4.1.11-stable review

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Marc Zyngier <[email protected]>

commit 688bc577ac42ae3d07c889a1f0a72f0b23763d58 upstream.

When running a guest with the architected timer disabled (with QEMU and the kernel_irqchip=off option, for example), it is important to make sure the timer gets turned off. Otherwise, the guest may try to enable it anyway, leading to a screaming HW interrupt.

The fix is to unconditionally turn off the virtual timer on guest exit.

---
 arch/arm/kvm/interrupts_head.S |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

@@ -518,8 +518,7 @@ ARM_BE8(rev	r6, r6  )
 
 	mrc	p15, 0, r2, c14, c3, 1	@ CNTV_CTL
 	str	r2, [vcpu, #VCPU_TIMER_CNTV_CTL]
-	bic	r2, #1			@ Clear ENABLE
-	mcr	p15, 0, r2, c14, c3, 1	@ CNTV_CTL
+
 	isb
 
 	mrrc	p15, 3, rr_lo_hi(r2, r3), c14	@ CNTV_CVAL

@@ -532,6 +531,9 @@ ARM_BE8(rev	r6, r6  )
 	mcrr	p15, 4, r2, r2, c14	@ CNTVOFF
 
 1:
+	mov	r2, #0			@ Clear ENABLE
+	mcr	p15, 0, r2, c14, c3, 1	@ CNTV_CTL
+
 	@ Allow physical timer/counter access for the host
 	mrc	p15, 4, r2, c14, c1, 0	@ CNTHCTL
 	orr	r2, r2, #(CNTHCTL_PL1PCEN | CNTHCTL_PL1PCTEN)

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Nicholas Bellinger <[email protected]>

This patch fixes a v4.1 only regression bug as reported by Martin where UNIT_ATTENTION checking for pre v4.2-rc1 RCU conversion code legacy se_node_acl->device_list[] was hitting a NULL pointer dereference in:

[ 1858.639654] CPU: 2 PID: 1293 Comm: kworker/2:1 Tainted: G          I 4.1.6-fixxcopy+ #1
[ 1858.639699] Hardware name: Dell Inc. PowerEdge R410/0N83VF, BIOS 1.11.0 07/20/2012
[ 1858.639747] Workqueue: xcopy_wq target_xcopy_do_work [target_core_mod]
[ 1858.639782] task: ffff880036f0cbe0 ti: ffff880317940000 task.ti: ffff880317940000
[ 1858.639822] RIP: 0010:[<ffffffffa01d3774>]  [<ffffffffa01d3774>] target_scsi3_ua_check+0x24/0x60 [target_core_mod]
[ 1858.639884] RSP: 0018:ffff880317943ce0  EFLAGS: 00010282
[ 1858.639913] RAX: 0000000000000000 RBX: ffff880317943dc0 RCX: 0000000000000000
[ 1858.639950] RDX: 0000000000000000 RSI: ffff880317943dd0 RDI: ffff88030eaee408
[ 1858.639987] RBP: ffff88030eaee408 R08: 0000000000000001 R09: 0000000000000001
[ 1858.640025] R10: 0000000000000000 R11: 00000000000706e0 R12: ffff880315e0a000
[ 1858.640062] R13: ffff88030eaee408 R14: 0000000000000001 R15: ffff88030eaee408
[ 1858.640100] FS:  0000000000000000(0000) GS:ffff880322e80000(0000) knlGS:0000000000000000
[ 1858.640143] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 1858.640173] CR2: 0000000000000000 CR3: 000000000180d000 CR4: 00000000000006e0
[ 1858.640210] Stack:
[ 1858.640223]  ffffffffa01cadfa ffff88030eaee400 ffff880318e7c340 ffff880315e0a000
[ 1858.640267]  ffffffffa01d8c25 ffff8800cae809e0 0000000000000400 0000000000000400
[ 1858.640310]  ffff880318e7c3d0 0000000006b75800 0000000000080000 ffff88030eaee400
[ 1858.640354] Call Trace:
[ 1858.640379]  [<ffffffffa01cadfa>] ? target_setup_cmd_from_cdb+0x13a/0x2c0 [target_core_mod]
[ 1858.640429]  [<ffffffffa01d8c25>] ? target_xcopy_setup_pt_cmd+0x85/0x320 [target_core_mod]
[ 1858.640479]  [<ffffffffa01d9424>] ? target_xcopy_do_work+0x264/0x700 [target_core_mod]
[ 1858.640526]  [<ffffffff810ac3a0>] ? pick_next_task_fair+0x720/0x8f0
[ 1858.640562]  [<ffffffff8108b3fb>] ? process_one_work+0x14b/0x430
[ 1858.640595]  [<ffffffff8108bf5b>] ? worker_thread+0x6b/0x560
[ 1858.640627]  [<ffffffff8108bef0>] ? rescuer_thread+0x390/0x390
[ 1858.640661]  [<ffffffff810913b3>] ? kthread+0xd3/0xf0
[ 1858.640689]  [<ffffffff810912e0>] ? kthread_create_on_node+0x180/0x180

Also, check for the same se_node_acl->device_list[] during EXTENDED_COPY operation as a non-holding persistent reservation port.

---
 drivers/target/target_core_pr.c |    3 +++
 drivers/target/target_core_ua.c |    8 ++++----
 2 files changed, 7 insertions(+), 4 deletions(-)

@@ -328,6 +328,9 @@ static int core_scsi3_pr_seq_non_holder(
 	int legacy = 0; /* Act like a legacy device and return
 			 * RESERVATION CONFLICT on some CDBs */
 
+	if (!se_sess->se_node_acl->device_list)
+		return;
+
 	se_deve = se_sess->se_node_acl->device_list[cmd->orig_fe_lun];
 	/*
 	 * Determine if the registration should be ignored due to

@@ -48,7 +48,7 @@ target_scsi3_ua_check(struct se_cmd *cmd
 		return 0;
 
 	nacl = sess->se_node_acl;
-	if (!nacl)
+	if (!nacl || !nacl->device_list)
 		return 0;
 
 	deve = nacl->device_list[cmd->orig_fe_lun];

@@ -90,7 +90,7 @@ int core_scsi3_ua_allocate(
 	/*
 	 * PASSTHROUGH OPS
 	 */
-	if (!nacl)
+	if (!nacl || !nacl->device_list)
 		return -EINVAL;
 
 	ua = kmem_cache_zalloc(se_ua_cache, GFP_ATOMIC);

@@ -208,7 +208,7 @@ void core_scsi3_ua_for_check_condition(
 		return;
 
 	nacl = sess->se_node_acl;
-	if (!nacl)
+	if (!nacl || !nacl->device_list)
 		return;
 
 	spin_lock_irq(&nacl->device_list_lock);

@@ -276,7 +276,7 @@ int core_scsi3_ua_clear_for_request_sens
 		return -EINVAL;
 
 	nacl = sess->se_node_acl;
-	if (!nacl)
+	if (!nacl || !nacl->device_list)
 		return -EINVAL;
 
 	spin_lock_irq(&nacl->device_list_lock);

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ard Biesheuvel <[email protected]>

commit a077224fd35b2f7fbc93f14cf67074fc792fbac2 upstream.

While working on the 32-bit ARM port of UEFI, I noticed a strange corruption in the kernel log. The following snprintf() statement (in drivers/firmware/efi/efi.c:efi_md_typeattr_format())

	snprintf(pos, size, "|%3s|%2s|%2s|%2s|%3s|%2s|%2s|%2s|%2s]",

was producing the following output in the log:

	|    |   |   |   |    |WB|WT|WC|UC]
	|    |   |   |   |    |WB|WT|WC|UC]
	|    |   |   |   |    |WB|WT|WC|UC]
	|RUN|   |   |   |    |WB|WT|WC|UC]*
	|RUN|   |   |   |    |WB|WT|WC|UC]*
	|    |   |   |   |    |WB|WT|WC|UC]
	|RUN|   |   |   |    |WB|WT|WC|UC]*
	|    |   |   |   |    |WB|WT|WC|UC]
	|RUN|   |   |   |    |   |   |   |UC]
	|RUN|   |   |   |    |   |   |   |UC]

As it turns out, this is caused by incorrect code being emitted for the string() function in lib/vsprintf.c. The following code

	if (!(spec.flags & LEFT)) {
		while (len < spec.field_width--) {
			if (buf < end)
				*buf = ' ';
			++buf;
		}
	}
	for (i = 0; i < len; ++i) {
		if (buf < end)
			*buf = *s;
		++buf; ++s;
	}
	while (len < spec.field_width--) {
		if (buf < end)
			*buf = ' ';
		++buf;
	}

when called with len == 0, triggers an issue in the GCC SRA optimization pass (Scalar Replacement of Aggregates), which handles promotion of signed struct members incorrectly. This is a known but as yet unresolved issue.
(https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65932). In this particular case, it is causing the second while loop to be executed erroneously a single time, causing the additional space characters to be printed.

So disable the optimization by passing -fno-ipa-sra.

---
 arch/arm/Makefile |    8 ++++++++
 1 file changed, 8 insertions(+)

@@ -50,6 +50,14 @@ AS		+= -EL
 LD		+= -EL
 endif
 
+#
+# The Scalar Replacement of Aggregates (SRA) optimization pass in GCC 4.9 and
+# later may result in code being generated that handles signed short and signed
+# char struct members incorrectly. So disable it.
+# (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65932)
+#
+KBUILD_CFLAGS	+= $(call cc-option,-fno-ipa-sra)
+
 # This selects which instruction set is used.
 # Note that GCC does not numerically define an architecture version
 # macro, but instead defines a whole series of macros which makes

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Doug Anderson <[email protected]>

commit 7ae85dc7687c7e7119053d83d02c560ea217b772 upstream.

In (23a4e40 arm: kgdb: Handle read-only text / modules) we moved to using patch_text() to set breakpoints so that we could handle the case when we had CONFIG_DEBUG_RODATA. That patch used patch_text(). Unfortunately, patch_text() assumes that we're not in atomic context when it runs since it needs to grab a mutex and also wait for other CPUs to stop (which it does with a completion).

This would result in a stack crawl if you had CONFIG_DEBUG_ATOMIC_SLEEP and tried to set a breakpoint in kgdb. The crawl looked something like:

 BUG: scheduling while atomic: swapper/0/0/0x00010007
 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.2.0-rc7-00133-geb63b34 #1073
 Hardware name: Rockchip (Device Tree)
  (unwind_backtrace) from [<c00133d4>] (show_stack+0x20/0x24)
  (show_stack) from [<c05400e8>] (dump_stack+0x84/0xb8)
  (dump_stack) from [<c004913c>] (__schedule_bug+0x54/0x6c)
  (__schedule_bug) from [<c054065c>] (__schedule+0x80/0x668)
  (__schedule) from [<c0540cfc>] (schedule+0xb8/0xd4)
  (schedule) from [<c0543a3c>] (schedule_timeout+0x2c/0x234)
  (schedule_timeout) from [<c05417c0>] (wait_for_common+0xf4/0x188)
  (wait_for_common) from [<c0541874>] (wait_for_completion+0x20/0x24)
  (wait_for_completion) from [<c00a0104>] (__stop_cpus+0x58/0x70)
  (__stop_cpus) from [<c00a0580>] (stop_cpus+0x3c/0x54)
  (stop_cpus) from [<c00a06c4>] (__stop_machine+0xcc/0xe8)
  (__stop_machine) from [<c00a0714>] (stop_machine+0x34/0x44)
  (stop_machine) from [<c00173e8>] (patch_text+0x28/0x34)
  (patch_text) from [<c001733c>] (kgdb_arch_set_breakpoint+0x40/0x4c)
  (kgdb_arch_set_breakpoint) from [<c00a0d68>] (kgdb_validate_break_address+0x2c/0x60)
  (kgdb_validate_break_address) from [<c00a0e90>] (dbg_set_sw_break+0x1c/0xdc)
  (dbg_set_sw_break) from [<c00a2e88>] (gdb_serial_stub+0x9c4/0xba4)
  (gdb_serial_stub) from [<c00a11cc>] (kgdb_cpu_enter+0x1f8/0x60c)
  (kgdb_cpu_enter) from [<c00a18cc>] (kgdb_handle_exception+0x19c/0x1d0)
  (kgdb_handle_exception) from [<c0016f7c>] (kgdb_compiled_brk_fn+0x30/0x3c)
  (kgdb_compiled_brk_fn) from [<c00091a4>] (do_undefinstr+0x1a4/0x20c)
  (do_undefinstr) from [<c001400c>] (__und_svc_finish+0x0/0x34)

It turns out that when we're in kgdb all the CPUs are stopped anyway so there's no reason we should be calling patch_text(). We can instead directly call __patch_text() which assumes that CPUs have already been stopped.

---
 arch/arm/kernel/kgdb.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

@@ -259,15 +259,17 @@ int kgdb_arch_set_breakpoint(struct kgdb
 	if (err)
 		return err;
 
-	patch_text((void *)bpt->bpt_addr,
-		   *(unsigned int *)arch_kgdb_ops.gdb_bpt_instr);
+	/* Machine is already stopped, so we can use __patch_text() directly */
+	__patch_text((void *)bpt->bpt_addr,
+		     *(unsigned int *)arch_kgdb_ops.gdb_bpt_instr);
 
 	return err;
 }
 
 int kgdb_arch_remove_breakpoint(struct kgdb_bkpt *bpt)
 {
-	patch_text((void *)bpt->bpt_addr, *(unsigned int *)bpt->saved_instr);
+	/* Machine is already stopped, so we can use __patch_text() directly */
+	__patch_text((void *)bpt->bpt_addr, *(unsigned int *)bpt->saved_instr);
 
 	return 0;
 }

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Grazvydas Ignotas <[email protected]>

commit 1dbdad75074d16c3e3005180f81a01cdc04a7872 upstream.

The i2c5 pinctrl offsets are wrong. If the bootloader doesn't set the pins up, communication with tca6424a doesn't work (controller timeouts) and it is not possible to enable HDMI.

---
 arch/arm/boot/dts/omap5-uevm.dts |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -174,8 +174,8 @@
 
 	i2c5_pins: pinmux_i2c5_pins {
 		pinctrl-single,pins = <
-			0x184 (PIN_INPUT | MUX_MODE0)		/* i2c5_scl */
-			0x186 (PIN_INPUT | MUX_MODE0)		/* i2c5_sda */
+			0x186 (PIN_INPUT | MUX_MODE0)		/* i2c5_scl */
+			0x188 (PIN_INPUT | MUX_MODE0)		/* i2c5_sda */
 		>;
 	};
 

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andy Lutomirski <[email protected]>

commit 83c133cf11fb0e68a51681447e372489f052d40e upstream.

The NMI entry code that switches to the normal kernel stack needs to be very careful not to clobber any extra stack slots on the NMI stack. The code is fine under the assumption that SWAPGS is just a normal instruction, but that assumption isn't really true. Use SWAPGS_UNSAFE_STACK instead.

This is part of a fix for some random crashes that Sasha saw.

---
 arch/x86/kernel/entry_64.S |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

@@ -1456,9 +1456,12 @@ ENTRY(nmi)
 	 * we don't want to enable interrupts, because then we'll end
 	 * up in an awkward situation in which IRQs are on but NMIs
 	 * are off.
+	 *
+	 * We also must not push anything to the stack before switching
+	 * stacks lest we corrupt the "NMI executing" variable.
 	 */
 
-	SWAPGS
+	SWAPGS_UNSAFE_STACK
 	cld
 	movq	%rsp, %rdx
 	movq	PER_CPU_VAR(kernel_stack), %rsp

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: =?UTF-8?q?Dirk=20M=C3=BCller?= <[email protected]>

commit d2922422c48df93f3edff7d872ee4f3191fefb08 upstream.

