4.5.1-stable review

This is the start of the stable review cycle for the 4.5.1 release. There are 238 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Tue Apr 12 18:34:18 UTC 2016. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.5.1-rc1.gz

and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 4.5.1-rc1

Andi Kleen <[email protected]>
perf/x86/intel: Fix PEBS data source interpretation on Nehalem/Westmere

Jiri Olsa <[email protected]>
perf/x86/intel: Use PAGE_SIZE for PEBS buffer size on Core2

Kan Liang <[email protected]>
perf/x86/intel: Fix PEBS warning by only restoring active PMU in pmi

Kan Liang <[email protected]>
perf/x86/intel/uncore: Remove SBOX support for BDX-DE

Stephane Eranian <[email protected]>
perf/x86/pebs: Add workaround for broken OVFL status on HSW+

Thomas Gleixner <[email protected]>
sched/cputime: Fix steal time accounting vs. CPU hotplug

Hannes Reinecke <[email protected]>
scsi_common: do not clobber fixed sense information

Lukas Wunner <[email protected]>
PM / sleep: Clear pm_suspend_global_flags upon hibernate

Len Brown <[email protected]>
intel_idle: prevent SKL-H boot failure when C8+C9+C10 enabled

Aaro Koskinen <[email protected]>
mtd: onenand: fix deadlock in onenand_block_markbad

Vlastimil Babka <[email protected]>
mm/page_alloc: prevent merging between isolated and other pageblocks

Joseph Qi <[email protected]>
ocfs2/dlm: fix BUG in dlm_move_lockres_to_recovery_list

Joseph Qi <[email protected]>
ocfs2/dlm: fix race between convert and recovery

Junxiao Bi <[email protected]>
ocfs2: o2hb: fix double free bug

Vladis Dronov <[email protected]>
Input: ati_remote2 - fix crashes on detecting device with invalid descriptor

Oliver Neukum <[email protected]>
Input: ims-pcu - sanity check against missing interfaces

Benjamin Tissoires <[email protected]>
Input: synaptics - handle spurious release of trackstick buttons, again

Tejun Heo <[email protected]>
writeback, cgroup: fix use of the wrong bdi_writeback which mismatches the inode

Tejun Heo <[email protected]>
writeback, cgroup: fix premature wb_put() in locked_inode_to_wb_and_lock_list()

Lukas Wunner <[email protected]>
ACPI / PM: Runtime resume devices when waking from hibernate

Ludovic Desroches <[email protected]>
ARM: dts: at91: sama5d4 Xplained: don't disable hsmci regulator

Ludovic Desroches <[email protected]>
ARM: dts: at91: sama5d3 Xplained: don't disable hsmci regulator

J. Bruce Fields <[email protected]>
nfsd: fix deadlock secinfo+readdir compound

J. Bruce Fields <[email protected]>
nfsd4: fix bad bounds checking

Jenny Derzhavetz <[email protected]>
iser-target: Rework connection termination

Jenny Derzhavetz <[email protected]>
iser-target: Separate flows for np listeners and connections cma events

Jenny Derzhavetz <[email protected]>
iser-target: Add new state ISER_CONN_BOUND to isert_conn

Jenny Derzhavetz <[email protected]>
iser-target: Fix identification of login rx descriptor type

Himanshu Madhani <[email protected]>
target: Fix target_release_cmd_kref shutdown comp leak

Eric Anholt <[email protected]>
clk: bcm2835: Fix setting of PLL divider clock rates

Alexander Kochetkov <[email protected]>
clk: rockchip: add hclk_cpubus to the list of rk3188 critical clocks

Heiko Stuebner <[email protected]>
clk: rockchip: rk3368: fix hdmi_cec gate-register

Heiko Stuebner <[email protected]>
clk: rockchip: rk3368: fix parents of video encoder/decoder

Heiko Stuebner <[email protected]>
clk: rockchip: rk3368: fix cpuclk core dividers

Heiko Stuebner <[email protected]>
clk: rockchip: rk3368: fix cpuclk mux bit of big cpu-cluster

Brent Taylor <[email protected]>
mmc: atmel-mci: Check pdata for NULL before dereferencing it at DMA config

Adrian Hunter <[email protected]>
mmc: sdhci: Fix override of timeout clk wrt max_busy_timeout

Lucas Stach <[email protected]>
mmc: tegra: properly disable card clock

Jon Hunter <[email protected]>
mmc: tegra: Disable UHS-I modes for tegra114

Russell King <[email protected]>
mmc: sdhci-pxav3: fix higher speed mode capabilities

Russell King <[email protected]>
mmc: sdhci: fix data timeout (part 2)

Russell King <[email protected]>
mmc: sdhci: fix data timeout (part 1)

Russell King <[email protected]>
mmc: sdhci: plug DMA mapping leak on error

Russell King <[email protected]>
mmc: sdhci: avoid unnecessary mapping/unmapping of align buffer

Russell King <[email protected]>
mmc: sdhci: further fix for DMA unmapping in sdhci_post_req()

Russell King <[email protected]>
mmc: sdhci: fix command response CRC error handling

Russell King <[email protected]>
mmc: sdhci: clean up command error handling

Russell King <[email protected]>
mmc: sdhci: move initialisation of command error member

Magnus Damm <[email protected]>
mmc: mmc_spi: Add Card Detect comments and fix CD GPIO case

Shawn Lin <[email protected]>
mmc: block: fix ABI regression of mmc_blk_ioctl

John Dahlstrom <[email protected]>
ideapad-laptop: Add ideapad Y700 (15) to the no_hw_rfkill DMI list

Guenter Roeck <[email protected]>
MAINTAINERS: Update mailing list and web page for hwmon subsystem

Jiri Kosina <[email protected]>
kbuild/mkspec: fix grub2 installkernel issue

Jan Beulich <[email protected]>
scripts/kconfig: allow building with make 3.80 again

Julia Lawall <[email protected]>
scripts/coccinelle: modernize &

Peter Zijlstra <[email protected]>
bitops: Do not default to __clear_bit() for __clear_bit_unlock()

Steven Rostedt (Red Hat) <[email protected]>
tracing: Fix trace_printk() to print when not using bprintk()

Steven Rostedt (Red Hat) <[email protected]>
tracing: Fix crash from reading trace_pipe with sendfile

Steven Rostedt (Red Hat) <[email protected]>
tracing: Have preempt(irqs)off trace preempt disabled functions

Eric Huang <[email protected]>
drm/amd/powerplay: add uvd/vce dpm enabling flag to fix the performance issue for CZ

Ken Wang <[email protected]>
drm/amdgpu: include the right version of gmc header files for iceland

Alex Deucher <[email protected]>
drm/amdgpu: disable runtime pm on PX laptops without dGPU power control

Dave Airlie <[email protected]>
drm/radeon/mst: fix regression in lane/link handling.

Alex Deucher <[email protected]>
drm/radeon: rework fbdev handling on chips with no connectors

Mario Kleiner <[email protected]>
drm/radeon: Don't drop DP 2.7 Ghz link setup on some cards.

Alex Deucher <[email protected]>
drm/radeon: disable runtime pm on PX laptops without dGPU power control

Dan Carpenter <[email protected]>
drm/vc4: Return -EFAULT on copy_from_user() failure

Aurelien Jacquiot <[email protected]>
rapidio/rionet: fix deadlock on SMP

Jann Horn <[email protected]>
fs/coredump: prevent fsuid=0 dumps into user-controlled directories

Jan Kiszka <[email protected]>
scripts/gdb: account for changes in module data structure

Seth Forshee <[email protected]>
fuse: Add reference counting for fuse_io_priv

Robert Doebbelin <[email protected]>
fuse: do not use iocb after it may have been freed

Ming Lei <[email protected]>
md: multipath: don't hardcopy bio in .make_request path

NeilBrown <[email protected]>
md/raid5: preserve STRIPE_PREREAD_ACTIVE in break_stripe_batch_list

Shaohua Li <[email protected]>
raid10: include bio_end_io_list in nr_queued to prevent freeze_array hang

Shaohua Li <[email protected]>
RAID5: revert e9e4c377e2f563 to fix a livelock

Shaohua Li <[email protected]>
RAID5: check_reshape() shouldn't call mddev_suspend

Jes Sorensen <[email protected]>
md/raid5: Compare apples to apples (or sectors to sectors)

Nate Dailey <[email protected]>
raid1: include bio_end_io_list in nr_queued to prevent freeze_array hang

Mateusz Guzik <[email protected]>
xfs: fix two memory leaks in xfs_attr_list.c error paths

Nikolay Borisov <[email protected]>
quota: Fix possible GPF due to uninitialised pointers

Vineet Gupta <[email protected]>
ARC: bitops: Remove non relevant comments

Lada Trimasova <[email protected]>
ARC: [BE] readl()/writel() to work in Big Endian CPU configuration

Alexey Brodkin <[email protected]>

    ARC: [plat-axs10x] add Ethernet PHY description in .dts

Max Filippov <[email protected]>
xtensa: clear all DBREAKC registers on start

Max Filippov <[email protected]>
xtensa: fix preemption in {clear,copy}_user_highpage

Max Filippov <[email protected]>
xtensa: ISS: don't hang if stdin EOF is reached

Rabin Vincent <[email protected]>
splice: handle zero nr_pages in splice_to_pipe()

Dmitry V. Levin <[email protected]>
vfs: show_vfsstat: do not ignore errors from show_devname method

Vinayak Menon <[email protected]>
of: alloc anywhere from memblock if range not specified

Hante Meuleman <[email protected]>
brcmfmac: Increase nr of supported flowrings.

Dmitri Epshtein <[email protected]>
net: mvneta: enable change MAC address when interface is up

Tejun Heo <[email protected]>
cgroup: ignore css_sets associated with dead cgroups during migration

Johan Hedberg <[email protected]>
Bluetooth: Fix potential buffer overflow with Add Advertising

Dmitry Tunin <[email protected]>

    Bluetooth: Add new AR3012 ID 0489:e095

Michael S. Tsirkin <[email protected]>
watchdog: rc32434_wdt: fix ioctl error handling

Joshua Hunt <[email protected]>
watchdog: don't run proc_watchdog_update if new value is same as old

Aaro Koskinen <[email protected]>
drivers/firmware/broadcom/bcm47xx_nvram.c: fix incorrect __ioread32_copy

Luis R. Rodriguez <[email protected]>
ia64: define ioremap_uc()

Johannes Weiner <[email protected]>
mm: memcontrol: reclaim and OOM kill when shrinking memory.max below usage

Johannes Weiner <[email protected]>
mm: memcontrol: reclaim when shrinking memory.high below usage

Eric Wheeler <[email protected]>
bcache: fix cache_set_flush() NULL pointer dereference on OOM

Eric Wheeler <[email protected]>
bcache: fix race of writeback thread starting before complete initialization

Eric Wheeler <[email protected]>
bcache: cleaned up error handling around register_cache()

Bart Van Assche <[email protected]>
IB/srpt: Simplify srpt_handle_tsk_mgmt()

Bart Van Assche <[email protected]>
brd: Fix discard request processing

Catalin Marinas <[email protected]>
arm64: Update PTE_RDONLY in set_pte_at() for PROT_NONE permission

Geert Uytterhoeven <[email protected]>

    gpio: pca953x: Fix pca953x_gpio_set_multiple() on 64-bit

OGAWA Hirofumi <[email protected]>
jbd2: fix FS corruption possibility in jbd2_journal_destroy() on umount path

Kamal Mostafa <[email protected]>
tools/hv: Use include/uapi with __EXPORTED_HEADERS__

Takashi Iwai <[email protected]>
ALSA: hda - Fix missing ELD update at unplugging

Takashi Iwai <[email protected]>
ALSA: hda - Workaround for unbalanced i915 power refcount by concurrent probe

Takashi Iwai <[email protected]>
ALSA: hda - Fix forgotten HDMI monitor_present update

Takashi Iwai <[email protected]>
ALSA: hda - Really restrict i915 notifier to HSW+

Takashi Iwai <[email protected]>
ALSA: hda - Fix spurious kernel WARNING on Baytrail HDMI

Takashi Iwai <[email protected]>
ALSA: hda - Limit i915 HDMI binding only for HSW and later

Takashi Iwai <[email protected]>
ALSA: hda - Fix unconditional GPIO toggle via automute

Aaron Plattner <[email protected]>

    ALSA: hda - Add new GPU codec ID 0x10de0082 to snd-hda

Hui Wang <[email protected]>
ALSA: hda - fix the mic mute button and led problem for a Lenovo AIO

Takashi Iwai <[email protected]>
ALSA: hda - Don't handle ELD notify from invalid port

Vittorio Gambaletta (VittGam) <[email protected]>
ALSA: intel8x0: Add clock quirk entry for AD1981B on IBM ThinkPad X41.

Takashi Iwai <[email protected]>
ALSA: pcm: Avoid "BUG:" string for warnings again

Takashi Iwai <[email protected]>
ALSA: hda - Apply reboot D3 fix for CX20724 codec, too

Takashi Iwai <[email protected]>
ALSA: hda - Fix unexpected resume through regmap code path

Asai Thambi SP <[email protected]>
mtip32xx: Cleanup queued requests after surprise removal

Asai Thambi SP <[email protected]>
mtip32xx: Implement timeout handler

Asai Thambi SP <[email protected]>
mtip32xx: Handle FTL rebuild failure state during device initialization

Asai Thambi SP <[email protected]>
mtip32xx: Handle safe removal during IO

Asai Thambi SP <[email protected]>
mtip32xx: Fix for rmmod crash when drive is in FTL rebuild

Asai Thambi SP <[email protected]>
mtip32xx: Print exact time when an internal command is interrupted

Asai Thambi SP <[email protected]>
mtip32xx: Remove unwanted code from taskfile error handler

Asai Thambi SP <[email protected]>
mtip32xx: Fix broken service thread handling

Asai Thambi SP <[email protected]>
mtip32xx: Avoid issuing standby immediate cmd during FTL rebuild

Tiffany Lin <[email protected]>
media: v4l2-compat-ioctl32: fix missing length copy in put_v4l2_buffer32

Philipp Zabel <[email protected]>
coda: fix first encoded frame payload

Hans de Goede <[email protected]>
bttv: Width must be a multiple of 16 when capturing planar formats

Hans Verkuil <[email protected]>
adv7511: TX_EDID_PRESENT is still 1 after a disconnect

Hans de Goede <[email protected]>
saa7134: Fix bytesperline not being set correctly for planar formats

Sebastian Frias <[email protected]>
8250: use callbacks to access UART_DLL/UART_DLM

Peter Hurley <[email protected]>
net: irda: Fix use-after-free in irtty_open()

Peter Hurley <[email protected]>
tty: Fix GPF in flush_to_ldisc(), part 2

H Hartley Sweeten <[email protected]>
staging: comedi: ni_mio_common: fix the ni_write[blw]() functions

Vladimir Zapolskiy <[email protected]>
staging: android: ion_test: fix check of platform_device_register_simple() error code

Spencer E. Olson <[email protected]>
staging: comedi: ni_tiocmd: change mistaken use of start_src for start_arg

Benjamin Tissoires <[email protected]>
HID: fix hid_ignore_special_drivers module parameter

Benjamin Tissoires <[email protected]>
HID: multitouch: force retrieving of Win8 signature blob

Dmitry Torokhov <[email protected]>
HID: i2c-hid: fix OOB write in i2c_hid_set_or_send_report()

Grazvydas Ignotas <[email protected]>
HID: logitech: fix Dual Action gamepad support

Jarkko Sakkinen <[email protected]>
tpm: fix the cleanup of struct tpm_chip

Harald Hoyer <[email protected]>
tpm_eventlog.c: fix binary_bios_measurements

Jarkko Sakkinen <[email protected]>
tpm_crb: tpm2_shutdown() must be called before tpm_chip_unregister()

Jarkko Sakkinen <[email protected]>
tpm: fix the rollback in tpm_chip_register()

Alexander Usyskin <[email protected]>
mei: bus: check if the device is enabled before data transfer

David Howells <[email protected]>
X.509: Fix leap year handling again

Boris BREZILLON <[email protected]>
crypto: marvell/cesa - forward devm_ioremap_resource() error code

Vladimir Zapolskiy <[email protected]>
crypto: ux500 - fix checks of error code returned by devm_ioremap_resource()

Vladimir Zapolskiy <[email protected]>
crypto: atmel - fix checks of error code returned by devm_ioremap_resource()

Dan Carpenter <[email protected]>
crypto: keywrap - memzero the correct memory

Tom Lendacky <[email protected]>
crypto: ccp - memset request context to zero during import

Tom Lendacky <[email protected]>
crypto: ccp - Don't assume export/import areas are aligned

Tom Lendacky <[email protected]>
crypto: ccp - Limit the amount of information exported

Tom Lendacky <[email protected]>
crypto: ccp - Add hash state import and export support

Dmitry Tunin <[email protected]>

    Bluetooth: btusb: Add a new AR3012 ID 13d3:3472

Dmitry Tunin <[email protected]>

    Bluetooth: btusb: Add a new AR3012 ID 04ca:3014

Dmitry Tunin <[email protected]>

    Bluetooth: btusb: Add new AR3012 ID 13d3:3395

Vladis Dronov <[email protected]>
ALSA: usb-audio: Fix double-free in error paths after snd_usb_add_audio_stream() call

Takashi Iwai <[email protected]>
ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk()

Victor Clément <[email protected]>
ALSA: usb-audio: add Microsoft HD-5001 to quirks

Takashi Iwai <[email protected]>
ALSA: usb-audio: Add sanity checks for endpoint accesses

Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix NULL dereference in create_fixed_stream_quirk()

Josh Boyer <[email protected]>
Input: powermate - fix oops with malicious USB descriptors

Hans de Goede <[email protected]>
pwc: Add USB id for Philips Spc880nc webcam

Anthony Wong <[email protected]>
rt2x00: add new rt2800usb device Buffalo WLI-UC-G450

Bjørn Mork <[email protected]>
USB: option: add "D-Link DWM-221 B1" device id

Josh Boyer <[email protected]>
USB: serial: ftdi_sio: Add support for ICP DAS I-756xU devices

Martyn Welch <[email protected]>

    USB: serial: cp210x: Adding GE Healthcare Device ID

Oliver Neukum <[email protected]>
USB: cypress_m8: add endpoint sanity check

Oliver Neukum <[email protected]>
USB: digi_acceleport: do sanity checking for the number of ports

Oliver Neukum <[email protected]>
USB: mct_u232: add sanity checking in probe

Oliver Neukum <[email protected]>
USB: usb_driver_claim_interface: add sanity checking

Josh Boyer <[email protected]>
USB: iowarrior: fix oops with malicious USB descriptors

Oliver Neukum <[email protected]>
USB: cdc-acm: more sanity checking

Hans de Goede <[email protected]>
USB: uas: Reduce can_queue to MAX_CMNDS

Oliver Neukum <[email protected]>
usb: hub: fix a typo in hub_port_init() leading to wrong logic

Oliver Neukum <[email protected]>
usb: retry reset if a device times out

Bryn M. Reeves <[email protected]>
dm: fix rq_end_stats() NULL pointer in dm_requeue_original_request()

Joe Thornber <[email protected]>
dm cache: make sure every metadata function checks fail_io

Joe Thornber <[email protected]>
dm thin metadata: don't issue prefetches if a transaction abort has failed

Mike Snitzer <[email protected]>
dm: fix excessive dm-mq context switching

DingXiang <[email protected]>
dm snapshot: disallow the COW and origin devices from being identical

Dan Williams <[email protected]>
libnvdimm, pmem: fix kmap_atomic() leak in error path

Jerry Hoemann <[email protected]>
libnvdimm: Fix security issue with DSM IOCTL.

