Switch to wait_event_killable() Tyrel Datwyler (1): powerpc/pseries/vio: Dispose of virq mapping on vdevice unregister Vasily Gorbik (1): s390/disassembler: increase show_code buffer size Vijendar Mukunda (1): ALSA: hda: Add Raven PCI ID Viktor Slavkovic (1): staging: android: ashmem: fix a race condition in ASHMEM_SET_SIZE ioctl Ville Syrjälä (1): drm/i915: Read timings from the correct transcoder in intel_crtc_mode_get() Waiman Long (1): blktrace: Fix potential deadlock between delete & sysfs ops William A. Kennington III (1): powerpc/opal: Fix EBUSY bug in acquiring tokens Xin Long (2): route: update fnhe_expires for redirect when the fnhe exists route: also update fnhe_genid when updating a route cache Yunlong Song (1): Revert "f2fs: handle dirty segments inside refresh_sit_entry" Zhou Chengming (1): kprobes, x86/alternatives: Use text_mutex to protect smp_alt_modules