The cpu feature flags are not ever going to change, so warning everytime can cause a lot of kernel log spam
(in our case more than 10GB/hour).

The warning seems to only occur when nested virtualization is enabled, so it's probably triggered by a KVM bug. This is a sensible and safe change anyway, and the KVM bug fix might not be suitable for stable releases anyway.

---
 arch/x86/kvm/svm.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -512,7 +512,7 @@ static void skip_emulated_instruction(st
 	struct vcpu_svm *svm = to_svm(vcpu);
 
 	if (svm->vmcb->control.next_rip != 0) {
-		WARN_ON(!static_cpu_has(X86_FEATURE_NRIPS));
+		WARN_ON_ONCE(!static_cpu_has(X86_FEATURE_NRIPS));
 		svm->next_rip = svm->vmcb->control.next_rip;
 	}
 

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Martin Schwidefsky <[email protected]>

commit 8d4bd0ed0439dfc780aab801a085961925ed6838 upstream.

The uc_sigmask in the ucontext structure is an array of words to keep the 64 signal bits (or 1024 if you ask glibc but the kernel sigset_t only has 64 bits).

For 64 bit the sigset_t contains a single 8 byte word, but for 31 bit there are two 4 byte words. The compat signal handler code uses a simple copy of the 64 bit sigset_t to the 31 bit compat_sigset_t. As s390 is a big-endian architecture this is incorrect, the two words in the 31 bit sigset_t array need to be swapped.

---
 arch/s390/kernel/compat_signal.c |   27 +++++++++++++++++++++++----
 1 file changed, 23 insertions(+), 4 deletions(-)

@@ -48,6 +48,19 @@ typedef struct
 	struct ucontext32 uc;
 } rt_sigframe32;
 
+static inline void sigset_to_sigset32(unsigned long *set64,
+				      compat_sigset_word *set32)
+{
+	set32[0] = (compat_sigset_word) set64[0];
+	set32[1] = (compat_sigset_word)(set64[0] >> 32);
+}
+
+static inline void sigset32_to_sigset(compat_sigset_word *set32,
+				      unsigned long *set64)
+{
+	set64[0] = (unsigned long) set32[0] | ((unsigned long) set32[1] << 32);
+}
+
 int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from)
 {
 	int err;

@@ -303,10 +316,12 @@ COMPAT_SYSCALL_DEFINE0(sigreturn)
 {
 	struct pt_regs *regs = task_pt_regs(current);
 	sigframe32 __user *frame = (sigframe32 __user *)regs->gprs[15];
+	compat_sigset_t cset;
 	sigset_t set;
 
-	if (__copy_from_user(&set.sig, &frame->sc.oldmask, _SIGMASK_COPY_SIZE32))
+	if (__copy_from_user(&cset.sig, &frame->sc.oldmask, _SIGMASK_COPY_SIZE32))
 		goto badframe;
+	sigset32_to_sigset(cset.sig, set.sig);
 	set_current_blocked(&set);
 	if (restore_sigregs32(regs, &frame->sregs))
 		goto badframe;

@@ -323,10 +338,12 @@ COMPAT_SYSCALL_DEFINE0(rt_sigreturn)
 {
 	struct pt_regs *regs = task_pt_regs(current);
 	rt_sigframe32 __user *frame = (rt_sigframe32 __user *)regs->gprs[15];
+	compat_sigset_t cset;
 	sigset_t set;
 
-	if (__copy_from_user(&set, &frame->uc.uc_sigmask, sizeof(set)))
+	if (__copy_from_user(&cset, &frame->uc.uc_sigmask, sizeof(cset)))
 		goto badframe;
+	sigset32_to_sigset(cset.sig, set.sig);
 	set_current_blocked(&set);
 	if (compat_restore_altstack(&frame->uc.uc_stack))
 		goto badframe;

@@ -397,7 +414,7 @@ static int setup_frame32(struct ksignal
 		return -EFAULT;
 
 	/* Create struct sigcontext32 on the signal stack */
-	memcpy(&sc.oldmask, &set->sig, _SIGMASK_COPY_SIZE32);
+	sigset_to_sigset32(set->sig, sc.oldmask);
 	sc.sregs = (__u32)(unsigned long __force) &frame->sregs;
 	if (__copy_to_user(&frame->sc, &sc, sizeof(frame->sc)))
 		return -EFAULT;

@@ -458,6 +475,7 @@ static int setup_frame32(struct ksignal
 static int setup_rt_frame32(struct ksignal *ksig, sigset_t *set,
 			    struct pt_regs *regs)
 {
+	compat_sigset_t cset;
 	rt_sigframe32 __user *frame;
 	unsigned long restorer;
 	size_t frame_size;

@@ -505,11 +523,12 @@ static int setup_rt_frame32(struct ksign
 	store_sigregs();
 
 	/* Create ucontext on the signal stack. */
+	sigset_to_sigset32(set->sig, cset.sig);
 	if (__put_user(uc_flags, &frame->uc.uc_flags) ||
 	    __put_user(0, &frame->uc.uc_link) ||
 	    __compat_save_altstack(&frame->uc.uc_stack, regs->gprs[15]) ||
 	    save_sigregs32(regs, &frame->uc.uc_mcontext) ||
-	    __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set)) ||
+	    __copy_to_user(&frame->uc.uc_sigmask, &cset, sizeof(cset)) ||
 	    save_sigregs_ext32(regs, &frame->uc.uc_mcontext_ext))
 		return -EFAULT;
 

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christian Borntraeger <[email protected]>

commit adc0b7fbf6fe9967505c0254d9535ec7288186ae upstream.

my gcc 5.1 used an ldgr instruction with a register != 0,2,4,6 for spilling/filling into a floating point register in our decompressor.

This will cause an AFP-register data exception as the decompressor did not setup the additional floating point registers via cr0. That causes a program check loop that looked like a hang with one "Uncompressing Linux... " message (directly booted via kvm) or a loop of "Uncompressing Linux... " messages (when booted via zipl boot loader).

The offending code in my build was

   48e400:       e3 c0 af ff ff 71       lay     %r12,-1(%r10)
-->48e406:       b3 c1 00 1c             ldgr    %f1,%r12
   48e40a:       ec 6c 01 22 02 7f       clij    %r6,2,12,0x48e64e

but gcc could do spilling into an fpr at any function. We can simply disable floating point support at that early stage.

---
 arch/s390/boot/compressed/Makefile |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -10,7 +10,7 @@ targets += misc.o piggy.o sizes.h head.o
 
 KBUILD_CFLAGS := -m64 -D__KERNEL__ $(LINUX_INCLUDE) -O2
 KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING
-KBUILD_CFLAGS += $(cflags-y) -fno-delete-null-pointer-checks
+KBUILD_CFLAGS += $(cflags-y) -fno-delete-null-pointer-checks -msoft-float
 KBUILD_CFLAGS += $(call cc-option,-mpacked-stack)
 KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
 

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Guenter Roeck <[email protected]>

commit a394d635193b641f2c86ead5ada5b115d57c51f8 upstream.

Actually, spi_master_put() after spi_alloc_master() must _not_ be followed by kfree(). The memory is already freed with the call to spi_master_put() through spi_master_class, which registers a release function. Calling both spi_master_put() and kfree() results in often nasty (and delayed) crashes elsewhere in the kernel, often in the networking stack.

This reverts commit eb4af0f5349235df2e4a5057a72fc8962d00308a.

Link to patch and concerns: https://lkml.org/lkml/2012/9/3/269
or
http://lkml.iu.edu/hypermail/linux/kernel/1209.0/00790.html

Alexey Klimov: This revert becomes valid after 94c69f765f1b4a658d96905ec59928e3e3e07e6a when spi-imx.c has been fixed and there is no need to call kfree() so comment for spi_alloc_master() should be fixed.

---
 drivers/spi/spi.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

@@ -1427,8 +1427,7 @@ static struct class spi_master_class = {
  *
  * The caller is responsible for assigning the bus number and initializing
  * the master's methods before calling spi_register_master(); and (after errors
- * adding the device) calling spi_master_put() and kfree() to prevent a memory
- * leak.
+ * adding the device) calling spi_master_put() to prevent a memory leak.
  */
 struct spi_master *spi_alloc_master(struct device *dev, unsigned size)
 {

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: "Tan, Jui Nee" <[email protected]>

commit 02bc933ebb59208f42c2e6305b2c17fd306f695d upstream.

On Intel Baytrail, there is case when interrupt handler get called, no SPI message is captured. The RX FIFO is indeed empty when RX timeout pending interrupt (SSSR_TINT) happens.

Use the BIOS version where both HSUART and SPI are on the same IRQ. Both drivers are using IRQF_SHARED when calling the request_irq function. When running two separate and independent SPI and HSUART application that generate data traffic on both components, user will see messages like below on the console:

pxa2xx-spi pxa2xx-spi.0: bad message state in interrupt handler

This commit will fix this by first checking Receiver Time-out Interrupt, if it is disabled, ignore the request and return without servicing.

---
 drivers/spi/spi-pxa2xx.c |    4 ++++
 1 file changed, 4 insertions(+)

@@ -624,6 +624,10 @@ static irqreturn_t ssp_int(int irq, void
 	if (!(sccr1_reg & SSCR1_TIE))
 		mask &= ~SSSR_TFS;
 
+	/* Ignore RX timeout interrupt if it is disabled */
+	if (!(sccr1_reg & SSCR1_TINTE))
+		mask &= ~SSSR_TINT;
+
 	if (!(status & mask))
 		return IRQ_NONE;
 

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Laura Abbott <[email protected]>

commit d05ea7da0e8f6df3c62cfee75538f347cb3d89ef upstream.

Much like all the other Lenovo laptops, add a quirk to make sound work with docking.

---
 sound/pci/hda/patch_realtek.c |    1 +
 1 file changed, 1 insertion(+)

@@ -5233,6 +5233,7 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x17aa, 0x2212, "Thinkpad T440", ALC292_FIXUP_TPT440_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x2214, "Thinkpad X240", ALC292_FIXUP_TPT440_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x2215, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+	SND_PCI_QUIRK(0x17aa, 0x2223, "ThinkPad T550", ALC292_FIXUP_TPT440_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
 	SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: John Flatness <[email protected]>

commit e8ff581f7ac2bc3b8886094b7ca635dcc4d1b0e9 upstream.

The MacBookPro 12,1 has the same setup as the 11 for controlling the status of the optical audio light. Simply apply the existing workaround to the subsystem ID for the 12,1.

[sorted the fixup entry by tiwai]

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=105401

---
 sound/pci/hda/patch_cirrus.c |    1 +
 1 file changed, 1 insertion(+)

@@ -634,6 +634,7 @@ static const struct snd_pci_quirk cs4208
 	SND_PCI_QUIRK(0x106b, 0x5e00, "MacBookPro 11,2", CS4208_MBP11),
 	SND_PCI_QUIRK(0x106b, 0x7100, "MacBookAir 6,1", CS4208_MBA6),
 	SND_PCI_QUIRK(0x106b, 0x7200, "MacBookAir 6,2", CS4208_MBA6),
+	SND_PCI_QUIRK(0x106b, 0x7b00, "MacBookPro 12,1", CS4208_MBP11),
 	{} /* terminator */
 };
 

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mike Snitzer <[email protected]>

commit 586b286b110e94eb31840ac5afc0c24e0881fe34 upstream.

Setting the dm-crypt device's max_segment_size to PAGE_SIZE is an unfortunate constraint that is required to avoid the potential for exceeding dm-crypt's underlying device's max_segments limits -- due to crypt_alloc_buffer() possibly allocating pages for the encryption bio that are not as physically contiguous as the original bio.

It is interesting to note that this problem was already fixed back in 2007 via commit 91e106259 ("dm crypt: use bio_add_page"). But Linux 4.0 commit cf2f1abfb ("dm crypt: don't allocate pages for a partial request") regressed dm-crypt back to _not_ using bio_add_page(). But given dm-crypt's cpu parallelization changes all depend on commit cf2f1abfb's abandoning of the more complex io fragments processing that dm-crypt previously had we cannot easily go back to using bio_add_page().

So all said the cleanest way to resolve this issue is to fix dm-crypt to properly constrain the original bios entering dm-crypt so the encryption bios that dm-crypt generates from the original bios are always compatible with the underlying device's max_segments queue limits.

It should be noted that technically Linux 4.3 does _not_ need this fix because of the block core's new late bio-splitting capability. But, it is reasoned, there is little to be gained by having the block core split the encrypted bio that is composed of PAGE_SIZE segments. That said, in the future we may revert this change.

---
 drivers/md/dm-crypt.c |   17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

@@ -955,7 +955,8 @@ static void crypt_free_buffer_pages(stru
 
 /*
  * Generate a new unfragmented bio with the given size
- * This should never violate the device limitations
+ * This should never violate the device limitations (but only because
+ * max_segment_size is being constrained to PAGE_SIZE).
  *
  * This function may be called concurrently. If we allocate from the mempool
  * concurrently, there is a possibility of deadlock. For example, if we have

@@ -2040,9 +2041,20 @@ static int crypt_iterate_devices(struct
 	return fn(ti, cc->dev, cc->start, ti->len, data);
 }
 
+static void crypt_io_hints(struct dm_target *ti, struct queue_limits *limits)
+{
+	/*
+	 * Unfortunate constraint that is required to avoid the potential
+	 * for exceeding underlying device's max_segments limits -- due to
+	 * crypt_alloc_buffer() possibly allocating pages for the encryption
+	 * bio that are not as physically contiguous as the original bio.
+	 */
+	limits->max_segment_size = PAGE_SIZE;
+}
+
 static struct target_type crypt_target = {
 	.name   = "crypt",
-	.version = {1, 14, 0},
+	.version = {1, 14, 1},
 	.module = THIS_MODULE,
 	.ctr    = crypt_ctr,
 	.dtr    = crypt_dtr,

@@ -2054,6 +2066,7 @@ static struct target_type crypt_target =
 	.message = crypt_message,
 	.merge  = crypt_merge,
 	.iterate_devices = crypt_iterate_devices,
+	.io_hints = crypt_io_hints,
 };
 
 static int __init dm_crypt_init(void)

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: "Liu.Zhao" <[email protected]>

commit 19ab6bc5674a30fdb6a2436b068d19a3c17dc73e upstream.

This is intended to add ZTE device PIDs on kernel.