Alan <[email protected]>
aic7xxx: Fix queue depth handling

Maurizio Lombardi <[email protected]>
be2iscsi: set the boot_kset pointer to NULL in case of failure

Vitaly Kuznetsov <[email protected]>
scsi: storvsc: fix SRB_STATUS_ABORTED handling

Finn Thain <[email protected]>
ncr5380: Call scsi_eh_prep_cmnd() and scsi_eh_restore_cmnd() as and when appropriate

Finn Thain <[email protected]>
ncr5380: Fix NCR5380_select() EH checks and result handling

Finn Thain <[email protected]>
ncr5380: Forget aborted commands

Finn Thain <[email protected]>

    ncr5380: Dont re-enter NCR5380_select()

Finn Thain <[email protected]>
ncr5380: Dont release lock for PIO transfer

Finn Thain <[email protected]>
ncr5380: Correctly clear command pointers and lists after bus reset

Martin K. Petersen <[email protected]>
sd: Fix discard granularity when LBPRZ=1

Raghava Aditya Renukunta <[email protected]>
aacraid: Set correct msix count for EEH recovery

Raghava Aditya Renukunta <[email protected]>
aacraid: Fix memory leak in aac_fib_map_free

Raghava Aditya Renukunta <[email protected]>
aacraid: Fix RRQ overload

Douglas Gilbert <[email protected]>
sg: fix dxferp in from_to case

Nadav Amit <[email protected]>
x86/mm: TLB_REMOTE_SEND_IPI should count pages

Andy Lutomirski <[email protected]>
x86/iopl: Fix iopl capability check on Xen PV

Andy Lutomirski <[email protected]>
x86/iopl/64: Properly context-switch IOPL on Xen PV

Dave Jones <[email protected]>
x86/apic: Fix suspicious RCU usage in smp_trace_call_function_interrupt()

Thomas Gleixner <[email protected]>
x86/irq: Cure live lock in fixup_irqs()

Lorenzo Pieralisi <[email protected]>
PCI: ACPI: IA64: fix IO port generic range check

Bjorn Helgaas <[email protected]>
PCI: Disable IO/MEM decoding for devices with non-compliant BARs

Phil Elwell <[email protected]>
pinctrl-bcm2835: Fix cut-and-paste error in "pull" parsing

Sebastian Ott <[email protected]>
s390/pci: enforce fmb page boundary rule

Heiko Carstens <[email protected]>
s390/cpumf: add missing lpp magic initialization

Martin Schwidefsky <[email protected]>
s390: fix floating pointer register corruption (again)

Dan Carpenter <[email protected]>
EDAC, amd64_edac: Shift wrapping issue in f1x_get_norm_dct_addr()

Tony Luck <[email protected]>
EDAC/sb_edac: Fix computation of channel address

David Hildenbrand <[email protected]>
sched/preempt, sh: kmap_coherent relies on disabled preemption

Byungchul Park <[email protected]>
sched/fair: Avoid using decay_load_missed() with a negative value

Chris Friesen <[email protected]>
sched/cputime: Fix steal_account_process_tick() to always return jiffies

Zhang Rui <[email protected]>
Thermal: Ignore invalid trip points

Jiri Olsa <[email protected]>
perf tools: Fix python extension build

Wang Nan <[email protected]>
perf tools: Fix checking asprintf return value

Andi Kleen <[email protected]>
perf tools: Dont stop PMU parsing on alias parse error

Alexander Shishkin <[email protected]>
perf/core: Fix perf_sched_count derailment

Paolo Bonzini <[email protected]>
KVM: VMX: fix nested vpid for old KVM guests

Paolo Bonzini <[email protected]>
KVM: VMX: avoid guest hang on invalid invvpid instruction

Paolo Bonzini <[email protected]>
KVM: VMX: avoid guest hang on invalid invept instruction

Paolo Bonzini <[email protected]>
KVM: fix spin_lock_init order on x86

Radim Krčmář <[email protected]>
KVM: i8254: change PIT discard tick policy

Paolo Bonzini <[email protected]>
KVM: x86: fix missed hardware breakpoints

Bjorn Helgaas <[email protected]>
x86/PCI: Mark Broadwell-EP Home Agent & PCU as having non-compliant BARs

Stephane Eranian <[email protected]>
perf/x86/intel: Add definition for PT PMI bit

Andy Lutomirski <[email protected]>
x86/entry/compat: Keep TS_COMPAT set during signal delivery

Borislav Petkov <[email protected]>
x86/microcode: Untangle from BLK_DEV_INITRD

Borislav Petkov <[email protected]>
x86/microcode/intel: Make early loader look for builtin microcode too

-------------

Diffstat:

 Documentation/cgroup-v2.txt                        |   6 +
 MAINTAINERS                                        |  96 ++++----
 Makefile                                           |   4 +-
 arch/arc/boot/dts/axs10x_mb.dtsi                   |   8 +
 arch/arc/include/asm/bitops.h                      |  15 --
 arch/arc/include/asm/io.h                          |  18 +-
 arch/arm/boot/dts/at91-sama5d3_xplained.dts        |   1 +
 arch/arm/boot/dts/at91-sama5d4_xplained.dts        |   1 +
 arch/arm64/include/asm/pgtable.h                   |   3 +-
 arch/ia64/include/asm/io.h                         |   1 +
 arch/s390/include/asm/pci.h                        |   2 +-
 arch/s390/kernel/entry.S                           | 106 +-------
 arch/s390/kernel/setup.c                           |   1 +
 arch/s390/pci/pci.c                                |   5 +-
 arch/sh/mm/kmap.c                                  |   2 +
 arch/um/drivers/mconsole_kern.c                    |   2 +-
 arch/x86/Kconfig                                   |  27 ++-
 arch/x86/entry/common.c                            |  23 +-
 arch/x86/include/asm/apic.h                        |   2 +-
 arch/x86/include/asm/hw_irq.h                      |   1 +
 arch/x86/include/asm/microcode.h                   |  26 ++
 arch/x86/include/asm/perf_event.h                  |   1 +
 arch/x86/include/asm/xen/hypervisor.h              |   2 +
 arch/x86/kernel/apic/vector.c                      |  88 +++++--
 arch/x86/kernel/cpu/microcode/intel.c              |  38 +--
 arch/x86/kernel/cpu/perf_event.c                   |  13 +
 arch/x86/kernel/cpu/perf_event.h                   |   3 +
 arch/x86/kernel/cpu/perf_event_intel.c             |  27 ++-
 arch/x86/kernel/cpu/perf_event_intel_ds.c          |  24 +-
 .../x86/kernel/cpu/perf_event_intel_uncore_snbep.c |   8 +-
 arch/x86/kernel/cpu/perf_event_knc.c               |   4 +-
 arch/x86/kernel/ioport.c                           |  12 +-
 arch/x86/kernel/process_64.c                       |  12 +
 arch/x86/kvm/i8254.c                               |  12 +-
 arch/x86/kvm/vmx.c                                 |  16 +-
 arch/x86/kvm/x86.c                                 |   1 +
 arch/x86/mm/tlb.c                                  |  12 +-
 arch/x86/pci/fixup.c                               |   7 +
 arch/x86/xen/enlighten.c                           |   2 +-
 arch/xtensa/kernel/head.S                          |   2 +-
 arch/xtensa/mm/cache.c                             |   8 +-
 arch/xtensa/platforms/iss/console.c                |  10 +-
 block/blk-core.c                                   |   2 +-
 crypto/asymmetric_keys/x509_cert_parser.c          |   8 +-
 crypto/keywrap.c                                   |   4 +-
 drivers/acpi/resource.c                            |  14 +-
 drivers/acpi/sleep.c                               |   1 +
 drivers/block/brd.c                                |   2 +-
 drivers/block/mtip32xx/mtip32xx.c                  | 267 ++++++++++++++++-----
 drivers/block/mtip32xx/mtip32xx.h                  |  11 +-
 drivers/bluetooth/ath3k.c                          |   8 +
 drivers/bluetooth/btusb.c                          |   4 +
 drivers/char/tpm/tpm-chip.c                        |  14 +-
 drivers/char/tpm/tpm_crb.c                         |   4 +-
 drivers/char/tpm/tpm_eventlog.c                    |  14 +-
 drivers/clk/bcm/clk-bcm2835.c                      |  12 +-
 drivers/clk/rockchip/clk-rk3188.c                  |   1 +
 drivers/clk/rockchip/clk-rk3368.c                  |  48 ++--
 drivers/crypto/atmel-aes.c                         |   4 +-
 drivers/crypto/atmel-sha.c                         |   4 +-
 drivers/crypto/atmel-tdes.c                        |   4 +-
 drivers/crypto/ccp/ccp-crypto-aes-cmac.c           |  36 +++
 drivers/crypto/ccp/ccp-crypto-sha.c                |  40 +++
 drivers/crypto/ccp/ccp-crypto.h                    |  22 ++
 drivers/crypto/marvell/cesa.c                      |   2 +-
 drivers/crypto/ux500/cryp/cryp_core.c              |   4 +-
 drivers/crypto/ux500/hash/hash_core.c              |   4 +-
 drivers/edac/amd64_edac.c                          |   2 +-
 drivers/edac/sb_edac.c                             |  26 +-
 drivers/firmware/broadcom/bcm47xx_nvram.c          |   5 +-
 drivers/gpio/gpio-pca953x.c                        |   6 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c   |   8 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c         |   8 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c             |   4 +-
 drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c     |   5 +
 drivers/gpu/drm/radeon/atombios_encoders.c         |   6 +-
 drivers/gpu/drm/radeon/radeon_atpx_handler.c       |   8 +-
 drivers/gpu/drm/radeon/radeon_device.c             |   8 +-
 drivers/gpu/drm/radeon/radeon_display.c            |   6 +-
 drivers/gpu/drm/radeon/radeon_dp_mst.c             |  12 +-
 drivers/gpu/drm/radeon/radeon_fb.c                 |  19 +-
 drivers/gpu/drm/vc4/vc4_bo.c                       |   7 +-
 drivers/hid/hid-core.c                             |   8 +-
 drivers/hid/hid-multitouch.c                       |   5 +
 drivers/hid/i2c-hid/i2c-hid.c                      |  16 +-
 drivers/idle/intel_idle.c                          | 108 +++++++--
 drivers/infiniband/ulp/isert/ib_isert.c            | 122 +++++-----
 drivers/infiniband/ulp/isert/ib_isert.h            |   2 +-
 drivers/infiniband/ulp/srpt/ib_srpt.c              |  59 +----
 drivers/input/misc/ati_remote2.c                   |  36 ++-
 drivers/input/misc/ims-pcu.c                       |   4 +
 drivers/input/misc/powermate.c                     |   3 +
 drivers/input/mouse/synaptics.c                    |   5 +-
 drivers/md/bcache/super.c                          |  46 +++-
 drivers/md/dm-cache-metadata.c                     |  98 +++++---
 drivers/md/dm-cache-metadata.h                     |   4 +-
 drivers/md/dm-cache-target.c                       |  12 +-
 drivers/md/dm-snap.c                               |   9 +
 drivers/md/dm-table.c                              |  36 ++-
 drivers/md/dm-thin-metadata.c                      |   5 +-
 drivers/md/dm.c                                    |  15 +-
 drivers/md/multipath.c                             |   4 +-
 drivers/md/raid1.c                                 |   7 +-
 drivers/md/raid10.c                                |   7 +-
 drivers/md/raid5.c                                 |  51 ++--
 drivers/md/raid5.h                                 |   4 +-
 drivers/media/i2c/adv7511.c                        |  21 +-
 drivers/media/pci/bt8xx/bttv-driver.c              |  26 +-
 drivers/media/pci/saa7134/saa7134-video.c          |  18 +-
 drivers/media/platform/coda/coda-bit.c             |   2 +-
 drivers/media/usb/pwc/pwc-if.c                     |   6 +
 drivers/media/v4l2-core/v4l2-compat-ioctl32.c      |  21 +-
 drivers/misc/mei/bus.c                             |   9 +
 drivers/mmc/card/block.c                           |  24 +-
 drivers/mmc/host/atmel-mci.c                       |   2 +-
 drivers/mmc/host/mmc_spi.c                         |   6 +
 drivers/mmc/host/sdhci-pxav3.c                     |   6 +-
 drivers/mmc/host/sdhci-tegra.c                     |  14 +-
 drivers/mmc/host/sdhci.c                           | 142 ++++++-----
 drivers/mtd/onenand/onenand_base.c                 |   3 +-
 drivers/net/ethernet/marvell/mvneta.c              |   2 +-
 drivers/net/irda/irtty-sir.c                       |  10 -
 drivers/net/rionet.c                               |   4 +-
 .../broadcom/brcm80211/brcmfmac/flowring.c         |  38 +--
 .../broadcom/brcm80211/brcmfmac/flowring.h         |  20 +-
 .../wireless/broadcom/brcm80211/brcmfmac/msgbuf.c  |  11 +-
 .../wireless/broadcom/brcm80211/brcmfmac/msgbuf.h  |   2 +-
 drivers/net/wireless/ralink/rt2x00/rt2800usb.c     |   1 +
 drivers/nvdimm/bus.c                               |   8 +-
 drivers/nvdimm/pmem.c                              |  11 +-
 drivers/of/of_reserved_mem.c                       |   4 +-
 drivers/pci/probe.c                                |  14 ++
 drivers/pinctrl/bcm/pinctrl-bcm2835.c              |   2 +-
 drivers/platform/x86/ideapad-laptop.c              |  14 ++
 drivers/scsi/NCR5380.c                             | 133 +++++-----
 drivers/scsi/aacraid/aacraid.h                     |   2 +
 drivers/scsi/aacraid/commsup.c                     |  37 ++-
 drivers/scsi/aacraid/linit.c                       |  12 +-
 drivers/scsi/aacraid/src.c                         |  30 +--
 drivers/scsi/aic7xxx/aic7xxx_osm.c                 |   1 +
 drivers/scsi/atari_NCR5380.c                       | 133 +++++-----
 drivers/scsi/be2iscsi/be_main.c                    |   1 +
 drivers/scsi/scsi_common.c                         |  12 +-
 drivers/scsi/sd.c                                  |   2 +-
 drivers/scsi/sg.c                                  |   3 +-
 drivers/scsi/storvsc_drv.c                         |   5 +-
 drivers/staging/android/ion/ion_test.c             |   4 +-
 drivers/staging/comedi/drivers/ni_mio_common.c     |  12 +-
 drivers/staging/comedi/drivers/ni_tiocmd.c         |   2 +-
 drivers/target/target_core_transport.c             |   2 -
 drivers/thermal/thermal_core.c                     |  13 +-
 drivers/tty/serial/8250/8250_port.c                |  18 +-
 drivers/usb/class/cdc-acm.c                        |   3 +
 drivers/usb/core/driver.c                          |   6 +-
 drivers/usb/core/hub.c                             |  16 +-
 drivers/usb/misc/iowarrior.c                       |   6 +
 drivers/usb/serial/cp210x.c                        |   1 +
 drivers/usb/serial/cypress_m8.c                    |  11 +-
 drivers/usb/serial/digi_acceleport.c               |  19 ++
 drivers/usb/serial/ftdi_sio.c                      |   4 +
 drivers/usb/serial/ftdi_sio_ids.h                  |   8 +
 drivers/usb/serial/mct_u232.c                      |   9 +-
 drivers/usb/serial/option.c                        |   2 +
 drivers/usb/storage/uas.c                          |   2 +-
 drivers/watchdog/rc32434_wdt.c                     |   2 +-
 fs/coredump.c                                      |  30 ++-
 fs/fhandle.c                                       |   2 +-
 fs/fs-writeback.c                                  |  37 ++-
 fs/fuse/cuse.c                                     |   4 +-
 fs/fuse/file.c                                     |  33 ++-
 fs/fuse/fuse_i.h                                   |   9 +
 fs/jbd2/journal.c                                  |  17 +-
 fs/nfsd/nfs4proc.c                                 |   1 +
 fs/nfsd/nfs4xdr.c                                  |  13 +-
 fs/ocfs2/cluster/heartbeat.c                       |   4 +-
 fs/ocfs2/dlm/dlmconvert.c                          |  24 +-
 fs/ocfs2/dlm/dlmrecovery.c                         |   1 -
 fs/open.c                                          |   6 +-
 fs/proc_namespace.c                                |   2 +
 fs/quota/dquot.c                                   |   3 +-
 fs/splice.c                                        |   3 +
 fs/xfs/xfs_attr_list.c                             |  19 +-
 include/asm-generic/bitops/lock.h                  |  14 +-
 include/linux/cgroup-defs.h                        |   3 +
 include/linux/device-mapper.h                      |   2 +
 include/linux/fs.h                                 |   2 +-
 include/linux/kernel.h                             |   6 +-
 include/linux/pci.h                                |   1 +
 include/linux/thermal.h                            |   2 +
 include/linux/tty.h                                |   2 +-
 include/sound/hdaudio.h                            |   2 +
 kernel/cgroup.c                                    |  20 +-
 kernel/events/core.c                               |   7 +-
 kernel/power/hibernate.c                           |   1 +
 kernel/sched/core.c                                |   1 +
 kernel/sched/cputime.c                             |  14 +-
 kernel/sched/fair.c                                |  12 +-
 kernel/sched/sched.h                               |  13 +
 kernel/sysctl_binary.c                             |   2 +-
 kernel/trace/trace.c                               |   5 +-
 kernel/trace/trace_irqsoff.c                       |   8 +-
 kernel/trace/trace_printk.c                        |   3 +
 kernel/watchdog.c                                  |   9 +-
 mm/memcontrol.c                                    |  44 +++-
 mm/page_alloc.c                                    |  46 +++-
 net/bluetooth/mgmt.c                               |   4 +
 scripts/coccinelle/iterators/use_after_iter.cocci  |   2 +-
 scripts/gdb/linux/modules.py                       |   5 +-
 scripts/gdb/linux/symbols.py                       |   2 +-
 scripts/kconfig/Makefile                           |   4 +-
 scripts/package/mkspec                             |   8 +-
 sound/core/pcm_lib.c                               |   2 +-
 sound/hda/hdac_device.c                            |  16 ++
 sound/hda/hdac_regmap.c                            |  69 ++++--
 sound/pci/hda/patch_cirrus.c                       |   8 +-
 sound/pci/hda/patch_conexant.c                     |   7 +-
 sound/pci/hda/patch_hdmi.c                         |  43 +++-
 sound/pci/hda/patch_realtek.c                      |   1 +
 sound/pci/intel8x0.c                               |   1 +
 sound/usb/clock.c                                  |   2 +
 sound/usb/endpoint.c                               |   3 +
 sound/usb/mixer_quirks.c                           |   4 +
 sound/usb/pcm.c                                    |   2 +
 sound/usb/quirks.c                                 |  27 ++-
 sound/usb/stream.c                                 |   6 +-
 tools/hv/Makefile                                  |   2 +
 tools/perf/util/parse-events.c                     |   6 +-
 tools/perf/util/pmu.c                              |  15 +-
 tools/perf/util/setup.py                           |   4 +
 virt/kvm/kvm_main.c                                |  21 +-
 230 files changed, 2359 insertions(+), 1266 deletions(-)