---
 drivers/usb/serial/option.c |   24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

@@ -278,6 +278,10 @@ static void option_instat_callback(struc
 #define ZTE_PRODUCT_MF622			0x0001
 #define ZTE_PRODUCT_MF628			0x0015
 #define ZTE_PRODUCT_MF626			0x0031
+#define ZTE_PRODUCT_ZM8620_X			0x0396
+#define ZTE_PRODUCT_ME3620_MBIM			0x0426
+#define ZTE_PRODUCT_ME3620_X			0x1432
+#define ZTE_PRODUCT_ME3620_L			0x1433
 #define ZTE_PRODUCT_AC2726			0xfff1
 #define ZTE_PRODUCT_MG880			0xfffd
 #define ZTE_PRODUCT_CDMA_TECH			0xfffe

@@ -544,6 +548,18 @@ static const struct option_blacklist_inf
 	.sendsetup = BIT(1) | BIT(2) | BIT(3),
 };
 
+static const struct option_blacklist_info zte_me3620_mbim_blacklist = {
+	.reserved = BIT(2) | BIT(3) | BIT(4),
+};
+
+static const struct option_blacklist_info zte_me3620_xl_blacklist = {
+	.reserved = BIT(3) | BIT(4) | BIT(5),
+};
+
+static const struct option_blacklist_info zte_zm8620_x_blacklist = {
+	.reserved = BIT(3) | BIT(4) | BIT(5),
+};
+
 static const struct option_blacklist_info huawei_cdc12_blacklist = {
 	.reserved = BIT(1) | BIT(2),
 };

@@ -1591,6 +1607,14 @@ static const struct usb_device_id option
 	 .driver_info = (kernel_ulong_t)&zte_ad3812_z_blacklist },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2716, 0xff, 0xff, 0xff),
 	 .driver_info = (kernel_ulong_t)&zte_mc2716_z_blacklist },
+	{ USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ME3620_L),
+	 .driver_info = (kernel_ulong_t)&zte_me3620_xl_blacklist },
+	{ USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ME3620_MBIM),
+	 .driver_info = (kernel_ulong_t)&zte_me3620_mbim_blacklist },
+	{ USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ME3620_X),
+	 .driver_info = (kernel_ulong_t)&zte_me3620_xl_blacklist },
+	{ USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ZM8620_X),
+	 .driver_info = (kernel_ulong_t)&zte_zm8620_x_blacklist },
 	{ USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) },
 	{ USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) },
 	{ USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) },

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: NeilBrown <[email protected]>

commit 199dc6ed5179251fa6158a461499c24bdd99c836 upstream.

When a (e.g.) RAID5 array is reshaped to RAID0, the updating of queue parameters (e.g. max number of sectors per bio) is done in the wrong place.
It should be part of ->run, but it is actually part of ->takeover. This means it happens before level_store() calls:

	blk_set_stacking_limits(&mddev->queue->limits);

and so it ineffective. This can lead to errors from underlying devices.

So move all the relevant settings out of create_stripe_zones() and into raid0_run().

As this can lead to a bug-on it is suitable for any -stable kernel which supports reshape to RAID0. So 2.6.35 or later. As the bug has been present for five years there is no urgency, so no need to rush into -stable.

---
 drivers/md/raid0.c |   75 +++++++++++++++++++++++++++--------------------------
 1 file changed, 39 insertions(+), 36 deletions(-)

@@ -83,7 +83,7 @@ static int create_strip_zones(struct mdd
 	char b[BDEVNAME_SIZE];
 	char b2[BDEVNAME_SIZE];
 	struct r0conf *conf = kzalloc(sizeof(*conf), GFP_KERNEL);
-	bool discard_supported = false;
+	unsigned short blksize = 512;
 
 	if (!conf)
 		return -ENOMEM;

@@ -98,6 +98,9 @@ static int create_strip_zones(struct mdd
 		sector_div(sectors, mddev->chunk_sectors);
 		rdev1->sectors = sectors * mddev->chunk_sectors;
 
+		blksize = max(blksize, queue_logical_block_size(
+				      rdev1->bdev->bd_disk->queue));
+
 		rdev_for_each(rdev2, mddev) {
 			pr_debug("md/raid0:%s:   comparing %s(%llu)"
 				 " with %s(%llu)\n",

@@ -134,6 +137,18 @@ static int create_strip_zones(struct mdd
 	}
 	pr_debug("md/raid0:%s: FINAL %d zones\n",
 		 mdname(mddev), conf->nr_strip_zones);
+	/*
+	 * now since we have the hard sector sizes, we can make sure
+	 * chunk size is a multiple of that sector size
+	 */
+	if ((mddev->chunk_sectors << 9) % blksize) {
+		printk(KERN_ERR "md/raid0:%s: chunk_size of %d not multiple of block size %d\n",
+		       mdname(mddev),
+		       mddev->chunk_sectors << 9, blksize);
+		err = -EINVAL;
+		goto abort;
+	}
+
 	err = -ENOMEM;
 	conf->strip_zone = kzalloc(sizeof(struct strip_zone)*
 				conf->nr_strip_zones, GFP_KERNEL);

@@ -188,19 +203,12 @@ static int create_strip_zones(struct mdd
 		}
 		dev[j] = rdev1;
 
-		if (mddev->queue)
-			disk_stack_limits(mddev->gendisk, rdev1->bdev,
-					  rdev1->data_offset << 9);
-
 		if (rdev1->bdev->bd_disk->queue->merge_bvec_fn)
 			conf->has_merge_bvec = 1;
 
 		if (!smallest || (rdev1->sectors < smallest->sectors))
 			smallest = rdev1;
 		cnt++;
-
-		if (blk_queue_discard(bdev_get_queue(rdev1->bdev)))
-			discard_supported = true;
 	}
 	if (cnt != mddev->raid_disks) {
 		printk(KERN_ERR "md/raid0:%s: too few disks (%d of %d) - "

@@ -261,28 +269,6 @@ static int create_strip_zones(struct mdd
 			 (unsigned long long)smallest->sectors);
 	}
 
-	/*
-	 * now since we have the hard sector sizes, we can make sure
-	 * chunk size is a multiple of that sector size
-	 */
-	if ((mddev->chunk_sectors << 9) % queue_logical_block_size(mddev->queue)) {
-		printk(KERN_ERR "md/raid0:%s: chunk_size of %d not valid\n",
-		       mdname(mddev),
-		       mddev->chunk_sectors << 9);
-		goto abort;
-	}
-
-	if (mddev->queue) {
-		blk_queue_io_min(mddev->queue, mddev->chunk_sectors << 9);
-		blk_queue_io_opt(mddev->queue,
-				 (mddev->chunk_sectors << 9) * mddev->raid_disks);
-
-		if (!discard_supported)
-			queue_flag_clear_unlocked(QUEUE_FLAG_DISCARD, mddev->queue);
-		else
-			queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, mddev->queue);
-	}
-
 	pr_debug("md/raid0:%s: done.\n", mdname(mddev));
 	*private_conf = conf;
 

@@ -433,12 +419,6 @@ static int raid0_run(struct mddev *mddev
 	if (md_check_no_bitmap(mddev))
 		return -EINVAL;
 
-	if (mddev->queue) {
-		blk_queue_max_hw_sectors(mddev->queue, mddev->chunk_sectors);
-		blk_queue_max_write_same_sectors(mddev->queue, mddev->chunk_sectors);
-		blk_queue_max_discard_sectors(mddev->queue, mddev->chunk_sectors);
-	}
-
 	/* if private is not null, we are here after takeover */
 	if (mddev->private == NULL) {
 		ret = create_strip_zones(mddev, &conf);

@@ -447,6 +427,29 @@ static int raid0_run(struct mddev *mddev
 		mddev->private = conf;
 	}
 	conf = mddev->private;
+	if (mddev->queue) {
+		struct md_rdev *rdev;
+		bool discard_supported = false;
+
+		rdev_for_each(rdev, mddev) {
+			disk_stack_limits(mddev->gendisk, rdev->bdev,
+					  rdev->data_offset << 9);
+			if (blk_queue_discard(bdev_get_queue(rdev->bdev)))
+				discard_supported = true;
+		}
+		blk_queue_max_hw_sectors(mddev->queue, mddev->chunk_sectors);
+		blk_queue_max_write_same_sectors(mddev->queue, mddev->chunk_sectors);
+		blk_queue_max_discard_sectors(mddev->queue, mddev->chunk_sectors);
+
+		blk_queue_io_min(mddev->queue, mddev->chunk_sectors << 9);
+		blk_queue_io_opt(mddev->queue,
+				 (mddev->chunk_sectors << 9) * mddev->raid_disks);
+
+		if (!discard_supported)
+			queue_flag_clear_unlocked(QUEUE_FLAG_DISCARD, mddev->queue);
+		else
+			queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, mddev->queue);
+	}
 
 	/* calculate array device size */
 	md_set_array_sectors(mddev, raid0_size(mddev, 0, 0));

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: "Eric W. Biederman" <[email protected]>

commit fdab6a4cbd8933092155449ca7253eba973ada14 upstream.

Currenlty nf_tables chains added in one network namespace are being run in all network namespace. The issues are myriad with the simplest being an unprivileged user can cause any network packets to be dropped.

Address this by simply not running nf_tables chains in the wrong network namespace.

---
 net/netfilter/nf_tables_core.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

@@ -114,7 +114,8 @@ unsigned int
 nft_do_chain(struct nft_pktinfo *pkt, const struct nf_hook_ops *ops)
 {
 	const struct nft_chain *chain = ops->priv, *basechain = chain;
-	const struct net *net = read_pnet(&nft_base_chain(basechain)->pnet);
+	const struct net *chain_net = read_pnet(&nft_base_chain(basechain)->pnet);
+	const struct net *net = dev_net(pkt->in ? pkt->in : pkt->out);
 	const struct nft_rule *rule;
 	const struct nft_expr *expr, *last;
 	struct nft_regs regs;

@@ -124,6 +125,10 @@ nft_do_chain(struct nft_pktinfo *pkt, co
 	int rulenum;
 	unsigned int gencursor = nft_genmask_cur(net);
 
+	/* Ignore chains that are not for the current network namespace */
+	if (!net_eq(net, chain_net))
+		return NF_ACCEPT;
+
 do_chain:
 	rulenum = 0;
 	rule = list_entry(&chain->rules, struct nft_rule, list);

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hedberg <[email protected]>

commit d8949aad3eab5d396f4fefcd581773bf07b9a79e upstream.

There are several actions that smp_conn_security() might make that do not require a valid SMP context (conn->smp pointer). One of these actions is to encrypt the link with an existing LTK. If the SMP context wasn't initialized properly we should still allow the independent actions to be done, i.e. the check for the context should only be done at the last possible moment.

---
 net/bluetooth/smp.c |   12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

@@ -2294,12 +2294,6 @@ int smp_conn_security(struct hci_conn *h
 	if (!conn)
 		return 1;
 
-	chan = conn->smp;
-	if (!chan) {
-		BT_ERR("SMP security requested but not available");
-		return 1;
-	}
-
 	if (!hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED))
 		return 1;
 

@@ -2313,6 +2307,12 @@ int smp_conn_security(struct hci_conn *h
 		if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
 			return 0;
 
+	chan = conn->smp;
+	if (!chan) {
+		BT_ERR("SMP security requested but not available");
+		return 1;
+	}
+
 	l2cap_chan_lock(chan);
 
 	/* If SMP is already in progress ignore this request */

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mathias Nyman <[email protected]>

commit a6809ffd1687b3a8c192960e69add559b9d32649 upstream.

We want to give the command abortion an additional try to stop the command ring before we completely hose xhci.

---
 drivers/usb/host/xhci-ring.c |    9 +++++++++
 1 file changed, 9 insertions(+)

@@ -302,6 +302,15 @@ static int xhci_abort_cmd_ring(struct xh
 	ret = xhci_handshake(&xhci->op_regs->cmd_ring,
 			CMD_RING_RUNNING, 0, 5 * 1000 * 1000);
 	if (ret < 0) {
+		/* we are about to kill xhci, give it one more chance */
+		xhci_write_64(xhci, temp_64 | CMD_RING_ABORT,
+			      &xhci->op_regs->cmd_ring);
+		udelay(1000);
+		ret = xhci_handshake(&xhci->op_regs->cmd_ring,
+				     CMD_RING_RUNNING, 0, 3 * 1000 * 1000);
+		if (ret == 0)
+			return 0;
+
 		xhci_err(xhci, "Stopped the command ring failed, "
 				"maybe the host is dead\n");
 		xhci->xhc_state |= XHCI_STATE_DYING;

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Roger Quadros <[email protected]>

commit 85ac90f8953a58f6a057b727bc9db97721e3fb8e upstream.

Else it races with xhci_setup_device

---
 drivers/usb/host/xhci.c |    4 ++++
 1 file changed, 4 insertions(+)

@@ -683,8 +683,11 @@ void xhci_stop(struct usb_hcd *hcd)
 	u32 temp;
 	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
 
+	mutex_lock(&xhci->mutex);
+
 	if (!usb_hcd_is_primary_hcd(hcd)) {
 		xhci_only_stop_hcd(xhci->shared_hcd);
+		mutex_unlock(&xhci->mutex);
 		return;
 	}
 

@@ -723,6 +726,7 @@ void xhci_stop(struct usb_hcd *hcd)
 	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
 			"xhci_stop completed - status = %x",
 			readl(&xhci->op_regs->status));
+	mutex_unlock(&xhci->mutex);
 }
 
 /*

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Roger Quadros <[email protected]>

commit e5bfeab0ad515b4f6df39fe716603e9dc6d3dfd0 upstream.

For whatever reason if XHCI died in the previous instant then it will never recover on the next xhci_start unless we clear the DYING flag.

---
 drivers/usb/host/xhci.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -146,7 +146,8 @@ static int xhci_start(struct xhci_hcd *x
 				"waited %u microseconds.\n",
 				XHCI_MAX_HALT_USEC);
 	if (!ret)
-		xhci->xhc_state &= ~XHCI_STATE_HALTED;
+		xhci->xhc_state &= ~(XHCI_STATE_HALTED | XHCI_STATE_DYING);
+
 	return ret;
 }
 

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Roger Quadros <[email protected]>

commit 448116bfa856d3c076fa7178ed96661a008a5d45 upstream.

During quick plug/removal of OTG adapter during dual-role testing it can happen that xhci_alloc_device() is called for the newly detected device after the DRD library has called xhci_stop to remove the HCD.

If that is the case, just fail early to prevent the following warning.