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Borislav Petkov <[email protected]>

commit 264285ac01673e70557c43ecee338ce97c4c0672 upstream.

Set the initrd @start depending on the presence of an initrd. Otherwise, builtin microcode loading doesn't work as the start is wrong and we're using it to compute offset to the microcode blobs.

---
 arch/x86/kernel/cpu/microcode/intel.c |   24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

@@ -551,10 +551,14 @@ scan_microcode(struct mc_saved_data *mc_
 	cd.data = NULL;
 	cd.size = 0;
 
-	cd = find_cpio_data(p, (void *)start, size, &offset);
-	if (!cd.data) {
+	/* try built-in microcode if no initrd */
+	if (!size) {
 		if (!load_builtin_intel_microcode(&cd))
 			return UCODE_ERROR;
+	} else {
+		cd = find_cpio_data(p, (void *)start, size, &offset);
+		if (!cd.data)
+			return UCODE_ERROR;
 	}
 
 	return get_matching_model_microcode(0, start, cd.data, cd.size,

@@ -728,16 +732,20 @@ void __init load_ucode_intel_bsp(void)
 	struct boot_params *p;
 
 	p	= (struct boot_params *)__pa_nodebug(&boot_params);
-	start	= p->hdr.ramdisk_image;
 	size	= p->hdr.ramdisk_size;
 
-	_load_ucode_intel_bsp(
-			(struct mc_saved_data *)__pa_nodebug(&mc_saved_data),
-			(unsigned long *)__pa_nodebug(&mc_saved_in_initrd),
-			start, size);
+	/*
+	 * Set start only if we have an initrd image. We cannot use initrd_start
+	 * because it is not set that early yet.
+	 */
+	start	= (size ? p->hdr.ramdisk_image : 0);
+
+	_load_ucode_intel_bsp((struct mc_saved_data *)__pa_nodebug(&mc_saved_data),
+			      (unsigned long *)__pa_nodebug(&mc_saved_in_initrd),
+			      start, size);
 #else
-	start	= boot_params.hdr.ramdisk_image + PAGE_OFFSET;
 	size	= boot_params.hdr.ramdisk_size;
+	start	= (size ? boot_params.hdr.ramdisk_image + PAGE_OFFSET : 0);
 
 	_load_ucode_intel_bsp(&mc_saved_data, mc_saved_in_initrd, start, size);
 #endif

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Borislav Petkov <[email protected]>

commit 5f9c01aa7c49a2d74474d6d879a797b8badf29e6 upstream.

Thomas Voegtle reported that doing oldconfig with a .config which has CONFIG_MICROCODE enabled but BLK_DEV_INITRD disabled prevents the microcode loading mechanism from being built.

So untangle it from the BLK_DEV_INITRD dependency so that oldconfig doesn't turn it off and add an explanatory text to its Kconfig help what the supported methods for supplying microcode are.

---
 arch/x86/Kconfig                      |   23 ++++++++++++-----------
 arch/x86/include/asm/microcode.h      |   26 ++++++++++++++++++++++++++
 arch/x86/kernel/cpu/microcode/intel.c |   14 ++++----------
 3 files changed, 42 insertions(+), 21 deletions(-)

@@ -1160,22 +1160,23 @@ config MICROCODE
 	bool "CPU microcode loading support"
 	default y
 	depends on CPU_SUP_AMD || CPU_SUP_INTEL
-	depends on BLK_DEV_INITRD
 	select FW_LOADER
 	---help---
-
 	  If you say Y here, you will be able to update the microcode on
-	  certain Intel and AMD processors. The Intel support is for the
-	  IA32 family, e.g. Pentium Pro, Pentium II, Pentium III, Pentium 4,
-	  Xeon etc. The AMD support is for families 0x10 and later. You will
-	  obviously need the actual microcode binary data itself which is not
-	  shipped with the Linux kernel.
+	  Intel and AMD processors. The Intel support is for the IA32 family,
+	  e.g. Pentium Pro, Pentium II, Pentium III, Pentium 4, Xeon etc. The
+	  AMD support is for families 0x10 and later. You will obviously need
+	  the actual microcode binary data itself which is not shipped with
+	  the Linux kernel.
 
-	  This option selects the general module only, you need to select
-	  at least one vendor specific module as well.
+	  The preferred method to load microcode from a detached initrd is described
+	  in Documentation/x86/early-microcode.txt. For that you need to enable
+	  CONFIG_BLK_DEV_INITRD in order for the loader to be able to scan the
+	  initrd for microcode blobs.
 
-	  To compile this driver as a module, choose M here: the module
-	  will be called microcode.
+	  In addition, you can build-in the microcode into the kernel. For that you
+	  need to enable FIRMWARE_IN_KERNEL and add the vendor-supplied microcode
+	  to the CONFIG_EXTRA_FIRMWARE config option.
 
 config MICROCODE_INTEL
 	bool "Intel microcode loading support"

@@ -3,6 +3,7 @@
 
 #include <asm/cpu.h>
 #include <linux/earlycpio.h>
+#include <linux/initrd.h>
 
 #define native_rdmsr(msr, val1, val2)			\
 do {							\

@@ -143,4 +144,29 @@ static inline void reload_early_microcod
 static inline bool
 get_builtin_firmware(struct cpio_data *cd, const char *name)	{ return false; }
 #endif
+
+static inline unsigned long get_initrd_start(void)
+{
+#ifdef CONFIG_BLK_DEV_INITRD
+	return initrd_start;
+#else
+	return 0;
+#endif
+}
+
+static inline unsigned long get_initrd_start_addr(void)
+{
+#ifdef CONFIG_BLK_DEV_INITRD
+#ifdef CONFIG_X86_32
+	unsigned long *initrd_start_p = (unsigned long *)__pa_nodebug(&initrd_start);
+
+	return (unsigned long)__pa_nodebug(*initrd_start_p);
+#else
+	return get_initrd_start();
+#endif
+#else /* CONFIG_BLK_DEV_INITRD */
+	return 0;
+#endif
+}
+
 #endif /* _ASM_X86_MICROCODE_H */

@@ -694,7 +694,7 @@ int __init save_microcode_in_initrd_inte
 	if (count == 0)
 		return ret;
 
-	copy_initrd_ptrs(mc_saved, mc_saved_in_initrd, initrd_start, count);
+	copy_initrd_ptrs(mc_saved, mc_saved_in_initrd, get_initrd_start(), count);
 	ret = save_microcode(&mc_saved_data, mc_saved, count);
 	if (ret)
 		pr_err("Cannot save microcode patches from initrd.\n");

@@ -756,20 +756,14 @@ void load_ucode_intel_ap(void)
 	struct mc_saved_data *mc_saved_data_p;
 	struct ucode_cpu_info uci;
 	unsigned long *mc_saved_in_initrd_p;
-	unsigned long initrd_start_addr;
 	enum ucode_state ret;
 #ifdef CONFIG_X86_32
-	unsigned long *initrd_start_p;
 
-	mc_saved_in_initrd_p =
-		(unsigned long *)__pa_nodebug(mc_saved_in_initrd);
+	mc_saved_in_initrd_p = (unsigned long *)__pa_nodebug(mc_saved_in_initrd);
 	mc_saved_data_p = (struct mc_saved_data *)__pa_nodebug(&mc_saved_data);
-	initrd_start_p = (unsigned long *)__pa_nodebug(&initrd_start);
-	initrd_start_addr = (unsigned long)__pa_nodebug(*initrd_start_p);
 #else
-	mc_saved_data_p = &mc_saved_data;
 	mc_saved_in_initrd_p = mc_saved_in_initrd;
-	initrd_start_addr = initrd_start;
+	mc_saved_data_p = &mc_saved_data;
 #endif
 
 	/*

@@ -781,7 +775,7 @@ void load_ucode_intel_ap(void)
 
 	collect_cpu_info_early(&uci);
 	ret = load_microcode(mc_saved_data_p, mc_saved_in_initrd_p,
-			     initrd_start_addr, &uci);
+			     get_initrd_start_addr(), &uci);
 
 	if (ret != UCODE_OK)
 		return;

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andy Lutomirski <[email protected]>

commit 4e79e182b419172e35936a47f098509092d69817 upstream.

Signal delivery needs to know the sign of an interrupted syscall's return value in order to detect -ERESTART variants. Normally this works independently of bitness because syscalls internally return long. Under ptrace, however, this can break, and syscall_get_error is supposed to sign-extend regs->ax if needed.

We were clearing TS_COMPAT too early, though, and this prevented sign extension, which subtly broke syscall restart under ptrace.

---
 arch/x86/entry/common.c |   23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

@@ -268,6 +268,7 @@ static void exit_to_usermode_loop(struct
 /* Called with IRQs disabled. */
 __visible inline void prepare_exit_to_usermode(struct pt_regs *regs)
 {
+	struct thread_info *ti = pt_regs_to_thread_info(regs);
 	u32 cached_flags;
 
 	if (IS_ENABLED(CONFIG_PROVE_LOCKING) && WARN_ON(!irqs_disabled()))

@@ -275,12 +276,22 @@ __visible inline void prepare_exit_to_us
 
 	lockdep_sys_exit();
 
-	cached_flags =
-		READ_ONCE(pt_regs_to_thread_info(regs)->flags);
+	cached_flags = READ_ONCE(ti->flags);
 
 	if (unlikely(cached_flags & EXIT_TO_USERMODE_LOOP_FLAGS))
 		exit_to_usermode_loop(regs, cached_flags);
 
+#ifdef CONFIG_COMPAT
+	/*
+	 * Compat syscalls set TS_COMPAT.  Make sure we clear it before
+	 * returning to user mode.  We need to clear it *after* signal
+	 * handling, because syscall restart has a fixup for compat
+	 * syscalls.  The fixup is exercised by the ptrace_syscall_32
+	 * selftest.
+	 */
+	ti->status &= ~TS_COMPAT;
+#endif
+
 	user_enter();
 }
 

@@ -332,14 +343,6 @@ __visible inline void syscall_return_slo
 	if (unlikely(cached_flags & SYSCALL_EXIT_WORK_FLAGS))
 		syscall_slow_exit_work(regs, cached_flags);
 
-#ifdef CONFIG_COMPAT
-	/*
-	 * Compat syscalls set TS_COMPAT.  Make sure we clear it before
-	 * returning to user mode.
-	 */
-	ti->status &= ~TS_COMPAT;
-#endif
-
 	local_irq_disable();
 	prepare_exit_to_usermode(regs);
 }

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Stephane Eranian <[email protected]>

commit 5690ae28e472d25e330ad0c637a5cea3fc39fb32 upstream.

This patch adds a definition for GLOBAL_OVFL_STATUS bit 55 which is used with the Processor Trace (PT) feature.

---
 arch/x86/include/asm/perf_event.h |    1 +
 1 file changed, 1 insertion(+)

@@ -165,6 +165,7 @@ struct x86_pmu_capability {
 #define GLOBAL_STATUS_ASIF				BIT_ULL(60)
 #define GLOBAL_STATUS_COUNTERS_FROZEN			BIT_ULL(59)
 #define GLOBAL_STATUS_LBRS_FROZEN			BIT_ULL(58)
+#define GLOBAL_STATUS_TRACE_TOPAPMI			BIT_ULL(55)
 
 /*
  * IBS cpuid feature detection

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bjorn Helgaas <[email protected]>

commit b894157145e4ac7598d7062bc93320898a5e059e upstream.

The Home Agent and PCU PCI devices in Broadwell-EP have a non-BAR register where a BAR should be. We don't know what the side effects of sizing the "BAR" would be, and we don't know what address space the "BAR" might appear to describe.

Mark these devices as having non-compliant BARs so the PCI core doesn't touch them.

---
 arch/x86/pci/fixup.c |    7 +++++++
 1 file changed, 7 insertions(+)

@@ -540,3 +540,10 @@ static void twinhead_reserve_killing_zon
         }
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x27B9, twinhead_reserve_killing_zone);
+
+static void pci_bdwep_bar(struct pci_dev *dev)
+{
+	dev->non_compliant_bars = 1;
+}
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fa0, pci_bdwep_bar);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fc0, pci_bdwep_bar);

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Paolo Bonzini <[email protected]>

commit 4e422bdd2f849d98fffccbc3295c2f0996097fb3 upstream.

Sometimes when setting a breakpoint a process doesn't stop on it. This is because the debug registers are not loaded correctly on VCPU load.

The following simple reproducer from Oleg Nesterov tries using debug registers in both the host and the guest, for example by running "./bp 0 1" on the host and "./bp 14 15" under QEMU.

    #include <unistd.h>
    #include <signal.h>
    #include <stdlib.h>
    #include <stdio.h>
    #include <sys/wait.h>
    #include <sys/ptrace.h>
    #include <sys/user.h>
    #include <asm/debugreg.h>
    #include <assert.h>

    #define offsetof(TYPE, MEMBER) ((size_t) &((TYPE *)0)->MEMBER)

    unsigned long encode_dr7(int drnum, int enable, unsigned int type, unsigned int len)
    {
        unsigned long dr7;

        dr7 = ((len | type) & 0xf)
            << (DR_CONTROL_SHIFT + drnum * DR_CONTROL_SIZE);
        if (enable)
            dr7 |= (DR_GLOBAL_ENABLE << (drnum * DR_ENABLE_SIZE));

        return dr7;
    }

    int write_dr(int pid, int dr, unsigned long val)
    {
        return ptrace(PTRACE_POKEUSER, pid,
                offsetof (struct user, u_debugreg[dr]),
                val);
    }

    void set_bp(pid_t pid, void *addr)
    {
        unsigned long dr7;
        assert(write_dr(pid, 0, (long)addr) == 0);
        dr7 = encode_dr7(0, 1, DR_RW_EXECUTE, DR_LEN_1);
        assert(write_dr(pid, 7, dr7) == 0);
    }

    void *get_rip(int pid)
    {
        return (void*)ptrace(PTRACE_PEEKUSER, pid,
                offsetof(struct user, regs.rip), 0);
    }

    void test(int nr)
    {
        void *bp_addr = &&label + nr, *bp_hit;
        int pid;

        printf("test bp %d\n", nr);
        assert(nr < 16); // see 16 asm nops below

        pid = fork();
        if (!pid) {
            assert(ptrace(PTRACE_TRACEME, 0,0,0) == 0);
            kill(getpid(), SIGSTOP);
            for (;;) {
                label: asm (
                    "nop; nop; nop; nop;"
                    "nop; nop; nop; nop;"
                    "nop; nop; nop; nop;"
                    "nop; nop; nop; nop;"
                );
            }
        }

        assert(pid == wait(NULL));
        set_bp(pid, bp_addr);

        for (;;) {
            assert(ptrace(PTRACE_CONT, pid, 0, 0) == 0);
            assert(pid == wait(NULL));

            bp_hit = get_rip(pid);
            if (bp_hit != bp_addr)
                fprintf(stderr, "ERR!! hit wrong bp %ld != %d\n",
                    bp_hit - &&label, nr);
        }
    }

    int main(int argc, const char *argv[])
    {
        while (--argc) {
            int nr = atoi(*++argv);
            if (!fork())
                test(nr);
        }

        while (wait(NULL) > 0)
            ;
        return 0;
    }

---
 arch/x86/kvm/x86.c |    1 +
 1 file changed, 1 insertion(+)

@@ -2752,6 +2752,7 @@ void kvm_arch_vcpu_load(struct kvm_vcpu
 	}
 
 	kvm_make_request(KVM_REQ_STEAL_UPDATE, vcpu);
+	vcpu->arch.switch_db_regs |= KVM_DEBUGREG_RELOAD;
 }
 
 void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu)

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Paolo Bonzini <[email protected]>

commit e9ad4ec8379ad1ba6f68b8ca1c26b50b5ae0a327 upstream.

Moving the initialization earlier is needed in 4.6 because kvm_arch_init_vm is now using mmu_lock, causing lockdep to complain:

[  284.440294] INFO: trying to register non-static key.
[  284.445259] the code is fine but needs lockdep annotation.
[  284.450736] turning off the locking correctness validator.
...
[  284.528318]  [<ffffffff810aecc3>] lock_acquire+0xd3/0x240
[  284.533733]  [<ffffffffa0305aa0>] ? kvm_page_track_register_notifier+0x20/0x60 [kvm]
[  284.541467]  [<ffffffff81715581>] _raw_spin_lock+0x41/0x80
[  284.546960]  [<ffffffffa0305aa0>] ? kvm_page_track_register_notifier+0x20/0x60 [kvm]
[  284.554707]  [<ffffffffa0305aa0>] kvm_page_track_register_notifier+0x20/0x60 [kvm]
[  284.562281]  [<ffffffffa02ece70>] kvm_mmu_init_vm+0x20/0x30 [kvm]
[  284.568381]  [<ffffffffa02dbf7a>] kvm_arch_init_vm+0x1ea/0x200 [kvm]
[  284.574740]  [<ffffffffa02bff3f>] kvm_dev_ioctl+0xbf/0x4d0 [kvm]

However, it also helps fixing a preexisting problem, which is why this patch is also good for stable kernels: kvm_create_vm was incrementing current->mm->mm_count but not decrementing it at the out_err label (in case kvm_init_mmu_notifier failed). The new initialization order makes it possible to add the required mmdrop without adding a new error label.

---
 virt/kvm/kvm_main.c |   21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

@@ -537,6 +537,16 @@ static struct kvm *kvm_create_vm(unsigne
 	if (!kvm)
 		return ERR_PTR(-ENOMEM);
 
+	spin_lock_init(&kvm->mmu_lock);
+	atomic_inc(&current->mm->mm_count);
+	kvm->mm = current->mm;
+	kvm_eventfd_init(kvm);
+	mutex_init(&kvm->lock);
+	mutex_init(&kvm->irq_lock);
+	mutex_init(&kvm->slots_lock);
+	atomic_set(&kvm->users_count, 1);
+	INIT_LIST_HEAD(&kvm->devices);
+
 	r = kvm_arch_init_vm(kvm, type);
 	if (r)
 		goto out_err_no_disable;

@@ -569,16 +579,6 @@ static struct kvm *kvm_create_vm(unsigne
 			goto out_err;
 	}
 
-	spin_lock_init(&kvm->mmu_lock);
-	kvm->mm = current->mm;
-	atomic_inc(&kvm->mm->mm_count);
-	kvm_eventfd_init(kvm);
-	mutex_init(&kvm->lock);
-	mutex_init(&kvm->irq_lock);
-	mutex_init(&kvm->slots_lock);
-	atomic_set(&kvm->users_count, 1);
-	INIT_LIST_HEAD(&kvm->devices);
-
 	r = kvm_init_mmu_notifier(kvm);
 	if (r)
 		goto out_err;

@@ -603,6 +603,7 @@ out_err_no_disable:
 	for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++)
 		kvm_free_memslots(kvm, kvm->memslots[i]);
 	kvm_arch_free_vm(kvm);
+	mmdrop(current->mm);
 	return ERR_PTR(r);
 }
 

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Paolo Bonzini <[email protected]>

commit 2849eb4f99d54925c543db12917127f88b3c38ff upstream.

A guest executing an invalid invept instruction would hang because the instruction pointer was not updated.

---
 arch/x86/kvm/vmx.c |    1 +
 1 file changed, 1 insertion(+)

@@ -7398,6 +7398,7 @@ static int handle_invept(struct kvm_vcpu
 	if (!(types & (1UL << type))) {
 		nested_vmx_failValid(vcpu,
 				VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
+		skip_emulated_instruction(vcpu);
 		return 1;
 	}
 

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Paolo Bonzini <[email protected]>

commit f6870ee9e53430f2a318ccf0dd5e66bb46194e43 upstream.

A guest executing an invalid invvpid instruction would hang because the instruction pointer was not updated.

---
 arch/x86/kvm/vmx.c |    1 +
 1 file changed, 1 insertion(+)

@@ -7457,6 +7457,7 @@ static int handle_invvpid(struct kvm_vcp
 	if (!(types & (1UL << type))) {
 		nested_vmx_failValid(vcpu,
 			VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
+		skip_emulated_instruction(vcpu);
 		return 1;
 	}
 

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Paolo Bonzini <[email protected]>

commit ef697a712a6165aea7779c295604b099e8bfae2e upstream.

Old KVM guests invoke single-context invvpid without actually checking whether it is supported. This was fixed by commit 518c8ae ("KVM: VMX:
Make sure single type invvpid is supported before issuing invvpid instruction", 2010-08-01) and the patch after, but pre-2.6.36 kernels lack it including RHEL 6.

---
 arch/x86/kvm/vmx.c |   14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

@@ -2702,8 +2702,15 @@ static void nested_vmx_setup_ctls_msrs(s
 	} else
 		vmx->nested.nested_vmx_ept_caps = 0;
 
+	/*
+	 * Old versions of KVM use the single-context version without
+	 * checking for support, so declare that it is supported even
+	 * though it is treated as global context.  The alternative is
+	 * not failing the single-context invvpid, and it is worse.
+	 */
 	if (enable_vpid)
 		vmx->nested.nested_vmx_vpid_caps = VMX_VPID_INVVPID_BIT |
+				VMX_VPID_EXTENT_SINGLE_CONTEXT_BIT |
 				VMX_VPID_EXTENT_GLOBAL_CONTEXT_BIT;
 	else
 		vmx->nested.nested_vmx_vpid_caps = 0;

@@ -7474,12 +7481,17 @@ static int handle_invvpid(struct kvm_vcp
 	}
 
 	switch (type) {
+	case VMX_VPID_EXTENT_SINGLE_CONTEXT:
+		/*
+		 * Old versions of KVM use the single-context version so we
+		 * have to support it; just treat it the same as all-context.
+		 */
 	case VMX_VPID_EXTENT_ALL_CONTEXT:
 		__vmx_flush_tlb(vcpu, to_vmx(vcpu)->nested.vpid02);
 		nested_vmx_succeed(vcpu);
 		break;
 	default:
-		/* Trap single context invalidation invvpid calls */
+		/* Trap individual address invalidation invvpid calls */
 		BUG_ON(1);
 		break;
 	}

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alexander Shishkin <[email protected]>

commit 927a5570855836e5d5859a80ce7e91e963545e8f upstream.

The error path in perf_event_open() is such that asking for a sampling event on a PMU that doesn't generate interrupts will end up in dropping the perf_sched_count even though it hasn't been incremented for this event yet.

Given a sufficient amount of these calls, we'll end up disabling scheduler's jump label even though we'd still have active events in the system, thereby facilitating the arrival of the infernal regions upon us.

I'm fixing this by moving account_event() inside perf_event_alloc().

---
 kernel/events/core.c |    7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

@@ -8001,6 +8001,9 @@ perf_event_alloc(struct perf_event_attr
 		}
 	}
 
+	/* symmetric to unaccount_event() in _free_event() */
+	account_event(event);
+
 	return event;
 
 err_per_task:

@@ -8364,8 +8367,6 @@ SYSCALL_DEFINE5(perf_event_open,
 		}
 	}
 
-	account_event(event);
-
 	/*
 	 * Special case software events and allow them to be part of
 	 * any hardware group.

@@ -8662,8 +8663,6 @@ perf_event_create_kernel_counter(struct
 	/* Mark owner so we could distinguish it from user events. */
 	event->owner = TASK_TOMBSTONE;
 
-	account_event(event);
-
 	ctx = find_get_context(event->pmu, task, event);
 	if (IS_ERR(ctx)) {
 		err = PTR_ERR(ctx);

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andi Kleen <[email protected]>

commit 940db6dcd3f4659303fdf6befe7416adc4d24118 upstream.

When an error happens during alias parsing currently the complete parsing of all attributes of the PMU is stopped. This is breaks old perf on a newer kernel that may have not-yet-know alias attributes (such as .scale or .per-pkg).

Continue when some attribute is unparseable.

This is IMHO a stable candidate and should be backported to older versions to avoid problems with newer kernels.

v2: Print warnings when something goes wrong.
v3: Change warning to debug output

---
 tools/perf/util/pmu.c |   15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

@@ -284,13 +284,12 @@ static int pmu_aliases_parse(char *dir,
 {
 	struct dirent *evt_ent;
 	DIR *event_dir;
-	int ret = 0;
 
 	event_dir = opendir(dir);
 	if (!event_dir)
 		return -EINVAL;
 
-	while (!ret && (evt_ent = readdir(event_dir))) {
+	while ((evt_ent = readdir(event_dir))) {
 		char path[PATH_MAX];
 		char *name = evt_ent->d_name;
 		FILE *file;

@@ -306,17 +305,19 @@ static int pmu_aliases_parse(char *dir,
 
 		snprintf(path, PATH_MAX, "%s/%s", dir, name);
 
-		ret = -EINVAL;
 		file = fopen(path, "r");
-		if (!file)
-			break;
+		if (!file) {
+			pr_debug("Cannot open %s\n", path);
+			continue;
+		}
 
-		ret = perf_pmu__new_alias(head, dir, name, file);
+		if (perf_pmu__new_alias(head, dir, name, file) < 0)
+			pr_debug("Cannot set up %s\n", name);
 		fclose(file);
 	}
 
 	closedir(event_dir);
-	return ret;
+	return 0;
 }
 
 /*

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Wang Nan <[email protected]>

commit 26dee028d365fbc0e3326606a8520260b4462381 upstream.

According to man pages, asprintf returns -1 when failure. This patch fixes two incorrect return value checker.

---
 tools/perf/util/parse-events.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

@@ -2101,11 +2101,11 @@ char *parse_events_formats_error_string(
 
 	/* valid terms */
 	if (additional_terms) {
-		if (!asprintf(&str, "valid terms: %s,%s",
-			      additional_terms, static_terms))
+		if (asprintf(&str, "valid terms: %s,%s",
+			     additional_terms, static_terms) < 0)
 			goto fail;
 	} else {
-		if (!asprintf(&str, "valid terms: %s", static_terms))
+		if (asprintf(&str, "valid terms: %s", static_terms) < 0)
 			goto fail;
 	}
 	return str;

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jiri Olsa <[email protected]>

commit 67d5268908283c187e0a460048a423256c2fb288 upstream.

The util/python-ext-sources file contains source files required to build the python extension relative to $(srctree)/tools/perf,

Such a file path $(FILE).c is handed over to the python extension build system, which builds the final object in the $(PYTHON_EXTBUILD)/tmp/$(FILE).o path.

After the build is done all files from $(PYTHON_EXTBUILD)lib/ are carried as the result binaries.

Above system fails when we add source file relative to ../lib, which we do for:

../lib/bitmap.c
../lib/find_bit.c
../lib/hweight.c
../lib/rbtree.c

All above objects will be built like:

  $(PYTHON_EXTBUILD)/tmp/../lib/bitmap.c
  $(PYTHON_EXTBUILD)/tmp/../lib/find_bit.c
  $(PYTHON_EXTBUILD)/tmp/../lib/hweight.c
  $(PYTHON_EXTBUILD)/tmp/../lib/rbtree.c

which accidentally happens to be final library path:

  $(PYTHON_EXTBUILD)/lib/

Changing setup.py to pass full paths of source files to Extension build class and thus keep all built objects under $(PYTHON_EXTBUILD)tmp directory.

---
 tools/perf/util/setup.py |    4 ++++
 1 file changed, 4 insertions(+)

@@ -22,6 +22,7 @@ cflags = getenv('CFLAGS', '').split()
 # switch off several checks (need to be at the end of cflags list)
 cflags += ['-fno-strict-aliasing', '-Wno-write-strings', '-Wno-unused-parameter' ]
 
+src_perf  = getenv('srctree') + '/tools/perf'
 build_lib = getenv('PYTHON_EXTBUILD_LIB')
 build_tmp = getenv('PYTHON_EXTBUILD_TMP')
 libtraceevent = getenv('LIBTRACEEVENT')

@@ -30,6 +31,9 @@ libapikfs = getenv('LIBAPI')
 ext_sources = [f.strip() for f in file('util/python-ext-sources')
 				if len(f.strip()) > 0 and f[0] != '#']
 
+# use full paths with source files
+ext_sources = map(lambda x: '%s/%s' % (src_perf, x) , ext_sources)
+
 perf = Extension('perf',
 		  sources = ext_sources,
 		  include_dirs = ['util/include'],

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Zhang Rui <[email protected]>

commit 81ad4276b505e987dd8ebbdf63605f92cd172b52 upstream.

In some cases, platform thermal driver may report invalid trip points, thermal core should not take any action for these trip points.

This fixed a regression that bogus trip point starts to screw up thermal control on some Lenovo laptops, after
commit bb431ba26c5cd0a17c941ca6c3a195a3a6d5d461

Author: Zhang Rui <[email protected]>
Date:   Fri Oct 30 16:31:47 2015 +0800

Thermal: initialize thermal zone device correctly

After thermal zone device registered, as we have not read any temperature before, thus tz->temperature should not be 0, which actually means 0C, and thermal trend is not available. In this case, we need specially handling for the first thermal_zone_device_update().

Both thermal core framework and step_wise governor is enhanced to handle this. And since the step_wise governor is the only one that uses trends, so it's the only thermal governor that needs to be updated.

---
 drivers/thermal/thermal_core.c |   13 ++++++++++++-
 include/linux/thermal.h        |    2 ++
 2 files changed, 14 insertions(+), 1 deletion(-)

@@ -454,6 +454,10 @@ static void handle_thermal_trip(struct t
 {
 	enum thermal_trip_type type;
 
+	/* Ignore disabled trip points */
+	if (test_bit(trip, &tz->trips_disabled))
+		return;
+
 	tz->ops->get_trip_type(tz, trip, &type);
 
 	if (type == THERMAL_TRIP_CRITICAL || type == THERMAL_TRIP_HOT)

@@ -1800,6 +1804,7 @@ struct thermal_zone_device *thermal_zone
 {
 	struct thermal_zone_device *tz;
 	enum thermal_trip_type trip_type;
+	int trip_temp;
 	int result;
 	int count;
 	int passive = 0;

@@ -1871,9 +1876,15 @@ struct thermal_zone_device *thermal_zone
 		goto unregister;
 
 	for (count = 0; count < trips; count++) {
-		tz->ops->get_trip_type(tz, count, &trip_type);
+		if (tz->ops->get_trip_type(tz, count, &trip_type))
+			set_bit(count, &tz->trips_disabled);
 		if (trip_type == THERMAL_TRIP_PASSIVE)
 			passive = 1;
+		if (tz->ops->get_trip_temp(tz, count, &trip_temp))
+			set_bit(count, &tz->trips_disabled);
+		/* Check for bogus trip points */
+		if (trip_temp == 0)
+			set_bit(count, &tz->trips_disabled);
 	}
 
 	if (!passive) {

@@ -156,6 +156,7 @@ struct thermal_attr {
  * @trip_hyst_attrs:	attributes for trip points for sysfs: trip hysteresis
  * @devdata:	private pointer for device private data
  * @trips:	number of trip points the thermal zone supports
+ * @trips_disabled;	bitmap for disabled trips
  * @passive_delay:	number of milliseconds to wait between polls when
  *			performing passive cooling.
  * @polling_delay:	number of milliseconds to wait between polls when

@@ -191,6 +192,7 @@ struct thermal_zone_device {
 	struct thermal_attr *trip_hyst_attrs;
 	void *devdata;
 	int trips;
+	unsigned long trips_disabled;	/* bitmap for disabled trips */
 	int passive_delay;
 	int polling_delay;
 	int temperature;

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chris Friesen <[email protected]>

commit f9c904b7613b8b4c85b10cd6b33ad41b2843fa9d upstream.

The callers of steal_account_process_tick() expect it to return whether a jiffy should be considered stolen or not.

Currently the return value of steal_account_process_tick() is in units of cputime, which vary between either jiffies or nsecs depending on CONFIG_VIRT_CPU_ACCOUNTING_GEN.

If cputime has nsecs granularity and there is a tiny amount of stolen time (a few nsecs, say) then we will consider the entire tick stolen and will not account the tick on user/system/idle, causing /proc/stats to show invalid data.

The fix is to change steal_account_process_tick() to accumulate the stolen time and only account it once it's worth a jiffy.

(Thanks to Frederic Weisbecker for suggestions to fix a bug in my first version of the patch.)

---
 kernel/sched/cputime.c |   14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

@@ -262,21 +262,21 @@ static __always_inline bool steal_accoun
 #ifdef CONFIG_PARAVIRT
 	if (static_key_false(&paravirt_steal_enabled)) {
 		u64 steal;
-		cputime_t steal_ct;
+		unsigned long steal_jiffies;
 
 		steal = paravirt_steal_clock(smp_processor_id());
 		steal -= this_rq()->prev_steal_time;
 
 		/*
-		 * cputime_t may be less precise than nsecs (eg: if it's
-		 * based on jiffies). Lets cast the result to cputime
+		 * steal is in nsecs but our caller is expecting steal
+		 * time in jiffies. Lets cast the result to jiffies
 		 * granularity and account the rest on the next rounds.
 		 */
-		steal_ct = nsecs_to_cputime(steal);
-		this_rq()->prev_steal_time += cputime_to_nsecs(steal_ct);
+		steal_jiffies = nsecs_to_jiffies(steal);
+		this_rq()->prev_steal_time += jiffies_to_nsecs(steal_jiffies);
 
-		account_steal_time(steal_ct);
-		return steal_ct;
+		account_steal_time(jiffies_to_cputime(steal_jiffies));
+		return steal_jiffies;
 	}
 #endif
 	return false;

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Byungchul Park <[email protected]>

commit 7400d3bbaa229eb8e7631d28fb34afd7cd2c96ff upstream.

decay_load_missed() cannot handle nagative values, so we need to prevent using the function with a negative value.