[  154.732649] hub 4-0:1.0: USB hub found
[  154.742204] hub 4-0:1.0: 1 port detected
[  154.824458] hub 3-0:1.0: state 7 ports 1 chg 0002 evt 0000
[  154.854609] hub 4-0:1.0: state 7 ports 1 chg 0000 evt 0000
[  154.944430] usb 3-1: new high-speed USB device number 2 using xhci-hcd
[  154.951009] xhci-hcd xhci-hcd.0.auto: xhci_setup_device
[  155.038191] xhci-hcd xhci-hcd.0.auto: remove, state 4
[  155.043315] usb usb4: USB disconnect, device number 1
[  155.055270] xhci-hcd xhci-hcd.0.auto: xhci_stop
[  155.060094] xhci-hcd xhci-hcd.0.auto: USB bus 4 deregistered
[  155.066576] xhci-hcd xhci-hcd.0.auto: remove, state 1
[  155.071710] usb usb3: USB disconnect, device number 1
[  155.077124] xhci-hcd xhci-hcd.0.auto: xhci_setup_device
[  155.082389] ------------[ cut here ]------------
[  155.087690] WARNING: CPU: 0 PID: 72 at drivers/usb/host/xhci.c:3800 xhci_setup_device+0x410/0x484 [xhci_hcd]()
[  155.097861] Modules linked in: sd_mod usb_storage scsi_mod usb_f_ss_lb g_zero libcomposite ipv6 xhci_plat_hcd xhci_hcd usbcore dwc3 udc_core evdev ti_am335x_adc joydev kfifo_buf industrialio snd_soc_simple_cc
[  155.146734] CPU: 0 PID: 72 Comm: kworker/0:3 Tainted: G        W       4.1.4-00834-gcd9380b-dirty #50
[  155.156073] Hardware name: Generic AM43 (Flattened Device Tree)
[  155.162117] Workqueue: usb_hub_wq hub_event [usbcore]
[  155.167249] Backtrace:
[  155.169751] [<c0012af0>] (dump_backtrace) from [<c0012c8c>] (show_stack+0x18/0x1c)
[  155.177390]  r6:c089d4a4 r5:ffffffff r4:00000000 r3:ee46c000
[  155.183137] [<c0012c74>] (show_stack) from [<c05f7c14>] (dump_stack+0x84/0xd0)
[  155.190446] [<c05f7b90>] (dump_stack) from [<c00439ac>] (warn_slowpath_common+0x80/0xbc)
[  155.198605]  r7:00000009 r6:00000ed8 r5:bf27eb70 r4:00000000
[  155.204348] [<c004392c>] (warn_slowpath_common) from [<c0043a0c>] (warn_slowpath_null+0x24/0x2c)
[  155.213202]  r8:ee49f000 r7:ee7c0004 r6:00000000 r5:ee7c0158 r4:ee7c0000
[  155.220051] [<c00439e8>] (warn_slowpath_null) from [<bf27eb70>] (xhci_setup_device+0x410/0x484 [xhci_hcd])
[  155.229816] [<bf27e760>] (xhci_setup_device [xhci_hcd]) from [<bf27ec10>] (xhci_address_device+0x14/0x18 [xhci_hcd])
[  155.240415]  r10:ee598200 r9:00000001 r8:00000002 r7:00000001 r6:00000003 r5:00000002
[  155.248363]  r4:ee49f000
[  155.250978] [<bf27ebfc>] (xhci_address_device [xhci_hcd]) from [<bf20cb94>] (hub_port_init+0x1b8/0xa9c [usbcore])
[  155.261403] [<bf20c9dc>] (hub_port_init [usbcore]) from [<bf2101e0>] (hub_event+0x738/0x1020 [usbcore])
[  155.270874]  r10:ee598200 r9:ee7c0000 r8:ee7c0038 r7:ee518800 r6:ee49f000 r5:00000001
[  155.278822]  r4:00000000
[  155.281426] [<bf20faa8>] (hub_event [usbcore]) from [<c005754c>] (process_one_work+0x128/0x340)
[  155.290196]  r10:00000000 r9:00000003 r8:00000000 r7:fedfa000 r6:eeec5400 r5:ee598314
[  155.298151]  r4:ee434380
[  155.300718] [<c0057424>] (process_one_work) from [<c00578f8>] (worker_thread+0x158/0x49c)
[  155.308963]  r10:ee434380 r9:00000003 r8:eeec5400 r7:00000008 r6:ee434398 r5:eeec5400
[  155.316913]  r4:eeec5414
[  155.319482] [<c00577a0>] (worker_thread) from [<c005cc40>] (kthread+0xdc/0xf8)
[  155.326765]  r10:00000000 r9:00000000 r8:00000000 r7:c00577a0 r6:ee434380 r5:ee4441c0
[  155.334713]  r4:00000000 r3:00000000
[  155.338341] [<c005cb64>] (kthread) from [<c000fc08>] (ret_from_fork+0x14/0x2c)
[  155.345626]  r7:00000000 r6:00000000 r5:c005cb64 r4:ee4441c0
[  155.356108] ---[ end trace a58d34c223b190e6 ]---
[  155.360783] xhci-hcd xhci-hcd.0.auto: Virt dev invalid for slot_id 0x1!
[  155.574404] xhci-hcd xhci-hcd.0.auto: xhci_setup_device
[  155.579667] ------------[ cut here ]------------

---
 drivers/usb/host/xhci.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -3795,6 +3795,9 @@ static int xhci_setup_device(struct usb_
 
 	mutex_lock(&xhci->mutex);
 
+	if (xhci->xhc_state)	/* dying or halted */
+		goto out;
+
 	if (!udev->slot_id) {
 		xhci_dbg_trace(xhci, trace_xhci_dbg_address,
 				"Bad Slot ID %d", udev->slot_id);

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mathias Nyman <[email protected]>

commit cc8e4fc0c3b5e8340bc8358990515d116a3c274c upstream.

Don't check if timer is running with a timer_pending() before deleting it with del_timer_sync(), this defies the whole point of the sync part and can cause a possible race.

Instead we just want to make sure the timer is initialized early enough before we have a chance to delete it.

---
 drivers/usb/host/xhci-mem.c |   11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

@@ -1792,8 +1792,7 @@ void xhci_mem_cleanup(struct xhci_hcd *x
 	int size;
 	int i, j, num_ports;
 
-	if (timer_pending(&xhci->cmd_timer))
-		del_timer_sync(&xhci->cmd_timer);
+	del_timer_sync(&xhci->cmd_timer);
 
 	/* Free the Event Ring Segment Table and the actual Event Ring */
 	size = sizeof(struct xhci_erst_entry)*(xhci->erst.num_entries);

@@ -2321,6 +2320,10 @@ int xhci_mem_init(struct xhci_hcd *xhci,
 
 	INIT_LIST_HEAD(&xhci->cmd_list);
 
+	/* init command timeout timer */
+	setup_timer(&xhci->cmd_timer, xhci_handle_command_timeout,
+		    (unsigned long)xhci);
+
 	page_size = readl(&xhci->op_regs->page_size);
 	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
 			"Supported page size register = 0x%x", page_size);

@@ -2505,10 +2508,6 @@ int xhci_mem_init(struct xhci_hcd *xhci,
 			"Wrote ERST address to ir_set 0.");
 	xhci_print_ir_set(xhci, 0);
 
-	/* init command timeout timer */
-	setup_timer(&xhci->cmd_timer, xhci_handle_command_timeout,
-		    (unsigned long)xhci);
-
 	/*
 	 * XXX: Might need to set the Interrupter Moderation Register to
 	 * something other than the default (~1ms minimum between interrupts).

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Linus Torvalds <[email protected]>

commit b9a532277938798b53178d5a66af6e2915cb27cf upstream.

As reported by Dmitry Vyukov, we really shouldn't do ipc_addid() before having initialized the IPC object state. Yes, we initialize the IPC object in a locked state, but with all the lockless RCU lookup work, that IPC object lock no longer means that the state cannot be seen.

We already did this for the IPC semaphore code (see commit e8577d1f0329:
"ipc/sem.c: fully initialize sem_array before making it visible") but we clearly forgot about msg and shm.

---
 ipc/msg.c  |   14 +++++++-------
 ipc/shm.c  |   13 +++++++------
 ipc/util.c |    8 ++++----
 3 files changed, 18 insertions(+), 17 deletions(-)

@@ -137,13 +137,6 @@ static int newque(struct ipc_namespace *
 		return retval;
 	}
 
-	/* ipc_addid() locks msq upon success. */
-	id = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni);
-	if (id < 0) {
-		ipc_rcu_putref(msq, msg_rcu_free);
-		return id;
-	}
-
 	msq->q_stime = msq->q_rtime = 0;
 	msq->q_ctime = get_seconds();
 	msq->q_cbytes = msq->q_qnum = 0;

@@ -153,6 +146,13 @@ static int newque(struct ipc_namespace *
 	INIT_LIST_HEAD(&msq->q_receivers);
 	INIT_LIST_HEAD(&msq->q_senders);
 
+	/* ipc_addid() locks msq upon success. */
+	id = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni);
+	if (id < 0) {
+		ipc_rcu_putref(msq, msg_rcu_free);
+		return id;
+	}
+
 	ipc_unlock_object(&msq->q_perm);
 	rcu_read_unlock();
 

@@ -550,12 +550,6 @@ static int newseg(struct ipc_namespace *
 	if (IS_ERR(file))
 		goto no_file;
 
-	id = ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni);
-	if (id < 0) {
-		error = id;
-		goto no_id;
-	}
-
 	shp->shm_cprid = task_tgid_vnr(current);
 	shp->shm_lprid = 0;
 	shp->shm_atim = shp->shm_dtim = 0;

@@ -564,6 +558,13 @@ static int newseg(struct ipc_namespace *
 	shp->shm_nattch = 0;
 	shp->shm_file = file;
 	shp->shm_creator = current;
+
+	id = ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni);
+	if (id < 0) {
+		error = id;
+		goto no_id;
+	}
+
 	list_add(&shp->shm_clist, &current->sysvshm.shm_clist);
 
 	/*

@@ -237,6 +237,10 @@ int ipc_addid(struct ipc_ids *ids, struc
 	rcu_read_lock();
 	spin_lock(&new->lock);
 
+	current_euid_egid(&euid, &egid);
+	new->cuid = new->uid = euid;
+	new->gid = new->cgid = egid;
+
 	id = idr_alloc(&ids->ipcs_idr, new,
 		       (next_id < 0) ? 0 : ipcid_to_idx(next_id), 0,
 		       GFP_NOWAIT);

@@ -249,10 +253,6 @@ int ipc_addid(struct ipc_ids *ids, struc
 
 	ids->in_use++;
 
-	current_euid_egid(&euid, &egid);
-	new->cuid = new->uid = euid;
-	new->gid = new->cgid = egid;
-
 	if (next_id < 0) {
 		new->seq = ids->seq++;
 		if (ids->seq > IPCID_SEQ_MAX)

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Julian Anastasov <[email protected]>

commit e3895c0334d0ef46e80f22eaf2a52401ff6d5a67 upstream.

Reset XPS's sender_cpu on forwarding.

---
 net/netfilter/ipvs/ip_vs_xmit.c |    6 ++++++
 1 file changed, 6 insertions(+)

@@ -518,6 +518,8 @@ static inline int ip_vs_tunnel_xmit_prep
 	if (ret == NF_ACCEPT) {
 		nf_reset(skb);
 		skb_forward_csum(skb);
+		if (!skb->sk)
+			skb_sender_cpu_clear(skb);
 	}
 	return ret;
 }

@@ -558,6 +560,8 @@ static inline int ip_vs_nat_send_or_cont
 
 	if (!local) {
 		skb_forward_csum(skb);
+		if (!skb->sk)
+			skb_sender_cpu_clear(skb);
 		NF_HOOK(pf, NF_INET_LOCAL_OUT, NULL, skb,
 			NULL, skb_dst(skb)->dev, dst_output_sk);
 	} else

@@ -578,6 +582,8 @@ static inline int ip_vs_send_or_cont(int
 	if (!local) {
 		ip_vs_drop_early_demux_sk(skb);
 		skb_forward_csum(skb);
+		if (!skb->sk)
+			skb_sender_cpu_clear(skb);
 		NF_HOOK(pf, NF_INET_LOCAL_OUT, NULL, skb,
 			NULL, skb_dst(skb)->dev, dst_output_sk);
 	} else

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Fabio Estevam <[email protected]>

commit 7ccddeb08a632c713eca0a5f13bcbfa7e6e83982 upstream.

The only user of this driver that has not been converted to fully device tree is the i.MX35 SoC.

There is a i.MX35-based board (mach-pcm043.c) that uses platform data to pass wp_gpio and cd_gpio information.

Commit 8d86e4fcccf61ba ("mmc: sdhci-esdhc-imx: Call mmc_of_parse()") broke the platform data case by removing mmc_gpio_request_ro() and mmc_gpio_request_cd(), so restore the functionality for the non-dt case.

Also, restore the check for ESDHC_CD_CONTROLLER so that we can still support the "fsl,cd-controller" property.

---
 drivers/mmc/host/sdhci-esdhc-imx.c |   36 +++++++++++++++++++++++++++++++++++-
 1 file changed, 35 insertions(+), 1 deletion(-)

@@ -925,6 +925,7 @@ static int sdhci_esdhc_imx_probe(struct
 	struct esdhc_platform_data *boarddata;
 	int err;
 	struct pltfm_imx_data *imx_data;
+	bool dt = true;
 
 	host = sdhci_pltfm_init(pdev, &sdhci_esdhc_imx_pdata, 0);
 	if (IS_ERR(host))

@@ -1012,11 +1013,44 @@ static int sdhci_esdhc_imx_probe(struct
 		}
 		imx_data->boarddata = *((struct esdhc_platform_data *)
 					host->mmc->parent->platform_data);
+		dt = false;
+	}
+	/* write_protect */
+	if (boarddata->wp_type == ESDHC_WP_GPIO && !dt) {
+		err = mmc_gpio_request_ro(host->mmc, boarddata->wp_gpio);
+		if (err) {
+			dev_err(mmc_dev(host->mmc),
+				"failed to request write-protect gpio!\n");
+			goto disable_clk;
+		}
+		host->mmc->caps2 |= MMC_CAP2_RO_ACTIVE_HIGH;
 	}
 
 	/* card_detect */
-	if (boarddata->cd_type == ESDHC_CD_CONTROLLER)
+	switch (boarddata->cd_type) {
+	case ESDHC_CD_GPIO:
+		if (dt)
+			break;
+		err = mmc_gpio_request_cd(host->mmc, boarddata->cd_gpio, 0);
+		if (err) {
+			dev_err(mmc_dev(host->mmc),
+				"failed to request card-detect gpio!\n");
+			goto disable_clk;
+		}
+		/* fall through */
+
+	case ESDHC_CD_CONTROLLER:
+		/* we have a working card_detect back */
 		host->quirks &= ~SDHCI_QUIRK_BROKEN_CARD_DETECTION;
+		break;
+
+	case ESDHC_CD_PERMANENT:
+		host->mmc->caps |= MMC_CAP_NONREMOVABLE;
+		break;
+
+	case ESDHC_CD_NONE:
+		break;
+	}
 
 	switch (boarddata->max_bus_width) {
 	case 8:

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ludovic Desroches <[email protected]>

commit d32dc9aa10c739363c775baf4499416b2e0dc11f upstream.

When masking/unmasking interrupts, mask_cache is updated and used later for suspend/resume. Unfortunately, it always was the mask_cache associated with the first irq chip which was updated. So when performing resume, only irqs 0-31 could be enabled.

---
 drivers/irqchip/irq-atmel-aic5.c |   24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

@@ -88,28 +88,36 @@ static void aic5_mask(struct irq_data *d
 {
 	struct irq_domain *domain = d->domain;
 	struct irq_domain_chip_generic *dgc = domain->gc;
-	struct irq_chip_generic *gc = dgc->gc[0];
+	struct irq_chip_generic *bgc = dgc->gc[0];
+	struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
 
-	/* Disable interrupt on AIC5 */
-	irq_gc_lock(gc);
+	/*
+	 * Disable interrupt on AIC5. We always take the lock of the
+	 * first irq chip as all chips share the same registers.
+	 */
+	irq_gc_lock(bgc);
 	irq_reg_writel(gc, d->hwirq, AT91_AIC5_SSR);
 	irq_reg_writel(gc, 1, AT91_AIC5_IDCR);
 	gc->mask_cache &= ~d->mask;
-	irq_gc_unlock(gc);
+	irq_gc_unlock(bgc);
 }
 
 static void aic5_unmask(struct irq_data *d)
 {
 	struct irq_domain *domain = d->domain;
 	struct irq_domain_chip_generic *dgc = domain->gc;
-	struct irq_chip_generic *gc = dgc->gc[0];
+	struct irq_chip_generic *bgc = dgc->gc[0];
+	struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
 
-	/* Enable interrupt on AIC5 */
-	irq_gc_lock(gc);
+	/*
+	 * Enable interrupt on AIC5. We always take the lock of the
+	 * first irq chip as all chips share the same registers.
+	 */
+	irq_gc_lock(bgc);
 	irq_reg_writel(gc, d->hwirq, AT91_AIC5_SSR);
 	irq_reg_writel(gc, 1, AT91_AIC5_IECR);
 	gc->mask_cache |= d->mask;
-	irq_gc_unlock(gc);
+	irq_gc_unlock(bgc);
 }
 
 static int aic5_retrigger(struct irq_data *d)

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Marc Zyngier <[email protected]>

commit 5a9a8915c8888b615521b17d70a4342187eae60b upstream.