---
 kernel/sched/fair.c |   12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

@@ -4459,9 +4459,17 @@ static void __update_cpu_load(struct rq
 
 		/* scale is effectively 1 << i now, and >> i divides by scale */
 
-		old_load = this_rq->cpu_load[i] - tickless_load;
+		old_load = this_rq->cpu_load[i];
 		old_load = decay_load_missed(old_load, pending_updates - 1, i);
-		old_load += tickless_load;
+		if (tickless_load) {
+			old_load -= decay_load_missed(tickless_load, pending_updates - 1, i);
+			/*
+			 * old_load can never be a negative value because a
+			 * decayed tickless_load cannot be greater than the
+			 * original tickless_load.
+			 */
+			old_load += tickless_load;
+		}
 		new_load = this_load;
 		/*
 		 * Round up the averaging division if load is increasing. This

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: David Hildenbrand <[email protected]>

commit b15d53d009558d14c4f394a6d1fa2039c7f45c43 upstream.

kmap_coherent needs disabled preemption to not schedule in the critical section, just like kmap_coherent on mips and kmap_atomic in general.

---
 arch/sh/mm/kmap.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -36,6 +36,7 @@ void *kmap_coherent(struct page *page, u
 
 	BUG_ON(!test_bit(PG_dcache_clean, &page->flags));
 
+	preempt_disable();
 	pagefault_disable();
 
 	idx = FIX_CMAP_END -

@@ -64,4 +65,5 @@ void kunmap_coherent(void *kvaddr)
 	}
 
 	pagefault_enable();
+	preempt_enable();
 }

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tony Luck <[email protected]>

commit eb1af3b71f9d83e45f2fd2fd649356e98e1c582c upstream.

Large memory Haswell-EX systems with multiple DIMMs per channel were sometimes reporting the wrong DIMM.

Found three problems:

1) Debug printouts for socket and channel interleave were not interpreting

    the register fields correctly. The socket interleave field is a 2^X
    value (0=1, 1=2, 2=4, 3=8). The channel interleave is X+1 (0=1, 1=2,
    2=3. 3=4).

2) Actual use of the socket interleave value didn't interpret as 2^X

3) Conversion of address to channel address was complicated, and wrong.

---
 drivers/edac/sb_edac.c |   26 ++++++++++----------------
 1 file changed, 10 insertions(+), 16 deletions(-)

@@ -1839,8 +1839,8 @@ static void get_memory_layout(const stru
 		edac_dbg(0, "TAD#%d: up to %u.%03u GB (0x%016Lx), socket interleave %d, memory interleave %d, TGT: %d, %d, %d, %d, reg=0x%08x\n",
 			 n_tads, gb, (mb*1000)/1024,
 			 ((u64)tmp_mb) << 20L,
-			 (u32)TAD_SOCK(reg),
-			 (u32)TAD_CH(reg),
+			 (u32)(1 << TAD_SOCK(reg)),
+			 (u32)TAD_CH(reg) + 1,
 			 (u32)TAD_TGT0(reg),
 			 (u32)TAD_TGT1(reg),
 			 (u32)TAD_TGT2(reg),

@@ -2118,7 +2118,7 @@ static int get_memory_error_data(struct
 	}
 
 	ch_way = TAD_CH(reg) + 1;
-	sck_way = TAD_SOCK(reg) + 1;
+	sck_way = 1 << TAD_SOCK(reg);
 
 	if (ch_way == 3)
 		idx = addr >> 6;

@@ -2175,7 +2175,7 @@ static int get_memory_error_data(struct
 		 n_tads,
 		 addr,
 		 limit,
-		 (u32)TAD_SOCK(reg),
+		 sck_way,
 		 ch_way,
 		 offset,
 		 idx,

@@ -2190,18 +2190,12 @@ static int get_memory_error_data(struct
 			offset, addr);
 		return -EINVAL;
 	}
-	addr -= offset;
-	/* Store the low bits [0:6] of the addr */
-	ch_addr = addr & 0x7f;
-	/* Remove socket wayness and remove 6 bits */
-	addr >>= 6;
-	addr = div_u64(addr, sck_xch);
-#if 0
-	/* Divide by channel way */
-	addr = addr / ch_way;
-#endif
-	/* Recover the last 6 bits */
-	ch_addr |= addr << 6;
+
+	ch_addr = addr - offset;
+	ch_addr >>= (6 + shiftup);
+	ch_addr /= ch_way * sck_way;
+	ch_addr <<= (6 + shiftup);
+	ch_addr |= addr & ((1 << (6 + shiftup)) - 1);
 
 	/*
 	 * Step 3) Decode rank

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email protected]>

commit 6f3508f61c814ee852c199988a62bd954c50dfc1 upstream.

dct_sel_base_off is declared as a u64 but we're only using the lower 32 bits because of a shift wrapping bug. This can possibly truncate the upper 16 bits of DctSelBaseOffset[47:26], causing us to misdecode the CS row.

---
 drivers/edac/amd64_edac.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -1452,7 +1452,7 @@ static u64 f1x_get_norm_dct_addr(struct
 	u64 chan_off;
 	u64 dram_base		= get_dram_base(pvt, range);
 	u64 hole_off		= f10_dhar_offset(pvt);
-	u64 dct_sel_base_off	= (pvt->dct_sel_hi & 0xFFFFFC00) << 16;
+	u64 dct_sel_base_off	= (u64)(pvt->dct_sel_hi & 0xFFFFFC00) << 16;
 
 	if (hi_rng) {
 		/*

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Martin Schwidefsky <[email protected]>

commit e370e4769463a65dcf8806fa26d2874e0542ac41 upstream.

There is a tricky interaction between the machine check handler and the critical sections of load_fpu_regs and save_fpu_regs functions. If the machine check interrupts one of the two functions the critical section cleanup will complete the function before the machine check handler s390_do_machine_check is called. Trouble is that the machine check handler needs to validate the floating point registers *before* and not *after* the completion of load_fpu_regs/save_fpu_regs.

The simplest solution is to rewind the PSW to the start of the load_fpu_regs/save_fpu_regs and retry the function after the return from the machine check handler.

---
 arch/s390/kernel/entry.S |  106 -----------------------------------------------
 1 file changed, 2 insertions(+), 104 deletions(-)

@@ -1199,114 +1199,12 @@ cleanup_critical:
 	.quad	.Lpsw_idle_lpsw
 
 .Lcleanup_save_fpu_regs:
-	TSTMSK	__LC_CPU_FLAGS,_CIF_FPU
-	bor	%r14
-	clg	%r9,BASED(.Lcleanup_save_fpu_regs_done)
-	jhe	5f
-	clg	%r9,BASED(.Lcleanup_save_fpu_regs_fp)
-	jhe	4f
-	clg	%r9,BASED(.Lcleanup_save_fpu_regs_vx_high)
-	jhe	3f
-	clg	%r9,BASED(.Lcleanup_save_fpu_regs_vx_low)
-	jhe	2f
-	clg	%r9,BASED(.Lcleanup_save_fpu_fpc_end)
-	jhe	1f
-	lg	%r2,__LC_CURRENT
-	aghi	%r2,__TASK_thread
-0:	# Store floating-point controls
-	stfpc	__THREAD_FPU_fpc(%r2)
-1:	# Load register save area and check if VX is active
-	lg	%r3,__THREAD_FPU_regs(%r2)
-	TSTMSK	__LC_MACHINE_FLAGS,MACHINE_FLAG_VX
-	jz	4f			  # no VX -> store FP regs
-2:	# Store vector registers (V0-V15)
-	VSTM	%v0,%v15,0,%r3		  # vstm 0,15,0(3)
-3:	# Store vector registers (V16-V31)
-	VSTM	%v16,%v31,256,%r3	  # vstm 16,31,256(3)
-	j	5f			  # -> done, set CIF_FPU flag
-4:	# Store floating-point registers
-	std	0,0(%r3)
-	std	1,8(%r3)
-	std	2,16(%r3)
-	std	3,24(%r3)
-	std	4,32(%r3)
-	std	5,40(%r3)
-	std	6,48(%r3)
-	std	7,56(%r3)
-	std	8,64(%r3)
-	std	9,72(%r3)
-	std	10,80(%r3)
-	std	11,88(%r3)
-	std	12,96(%r3)
-	std	13,104(%r3)
-	std	14,112(%r3)
-	std	15,120(%r3)
-5:	# Set CIF_FPU flag
-	oi	__LC_CPU_FLAGS+7,_CIF_FPU
-	lg	%r9,48(%r11)		# return from save_fpu_regs
+	larl	%r9,save_fpu_regs
 	br	%r14
-.Lcleanup_save_fpu_fpc_end:
-	.quad	.Lsave_fpu_regs_fpc_end
-.Lcleanup_save_fpu_regs_vx_low:
-	.quad	.Lsave_fpu_regs_vx_low
-.Lcleanup_save_fpu_regs_vx_high:
-	.quad	.Lsave_fpu_regs_vx_high
-.Lcleanup_save_fpu_regs_fp:
-	.quad	.Lsave_fpu_regs_fp
-.Lcleanup_save_fpu_regs_done:
-	.quad	.Lsave_fpu_regs_done
 
 .Lcleanup_load_fpu_regs:
-	TSTMSK	__LC_CPU_FLAGS,_CIF_FPU
-	bnor	%r14
-	clg	%r9,BASED(.Lcleanup_load_fpu_regs_done)
-	jhe	1f
-	clg	%r9,BASED(.Lcleanup_load_fpu_regs_fp)
-	jhe	2f
-	clg	%r9,BASED(.Lcleanup_load_fpu_regs_vx_high)
-	jhe	3f
-	clg	%r9,BASED(.Lcleanup_load_fpu_regs_vx)
-	jhe	4f
-	lg	%r4,__LC_CURRENT
-	aghi	%r4,__TASK_thread
-	lfpc	__THREAD_FPU_fpc(%r4)
-	TSTMSK	__LC_MACHINE_FLAGS,MACHINE_FLAG_VX
-	lg	%r4,__THREAD_FPU_regs(%r4)	# %r4 <- reg save area
-	jz	2f				# -> no VX, load FP regs
-4:	# Load V0 ..V15 registers
-	VLM	%v0,%v15,0,%r4
-3:	# Load V16..V31 registers
-	VLM	%v16,%v31,256,%r4
-	j	1f
-2:	# Load floating-point registers
-	ld	0,0(%r4)
-	ld	1,8(%r4)
-	ld	2,16(%r4)
-	ld	3,24(%r4)
-	ld	4,32(%r4)
-	ld	5,40(%r4)
-	ld	6,48(%r4)
-	ld	7,56(%r4)
-	ld	8,64(%r4)
-	ld	9,72(%r4)
-	ld	10,80(%r4)
-	ld	11,88(%r4)
-	ld	12,96(%r4)
-	ld	13,104(%r4)
-	ld	14,112(%r4)
-	ld	15,120(%r4)
-1:	# Clear CIF_FPU bit
-	ni	__LC_CPU_FLAGS+7,255-_CIF_FPU
-	lg	%r9,48(%r11)		# return from load_fpu_regs
+	larl	%r9,load_fpu_regs
 	br	%r14
-.Lcleanup_load_fpu_regs_vx:
-	.quad	.Lload_fpu_regs_vx
-.Lcleanup_load_fpu_regs_vx_high:
-	.quad	.Lload_fpu_regs_vx_high
-.Lcleanup_load_fpu_regs_fp:
-	.quad	.Lload_fpu_regs_fp
-.Lcleanup_load_fpu_regs_done:
-	.quad	.Lload_fpu_regs_done
 
 /*
  * Integer constants

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Heiko Carstens <[email protected]>

commit 8f100bb1ff27873dd71f636da670e503b9ade3c6 upstream.

Add the missing lpp magic initialization for cpu 0. Without this all samples on cpu 0 do not have the most significant bit set in the program parameter field, which we use to distinguish between guest and host samples if the pid is also 0.

We did initialize the lpp magic in the absolute zero lowcore but forgot that when switching to the allocated lowcore on cpu 0 only.

---
 arch/s390/kernel/setup.c |    1 +
 1 file changed, 1 insertion(+)

@@ -327,6 +327,7 @@ static void __init setup_lowcore(void)
 		+ PAGE_SIZE - STACK_FRAME_OVERHEAD - sizeof(struct pt_regs);
 	lc->current_task = (unsigned long) init_thread_union.thread_info.task;
 	lc->thread_info = (unsigned long) &init_thread_union;
+	lc->lpp = LPP_MAGIC;
 	lc->machine_flags = S390_lowcore.machine_flags;
 	lc->stfl_fac_list = S390_lowcore.stfl_fac_list;
 	memcpy(lc->stfle_fac_list, S390_lowcore.stfle_fac_list,

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sebastian Ott <[email protected]>

commit 80c544ded25ac14d7cc3e555abb8ed2c2da99b84 upstream.

The function measurement block must not cross a page boundary. Ensure that by raising the alignment requirement to the smallest power of 2 larger than the size of the fmb.

---
 arch/s390/include/asm/pci.h |    2 +-
 arch/s390/pci/pci.c         |    5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

@@ -45,7 +45,7 @@ struct zpci_fmb {
 	u64 rpcit_ops;
 	u64 dma_rbytes;
 	u64 dma_wbytes;
-} __packed __aligned(16);
+} __packed __aligned(64);
 
 enum zpci_state {
 	ZPCI_FN_STATE_RESERVED,

@@ -864,8 +864,11 @@ static inline int barsize(u8 size)
 
 static int zpci_mem_init(void)
 {
+	BUILD_BUG_ON(!is_power_of_2(__alignof__(struct zpci_fmb)) ||
+		     __alignof__(struct zpci_fmb) < sizeof(struct zpci_fmb));
+
 	zdev_fmb_cache = kmem_cache_create("PCI_FMB_cache", sizeof(struct zpci_fmb),
-				16, 0, NULL);
+					   __alignof__(struct zpci_fmb), 0, NULL);
 	if (!zdev_fmb_cache)
 		goto error_fmb;
 

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Phil Elwell <[email protected]>

commit 2c7e3306d23864d49f686f22e56e180ff0fffb7f upstream.

The DT bindings for pinctrl-bcm2835 allow both the function and pull to contain either one entry or one per pin. However, an error in the DT parsing can cause failures if the number of pulls differs from the number of functions.

---
 drivers/pinctrl/bcm/pinctrl-bcm2835.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -779,7 +779,7 @@ static int bcm2835_pctl_dt_node_to_map(s
 		}
 		if (num_pulls) {
 			err = of_property_read_u32_index(np, "brcm,pull",
-					(num_funcs > 1) ? i : 0, &pull);
+					(num_pulls > 1) ? i : 0, &pull);
 			if (err)
 				goto out;
 			err = bcm2835_pctl_dt_node_to_map_pull(pc, np, pin,

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bjorn Helgaas <[email protected]>

commit b84106b4e2290c081cdab521fa832596cdfea246 upstream.

The PCI config header (first 64 bytes of each device's config space) is defined by the PCI spec so generic software can identify the device and manage its usage of I/O, memory, and IRQ resources.

Some non-spec-compliant devices put registers other than BARs where the BARs should be. When the PCI core sizes these "BARs", the reads and writes it does may have unwanted side effects, and the "BAR" may appear to describe non-sensical address space.

Add a flag bit to mark non-compliant devices so we don't touch their BARs. Turn off IO/MEM decoding to prevent the devices from consuming address space, since we can't read the BARs to find out what that address space would be.

---
 drivers/pci/probe.c |   14 ++++++++++++++
 include/linux/pci.h |    1 +
 2 files changed, 15 insertions(+)

@@ -179,6 +179,9 @@ int __pci_read_base(struct pci_dev *dev,
 	u16 orig_cmd;
 	struct pci_bus_region region, inverted_region;
 
+	if (dev->non_compliant_bars)
+		return 0;
+
 	mask = type ? PCI_ROM_ADDRESS_MASK : ~0;
 
 	/* No printks while decoding is disabled! */

@@ -1171,6 +1174,7 @@ static void pci_msi_setup_pci_dev(struct
 int pci_setup_device(struct pci_dev *dev)
 {
 	u32 class;
+	u16 cmd;
 	u8 hdr_type;
 	int pos = 0;
 	struct pci_bus_region region;

@@ -1214,6 +1218,16 @@ int pci_setup_device(struct pci_dev *dev
 	/* device class may be changed after fixup */
 	class = dev->class >> 8;
 
+	if (dev->non_compliant_bars) {
+		pci_read_config_word(dev, PCI_COMMAND, &cmd);
+		if (cmd & (PCI_COMMAND_IO | PCI_COMMAND_MEMORY)) {
+			dev_info(&dev->dev, "device has non-compliant BARs; disabling IO/MEM decoding\n");
+			cmd &= ~PCI_COMMAND_IO;
+			cmd &= ~PCI_COMMAND_MEMORY;
+			pci_write_config_word(dev, PCI_COMMAND, cmd);
+		}
+	}
+
 	switch (dev->hdr_type) {		    /* header type */
 	case PCI_HEADER_TYPE_NORMAL:		    /* standard header */
 		if (class == PCI_CLASS_BRIDGE_PCI)

@@ -359,6 +359,7 @@ struct pci_dev {
 	unsigned int	io_window_1k:1;	/* Intel P2P bridge 1K I/O windows */
 	unsigned int	irq_managed:1;
 	unsigned int	has_secondary_link:1;
+	unsigned int	non_compliant_bars:1;	/* broken BARs; ignore them */
 	pci_dev_flags_t dev_flags;
 	atomic_t	enable_cnt;	/* pci_enable_device has been called */
 

[...]

No objection, but patch 005/238 seems to depend on this so please reorder them so bisection will work.

Ben.

Ben Hutchings
This sentence contradicts itself - no actually it doesn't.

Now reordered, thanks.

greg k-h

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Lorenzo Pieralisi <[email protected]>

commit 4a2e7aab4ffce1e0e79b303dc2f9a03aa9f3a332 upstream.

The [0 - 64k] ACPI PCI IO port resource boundary check in:

acpi_dev_ioresource_flags()

is currently applied blindly in the ACPI resource parsing to all architectures, but only x86 suffers from that IO space limitation.

On arches (ie IA64 and ARM64) where IO space is memory mapped, the PCI root bridges IO resource windows are firstly initialized from the _CRS (in acpi_decode_space()) and contain the CPU physical address at which a root bridge decodes IO space in the CPU physical address space with the offset value representing the offset required to translate the PCI bus address into the CPU physical address.

The IO resource windows are then parsed and updated in arch code before creating and enumerating PCI buses (eg IA64 add_io_space()) to map in an arch specific way the obtained CPU physical address range to a slice of virtual address space reserved to map PCI IO space, ending up with PCI bridges resource windows containing IO resources like the following on a working IA64 configuration:

PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [io 0x1000000-0x100ffff window] (bus address [0x0000-0xffff])
pci_bus 0000:00: root bus resource [mem 0x000a0000-0x000fffff window] pci_bus 0000:00: root bus resource [mem 0x80000000-0x8fffffff window] pci_bus 0000:00: root bus resource [mem 0x80004000000-0x800ffffffff window] pci_bus 0000:00: root bus resource [bus 00]

This implies that the [0 - 64K] check in acpi_dev_ioresource_flags() leaves platforms with memory mapped IO space (ie IA64) broken (ie kernel can't claim IO resources since the host bridge IO resource is disabled and discarded by ACPI core code, see log on IA64 with missing root bridge IO resource, silently filtered by current [0 - 64k] check in acpi_dev_ioresource_flags()):

PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [mem 0x000a0000-0x000fffff window] pci_bus 0000:00: root bus resource [mem 0x80000000-0x8fffffff window] pci_bus 0000:00: root bus resource [mem 0x80004000000-0x800ffffffff window] pci_bus 0000:00: root bus resource [bus 00]

[...]

pci 0000:00:03.0: [1002:515e] type 00 class 0x030000
pci 0000:00:03.0: reg 0x10: [mem 0x80000000-0x87ffffff pref] pci 0000:00:03.0: reg 0x14: [io 0x1000-0x10ff]
pci 0000:00:03.0: reg 0x18: [mem 0x88020000-0x8802ffff]
pci 0000:00:03.0: reg 0x30: [mem 0x88000000-0x8801ffff pref] pci 0000:00:03.0: supports D1 D2
pci 0000:00:03.0: can't claim BAR 1 [io 0x1000-0x10ff]: no compatible bridge window

For this reason, the IO port resources boundaries check in generic ACPI parsing code should be guarded with a CONFIG_X86 guard so that more arches (ie ARM64) can benefit from the generic ACPI resources parsing interface without incurring in unexpected resource filtering, fixing at the same time current breakage on IA64.

This patch factors out IO ports boundary [0 - 64k] check in generic ACPI code and makes the IO space check X86 specific to make sure that IO space resources are usable on other arches too.

---
 drivers/acpi/resource.c |   14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

@@ -27,8 +27,20 @@
 
 #ifdef CONFIG_X86
 #define valid_IRQ(i) (((i) != 0) && ((i) != 2))
+static inline bool acpi_iospace_resource_valid(struct resource *res)
+{
+	/* On X86 IO space is limited to the [0 - 64K] IO port range */
+	return res->end < 0x10003;
+}
 #else
 #define valid_IRQ(i) (true)
+/*
+ * ACPI IO descriptors on arches other than X86 contain MMIO CPU physical
+ * addresses mapping IO space in CPU physical address space, IO space
+ * resources can be placed anywhere in the 64-bit physical address space.
+ */
+static inline bool
+acpi_iospace_resource_valid(struct resource *res) { return true; }
 #endif
 
 static bool acpi_dev_resource_len_valid(u64 start, u64 end, u64 len, bool io)

@@ -127,7 +139,7 @@ static void acpi_dev_ioresource_flags(st
 	if (!acpi_dev_resource_len_valid(res->start, res->end, len, true))
 		res->flags |= IORESOURCE_DISABLED | IORESOURCE_UNSET;
 
-	if (res->end >= 0x10003)
+	if (!acpi_iospace_resource_valid(res))
 		res->flags |= IORESOURCE_DISABLED | IORESOURCE_UNSET;
 
 	if (io_decode == ACPI_DECODE_16)

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Thomas Gleixner <[email protected]>

commit 551adc60573cb68e3d55cacca9ba1b7437313df7 upstream.

Harry reported, that he's able to trigger a system freeze with cpu hot unplug. The freeze turned out to be a live lock caused by recent changes in irq_force_complete_move().

When fixup_irqs() and from there irq_force_complete_move() is called on the dying cpu, then all other cpus are in stop machine an wait for the dying cpu to complete the teardown. If there is a move of an interrupt pending then irq_force_complete_move() sends the cleanup IPI to the cpus in the old_domain mask and waits for them to clear the mask. That's obviously impossible as those cpus are firmly stuck in stop machine with interrupts disabled.

I should have known that, but I completely overlooked it being concentrated on the locking issues around the vectors. And the existance of the call to __irq_complete_move() in the code, which actually sends the cleanup IPI made it reasonable to wait for that cleanup to complete. That call was bogus even before the recent changes as it was just a pointless distraction.

We have to look at two cases:

1) The move_in_progress flag of the interrupt is set

This means the ioapic has been updated with the new vector, but it has not fired yet. In theory there is a race:

set_ioapic(new_vector) <-- Interrupt is raised before update is effective,
i.e. it's raised on the old vector.

So if the target cpu cannot handle that interrupt before the old vector is cleaned up, we get a spurious interrupt and in the worst case the ioapic irq line becomes stale, but my experiments so far have only resulted in spurious interrupts.

But in case of cpu hotplug this should be a non issue because if the affinity update happens right before all cpus rendevouz in stop machine, there is no way that the interrupt can be blocked on the target cpu because all cpus loops first with interrupts enabled in stop machine, so the old vector is not yet cleaned up when the interrupt fires.

So the only way to run into this issue is if the delivery of the interrupt on the apic/system bus would be delayed beyond the point where the target cpu disables interrupts in stop machine. I doubt that it can happen, but at least there is a theroretical chance. Virtualization might be able to expose this, but AFAICT the IOAPIC emulation is not as stupid as the real hardware.

I've spent quite some time over the weekend to enforce that situation, though I was not able to trigger the delayed case.

2) The move_in_progress flag is not set and the old_domain cpu mask is not empty.

That means, that an interrupt was delivered after the change and the cleanup IPI has been sent to the cpus in old_domain, but not all CPUs have responded to it yet.

In both cases we can assume that the next interrupt will arrive on the new vector, so we can cleanup the old vectors on the cpus in the old_domain cpu mask.

---
 arch/x86/include/asm/hw_irq.h |    1 
 arch/x86/kernel/apic/vector.c |   88 +++++++++++++++++++++++++++++++++---------
 2 files changed, 71 insertions(+), 18 deletions(-)

@@ -141,6 +141,7 @@ struct irq_alloc_info {
 struct irq_cfg {
 	unsigned int		dest_apicid;
 	u8			vector;
+	u8			old_vector;
 };
 
 extern struct irq_cfg *irq_cfg(unsigned int irq);

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dave Jones <[email protected]>

commit 7834c10313fb823e538f2772be78edcdeed2e6e3 upstream.

Since 4.4, I've been able to trigger this occasionally:

===============================
[ INFO: suspicious RCU usage. ]
4.5.0-rc7-think+ #3 Not tainted

-------------------------------
./arch/x86/include/asm/msr-trace.h:47 suspicious rcu_dereference_check() usage!

other info that might help us debug this:

RCU used illegally from idle CPU!
rcu_scheduler_active = 1, debug_locks = 1
RCU used illegally from extended quiescent state!
no locks held by swapper/3/0.

stack backtrace:
CPU: 3 PID: 0 Comm: swapper/3 Not tainted 4.5.0-rc7-think+ #3
 ffffffff92f821e0 1f3e5c340597d7fc ffff880468e07f10 ffffffff92560c2a
 ffff880462145280 0000000000000001 ffff880468e07f40 ffffffff921376a6
 ffffffff93665ea0 0000cc7c876d28da 0000000000000005 ffffffff9383dd60
Call Trace:
 <IRQ>  [<ffffffff92560c2a>] dump_stack+0x67/0x9d
 [<ffffffff921376a6>] lockdep_rcu_suspicious+0xe6/0x100
 [<ffffffff925ae7a7>] do_trace_write_msr+0x127/0x1a0
 [<ffffffff92061c83>] native_apic_msr_eoi_write+0x23/0x30
 [<ffffffff92054408>] smp_trace_call_function_interrupt+0x38/0x360
 [<ffffffff92d1ca60>] trace_call_function_interrupt+0x90/0xa0
 <EOI>  [<ffffffff92ac5124>] ? cpuidle_enter_state+0x1b4/0x520

Move the entering_irq() call before ack_APIC_irq(), because entering_irq() tells the RCU susbstems to end the extended quiescent state, so that the following trace call in ack_APIC_irq() works correctly.

---
 arch/x86/include/asm/apic.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -644,8 +644,8 @@ static inline void entering_irq(void)
 
 static inline void entering_ack_irq(void)
 {
-	ack_APIC_irq();
 	entering_irq();
+	ack_APIC_irq();
 }
 
 static inline void ipi_entering_ack_irq(void)

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andy Lutomirski <[email protected]>

commit b7a584598aea7ca73140cb87b40319944dd3393f upstream.

On Xen PV, regs->flags doesn't reliably reflect IOPL and the exit-to-userspace code doesn't change IOPL. We need to context switch it manually.

I'm doing this without going through paravirt because this is specific to Xen PV. After the dust settles, we can merge this with the 32-bit code, tidy up the iopl syscall implementation, and remove the set_iopl pvop entirely.

Fixes XSA-171.

---
 arch/x86/include/asm/xen/hypervisor.h |    2 ++
 arch/x86/kernel/process_64.c          |   12 ++++++++++++
 arch/x86/xen/enlighten.c              |    2 +-
 3 files changed, 15 insertions(+), 1 deletion(-)

@@ -62,4 +62,6 @@ void xen_arch_register_cpu(int num);
 void xen_arch_unregister_cpu(int num);
 #endif
 
+extern void xen_set_iopl_mask(unsigned mask);
+
 #endif /* _ASM_X86_XEN_HYPERVISOR_H */

@@ -48,6 +48,7 @@
 #include <asm/syscalls.h>
 #include <asm/debugreg.h>
 #include <asm/switch_to.h>
+#include <asm/xen/hypervisor.h>
 
 asmlinkage extern void ret_from_fork(void);
 

@@ -411,6 +412,17 @@ __switch_to(struct task_struct *prev_p,
 		     task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV))
 		__switch_to_xtra(prev_p, next_p, tss);
 
+#ifdef CONFIG_XEN
+	/*
+	 * On Xen PV, IOPL bits in pt_regs->flags have no effect, and
+	 * current_pt_regs()->flags may not match the current task's
+	 * intended IOPL.  We need to switch it manually.
+	 */
+	if (unlikely(static_cpu_has(X86_FEATURE_XENPV) &&
+		     prev->iopl != next->iopl))
+		xen_set_iopl_mask(next->iopl);
+#endif
+
 	if (static_cpu_has_bug(X86_BUG_SYSRET_SS_ATTRS)) {
 		/*
 		 * AMD CPUs have a misfeature: SYSRET sets the SS selector but

@@ -961,7 +961,7 @@ static void xen_load_sp0(struct tss_stru
 	tss->x86_tss.sp0 = thread->sp0;
 }
 
-static void xen_set_iopl_mask(unsigned mask)
+void xen_set_iopl_mask(unsigned mask)
 {
 	struct physdev_set_iopl set_iopl;
 

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andy Lutomirski <[email protected]>

commit c29016cf41fe9fa994a5ecca607cf5f1cd98801e upstream.

iopl(3) is supposed to work if iopl is already 3, even if unprivileged. This didn't work right on Xen PV. Fix it.

---
 arch/x86/kernel/ioport.c |   12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

@@ -96,9 +96,14 @@ asmlinkage long sys_ioperm(unsigned long
 SYSCALL_DEFINE1(iopl, unsigned int, level)
 {
 	struct pt_regs *regs = current_pt_regs();
-	unsigned int old = (regs->flags >> 12) & 3;
 	struct thread_struct *t = &current->thread;
 
+	/*
+	 * Careful: the IOPL bits in regs->flags are undefined under Xen PV
+	 * and changing them has no effect.
+	 */
+	unsigned int old = t->iopl >> X86_EFLAGS_IOPL_BIT;
+
 	if (level > 3)
 		return -EINVAL;
 	/* Trying to gain more privileges? */

@@ -106,8 +111,9 @@ SYSCALL_DEFINE1(iopl, unsigned int, leve
 		if (!capable(CAP_SYS_RAWIO))
 			return -EPERM;
 	}
-	regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | (level << 12);
-	t->iopl = level << 12;
+	regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) |
+		(level << X86_EFLAGS_IOPL_BIT);
+	t->iopl = level << X86_EFLAGS_IOPL_BIT;
 	set_iopl_mask(t->iopl);
 
 	return 0;

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Nadav Amit <[email protected]>

commit 18c98243ddf05a1827ad2c359c5ac051101e7ff7 upstream.

TLB_REMOTE_SEND_IPI was recently introduced, but it counts bytes instead of pages. In addition, it does not report correctly the case in which flush_tlb_page flushes a page. Fix it to be consistent with other TLB counters.

---
 arch/x86/mm/tlb.c |   12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

@@ -106,8 +106,6 @@ static void flush_tlb_func(void *info)
 
 	if (f->flush_mm != this_cpu_read(cpu_tlbstate.active_mm))
 		return;
-	if (!f->flush_end)
-		f->flush_end = f->flush_start + PAGE_SIZE;
 
 	count_vm_tlb_event(NR_TLB_REMOTE_FLUSH_RECEIVED);
 	if (this_cpu_read(cpu_tlbstate.state) == TLBSTATE_OK) {

@@ -135,12 +133,20 @@ void native_flush_tlb_others(const struc
 				 unsigned long end)
 {
 	struct flush_tlb_info info;
+
+	if (end == 0)
+		end = start + PAGE_SIZE;
 	info.flush_mm = mm;
 	info.flush_start = start;
 	info.flush_end = end;
 
 	count_vm_tlb_event(NR_TLB_REMOTE_FLUSH);
-	trace_tlb_flush(TLB_REMOTE_SEND_IPI, end - start);
+	if (end == TLB_FLUSH_ALL)
+		trace_tlb_flush(TLB_REMOTE_SEND_IPI, TLB_FLUSH_ALL);
+	else
+		trace_tlb_flush(TLB_REMOTE_SEND_IPI,
+				(end - start) >> PAGE_SHIFT);
+
 	if (is_uv_system()) {
 		unsigned int cpu;
 

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Douglas Gilbert <[email protected]>

commit 5ecee0a3ee8d74b6950cb41e8989b0c2174568d4 upstream.

One of the strange things that the original sg driver did was let the user provide both a data-out buffer (it followed the sg_header+cdb) _and_ specify a reply length greater than zero. What happened was that the user data-out buffer was copied into some kernel buffers and then the mid level was told a read type operation would take place with the data from the device overwriting the same kernel buffers. The user would then read those kernel buffers back into the user space.

("sg: set dxferp to NULL for READ with the older SG interface") in 2008 and syzkaller found that out recently.

Make sure that a user space pointer is passed through when data follows the sg_header structure and command. Fix the abnormal case when a non-zero reply_len is also given.

---
 drivers/scsi/sg.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -652,7 +652,8 @@ sg_write(struct file *filp, const char _
 	else
 		hp->dxfer_direction = (mxsize > 0) ? SG_DXFER_FROM_DEV : SG_DXFER_NONE;
 	hp->dxfer_len = mxsize;
-	if (hp->dxfer_direction == SG_DXFER_TO_DEV)
+	if ((hp->dxfer_direction == SG_DXFER_TO_DEV) ||
+	    (hp->dxfer_direction == SG_DXFER_TO_FROM_DEV))
 		hp->dxferp = (char __user *)buf + cmd_size;
 	else
 		hp->dxferp = NULL;

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Raghava Aditya Renukunta <[email protected]>

commit 3f4ce057d51a9c0ed9b01ba693df685d230ffcae upstream.

The driver utilizes an array of atomic variables to keep track of IO submissions to each vector. To submit an IO multiple threads iterate through the array to find a vector which has empty slots to send an IO. The reading and updating of the variable is not atomic, causing race conditions when a thread uses a full vector to submit an IO.

Fixed by mapping each FIB to a vector, the submission path then uses said vector to submit IO thereby removing the possibly of a race condition.The vector assignment is started from 1 since vector 0 is reserved for the use of AIF management FIBS.If the number of MSIx vectors is 1 (MSI or INTx mode) then all the fibs are allocated to vector 0.