When the ITS is configured for non-cacheable transactions, make sure that the allocated, zeroed memory is flushed to the Point of Coherency, allowing the ITS to observe the zeros instead of random garbage (or even get its own data overwritten by zeros being evicted from the cache...).

---
 drivers/irqchip/irq-gic-v3-its.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

@@ -921,8 +921,10 @@ retry_baser:
 			 * non-cacheable as well.
 			 */
 			shr = tmp & GITS_BASER_SHAREABILITY_MASK;
-			if (!shr)
+			if (!shr) {
 				cache = GITS_BASER_nC;
+				__flush_dcache_area(base, alloc_size);
+			}
 			goto retry_baser;
 		}
 

@@ -1163,6 +1165,8 @@ static struct its_device *its_create_dev
 		return NULL;
 	}
 
+	__flush_dcache_area(itt, sz);
+
 	dev->its = its;
 	dev->itt = itt;
 	dev->nr_ites = nr_ites;

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mario Carrillo <[email protected]>

commit e4144fe5d47c91c92d36cdbd5f31ed8d6e3a57ab upstream.

The HOWTO document needed updating for the new kernel versioning.

---
 Documentation/HOWTO |   28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

@@ -218,16 +218,16 @@ The development process
 Linux kernel development process currently consists of a few different
 main kernel "branches" and lots of different subsystem-specific kernel
 branches.  These different branches are:
-  - main 3.x kernel tree
-  - 3.x.y -stable kernel tree
-  - 3.x -git kernel patches
+  - main 4.x kernel tree
+  - 4.x.y -stable kernel tree
+  - 4.x -git kernel patches
   - subsystem specific kernel trees and patches
-  - the 3.x -next kernel tree for integration tests
+  - the 4.x -next kernel tree for integration tests
 
-3.x kernel tree
+4.x kernel tree
 -----------------
-3.x kernels are maintained by Linus Torvalds, and can be found on
-kernel.org in the pub/linux/kernel/v3.x/ directory.  Its development
+4.x kernels are maintained by Linus Torvalds, and can be found on
+kernel.org in the pub/linux/kernel/v4.x/ directory.  Its development
 process is as follows:
   - As soon as a new kernel is released a two weeks window is open,
     during this period of time maintainers can submit big diffs to

@@ -262,20 +262,20 @@ mailing list about kernel releases:
 	released according to perceived bug status, not according to a
 	preconceived timeline."
 
-3.x.y -stable kernel tree
+4.x.y -stable kernel tree
 ---------------------------
 Kernels with 3-part versions are -stable kernels. They contain
 relatively small and critical fixes for security problems or significant
-regressions discovered in a given 3.x kernel.
+regressions discovered in a given 4.x kernel.
 
 This is the recommended branch for users who want the most recent stable
 kernel and are not interested in helping test development/experimental
 versions.
 
-If no 3.x.y kernel is available, then the highest numbered 3.x
+If no 4.x.y kernel is available, then the highest numbered 4.x
 kernel is the current stable kernel.
 
-3.x.y are maintained by the "stable" team <[email protected]>, and
+4.x.y are maintained by the "stable" team <[email protected]>, and
 are released as needs dictate.  The normal release period is approximately
 two weeks, but it can be longer if there are no pressing problems.  A
 security-related problem, instead, can cause a release to happen almost

@@ -285,7 +285,7 @@ The file Documentation/stable_kernel_rul
 documents what kinds of changes are acceptable for the -stable tree, and
 how the release process works.
 
-3.x -git patches
+4.x -git patches
 ------------------
 These are daily snapshots of Linus' kernel tree which are managed in a
 git repository (hence the name.) These patches are usually released

@@ -317,9 +317,9 @@ revisions to it, and maintainers can mar
 accepted, or rejected.  Most of these patchwork sites are listed at
 http://patchwork.kernel.org/.
 
-3.x -next kernel tree for integration tests
+4.x -next kernel tree for integration tests
 ---------------------------------------------
-Before updates from subsystem trees are merged into the mainline 3.x
+Before updates from subsystem trees are merged into the mainline 4.x
 tree, they need to be integration-tested.  For this purpose, a special
 testing repository exists into which virtually all subsystem trees are
 pulled on an almost daily basis:

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Boris BREZILLON <[email protected]>

commit 8e375ccda31ccc73b087134e263c48d2114534f4 upstream.

The sunxi_nand_chips_cleanup() function is missing a call to list_del() which generates a double free error.

---
 drivers/mtd/nand/sunxi_nand.c |    1 +
 1 file changed, 1 insertion(+)

@@ -1312,6 +1312,7 @@ static void sunxi_nand_chips_cleanup(str
 					node);
 		nand_release(&chip->mtd);
 		sunxi_nand_ecc_cleanup(&chip->nand.ecc);
+		list_del(&chip->node);
 	}
 }
 

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Boris BREZILLON <[email protected]>

commit 03a0e8a7c5ea29b5c4e72dfd64900b47a8fb6f2d upstream.

The USER_DATA register cannot be accessed using byte accessors on A13 SoCs, thus triggering a bug when using memcpy_toio on this register. Declare an helper macros to convert an OOB buffer into a suitable USER_DATA value and vice-versa.

This patch also fixes an error in the oob_required logic (some OOB data are not written even if the user required it) by removing the oob_required condition, which is perfectly valid since the core already fill ->oob_poi with FFs when oob_required is false.

---
 drivers/mtd/nand/sunxi_nand.c |   26 +++++++++-----------------
 1 file changed, 9 insertions(+), 17 deletions(-)

@@ -138,6 +138,10 @@
 #define NFC_ECC_MODE		GENMASK(15, 12)
 #define NFC_RANDOM_SEED		GENMASK(30, 16)
 
+/* NFC_USER_DATA helper macros */
+#define NFC_BUF_TO_USER_DATA(buf)	((buf)[0] | ((buf)[1] << 8) | \
+					((buf)[2] << 16) | ((buf)[3] << 24))
+
 #define NFC_DEFAULT_TIMEOUT_MS	1000
 
 #define NFC_SRAM_SIZE		1024

@@ -632,15 +636,9 @@ static int sunxi_nfc_hw_ecc_write_page(s
 		offset = layout->eccpos[i * ecc->bytes] - 4 + mtd->writesize;
 
 		/* Fill OOB data in */
-		if (oob_required) {
-			tmp = 0xffffffff;
-			memcpy_toio(nfc->regs + NFC_REG_USER_DATA_BASE, &tmp,
-				    4);
-		} else {
-			memcpy_toio(nfc->regs + NFC_REG_USER_DATA_BASE,
-				    chip->oob_poi + offset - mtd->writesize,
-				    4);
-		}
+		writel(NFC_BUF_TO_USER_DATA(chip->oob_poi +
+					    layout->oobfree[i].offset),
+		       nfc->regs + NFC_REG_USER_DATA_BASE);
 
 		chip->cmdfunc(mtd, NAND_CMD_RNDIN, offset, -1);
 

@@ -770,14 +768,8 @@ static int sunxi_nfc_hw_syndrome_ecc_wri
 		offset += ecc->size;
 
 		/* Fill OOB data in */
-		if (oob_required) {
-			tmp = 0xffffffff;
-			memcpy_toio(nfc->regs + NFC_REG_USER_DATA_BASE, &tmp,
-				    4);
-		} else {
-			memcpy_toio(nfc->regs + NFC_REG_USER_DATA_BASE, oob,
-				    4);
-		}
+		writel(NFC_BUF_TO_USER_DATA(oob),
+		       nfc->regs + NFC_REG_USER_DATA_BASE);
 
 		tmp = NFC_DATA_TRANS | NFC_DATA_SWAP_METHOD | NFC_ACCESS_DIR |
 		      (1 << 30);

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andy Shevchenko <[email protected]>

commit ecc87eed7beeb50c0be0b73322d62135277ea2b0 upstream.

In device_add_property_set() we check pset parameter for a NULL, but few lines later we do a pointer arithmetic without check that will crash kernel in the set_secondary_fwnode().

Here we check if pset parameter is NULL and return immediately.

---
 drivers/base/property.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

@@ -26,9 +26,10 @@
  */
 void device_add_property_set(struct device *dev, struct property_set *pset)
 {
-	if (pset)
-		pset->fwnode.type = FWNODE_PDATA;
+	if (!pset)
+		return;
 
+	pset->fwnode.type = FWNODE_PDATA;
 	set_secondary_fwnode(dev, &pset->fwnode);
 }
 EXPORT_SYMBOL_GPL(device_add_property_set);

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jann Horn <[email protected]>

commit b7f76ea2ef6739ee484a165ffbac98deb855d3d3 upstream.

---
 include/linux/security.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -2527,7 +2527,7 @@ static inline int security_task_prctl(in
 				      unsigned long arg4,
 				      unsigned long arg5)
 {
-	return cap_task_prctl(option, arg2, arg3, arg3, arg5);
+	return cap_task_prctl(option, arg2, arg3, arg4, arg5);
 }
 
 static inline void security_task_to_inode(struct task_struct *p, struct inode *inode)

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Peter Chen <[email protected]>

commit 56ffa1d154c7e12af16273f0cdc42690dd05caf5 upstream.

According to spec, there are functional and protocol stalls.

For functional stall, it is for bulk and interrupt endpoints, below are cases for it:
- Host sends SET_FEATURE request for Set-Halt, the udc driver needs to set stall, and return true unconditionally.
- The gadget driver may call usb_ep_set_halt to stall certain endpoints, if there is a transfer in pending, the udc driver should not set stall, and return -EAGAIN accordingly.
These two kinds of stall need to be cleared by host using CLEAR_FEATURE request (Clear-Halt).

For protocol stall, it is for control endpoint, this stall will be set if the control request has failed. This stall will be cleared by next setup request (hardware will do it).

It fixed usbtest (drivers/usb/misc/usbtest.c) Test 13 "set/clear halt" test failure, meanwhile, this change has been verified by USB2 CV Compliance Test and MSC Tests.

---
 drivers/usb/chipidea/udc.c |   84 +++++++++++++++++++++++----------------------
 1 file changed, 44 insertions(+), 40 deletions(-)

@@ -656,6 +656,44 @@ __acquires(hwep->lock)
 	return 0;
 }
 
+static int _ep_set_halt(struct usb_ep *ep, int value, bool check_transfer)
+{
+	struct ci_hw_ep *hwep = container_of(ep, struct ci_hw_ep, ep);
+	int direction, retval = 0;
+	unsigned long flags;
+
+	if (ep == NULL || hwep->ep.desc == NULL)
+		return -EINVAL;
+
+	if (usb_endpoint_xfer_isoc(hwep->ep.desc))
+		return -EOPNOTSUPP;
+
+	spin_lock_irqsave(hwep->lock, flags);
+
+	if (value && hwep->dir == TX && check_transfer &&
+		!list_empty(&hwep->qh.queue) &&
+			!usb_endpoint_xfer_control(hwep->ep.desc)) {
+		spin_unlock_irqrestore(hwep->lock, flags);
+		return -EAGAIN;
+	}
+
+	direction = hwep->dir;
+	do {
+		retval |= hw_ep_set_halt(hwep->ci, hwep->num, hwep->dir, value);
+
+		if (!value)
+			hwep->wedge = 0;
+
+		if (hwep->type == USB_ENDPOINT_XFER_CONTROL)
+			hwep->dir = (hwep->dir == TX) ? RX : TX;
+
+	} while (hwep->dir != direction);
+
+	spin_unlock_irqrestore(hwep->lock, flags);
+	return retval;
+}
+
+
 /**
  * _gadget_stop_activity: stops all USB activity, flushes & disables all endpts
  * @gadget: gadget

@@ -1051,7 +1089,7 @@ __acquires(ci->lock)
 				num += ci->hw_ep_max / 2;
 
 			spin_unlock(&ci->lock);
-			err = usb_ep_set_halt(&ci->ci_hw_ep[num].ep);
+			err = _ep_set_halt(&ci->ci_hw_ep[num].ep, 1, false);
 			spin_lock(&ci->lock);
 			if (!err)
 				isr_setup_status_phase(ci);

@@ -1110,8 +1148,8 @@ delegate:
 
 	if (err < 0) {
 		spin_unlock(&ci->lock);
-		if (usb_ep_set_halt(&hwep->ep))
-			dev_err(ci->dev, "error: ep_set_halt\n");
+		if (_ep_set_halt(&hwep->ep, 1, false))
+			dev_err(ci->dev, "error: _ep_set_halt\n");
 		spin_lock(&ci->lock);
 	}
 }

@@ -1142,9 +1180,9 @@ __acquires(ci->lock)
 					err = isr_setup_status_phase(ci);
 				if (err < 0) {
 					spin_unlock(&ci->lock);
-					if (usb_ep_set_halt(&hwep->ep))
+					if (_ep_set_halt(&hwep->ep, 1, false))
 						dev_err(ci->dev,
-							"error: ep_set_halt\n");
+						"error: _ep_set_halt\n");
 					spin_lock(&ci->lock);
 				}
 			}

@@ -1390,41 +1428,7 @@ static int ep_dequeue(struct usb_ep *ep,
  */
 static int ep_set_halt(struct usb_ep *ep, int value)
 {
-	struct ci_hw_ep *hwep = container_of(ep, struct ci_hw_ep, ep);
-	int direction, retval = 0;
-	unsigned long flags;
-
-	if (ep == NULL || hwep->ep.desc == NULL)
-		return -EINVAL;
-
-	if (usb_endpoint_xfer_isoc(hwep->ep.desc))
-		return -EOPNOTSUPP;
-
-	spin_lock_irqsave(hwep->lock, flags);
-
-#ifndef STALL_IN
-	/* g_file_storage MS compliant but g_zero fails chapter 9 compliance */
-	if (value && hwep->type == USB_ENDPOINT_XFER_BULK && hwep->dir == TX &&
-	    !list_empty(&hwep->qh.queue)) {
-		spin_unlock_irqrestore(hwep->lock, flags);
-		return -EAGAIN;
-	}
-#endif
-
-	direction = hwep->dir;
-	do {
-		retval |= hw_ep_set_halt(hwep->ci, hwep->num, hwep->dir, value);
-
-		if (!value)
-			hwep->wedge = 0;
-
-		if (hwep->type == USB_ENDPOINT_XFER_CONTROL)
-			hwep->dir = (hwep->dir == TX) ? RX : TX;
-
-	} while (hwep->dir != direction);
-
-	spin_unlock_irqrestore(hwep->lock, flags);
-	return retval;
+	return _ep_set_halt(ep, value, true);
 }
 
 /**

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mathias Nyman <[email protected]>

commit ff30cbc8da425754e8ab96904db1d295bd034f27 upstream.

Bits 1:0 of the bmAttributes are used for the burst multiplier. The rest of the bits used to be reserved (zero), but USB3.1 takes bit 7 into use.

Use the existing USB_SS_MULT() macro instead to make sure the mult value and hence max packet calculations are correct for USB3.1 devices.