---
 drivers/scsi/aacraid/aacraid.h |    2 ++
 drivers/scsi/aacraid/commsup.c |   28 ++++++++++++++++++++++++++++
 drivers/scsi/aacraid/src.c     |   30 +++++++-----------------------
 3 files changed, 37 insertions(+), 23 deletions(-)

@@ -944,6 +944,7 @@ struct fib {
 	 */
 	struct list_head	fiblink;
 	void			*data;
+	u32			vector_no;
 	struct hw_fib		*hw_fib_va;		/* Actual shared object */
 	dma_addr_t		hw_fib_pa;		/* physical address of hw_fib*/
 };

@@ -2113,6 +2114,7 @@ static inline unsigned int cap_to_cyls(s
 int aac_acquire_irq(struct aac_dev *dev);
 void aac_free_irq(struct aac_dev *dev);
 const char *aac_driverinfo(struct Scsi_Host *);
+void aac_fib_vector_assign(struct aac_dev *dev);
 struct fib *aac_fib_alloc(struct aac_dev *dev);
 int aac_fib_setup(struct aac_dev *dev);
 void aac_fib_map_free(struct aac_dev *dev);

@@ -90,6 +90,28 @@ void aac_fib_map_free(struct aac_dev *de
 	dev->hw_fib_pa = 0;
 }
 
+void aac_fib_vector_assign(struct aac_dev *dev)
+{
+	u32 i = 0;
+	u32 vector = 1;
+	struct fib *fibptr = NULL;
+
+	for (i = 0, fibptr = &dev->fibs[i];
+		i < (dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB);
+		i++, fibptr++) {
+		if ((dev->max_msix == 1) ||
+		  (i > ((dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB - 1)
+			- dev->vector_cap))) {
+			fibptr->vector_no = 0;
+		} else {
+			fibptr->vector_no = vector;
+			vector++;
+			if (vector == dev->max_msix)
+				vector = 1;
+		}
+	}
+}
+
 /**
  *	aac_fib_setup	-	setup the fibs
  *	@dev: Adapter to set up

@@ -151,6 +173,12 @@ int aac_fib_setup(struct aac_dev * dev)
 		hw_fib_pa = hw_fib_pa +
 			dev->max_fib_size + sizeof(struct aac_fib_xporthdr);
 	}
+
+	/*
+	 *Assign vector numbers to fibs
+	 */
+	aac_fib_vector_assign(dev);
+
 	/*
 	 *	Add the fib chain to the free list
 	 */

@@ -156,8 +156,8 @@ static irqreturn_t aac_src_intr_message(
 				break;
 			if (dev->msi_enabled && dev->max_msix > 1)
 				atomic_dec(&dev->rrq_outstanding[vector_no]);
-			aac_intr_normal(dev, handle-1, 0, isFastResponse, NULL);
 			dev->host_rrq[index++] = 0;
+			aac_intr_normal(dev, handle-1, 0, isFastResponse, NULL);
 			if (index == (vector_no + 1) * dev->vector_cap)
 				index = vector_no * dev->vector_cap;
 			dev->host_rrq_idx[vector_no] = index;

@@ -452,36 +452,20 @@ static int aac_src_deliver_message(struc
 #endif
 
 	u16 hdr_size = le16_to_cpu(fib->hw_fib_va->header.Size);
+	u16 vector_no;
 
 	atomic_inc(&q->numpending);
 
 	if (dev->msi_enabled && fib->hw_fib_va->header.Command != AifRequest &&
 	    dev->max_msix > 1) {
-		u_int16_t vector_no, first_choice = 0xffff;
-
-		vector_no = dev->fibs_pushed_no % dev->max_msix;
-		do {
-			vector_no += 1;
-			if (vector_no == dev->max_msix)
-				vector_no = 1;
-			if (atomic_read(&dev->rrq_outstanding[vector_no]) <
-			    dev->vector_cap)
-				break;
-			if (0xffff == first_choice)
-				first_choice = vector_no;
-			else if (vector_no == first_choice)
-				break;
-		} while (1);
-		if (vector_no == first_choice)
-			vector_no = 0;
-		atomic_inc(&dev->rrq_outstanding[vector_no]);
-		if (dev->fibs_pushed_no == 0xffffffff)
-			dev->fibs_pushed_no = 0;
-		else
-			dev->fibs_pushed_no++;
+		vector_no = fib->vector_no;
 		fib->hw_fib_va->header.Handle += (vector_no << 16);
+	} else {
+		vector_no = 0;
 	}
 
+	atomic_inc(&dev->rrq_outstanding[vector_no]);
+
 	if (dev->comm_interface == AAC_COMM_MESSAGE_TYPE2) {
 		/* Calculate the amount to the fibsize bits */
 		fibsize = (hdr_size + 127) / 128 - 1;

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Raghava Aditya Renukunta <[email protected]>

commit f88fa79a61726ce9434df9b4aede36961f709f17 upstream.

aac_fib_map_free() calls pci_free_consistent() without checking that dev->hw_fib_va is not NULL and dev->max_fib_size is not zero.If they are indeed NULL/0, this will result in a hang as pci_free_consistent() will attempt to invalidate cache for the entire 64-bit address space (which would take a very long time).

Fixed by adding a check to make sure that dev->hw_fib_va and dev->max_fib_size are not NULL and 0 respectively.

---
 drivers/scsi/aacraid/commsup.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

@@ -83,9 +83,12 @@ static int fib_map_alloc(struct aac_dev
 
 void aac_fib_map_free(struct aac_dev *dev)
 {
-	pci_free_consistent(dev->pdev,
-	  dev->max_fib_size * (dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB),
-	  dev->hw_fib_va, dev->hw_fib_pa);
+	if (dev->hw_fib_va && dev->max_fib_size) {
+		pci_free_consistent(dev->pdev,
+		(dev->max_fib_size *
+		(dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB)),
+		dev->hw_fib_va, dev->hw_fib_pa);
+	}
 	dev->hw_fib_va = NULL;
 	dev->hw_fib_pa = 0;
 }

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Raghava Aditya Renukunta <[email protected]>

commit ecc479e00db8eb110b200afe1effcb3df20ca7ae upstream.

During EEH recovery number of online CPU's might change thereby changing the number of MSIx vectors. Since each fib is allocated to a vector, changes in the number of vectors causes fib to be sent thru invalid vectors.In addition the correct number of MSIx vectors is not updated in the INIT struct sent to the controller, when it is reinitialized.

Fixed by reassigning vectors to fibs based on the updated number of MSIx vectors and updating the INIT structure before sending to controller.

---
 drivers/scsi/aacraid/linit.c |   12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

@@ -1404,8 +1404,18 @@ static int aac_acquire_resources(struct
 
 	aac_adapter_enable_int(dev);
 
-	if (!dev->sync_mode)
+	/*max msix may change  after EEH
+	 * Re-assign vectors to fibs
+	 */
+	aac_fib_vector_assign(dev);
+
+	if (!dev->sync_mode) {
+		/* After EEH recovery or suspend resume, max_msix count
+		 * may change, therfore updating in init as well.
+		 */
 		aac_adapter_start(dev);
+		dev->init->Sa_MSIXVectors = cpu_to_le32(dev->max_msix);
+	}
 	return 0;
 
 error_iounmap:

Really?

[...]

Ben Hutchings
This sentence contradicts itself - no actually it doesn't.

Hello Ben,

You are right those are two lines are in the wrong order, I will submit another patch to correct that issue.

Raghava

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Martin K. Petersen <[email protected]>

commit 6540a65da90c09590897310e31993b1f6e28485a upstream.

Commit 397737223c59 ("sd: Make discard granularity match logical block size when LBPRZ=1") accidentally set the granularity to one byte instead of one logical block on devices that provide deterministic zeroes after UNMAP.

---
 drivers/scsi/sd.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -648,7 +648,7 @@ static void sd_config_discard(struct scs
 	 */
 	if (sdkp->lbprz) {
 		q->limits.discard_alignment = 0;
-		q->limits.discard_granularity = 1;
+		q->limits.discard_granularity = logical_block_size;
 	} else {
 		q->limits.discard_alignment = sdkp->unmap_alignment *
 			logical_block_size;

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Finn Thain <[email protected]>

commit 1884c2838f31e6bf20f21459ed9921f8c92ed3ef upstream.

Commands subject to exception handling are to be returned to the scsi mid-layer. Make sure that the various command pointers and command lists in the low-level driver are correctly cleansed of affected commands.

This fixes some bugs that I accidentally introduced in v4.5-rc1 including the removal of INIT_LIST_HEAD for the 'autosense' and 'disconnected' command lists, and the possible NULL pointer dereference in NCR5380_bus_reset() that was reported by Dan Carpenter.

hostdata->sensing may also point to an affected command so this pointer also has to be cleared. The abort handler calls complete_cmd() to take care of this; let's have the bus reset handler do the same.

The issue queue may also contain an affected command. If so, remove it. This also follows the abort handler logic.

---
 drivers/scsi/NCR5380.c       |   19 ++++++++++++-------
 drivers/scsi/atari_NCR5380.c |   19 ++++++++++++-------
 2 files changed, 24 insertions(+), 14 deletions(-)

@@ -2450,7 +2450,16 @@ static int NCR5380_bus_reset(struct scsi
 	 * commands!
 	 */
 
-	hostdata->selecting = NULL;
+	if (list_del_cmd(&hostdata->unissued, cmd)) {
+		cmd->result = DID_RESET << 16;
+		cmd->scsi_done(cmd);
+	}
+
+	if (hostdata->selecting) {
+		hostdata->selecting->result = DID_RESET << 16;
+		complete_cmd(instance, hostdata->selecting);
+		hostdata->selecting = NULL;
+	}
 
 	list_for_each_entry(ncmd, &hostdata->disconnected, list) {
 		struct scsi_cmnd *cmd = NCR5380_to_scmd(ncmd);

@@ -2458,6 +2467,7 @@ static int NCR5380_bus_reset(struct scsi
 		set_host_byte(cmd, DID_RESET);
 		cmd->scsi_done(cmd);
 	}
+	INIT_LIST_HEAD(&hostdata->disconnected);
 
 	list_for_each_entry(ncmd, &hostdata->autosense, list) {
 		struct scsi_cmnd *cmd = NCR5380_to_scmd(ncmd);

@@ -2465,6 +2475,7 @@ static int NCR5380_bus_reset(struct scsi
 		set_host_byte(cmd, DID_RESET);
 		cmd->scsi_done(cmd);
 	}
+	INIT_LIST_HEAD(&hostdata->autosense);
 
 	if (hostdata->connected) {
 		set_host_byte(hostdata->connected, DID_RESET);

@@ -2472,12 +2483,6 @@ static int NCR5380_bus_reset(struct scsi
 		hostdata->connected = NULL;
 	}
 
-	if (hostdata->sensing) {
-		set_host_byte(hostdata->connected, DID_RESET);
-		complete_cmd(instance, hostdata->sensing);
-		hostdata->sensing = NULL;
-	}
-
 	for (i = 0; i < 8; ++i)
 		hostdata->busy[i] = 0;
 #ifdef REAL_DMA

@@ -2646,7 +2646,16 @@ static int NCR5380_bus_reset(struct scsi
 	 * commands!
 	 */
 
-	hostdata->selecting = NULL;
+	if (list_del_cmd(&hostdata->unissued, cmd)) {
+		cmd->result = DID_RESET << 16;
+		cmd->scsi_done(cmd);
+	}
+
+	if (hostdata->selecting) {
+		hostdata->selecting->result = DID_RESET << 16;
+		complete_cmd(instance, hostdata->selecting);
+		hostdata->selecting = NULL;
+	}
 
 	list_for_each_entry(ncmd, &hostdata->disconnected, list) {
 		struct scsi_cmnd *cmd = NCR5380_to_scmd(ncmd);

@@ -2654,6 +2663,7 @@ static int NCR5380_bus_reset(struct scsi
 		set_host_byte(cmd, DID_RESET);
 		cmd->scsi_done(cmd);
 	}
+	INIT_LIST_HEAD(&hostdata->disconnected);
 
 	list_for_each_entry(ncmd, &hostdata->autosense, list) {
 		struct scsi_cmnd *cmd = NCR5380_to_scmd(ncmd);

@@ -2661,6 +2671,7 @@ static int NCR5380_bus_reset(struct scsi
 		set_host_byte(cmd, DID_RESET);
 		cmd->scsi_done(cmd);
 	}
+	INIT_LIST_HEAD(&hostdata->autosense);
 
 	if (hostdata->connected) {
 		set_host_byte(hostdata->connected, DID_RESET);

@@ -2668,12 +2679,6 @@ static int NCR5380_bus_reset(struct scsi
 		hostdata->connected = NULL;
 	}
 
-	if (hostdata->sensing) {
-		set_host_byte(hostdata->connected, DID_RESET);
-		complete_cmd(instance, hostdata->sensing);
-		hostdata->sensing = NULL;
-	}
-
 #ifdef SUPPORT_TAGS
 	free_all_tags(hostdata);
 #endif

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Finn Thain <[email protected]>

commit 1678847ec93040ae8280d19c42ae0ba8a4233e6d upstream.

The calls to NCR5380_transfer_pio() for DATA IN and DATA OUT phases will modify cmd->SCp.this_residual, cmd->SCp.ptr and cmd->SCp.buffer. That works as long as EH does not intervene, which became possible in atari_NCR5380.c when I changed the locking to bring it closer to NCR5380.c.

If error recovery aborts the command, the scsi_cmnd in question and its buffer will be returned to the mid-layer. So the transfer has to cease, but it can't be stopped by the initiator because the target controls the bus phase.

The problem does not arise if the lock is not released. That was fine for atari_scsi, because it implements DMA. For the other drivers, we have to release the lock and re-enable interrupts for long PIO data transfers.

The solution is to split the transfer into small chunks. In between chunks the main loop releases the lock and re-enables interrupts. Thus interrupts can be serviced and eh_bus_reset_handler can intervene if need be.

This fixes an oops in NCR5380_transfer_pio() that can happen when the EH abort handler is invoked during DATA IN or DATA OUT phase.

---
 drivers/scsi/NCR5380.c       |   16 +++++++++-------
 drivers/scsi/atari_NCR5380.c |   16 +++++++++-------
 2 files changed, 18 insertions(+), 14 deletions(-)

@@ -1759,9 +1759,7 @@ static void NCR5380_information_transfer
 	unsigned char msgout = NOP;
 	int sink = 0;
 	int len;
-#if defined(PSEUDO_DMA) || defined(REAL_DMA_POLL)
 	int transfersize;
-#endif
 	unsigned char *data;
 	unsigned char phase, tmp, extended_msg[10], old_phase = 0xff;
 	struct scsi_cmnd *cmd;

@@ -1854,13 +1852,17 @@ static void NCR5380_information_transfer
 				} else
 #endif				/* defined(PSEUDO_DMA) || defined(REAL_DMA_POLL) */
 				{
-					spin_unlock_irq(&hostdata->lock);
-					NCR5380_transfer_pio(instance, &phase,
-					                     (int *)&cmd->SCp.this_residual,
+					/* Break up transfer into 3 ms chunks,
+					 * presuming 6 accesses per handshake.
+					 */
+					transfersize = min((unsigned long)cmd->SCp.this_residual,
+					                   hostdata->accesses_per_ms / 2);
+					len = transfersize;
+					NCR5380_transfer_pio(instance, &phase, &len,
 					                     (unsigned char **)&cmd->SCp.ptr);
-					spin_lock_irq(&hostdata->lock);
+					cmd->SCp.this_residual -= transfersize - len;
 				}
-				break;
+				return;
 			case PHASE_MSGIN:
 				len = 1;
 				data = &tmp;

@@ -1838,9 +1838,7 @@ static void NCR5380_information_transfer
 	unsigned char msgout = NOP;
 	int sink = 0;
 	int len;
-#if defined(REAL_DMA)
 	int transfersize;
-#endif
 	unsigned char *data;
 	unsigned char phase, tmp, extended_msg[10], old_phase = 0xff;
 	struct scsi_cmnd *cmd;

@@ -1983,18 +1981,22 @@ static void NCR5380_information_transfer
 				} else
 #endif /* defined(REAL_DMA) */
 				{
-					spin_unlock_irq(&hostdata->lock);
-					NCR5380_transfer_pio(instance, &phase,
-					                     (int *)&cmd->SCp.this_residual,
+					/* Break up transfer into 3 ms chunks,
+					 * presuming 6 accesses per handshake.
+					 */
+					transfersize = min((unsigned long)cmd->SCp.this_residual,
+					                   hostdata->accesses_per_ms / 2);
+					len = transfersize;
+					NCR5380_transfer_pio(instance, &phase, &len,
 					                     (unsigned char **)&cmd->SCp.ptr);
-					spin_lock_irq(&hostdata->lock);
+					cmd->SCp.this_residual -= transfersize - len;
 				}
 #if defined(CONFIG_SUN3) && defined(REAL_DMA)
 				/* if we had intended to dma that command clear it */
 				if (sun3_dma_setup_done == cmd)
 					sun3_dma_setup_done = NULL;
 #endif
-				break;
+				return;
 			case PHASE_MSGIN:
 				len = 1;
 				data = &tmp;

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Finn Thain <[email protected]>

commit 71a00593ec0c2e2c1720e4041cf2926ff1d07826 upstream.

Calling NCR5380_select() from the abort handler causes various problems. Firstly, it means potentially re-entering NCR5380_select(). Secondly, it means that the lock is released, which permits the EH handlers to be re-entered. The combination results in crashes. Don't do it.

---
 drivers/scsi/NCR5380.c       |   16 ++++++++--------
 drivers/scsi/atari_NCR5380.c |   16 ++++++++--------
 2 files changed, 16 insertions(+), 16 deletions(-)

@@ -2302,6 +2302,9 @@ static bool list_del_cmd(struct list_hea
  * If cmd was not found at all then presumably it has already been completed,
  * in which case return SUCCESS to try to avoid further EH measures.
  * If the command has not completed yet, we must not fail to find it.
+ *
+ * The lock protects driver data structures, but EH handlers also use it
+ * to serialize their own execution and prevent their own re-entry.
  */
 
 static int NCR5380_abort(struct scsi_cmnd *cmd)

@@ -2338,14 +2341,11 @@ static int NCR5380_abort(struct scsi_cmn
 	if (list_del_cmd(&hostdata->disconnected, cmd)) {
 		dsprintk(NDEBUG_ABORT, instance,
 		         "abort: removed %p from disconnected list\n", cmd);
-		cmd->result = DID_ERROR << 16;
-		if (!hostdata->connected)
-			NCR5380_select(instance, cmd);
-		if (hostdata->connected != cmd) {
-			complete_cmd(instance, cmd);
-			result = FAILED;
-			goto out;
-		}
+		/* Can't call NCR5380_select() and send ABORT because that
+		 * means releasing the lock. Need a bus reset.
+		 */
+		result = FAILED;
+		goto out;
 	}
 
 	if (hostdata->connected == cmd) {

@@ -2497,6 +2497,9 @@ static bool list_del_cmd(struct list_hea
  * If cmd was not found at all then presumably it has already been completed,
  * in which case return SUCCESS to try to avoid further EH measures.
  * If the command has not completed yet, we must not fail to find it.
+ *
+ * The lock protects driver data structures, but EH handlers also use it
+ * to serialize their own execution and prevent their own re-entry.
  */
 
 static int NCR5380_abort(struct scsi_cmnd *cmd)

@@ -2533,14 +2536,11 @@ static int NCR5380_abort(struct scsi_cmn
 	if (list_del_cmd(&hostdata->disconnected, cmd)) {
 		dsprintk(NDEBUG_ABORT, instance,
 		         "abort: removed %p from disconnected list\n", cmd);
-		cmd->result = DID_ERROR << 16;
-		if (!hostdata->connected)
-			NCR5380_select(instance, cmd);
-		if (hostdata->connected != cmd) {
-			complete_cmd(instance, cmd);
-			result = FAILED;
-			goto out;
-		}
+		/* Can't call NCR5380_select() and send ABORT because that
+		 * means releasing the lock. Need a bus reset.
+		 */
+		result = FAILED;
+		goto out;
 	}
 
 	if (hostdata->connected == cmd) {

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Finn Thain <[email protected]>

commit dc183965282d28c82f192e39cbfa91da85505a6f upstream.

The list structures and related logic used in the NCR5380 driver mean that a command cannot be queued twice (i.e. can't appear on more than one queue and can't appear on the same queue more than once).

The abort handler must forget the command so that the mid-layer can re-use it. E.g. the ML may send it back to the LLD via via scsi_eh_get_sense().

Fix this and also fix two error paths, so that commands get forgotten iff completed.

---
 drivers/scsi/NCR5380.c       |   62 +++++++++++--------------------------------
 drivers/scsi/atari_NCR5380.c |   62 +++++++++++--------------------------------
 2 files changed, 34 insertions(+), 90 deletions(-)

@@ -1796,6 +1796,7 @@ static void NCR5380_information_transfer
 				do_abort(instance);
 				cmd->result = DID_ERROR << 16;
 				complete_cmd(instance, cmd);
+				hostdata->connected = NULL;
 				return;
 #endif
 			case PHASE_DATAIN:

@@ -1845,7 +1846,6 @@ static void NCR5380_information_transfer
 						sink = 1;
 						do_abort(instance);
 						cmd->result = DID_ERROR << 16;
-						complete_cmd(instance, cmd);
 						/* XXX - need to source or sink data here, as appropriate */
 					} else
 						cmd->SCp.this_residual -= transfersize - len;

@@ -2294,14 +2294,14 @@ static bool list_del_cmd(struct list_hea
  * [disconnected -> connected ->]...
  * [autosense -> connected ->] done
  *
- * If cmd is unissued then just remove it.
- * If cmd is disconnected, try to select the target.
- * If cmd is connected, try to send an abort message.
- * If cmd is waiting for autosense, give it a chance to complete but check
- * that it isn't left connected.
  * If cmd was not found at all then presumably it has already been completed,
  * in which case return SUCCESS to try to avoid further EH measures.
+ *
  * If the command has not completed yet, we must not fail to find it.
+ * We have no option but to forget the aborted command (even if it still
+ * lacks sense data). The mid-layer may re-issue a command that is in error
+ * recovery (see scsi_send_eh_cmnd), but the logic and data structures in
+ * this driver are such that a command can appear on one queue only.
  *
  * The lock protects driver data structures, but EH handlers also use it
  * to serialize their own execution and prevent their own re-entry.

@@ -2327,6 +2327,7 @@ static int NCR5380_abort(struct scsi_cmn
 		         "abort: removed %p from issue queue\n", cmd);
 		cmd->result = DID_ABORT << 16;
 		cmd->scsi_done(cmd); /* No tag or busy flag to worry about */
+		goto out;
 	}
 
 	if (hostdata->selecting == cmd) {

@@ -2344,6 +2345,8 @@ static int NCR5380_abort(struct scsi_cmn
 		/* Can't call NCR5380_select() and send ABORT because that
 		 * means releasing the lock. Need a bus reset.
 		 */
+		set_host_byte(cmd, DID_ERROR);
+		complete_cmd(instance, cmd);
 		result = FAILED;
 		goto out;
 	}

@@ -2351,45 +2354,9 @@ static int NCR5380_abort(struct scsi_cmn
 	if (hostdata->connected == cmd) {
 		dsprintk(NDEBUG_ABORT, instance, "abort: cmd %p is connected\n", cmd);
 		hostdata->connected = NULL;
-		if (do_abort(instance)) {
-			set_host_byte(cmd, DID_ERROR);
-			complete_cmd(instance, cmd);
-			result = FAILED;
-			goto out;
-		}
-		set_host_byte(cmd, DID_ABORT);
 #ifdef REAL_DMA
 		hostdata->dma_len = 0;
 #endif
-		if (cmd->cmnd[0] == REQUEST_SENSE)
-			complete_cmd(instance, cmd);
-		else {
-			struct NCR5380_cmd *ncmd = scsi_cmd_priv(cmd);
-
-			/* Perform autosense for this command */
-			list_add(&ncmd->list, &hostdata->autosense);
-		}
-	}
-
-	if (list_find_cmd(&hostdata->autosense, cmd)) {
-		dsprintk(NDEBUG_ABORT, instance,
-		         "abort: found %p on sense queue\n", cmd);
-		spin_unlock_irqrestore(&hostdata->lock, flags);
-		queue_work(hostdata->work_q, &hostdata->main_task);
-		msleep(1000);
-		spin_lock_irqsave(&hostdata->lock, flags);
-		if (list_del_cmd(&hostdata->autosense, cmd)) {
-			dsprintk(NDEBUG_ABORT, instance,
-			         "abort: removed %p from sense queue\n", cmd);
-			set_host_byte(cmd, DID_ABORT);
-			complete_cmd(instance, cmd);
-			goto out;
-		}
-	}
-
-	if (hostdata->connected == cmd) {
-		dsprintk(NDEBUG_ABORT, instance, "abort: cmd %p is connected\n", cmd);
-		hostdata->connected = NULL;
 		if (do_abort(instance)) {
 			set_host_byte(cmd, DID_ERROR);
 			complete_cmd(instance, cmd);

@@ -2397,9 +2364,14 @@ static int NCR5380_abort(struct scsi_cmn
 			goto out;
 		}
 		set_host_byte(cmd, DID_ABORT);
-#ifdef REAL_DMA
-		hostdata->dma_len = 0;
-#endif
+		complete_cmd(instance, cmd);
+		goto out;
+	}
+
+	if (list_del_cmd(&hostdata->autosense, cmd)) {
+		dsprintk(NDEBUG_ABORT, instance,
+		         "abort: removed %p from sense queue\n", cmd);
+		set_host_byte(cmd, DID_ERROR);
 		complete_cmd(instance, cmd);
 	}
 

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Finn Thain <[email protected]>

commit ccf6efd78317ef6265829c81a3e1a19f628b1a2d upstream.

Add missing checks for EH abort during arbitration and selection. Rework the handling of NCR5380_select() result to improve clarity.

---
 drivers/scsi/NCR5380.c       |   16 +++++++++++-----
 drivers/scsi/atari_NCR5380.c |   16 +++++++++++-----
 2 files changed, 22 insertions(+), 10 deletions(-)

@@ -815,15 +815,17 @@ static void NCR5380_main(struct work_str
 	struct NCR5380_hostdata *hostdata =
 		container_of(work, struct NCR5380_hostdata, main_task);
 	struct Scsi_Host *instance = hostdata->host;
-	struct scsi_cmnd *cmd;
 	int done;
 
 	do {
 		done = 1;
 
 		spin_lock_irq(&hostdata->lock);
-		while (!hostdata->connected &&
-		       (cmd = dequeue_next_cmd(instance))) {
+		while (!hostdata->connected && !hostdata->selecting) {
+			struct scsi_cmnd *cmd = dequeue_next_cmd(instance);
+
+			if (!cmd)
+				break;
 
 			dsprintk(NDEBUG_MAIN, instance, "main: dequeued %p\n", cmd);
 

@@ -840,8 +842,7 @@ static void NCR5380_main(struct work_str
 			 * entire unit.
 			 */
 
-			cmd = NCR5380_select(instance, cmd);
-			if (!cmd) {
+			if (!NCR5380_select(instance, cmd)) {
 				dsprintk(NDEBUG_MAIN, instance, "main: select complete\n");
 			} else {
 				dsprintk(NDEBUG_MAIN | NDEBUG_QUEUES, instance,

@@ -1056,6 +1057,11 @@ static struct scsi_cmnd *NCR5380_select(
 		/* Reselection interrupt */
 		goto out;
 	}
+	if (!hostdata->selecting) {
+		/* Command was aborted */
+		NCR5380_write(MODE_REG, MR_BASE);
+		goto out;
+	}
 	if (err < 0) {
 		NCR5380_write(MODE_REG, MR_BASE);
 		shost_printk(KERN_ERR, instance,

@@ -923,7 +923,6 @@ static void NCR5380_main(struct work_str
 	struct NCR5380_hostdata *hostdata =
 		container_of(work, struct NCR5380_hostdata, main_task);
 	struct Scsi_Host *instance = hostdata->host;
-	struct scsi_cmnd *cmd;
 	int done;
 
 	/*

@@ -936,8 +935,11 @@ static void NCR5380_main(struct work_str
 		done = 1;
 
 		spin_lock_irq(&hostdata->lock);
-		while (!hostdata->connected &&
-		       (cmd = dequeue_next_cmd(instance))) {
+		while (!hostdata->connected && !hostdata->selecting) {
+			struct scsi_cmnd *cmd = dequeue_next_cmd(instance);
+
+			if (!cmd)
+				break;
 
 			dsprintk(NDEBUG_MAIN, instance, "main: dequeued %p\n", cmd);
 

@@ -960,8 +962,7 @@ static void NCR5380_main(struct work_str
 #ifdef SUPPORT_TAGS
 			cmd_get_tag(cmd, cmd->cmnd[0] != REQUEST_SENSE);
 #endif
-			cmd = NCR5380_select(instance, cmd);
-			if (!cmd) {
+			if (!NCR5380_select(instance, cmd)) {
 				dsprintk(NDEBUG_MAIN, instance, "main: select complete\n");
 				maybe_release_dma_irq(instance);
 			} else {

@@ -1257,6 +1258,11 @@ static struct scsi_cmnd *NCR5380_select(
 		/* Reselection interrupt */
 		goto out;
 	}
+	if (!hostdata->selecting) {
+		/* Command was aborted */
+		NCR5380_write(MODE_REG, MR_BASE);
+		goto out;
+	}
 	if (err < 0) {
 		NCR5380_write(MODE_REG, MR_BASE);
 		shost_printk(KERN_ERR, instance,

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Finn Thain <[email protected]>

commit 8d5dbec3bcb24a7d071962448e0fecaca8c75cc7 upstream.

This bug causes the wrong command to have its sense pointer overwritten, which sometimes leads to a NULL pointer deref. Fix this by checking which command is being requeued before restoring the scsi_eh_save data.

It turns out that some targets will disconnect a REQUEST SENSE command. The autosense algorithm doesn't anticipate this. Hence multiple commands can end up undergoing autosense simultaneously, and they will all try to use the same scsi_eh_save struct, which won't work. Defer autosense when the scsi_eh_save storage is in use by another command.

---
 drivers/scsi/NCR5380.c       |    4 ++--
 drivers/scsi/atari_NCR5380.c |    4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

@@ -760,7 +760,7 @@ static struct scsi_cmnd *dequeue_next_cm
 	struct NCR5380_cmd *ncmd;
 	struct scsi_cmnd *cmd;
 
-	if (list_empty(&hostdata->autosense)) {
+	if (hostdata->sensing || list_empty(&hostdata->autosense)) {
 		list_for_each_entry(ncmd, &hostdata->unissued, list) {
 			cmd = NCR5380_to_scmd(ncmd);
 			dsprintk(NDEBUG_QUEUES, instance, "dequeue: cmd=%p target=%d busy=0x%02x lun=%llu\n",

@@ -793,7 +793,7 @@ static void requeue_cmd(struct Scsi_Host
 	struct NCR5380_hostdata *hostdata = shost_priv(instance);
 	struct NCR5380_cmd *ncmd = scsi_cmd_priv(cmd);
 
-	if (hostdata->sensing) {
+	if (hostdata->sensing == cmd) {
 		scsi_eh_restore_cmnd(cmd, &hostdata->ses);
 		list_add(&ncmd->list, &hostdata->autosense);
 		hostdata->sensing = NULL;

@@ -862,7 +862,7 @@ static struct scsi_cmnd *dequeue_next_cm
 	struct NCR5380_cmd *ncmd;
 	struct scsi_cmnd *cmd;
 
-	if (list_empty(&hostdata->autosense)) {
+	if (hostdata->sensing || list_empty(&hostdata->autosense)) {
 		list_for_each_entry(ncmd, &hostdata->unissued, list) {
 			cmd = NCR5380_to_scmd(ncmd);
 			dsprintk(NDEBUG_QUEUES, instance, "dequeue: cmd=%p target=%d busy=0x%02x lun=%llu\n",

@@ -901,7 +901,7 @@ static void requeue_cmd(struct Scsi_Host
 	struct NCR5380_hostdata *hostdata = shost_priv(instance);
 	struct NCR5380_cmd *ncmd = scsi_cmd_priv(cmd);
 
-	if (hostdata->sensing) {
+	if (hostdata->sensing == cmd) {
 		scsi_eh_restore_cmnd(cmd, &hostdata->ses);
 		list_add(&ncmd->list, &hostdata->autosense);
 		hostdata->sensing = NULL;

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Vitaly Kuznetsov <[email protected]>

commit ff06c5ffbcb4ffa542fb80c897be977956fafecc upstream.

Commit 3209f9d780d1 ("scsi: storvsc: Fix a bug in the handling of SRB status flags") filtered SRB_STATUS_AUTOSENSE_VALID out effectively making the (SRB_STATUS_ABORTED | SRB_STATUS_AUTOSENSE_VALID) case a dead code. The logic from this branch (e.g. storvsc_device_scan() call) is still required, fix the check.

---
 drivers/scsi/storvsc_drv.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

@@ -914,8 +914,9 @@ static void storvsc_handle_error(struct
 		do_work = true;
 		process_err_fn = storvsc_remove_lun;
 		break;
-	case (SRB_STATUS_ABORTED | SRB_STATUS_AUTOSENSE_VALID):
-		if ((asc == 0x2a) && (ascq == 0x9)) {
+	case SRB_STATUS_ABORTED:
+		if (vm_srb->srb_status & SRB_STATUS_AUTOSENSE_VALID &&
+		    (asc == 0x2a) && (ascq == 0x9)) {
 			do_work = true;
 			process_err_fn = storvsc_device_scan;
 			/*

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Maurizio Lombardi <[email protected]>

commit 84bd64993f916bcf86270c67686ecf4cea7b8933 upstream.

In beiscsi_setup_boot_info(), the boot_kset pointer should be set to NULL in case of failure otherwise an invalid pointer dereference may occur later.

---
 drivers/scsi/be2iscsi/be_main.c |    1 +
 1 file changed, 1 insertion(+)

@@ -4468,6 +4468,7 @@ put_shost:
 	scsi_host_put(phba->shost);
 free_kset:
 	iscsi_boot_destroy_kset(phba->boot_kset);
+	phba->boot_kset = NULL;
 	return -ENOMEM;
 }
 

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alan <[email protected]>

commit 5a51a7abca133860a6f4429655a9eda3c4afde32 upstream.

We were setting the queue depth correctly, then setting it back to two. If you hit this as a bisection point then please send me an email as it would imply we've been hiding other bugs with this one.

---
 drivers/scsi/aic7xxx/aic7xxx_osm.c |    1 +
 1 file changed, 1 insertion(+)

@@ -1336,6 +1336,7 @@ ahc_platform_set_tags(struct ahc_softc *
 	case AHC_DEV_Q_TAGGED:
 		scsi_change_queue_depth(sdev,
 				dev->openings + dev->active);
+		break;
 	default:
 		/*
 		 * We allow the OS to queue 2 untagged transactions to

4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jerry Hoemann <[email protected]>

commit 07accfa9d1a8bac8262f6d24a94a54d2d1f35149 upstream.

Code attempts to prevent certain IOCTL DSM from being called when device is opened read only. This security feature can be trivially overcome by changing the size portion of the ioctl_command which isn't used.

Check only the _IOC_NR (i.e. the command).

---
 drivers/nvdimm/bus.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

@@ -513,10 +513,10 @@ static int __nd_ioctl(struct nvdimm_bus
 
 	/* fail write commands (when read-only) */
 	if (read_only)
-		switch (ioctl_cmd) {
-		case ND_IOCTL_VENDOR:
-		case ND_IOCTL_SET_CONFIG_DATA:
-		case ND_IOCTL_ARS_START:
+		switch (cmd) {
+		case ND_CMD_VENDOR:
+		case ND_CMD_SET_CONFIG_DATA:
+		case ND_CMD_ARS_START:
 			dev_dbg(&nvdimm_bus->dev, "'%s' command while read-only.\n",
 					nvdimm ? nvdimm_cmd_name(cmd)
 					: nvdimm_bus_cmd_name(cmd));