Note that burst multiplier in bmAttributes is zero based and that the USB_SS_MULT() macro adds one.

---
 drivers/usb/core/config.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

@@ -112,7 +112,7 @@ static void usb_parse_ss_endpoint_compan
 				cfgno, inum, asnum, ep->desc.bEndpointAddress);
 		ep->ss_ep_comp.bmAttributes = 16;
 	} else if (usb_endpoint_xfer_isoc(&ep->desc) &&
-			desc->bmAttributes > 2) {
+		   USB_SS_MULT(desc->bmAttributes) > 3) {
 		dev_warn(ddev, "Isoc endpoint has Mult of %d in "
 				"config %d interface %d altsetting %d ep %d: "
 				"setting to 3\n", desc->bmAttributes + 1,

@@ -121,7 +121,8 @@ static void usb_parse_ss_endpoint_compan
 	}
 
 	if (usb_endpoint_xfer_isoc(&ep->desc))
-		max_tx = (desc->bMaxBurst + 1) * (desc->bmAttributes + 1) *
+		max_tx = (desc->bMaxBurst + 1) *
+			(USB_SS_MULT(desc->bmAttributes)) *
 			usb_endpoint_maxp(&ep->desc);
 	else if (usb_endpoint_xfer_int(&ep->desc))
 		max_tx = usb_endpoint_maxp(&ep->desc) *

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Vincent Palatin <[email protected]>

commit 72194739f54607bbf8cfded159627a2015381557 upstream.

Add a device quirk for the Logitech PTZ Pro Camera and its sibling the ConferenceCam CC3000e Camera.
This fixes the failed camera enumeration on some boot, particularly on machines with fast CPU.

Tested by connecting a Logitech PTZ Pro Camera to a machine with a Haswell Core i7-4600U CPU @ 2.10GHz, and doing thousands of reboot cycles while recording the kernel logs and taking camera picture after each boot. Before the patch, more than 7% of the boots show some enumeration transfer failures and in a few of them, the kernel is giving up before actually enumerating the webcam. After the patch, the enumeration has been correct on every reboot.

---
 drivers/usb/core/quirks.c |    7 +++++++
 1 file changed, 7 insertions(+)

@@ -54,6 +54,13 @@ static const struct usb_device_id usb_qu
 	{ USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
 	{ USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT },
 
+	/* Logitech ConferenceCam CC3000e */
+	{ USB_DEVICE(0x046d, 0x0847), .driver_info = USB_QUIRK_DELAY_INIT },
+	{ USB_DEVICE(0x046d, 0x0848), .driver_info = USB_QUIRK_DELAY_INIT },
+
+	/* Logitech PTZ Pro Camera */
+	{ USB_DEVICE(0x046d, 0x0853), .driver_info = USB_QUIRK_DELAY_INIT },
+
 	/* Logitech Quickcam Fusion */
 	{ USB_DEVICE(0x046d, 0x08c1), .driver_info = USB_QUIRK_RESET_RESUME },
 

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Richard Weinberger <[email protected]>

commit 281fda27673f833a01d516658a64d22a32c8e072 upstream.

Make sure that data_size is less than LEB size. Otherwise a handcrafted UBI image is able to trigger an out of bounds memory access in ubi_compare_lebs().

---
 drivers/mtd/ubi/io.c |    5 +++++
 1 file changed, 5 insertions(+)

@@ -926,6 +926,11 @@ static int validate_vid_hdr(const struct
 		goto bad;
 	}
 
+	if (data_size > ubi->leb_size) {
+		ubi_err(ubi, "bad data_size");
+		goto bad;
+	}
+
 	if (vol_type == UBI_VID_STATIC) {
 		/*
 		 * Although from high-level point of view static volumes may

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Stefan Assmann <[email protected]>

commit 6423fc34160939142d72ffeaa2db6408317f54df upstream.

During driver probing the following code path is triggered. igb_probe
->igb_sw_init
->igb_probe_vfs

    ->igb_pci_enable_sriov
      ->igb_sriov_reinit

Doing the SR-IOV re-init is not necessary during probing since we're starting from scratch. Here we can call igb_enable_sriov() right away.

Running igb_sriov_reinit() during igb_probe() also seems to cause occasional packet loss on some onboard 82576 NICs. Reproduced on Dell and HP servers with onboard 82576 NICs.
Example:
Intel Corporation 82576 Gigabit Network Connection [8086:10c9] (rev 01)
Subsystem: Dell Device [1028:0481]

---
 drivers/net/ethernet/intel/igb/igb_main.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -2864,7 +2864,7 @@ static void igb_probe_vfs(struct igb_ada
 		return;
 
 	pci_sriov_set_totalvfs(pdev, 7);
-	igb_pci_enable_sriov(pdev, max_vfs);
+	igb_enable_sriov(pdev, max_vfs);
 
 #endif /* CONFIG_PCI_IOV */
 }

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ben Hutchings <[email protected]>

commit 95c2b17534654829db428f11bcf4297c059a2a7e upstream.

Per-IRQ directories in procfs are created only when a handler is first added to the irqdesc, not when the irqdesc is created. In the case of a shared IRQ, multiple tasks can race to create a directory. This race condition seems to have been present forever, but is easier to hit with async probing.

---
 kernel/irq/proc.c |   19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

@@ -12,6 +12,7 @@
 #include <linux/seq_file.h>
 #include <linux/interrupt.h>
 #include <linux/kernel_stat.h>
+#include <linux/mutex.h>
 
 #include "internals.h"
 

@@ -323,18 +324,29 @@ void register_handler_proc(unsigned int
 
 void register_irq_proc(unsigned int irq, struct irq_desc *desc)
 {
+	static DEFINE_MUTEX(register_lock);
 	char name [MAX_NAMELEN];
 
-	if (!root_irq_dir || (desc->irq_data.chip == &no_irq_chip) || desc->dir)
+	if (!root_irq_dir || (desc->irq_data.chip == &no_irq_chip))
 		return;
 
+	/*
+	 * irq directories are registered only when a handler is
+	 * added, not when the descriptor is created, so multiple
+	 * tasks might try to register at the same time.
+	 */
+	mutex_lock(&register_lock);
+
+	if (desc->dir)
+		goto out_unlock;
+
 	memset(name, 0, MAX_NAMELEN);
 	sprintf(name, "%d", irq);
 
 	/* create /proc/irq/1234 */
 	desc->dir = proc_mkdir(name, root_irq_dir);
 	if (!desc->dir)
-		return;
+		goto out_unlock;
 
 #ifdef CONFIG_SMP
 	/* create /proc/irq/<irq>/smp_affinity */

@@ -355,6 +367,9 @@ void register_irq_proc(unsigned int irq,
 
 	proc_create_data("spurious", 0444, desc->dir,
 			 &irq_spurious_proc_fops, (void *)(long)irq);
+
+out_unlock:
+	mutex_unlock(&register_lock);
 }
 
 void unregister_irq_proc(unsigned int irq, struct irq_desc *desc)

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: David Howells <[email protected]>

commit 4bacc9c9234c7c8eec44f5ed4e960d9f96fa0f01 upstream.

Make file->f_path always point to the overlay dentry so that the path in /proc/pid/fd is correct and to ensure that label-based LSMs have access to the overlay as well as the underlay (path-based LSMs probably don't need it).

Using my union testsuite to set things up, before the patch I see:

	[root@andromeda union-testsuite]# bash 5</mnt/a/foo107
	[root@andromeda union-testsuite]# ls -l /proc/$$/fd/
	...
	lr-x------. 1 root root 64 Jun  5 14:38 5 -> /a/foo107
	[root@andromeda union-testsuite]# stat /mnt/a/foo107
	...
	Device: 23h/35d Inode: 13381       Links: 1
	...
	[root@andromeda union-testsuite]# stat -L /proc/$$/fd/5
	...
	Device: 23h/35d Inode: 13381       Links: 1
	...

After the patch:

	[root@andromeda union-testsuite]# bash 5</mnt/a/foo107
	[root@andromeda union-testsuite]# ls -l /proc/$$/fd/
	...
	lr-x------. 1 root root 64 Jun  5 14:22 5 -> /mnt/a/foo107
	[root@andromeda union-testsuite]# stat /mnt/a/foo107
	...
	Device: 23h/35d Inode: 40346       Links: 1
	...
	[root@andromeda union-testsuite]# stat -L /proc/$$/fd/5
	...
	Device: 23h/35d Inode: 40346       Links: 1
	...

Note the change in where /proc/$$/fd/5 points to in the ls command. It was pointing to /a/foo107 (which doesn't exist) and now points to /mnt/a/foo107 (which is correct).

The inode accessed, however, is the lower layer. The union layer is on device 25h/37d and the upper layer on 24h/36d.

---
 fs/dcache.c              |    5 +++-
 fs/internal.h            |    1 
 fs/open.c                |   49 ++++++++++++++++++++++++-----------------------
 fs/overlayfs/inode.c     |   14 +++++--------
 fs/overlayfs/overlayfs.h |    1 
 fs/overlayfs/super.c     |    1 
 include/linux/dcache.h   |    2 +
 include/linux/fs.h       |    2 -
 8 files changed, 41 insertions(+), 34 deletions(-)

@@ -1676,7 +1676,8 @@ void d_set_d_op(struct dentry *dentry, c
 				DCACHE_OP_COMPARE	|
 				DCACHE_OP_REVALIDATE	|
 				DCACHE_OP_WEAK_REVALIDATE	|
-				DCACHE_OP_DELETE ));
+				DCACHE_OP_DELETE	|
+				DCACHE_OP_SELECT_INODE));
 	dentry->d_op = op;
 	if (!op)
 		return;

@@ -1692,6 +1693,8 @@ void d_set_d_op(struct dentry *dentry, c
 		dentry->d_flags |= DCACHE_OP_DELETE;
 	if (op->d_prune)
 		dentry->d_flags |= DCACHE_OP_PRUNE;
+	if (op->d_select_inode)
+		dentry->d_flags |= DCACHE_OP_SELECT_INODE;
 
 }
 EXPORT_SYMBOL(d_set_d_op);

@@ -107,6 +107,7 @@ extern struct file *do_file_open_root(st
 extern long do_handle_open(int mountdirfd,
 			   struct file_handle __user *ufh, int open_flag);
 extern int open_check_o_direct(struct file *f);
+extern int vfs_open(const struct path *, struct file *, const struct cred *);
 
 /*
  * inode.c

@@ -336,31 +336,30 @@ static bool ovl_open_need_copy_up(int fl
 	return true;
 }
 
-static int ovl_dentry_open(struct dentry *dentry, struct file *file,
-		    const struct cred *cred)
+struct inode *ovl_d_select_inode(struct dentry *dentry, unsigned file_flags)
 {
 	int err;
 	struct path realpath;
 	enum ovl_path_type type;
 
 	type = ovl_path_real(dentry, &realpath);
-	if (ovl_open_need_copy_up(file->f_flags, type, realpath.dentry)) {
+	if (ovl_open_need_copy_up(file_flags, type, realpath.dentry)) {
 		err = ovl_want_write(dentry);
 		if (err)
-			return err;
+			return ERR_PTR(err);
 
-		if (file->f_flags & O_TRUNC)
+		if (file_flags & O_TRUNC)
 			err = ovl_copy_up_last(dentry, NULL, true);
 		else
 			err = ovl_copy_up(dentry);
 		ovl_drop_write(dentry);
 		if (err)
-			return err;
+			return ERR_PTR(err);
 
 		ovl_path_upper(dentry, &realpath);
 	}
 
-	return vfs_open(&realpath, file, cred);
+	return d_backing_inode(realpath.dentry);
 }
 
 static const struct inode_operations ovl_file_inode_operations = {

@@ -371,7 +370,6 @@ static const struct inode_operations ovl
 	.getxattr	= ovl_getxattr,
 	.listxattr	= ovl_listxattr,
 	.removexattr	= ovl_removexattr,
-	.dentry_open	= ovl_dentry_open,
 };
 
 static const struct inode_operations ovl_symlink_inode_operations = {

@@ -173,6 +173,7 @@ ssize_t ovl_getxattr(struct dentry *dent
 		     void *value, size_t size);
 ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size);
 int ovl_removexattr(struct dentry *dentry, const char *name);
+struct inode *ovl_d_select_inode(struct dentry *dentry, unsigned file_flags);
 
 struct inode *ovl_new_inode(struct super_block *sb, umode_t mode,
 			    struct ovl_entry *oe);

@@ -275,6 +275,7 @@ static void ovl_dentry_release(struct de
 
 static const struct dentry_operations ovl_dentry_operations = {
 	.d_release = ovl_dentry_release,
+	.d_select_inode = ovl_d_select_inode,
 };
 
 static struct ovl_entry *ovl_alloc_entry(unsigned int numlower)

@@ -160,6 +160,7 @@ struct dentry_operations {
 	char *(*d_dname)(struct dentry *, char *, int);
 	struct vfsmount *(*d_automount)(struct path *);
 	int (*d_manage)(struct dentry *, bool);
+	struct inode *(*d_select_inode)(struct dentry *, unsigned);
 } ____cacheline_aligned;
 
 /*

@@ -225,6 +226,7 @@ struct dentry_operations {
 
 #define DCACHE_MAY_FREE			0x00800000
 #define DCACHE_FALLTHRU			0x01000000 /* Fall through to lower layer */
+#define DCACHE_OP_SELECT_INODE		0x02000000 /* Unioned entry: dcache op selects inode */
 
 extern seqlock_t rename_lock;
 

@@ -1641,7 +1641,6 @@ struct inode_operations {
 	int (*set_acl)(struct inode *, struct posix_acl *, int);
 
 	/* WARNING: probably going away soon, do not use! */
-	int (*dentry_open)(struct dentry *, struct file *, const struct cred *);
 } ____cacheline_aligned;
 
 ssize_t rw_copy_check_uvector(int type, const struct iovec __user * uvector,

@@ -2193,7 +2192,6 @@ extern struct file *file_open_name(struc
 extern struct file *filp_open(const char *, int, umode_t);
 extern struct file *file_open_root(struct dentry *, struct vfsmount *,
 				   const char *, int);
-extern int vfs_open(const struct path *, struct file *, const struct cred *);
 extern struct file * dentry_open(const struct path *, int, const struct cred *);
 extern int filp_close(struct file *, fl_owner_t id);
 

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Al Viro <[email protected]>

commit 9391dd00d13c853ab4f2a85435288ae2202e0e43 upstream.

when opening a directory we want the overlayfs inode, not one from the topmost layer.

---
 fs/overlayfs/inode.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -342,6 +342,9 @@ struct inode *ovl_d_select_inode(struct
 	struct path realpath;
 	enum ovl_path_type type;
 
+	if (d_is_dir(dentry))
+		return d_backing_inode(dentry);
+
 	type = ovl_path_real(dentry, &realpath);
 	if (ovl_open_need_copy_up(file_flags, type, realpath.dentry)) {
 		err = ovl_want_write(dentry);

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ben Dooks <[email protected]>

commit 19e79687de22f23bcfb5e79cce3daba20af228d1 upstream.

On the OMAP AM3517 platform the uart4_ick gets registered twice, causing any power management to /dev/ttyO3 to fail when trying to wake the device up.

This solves the following oops:

[] Unhandled fault: external abort on non-linefetch (0x1028) at 0xfa09e008 [] PC is at serial_omap_pm+0x48/0x15c
[] LR is at _raw_spin_unlock_irqrestore+0x30/0x5c

---
 drivers/clk/ti/clk-3xxx.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -163,7 +163,6 @@ static struct ti_dt_clk omap3xxx_clks[]
 	DT_CLK(NULL, "gpio2_ick", "gpio2_ick"),
 	DT_CLK(NULL, "wdt3_ick", "wdt3_ick"),
 	DT_CLK(NULL, "uart3_ick", "uart3_ick"),
-	DT_CLK(NULL, "uart4_ick", "uart4_ick"),
 	DT_CLK(NULL, "gpt9_ick", "gpt9_ick"),
 	DT_CLK(NULL, "gpt8_ick", "gpt8_ick"),
 	DT_CLK(NULL, "gpt7_ick", "gpt7_ick"),

@@ -308,6 +307,7 @@ static struct ti_dt_clk am35xx_clks[] =
 static struct ti_dt_clk omap36xx_clks[] = {
 	DT_CLK(NULL, "omap_192m_alwon_fck", "omap_192m_alwon_fck"),
 	DT_CLK(NULL, "uart4_fck", "uart4_fck"),
+	DT_CLK(NULL, "uart4_ick", "uart4_ick"),
 	{ .node_name = NULL },
 };
 

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <[email protected]>

commit daf3761c9fcde0f4ca64321cbed6c1c86d304193 upstream.

Leandro Awa writes:
"After switching to version 4.1.6, our parallelized and distributed
workflows now fail consistently with errors of the form:

T34: ./regex.c:39:22: error: config.h: No such file or directory

From our 'git bisect' testing, the following commit appears to be the possible cause of the behavior we've been seeing: commit 766c4cbfacd8"

Al Viro says:
"What happens is that 766c4cbfacd8 got the things subtly wrong.

We used to treat d_is_negative() after lookup_fast() as "fall with ENOENT". That was wrong - checking ->d_flags outside of ->d_seq protection is unreliable and failing with hard error on what should've fallen back to non-RCU pathname resolution is a bug.

Unfortunately, we'd pulled the test too far up and ran afoul of another kind of staleness. The dentry might have been absolutely stable from the RCU point of view (and we might be on UP, etc), but stale from the remote fs point of view. If ->d_revalidate() returns "it's actually stale", dentry gets thrown away and the original code wouldn't even have looked at its ->d_flags.

What we need is to check ->d_flags where 766c4cbfacd8 does (prior to ->d_seq validation) but only use the result in cases where we do not discard this dentry outright"

---
 fs/namei.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

@@ -1453,8 +1453,6 @@ static int lookup_fast(struct nameidata
 		negative = d_is_negative(dentry);
 		if (read_seqcount_retry(&dentry->d_seq, seq))
 			return -ECHILD;
-		if (negative)
-			return -ENOENT;
 
 		/*
 		 * This sequence count validates that the parent had no

@@ -1475,6 +1473,12 @@ static int lookup_fast(struct nameidata
 				goto unlazy;
 			}
 		}
+		/*
+		 * Note: do negative dentry check after revalidation in
+		 * case that drops it.
+		 */
+		if (negative)
+			return -ENOENT;
 		path->mnt = mnt;
 		path->dentry = dentry;
 		if (likely(__follow_mount_rcu(nd, path, inode)))

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Marek Majtyka <[email protected]>

commit ca09f02f122b2ecb0f5ddfc5fd47b29ed657d4fd upstream.

A critical bug has been found in device memory stage1 translation for VMs with more then 4GB of address space. Once vm_pgoff size is smaller then pa (which is true for LPAE case, u32 and u64 respectively) some more significant bits of pa may be lost as a shift operation is performed on u32 and later cast onto u64.

Example: vm_pgoff(u32)=0x00210030, PAGE_SHIFT=12

        expected pa(u64):   0x0000002010030000
        produced pa(u64):   0x0000000010030000

The fix is to change the order of operations (casting first onto phys_addr_t and then shifting).

---
 arch/arm/kvm/mmu.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

@@ -1790,8 +1790,10 @@ int kvm_arch_prepare_memory_region(struc
 		if (vma->vm_flags & VM_PFNMAP) {
 			gpa_t gpa = mem->guest_phys_addr +
 				    (vm_start - mem->userspace_addr);
-			phys_addr_t pa = (vma->vm_pgoff << PAGE_SHIFT) +
-					 vm_start - vma->vm_start;
+			phys_addr_t pa;
+
+			pa = (phys_addr_t)vma->vm_pgoff << PAGE_SHIFT;
+			pa += vm_start - vma->vm_start;
 
 			/* IO region dirty page logging not allowed */
 			if (memslot->flags & KVM_MEM_LOG_DIRTY_PAGES)

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jason Wang <[email protected]>

commit 8453fecbecae26edb3f278627376caab05d9a88d upstream.

We only want zero length mmio eventfd to be registered on KVM_FAST_MMIO_BUS. So check this explicitly when arg->len is zero to make sure this.

---
 virt/kvm/eventfd.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -846,7 +846,7 @@ kvm_assign_ioeventfd(struct kvm *kvm, st
 	/* When length is ignored, MMIO is also put on a separate bus, for
 	 * faster lookups.
 	 */
-	if (!args->len && !(args->flags & KVM_IOEVENTFD_FLAG_PIO)) {
+	if (!args->len && bus_idx == KVM_MMIO_BUS) {
 		ret = kvm_io_bus_register_dev(kvm, KVM_FAST_MMIO_BUS,
 					      p->addr, 0, &p->dev);
 		if (ret < 0)

@@ -901,7 +901,7 @@ kvm_deassign_ioeventfd(struct kvm *kvm,
 			continue;
 
 		kvm_io_bus_unregister_dev(kvm, bus_idx, &p->dev);
-		if (!p->length) {
+		if (!p->length && p->bus_idx == KVM_MMIO_BUS) {
 			kvm_io_bus_unregister_dev(kvm, KVM_FAST_MMIO_BUS,
 						  &p->dev);
 		}

This is the start of the stable review cycle for the 4.1.11 release. There are 202 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Tue Oct 20 01:48:10 UTC 2015. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.1.11-rc1.gz

and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 4.1.11-rc1

Christoph Hellwig <[email protected]>
3w-9xxx: don't unmap bounce buffered commands

Guenter Roeck <[email protected]>
MIPS: Fix console output for Fulong2e system

Joonsoo Kim <[email protected]>
mm/slab: fix unexpected index mapping result of kmalloc_size(INDEX_NODE+1)

Prarit Bhargava <[email protected]>
intel_pstate: Fix overflow in busy_scaled due to long delay

Uwe Kleine-König <[email protected]>
serial: atmel: fix error path of probe function

Mans Rullgard <[email protected]>
serial: 8250: add uart_config entry for PORT_RT2880

Jann Horn <[email protected]>
drivers/tty: require read access for controlling terminal

Kosuke Tatsukawa <[email protected]>
tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.c

[email protected] <[email protected]>
staging: speakup: fix speakup-r regression

Joe Thornber <[email protected]>
dm cache: fix NULL pointer when switching from cleaner policy

Junichi Nomura <[email protected]>
dm: fix AB-BA deadlock in __dm_destroy()

Trond Myklebust <[email protected]>
namei: results of d_is_negative() should be checked after dentry revalidation

Ben Dooks <[email protected]>
clk: ti: fix dual-registration of uart4_ick

Kinglong Mee <[email protected]>
nfs/filelayout: Fix NULL reference caused by double freeing of fh_array

Al Viro <[email protected]>
fix a braino in ovl_d_select_inode()

David Howells <[email protected]>
overlayfs: Make f_path always point to the overlay and f_inode to the underlay

David Howells <[email protected]>
overlay: Call ovl_drop_write() earlier in ovl_dentry_open()

NeilBrown <[email protected]>
md/bitmap: don't pass -1 to bitmap_storage_alloc.

Ben Hutchings <[email protected]>
genirq: Fix race in register_irq_proc()

Stefan Assmann <[email protected]>
igb: do not re-init SR-IOV during probe

Chas Williams <[email protected]>
net/xen-netfront: only napi_synchronize() if running

Andreas Schwab <[email protected]>
m68k: Define asmlinkage_protect

Mark Salyzyn <[email protected]>
arm64: readahead: fault retry breaks mmap file read random detection

Li Bin <[email protected]>
arm64: ftrace: fix function_graph tracer panic

Ard Biesheuvel <[email protected]>
arm64/efi: Fix boot crash by not padding between EFI_MEMORY_RUNTIME regions

Eric W. Biederman <[email protected]>
vfs: Test for and handle paths that are unreachable from their mnt_root

Eric W. Biederman <[email protected]>
dcache: Handle escaped paths in prepend_path

Ulf Hansson <[email protected]>
mmc: core: Don't return an error for CD/WP GPIOs when GPIOLIB is unset

Haibo Chen <[email protected]>
mmc: sdhci: fix dma memory leak in sdhci_pre_req()

shengyong <[email protected]>
UBI: return ENOSPC if no enough space available

Richard Weinberger <[email protected]>
UBI: Validate data_size

Richard Weinberger <[email protected]>
UBIFS: Kill unneeded locking in ubifs_init_security

Eric Dumazet <[email protected]>
inet: fix potential deadlock in reqsk_queue_unlink()

Christian Engelmayer <[email protected]>
rsi: Fix possible leak when loading firmware

Paul Mackerras <[email protected]>
powerpc/MSI: Fix race condition in tearing down MSI interrupts

Kapileshwar Singh <[email protected]>
tools lib traceevent: Fix string handling in heterogeneous arch environments

Linus Lüssing <[email protected]>
batman-adv: Fix potentially broken skb network header access

Linus Lüssing <[email protected]>
batman-adv: Fix potential synchronization issues in mcast tvlv handler

Linus Lüssing <[email protected]>
batman-adv: Make MCAST capability changes atomic

Linus Lüssing <[email protected]>
batman-adv: Make TT capability changes atomic

Linus Lüssing <[email protected]>
batman-adv: Make NC capability changes atomic

James Hogan <[email protected]>
MIPS: dma-default: Fix 32-bit fall back to GFP_DMA

Viresh Kumar <[email protected]>
cpufreq: dt: Tolerance applies on both sides of target voltage

Borislav Petkov <[email protected]>
cpu/cacheinfo: Fix teardown path

Yao-Wen Mao <[email protected]>
USB: Add reset-resume quirk for two Plantronics usb headphones.

Vincent Palatin <[email protected]>
usb: Add device quirk for Logitech PTZ cameras

Alexander Inyukhin <[email protected]>
USB: chaoskey read offset bug

Felipe Balbi <[email protected]>
usb: musb: cppi41: allow it to work again

Roger Quadros <[email protected]>
usb: phy: phy-generic: Fix reset behaviour on legacy boot

Mathias Nyman <[email protected]>
usb: Use the USB_SS_MULT() macro to get the burst multiplier.

Peter Chen <[email protected]>
usb: chipidea: udc: using the correct stall implementation

Bin Liu <[email protected]>
usb: musb: dsps: fix polling in device-only mode

Jann Horn <[email protected]>
security: fix typo in security_task_prctl

Mark Brown <[email protected]>
regmap: debugfs: Don't bother actually printing when calculating max length

Mark Brown <[email protected]>
regmap: debugfs: Ensure we don't underflow when printing access masks

Gabriel Krisman Bertazi <[email protected]>
ipr: Enable SIS pipe commands for SIS-32 devices.

Russell King <[email protected]>
pcmcia: sa11x0: fix missing clk_put() in sa11x0 socket drivers

Michal Kazior <[email protected]>
ath10k: reject 11b tx fragmentation configuration

Andy Shevchenko <[email protected]>
device property: fix potential NULL pointer dereference

Heiko Stuebner <[email protected]>
PM / AVS: rockchip-io: depend on CONFIG_POWER_AVS

Boris BREZILLON <[email protected]>

    mtd: nand: sunxi: fix OOB handling in ->write_xxx() functions

Boris BREZILLON <[email protected]>
mtd: nand: sunxi: fix sunxi_nand_chips_cleanup()

Antoine Ténart <[email protected]>
mtd: pxa3xx_nand: add a default chunk size

Mario Carrillo <[email protected]>

    docs: update HOWTO for 3.x -> 4.x versioning

Marc Zyngier <[email protected]>
irqchip/gic-v3-its: Add missing cache flushes

Ludovic Desroches <[email protected]>
irqchip/atmel-aic5: Use per chip mask caches in mask/unmask()

Peter Seiderer <[email protected]>
cifs: use server timestamp for ntlmv2 authentication

Li Jun <[email protected]>
usb: chipidea: imx: fix a typo for imx6sx

Dong Aisheng <[email protected]>
dts: imx25: fix sd card gpio polarity specified in device tree

Dong Aisheng <[email protected]>
dts: imx53: fix sd card gpio polarity specified in device tree

Dong Aisheng <[email protected]>
dts: imx51: fix sd card gpio polarity specified in device tree

Dong Aisheng <[email protected]>
mmc: sdhci-esdhc-imx: fix cd regression for dt platform

Fabio Estevam <[email protected]>
mmc: sdhci-esdhc-imx: Do not break platform data boards

Fabio Estevam <[email protected]>
mmc: sdhci-esdhc-imx: Move mmc_of_parse() to the dt probe

Alexey Brodkin <[email protected]>
mmc: dw_mmc: handle data blocks > than 4kB if IDMAC is used

Linus Lüssing <[email protected]>
batman-adv: Make DAT capability changes atomic

Marek Lindner <[email protected]>
batman-adv: protect tt_local_entry from concurrent delete events

Marek Lindner <[email protected]>
batman-adv: fix kernel crash due to missing NULL checks

Linus Walleij <[email protected]>
fbdev: select versatile helpers for the integrator

Julian Anastasov <[email protected]>
ipvs: call skb_sender_cpu_clear

Julian Anastasov <[email protected]>
ipvs: fix crash with sync protocol v0 and FTP

Alex Gartrell <[email protected]>
ipvs: skb_orphan in case of forwarding

Julian Anastasov <[email protected]>
ipvs: fix crash if scheduler is changed

Julian Anastasov <[email protected]>
ipvs: do not use random local source address for tunnels

Dave Martin <[email protected]>
serial/amba-pl011: Disable interrupts around TX softirq

Ben Segall <[email protected]>
sched/fair: Prevent throttling in early pick_next_task_fair()

Linus Torvalds <[email protected]>
Initialize msg/shm IPC objects before doing ipc_addid()

Reyad Attiyat <[email protected]>
usb: xhci: Add support for URB_ZERO_PACKET to bulk/sg transfers

Mathias Nyman <[email protected]>
xhci: init command timeout timer earlier to avoid deleting it uninitialized

Mathias Nyman <[email protected]>
xhci: change xhci 1.0 only restrictions to support xhci 1.1

Roger Quadros <[email protected]>
usb: xhci: exit early in xhci_setup_device() if we're halted or dying

Roger Quadros <[email protected]>
usb: xhci: Clear XHCI_STATE_DYING on start

Roger Quadros <[email protected]>
usb: xhci: lock mutex on xhci_stop

Mathias Nyman <[email protected]>
xhci: give command abortion one more chance before killing xhci

Johan Hovold <[email protected]>
USB: whiteheat: fix potential null-deref at probe

Dave Airlie <[email protected]>
drm/dp/mst: drop cancel work sync in the mstb destroy path (v2)

Michel Dänzer <[email protected]>
drm/radeon: Restore LCD backlight level on resume (>= R5xx)

Daniel Vetter <[email protected]>
drm: Reject DRI1 hw lock ioctl functions for kms drivers

Jani Nikula <[email protected]>
drm/i915/bios: handle MIPI Sequence Block v3+ gracefully

Fabiano Fidêncio <[email protected]>
drm/qxl: recreate the primary surface when the bo is not primary

Dave Airlie <[email protected]>
drm/qxl: only report first monitor as connected if we have no state

Steve French <[email protected]>
Do not fall back to SMBWriteX in set_file_size error cases

Steve French <[email protected]>
disabling oplocks/leases via module parm enable_oplocks broken for SMB3

Steve French <[email protected]>
Fix sec=krb5 on smb3 mounts

Trond Myklebust <[email protected]>
NFS: Fix a write performance regression

Peng Tao <[email protected]>
nfs: fix pg_test page count calculation

Kinglong Mee <[email protected]>
NFS: Do cleanup before resetting pageio read/write to mds

Johan Hedberg <[email protected]>

    Bluetooth: Delay check for conn->smp in smp_conn_security()

Florian Westphal <[email protected]>
netfilter: nf_log: don't zap all loggers on unregister

Pablo Neira Ayuso <[email protected]>
netfilter: nft_compat: skip family comparison in case of NFPROTO_UNSPEC

Pablo Neira Ayuso <[email protected]>
netfilter: nf_log: wait for rcu grace after logger unregistration

Eric W. Biederman <[email protected]>
netfilter: nftables: Do not run chains in the wrong network namespace

Eric W. Biederman <[email protected]>
netfilter: nf_qeueue: Drop queue entries on nf_unregister_hook

Pablo Neira Ayuso <[email protected]>
netfilter: ctnetlink: put back references to master ct and expect objects

Joe Stringer <[email protected]>
netfilter: nf_conntrack: Support expectations in different zones

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: Use 32 bit addressing register from nft_type_to_reg()

Pablo Neira Ayuso <[email protected]>
netfilter: nfnetlink: work around wrong endianess in res_id field

Mikulas Patocka <[email protected]>
dm raid: fix round up of default region size

NeilBrown <[email protected]>
md/raid0: apply base queue limits *before* disk_stack_limits

NeilBrown <[email protected]>
md/raid0: update queue parameter in a safer location.

Liu.Zhao <[email protected]>
USB: option: add ZTE PIDs

Shawn Lin <[email protected]>
staging: ion: fix corruption of ion_import_dma_buf

Joe Thornber <[email protected]>
dm btree: add ref counting ops for the leaves of top level btrees

Chuck Lever <[email protected]>
svcrdma: Fix send_reply() scatter/gather set-up

Michal Kazior <[email protected]>
ath10k: fix dma_mapping_error() handling

Mike Snitzer <[email protected]>
dm crypt: constrain crypt device's max_segment_size to PAGE_SIZE

Bjorn Helgaas <[email protected]>
PCI: Clear IORESOURCE_UNSET when clipping a bridge window

Alex Williamson <[email protected]>
PCI: Use function 0 VPD for identical functions, regular VPD for others

Alex Williamson <[email protected]>
PCI: Fix devfn for VPD access through function 0

Filipe Manana <[email protected]>
Btrfs: update fix for read corruption of compressed and shared extents

Filipe Manana <[email protected]>
Btrfs: fix read corruption of compressed and shared extents

Jeff Mahoney <[email protected]>
btrfs: skip waiting on ordered range for special files

Gianluca Renzi <[email protected]>
ASoC: sgtl5000: fix wrong register MIC_BIAS_VOLTAGE setup on probe

Lars-Peter Clausen <[email protected]>

    ASoC: db1200: Fix DAI link format for db1300 and db1550

Yitian Bu <[email protected]>
ASoC: dwc: correct irq clear method

Robert Jarzmik <[email protected]>
ASoC: fix broken pxa SoC support

Robert Jarzmik <[email protected]>
ASoC: pxa: pxa2xx-ac97: fix dma requestor lines

Takashi Iwai <[email protected]>
ALSA: hda - Disable power_save_node for IDT 92HD73xx chips

John Flatness <[email protected]>
ALSA: hda - Apply SPDIF pin ctl to MacBookPro 12,1

Laura Abbott <[email protected]>
ALSA: hda: Add dock support for ThinkPad T550

Takashi Iwai <[email protected]>
ALSA: synth: Fix conflicting OSS device registration on AWE32

Takashi Iwai <[email protected]>
ALSA: hda - Disable power_save_node for Thinkpads

Mel Gorman <[email protected]>
mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy a fault

Joseph Qi <[email protected]>
ocfs2/dlm: fix deadlock when dispatch assert master

Sowmini Varadhan <[email protected]>

    lib/iommu-common.c: do not try to deref a null iommu->lazy_flush() pointer when n < pool->hint

Naoya Horiguchi <[email protected]>
mm: migrate: hugetlb: putback destination hugepage to active list

Sudip Mukherjee <[email protected]>
spi: spidev: fix possible NULL dereference

Tan, Jui Nee <[email protected]>
spi: spi-pxa2xx: Check status register to determine if SSSR_TINT is disabled

Max Filippov <[email protected]>
spi: xtensa-xtfpga: fix register endianness

Guenter Roeck <[email protected]>
spi: Fix documentation of spi_alloc_master()

Christian Borntraeger <[email protected]>
s390/boot/decompression: disable floating point in decompressor

Martin Schwidefsky <[email protected]>
s390/compat: correct uc_sigmask of the compat signal frame

Peter Zijlstra <[email protected]>
sched/core: Fix TASK_DEAD race in finish_task_switch()

Ricardo Ribalda Delgado <[email protected]>
leds/led-class: Add missing put_device()

Vitaly Kuznetsov <[email protected]>
x86/xen: Support kexec/kdump in HVM guests by doing a soft reset

Stephen Smalley <[email protected]>
x86/mm: Set NX on gap between __ex_table and rodata

Thomas Gleixner <[email protected]>
x86/process: Add proper bound checks in 64bit get_wchan()

Lee, Chun-Yi <[email protected]>
x86/kexec: Fix kexec crash in syscall kexec_file_load()

Matt Fleming <[email protected]>
x86/efi: Fix boot crash by mapping EFI memmap entries bottom-up at runtime, instead of top-down

Dirk Müller <[email protected]>
Use WARN_ON_ONCE for missing X86_FEATURE_NRIPS

Andy Lutomirski <[email protected]>
x86/nmi/64: Fix a paravirt stack-clobbering bug in the NMI code

Andy Lutomirski <[email protected]>
x86/paravirt: Replace the paravirt nop with a bona fide empty function

David Woodhouse <[email protected]>
x86/platform: Fix Geode LX timekeeping in the generic x86 build

Thomas Gleixner <[email protected]>
x86/alternatives: Make optimize_nops() interrupt safe and synced

Shaohua Li <[email protected]>
x86/apic: Serialize LVTT and TSC_DEADLINE writes

Andy Shevchenko <[email protected]>
dmaengine: dw: properly read DWC_PARAMS register

Jeff Moyer <[email protected]>
blockdev: don't set S_DAX for misaligned partitions

Felipe F. Tonello <[email protected]>
ARM: dts: fix usb pin control for imx-rex dts

Chanho Park <[email protected]>
ARM: EXYNOS: reset Little cores when cpu is up

Carl Frederik Werner <[email protected]>
ARM: dts: omap3-beagle: make i2c3, ddc and tfp410 gpio work again

Grazvydas Ignotas <[email protected]>
ARM: dts: omap5-uevm.dts: fix i2c5 pinctrl offsets

Doug Anderson <[email protected]>
ARM: 8425/1: kgdb: Don't try to stop the machine when setting breakpoints

Paul Bolle <[email protected]>
windfarm: decrement client count when unregistering

Ard Biesheuvel <[email protected]>
ARM: 8429/1: disable GCC SRA optimization

Russell King <[email protected]>
ARM: fix Thumb2 signal handling when ARMv6 is enabled

Guenter Roeck <[email protected]>
hwmon: (nct6775) Swap STEP_UP_TIME and STEP_DOWN_TIME registers for most chips

Dominik Dingel <[email protected]>
sched: access local runqueue directly in single_task_running

Francesco Lavra <[email protected]>
watchdog: sunxi: fix activation of system reset

Peter Zijlstra <[email protected]>
perf: Fix AUX buffer refcounting

Arnaldo Carvalho de Melo <[email protected]>
perf header: Fixup reading of HEADER_NRCPUS feature

Ben Hutchings <[email protected]>
perf tools: Add empty Build files for architectures lacking them

Kan Liang <[email protected]>
perf stat: Get correct cpu id for print_aggr

Arnaldo Carvalho de Melo <[email protected]>
perf hists: Update the column width for the "srcline" sort key

Adrian Hunter <[email protected]>
perf tools: Fix copying of /proc/kcore

Peter Zijlstra <[email protected]>
perf/x86/intel: Fix constraint access

Azael Avalos <[email protected]>
toshiba_acpi: Fix hotkeys registration on some toshiba models

Nicholas Bellinger <[email protected]>

    target: Fix v4.1 UNIT_ATTENTION se_node_acl->device_list[] NULL pointer

Jenny Derzhavetz <[email protected]>
iser-target: Put the reference on commands waiting for unsol data

Jenny Derzhavetz <[email protected]>
iser-target: remove command with state ISTATE_REMOVE

Nicholas Bellinger <[email protected]>
target: Attach EXTENDED_COPY local I/O descriptors to xcopy_pt_sess

Michal Hocko <[email protected]>
scsi: fix scsi_error_handler vs. scsi_host_dev_release race

Andy Grover <[email protected]>
target/iscsi: Fix np_ip bracket issue by removing np_ip

John Stultz <[email protected]>
time: Fix timekeeping_freqadjust()'s incorrect use of abs() instead of abs64()

Gautham R. Shenoy <[email protected]>
KVM: PPC: Book3S HV: Pass the correct trap argument to kvmhv_commence_exit

Thomas Huth <[email protected]>

    KVM: PPC: Book3S: Take the kvm->srcu lock in kvmppc_h_logical_ci_load/store()

Marc Zyngier <[email protected]>
arm: KVM: Disable virtual timer even if the guest is not using it

Jason Wang <[email protected]>
kvm: fix double free for fast mmio eventfd

Jason Wang <[email protected]>
kvm: factor out core eventfd assign/deassign logic

Jason Wang <[email protected]>
kvm: fix zero length mmio searching

Jason Wang <[email protected]>
kvm: don't try to register to KVM_FAST_MMIO_BUS for non mmio eventfd

Wanpeng Li <[email protected]>
KVM: vmx: fix VPID is 0000H in non-root operation

Marek Majtyka <[email protected]>
arm: KVM: Fix incorrect device to IPA mapping

-------------

Diffstat:

 Documentation/HOWTO                            |  28 +++---
 Makefile                                       |   4 +-
 arch/arm/Makefile                              |   8 ++
 arch/arm/boot/dts/imx25-pdk.dts                |   5 +-
 arch/arm/boot/dts/imx51-apf51dev.dts           |   2 +-
 arch/arm/boot/dts/imx53-ard.dts                |   4 +-
 arch/arm/boot/dts/imx53-m53evk.dts             |   4 +-
 arch/arm/boot/dts/imx53-qsb-common.dtsi        |   4 +-
 arch/arm/boot/dts/imx53-smd.dts                |   4 +-
 arch/arm/boot/dts/imx53-tqma53.dtsi            |   4 +-
 arch/arm/boot/dts/imx53-tx53.dtsi              |   4 +-
 arch/arm/boot/dts/imx53-voipac-bsb.dts         |   4 +-
 arch/arm/boot/dts/imx6qdl-rex.dtsi             |   2 -
 arch/arm/boot/dts/omap3-beagle.dts             |   2 +-
 arch/arm/boot/dts/omap5-uevm.dts               |   4 +-
 arch/arm/kernel/kgdb.c                         |   8 +-
 arch/arm/kernel/signal.c                       |  15 ++-
 arch/arm/kvm/interrupts_head.S                 |   6 +-
 arch/arm/kvm/mmu.c                             |   6 +-
 arch/arm/mach-exynos/mcpm-exynos.c             |  27 +++++-
 arch/arm/mach-exynos/regs-pmu.h                |   6 ++
 arch/arm64/kernel/efi.c                        |   3 +-
 arch/arm64/kernel/entry-ftrace.S               |  22 ++++-
 arch/arm64/mm/fault.c                          |   1 +
 arch/m68k/include/asm/linkage.h                |  30 ++++++
 arch/mips/loongson/common/env.c                |   3 +
 arch/mips/mm/dma-default.c                     |   2 +-
 arch/powerpc/kvm/book3s.c                      |   6 ++
 arch/powerpc/kvm/book3s_hv_rmhandlers.S        |   1 +
 arch/powerpc/platforms/powernv/pci.c           |   5 +-
 arch/powerpc/sysdev/fsl_msi.c                  |   5 +-
 arch/powerpc/sysdev/mpic_pasemi_msi.c          |   6 +-
 arch/powerpc/sysdev/mpic_u3msi.c               |   5 +-
 arch/powerpc/sysdev/ppc4xx_msi.c               |   5 +-
 arch/s390/boot/compressed/Makefile             |   2 +-
 arch/s390/kernel/compat_signal.c               |  27 +++++-
 arch/x86/kernel/alternative.c                  |   5 +
 arch/x86/kernel/apic/apic.c                    |   7 ++
 arch/x86/kernel/cpu/perf_event_intel.c         |   5 +-
 arch/x86/kernel/crash.c                        |   7 +-
 arch/x86/kernel/entry_64.S                     |  16 +++-
 arch/x86/kernel/paravirt.c                     |  16 +++-
 arch/x86/kernel/process_64.c                   |  52 +++++++++--
 arch/x86/kernel/tsc.c                          |  17 ++--
 arch/x86/kvm/svm.c                             |   2 +-
 arch/x86/kvm/vmx.c                             |   2 +
 arch/x86/mm/init_64.c                          |   2 +-
 arch/x86/platform/efi/efi.c                    |  67 ++++++++++++-
 arch/x86/xen/enlighten.c                       |  23 +++++
 drivers/base/cacheinfo.c                       |  10 +-
 drivers/base/property.c                        |   5 +-
 drivers/base/regmap/regmap-debugfs.c           |   5 +-
 drivers/clk/ti/clk-3xxx.c                      |   2 +-
 drivers/cpufreq/cpufreq-dt.c                   |   3 +-
 drivers/cpufreq/intel_pstate.c                 |  10 +-
 drivers/dma/dw/core.c                          |   4 +-
 drivers/firmware/efi/libstub/arm-stub.c        |  88 +++++++++++++++---
 drivers/gpu/drm/drm_dp_mst_topology.c          |   5 +-
 drivers/gpu/drm/drm_lock.c                     |   6 ++
 drivers/gpu/drm/i915/intel_bios.c              |  12 ++-
 drivers/gpu/drm/qxl/qxl_display.c              |  14 +--
 drivers/gpu/drm/radeon/atombios_encoders.c     |   8 +-
 drivers/hwmon/nct6775.c                        |  16 ++--
 drivers/infiniband/ulp/isert/ib_isert.c        |  47 +++++++++-
 drivers/irqchip/irq-atmel-aic5.c               |  24 +++--
 drivers/irqchip/irq-gic-v3-its.c               |   6 +-
 drivers/leds/led-class.c                       |   7 +-
 drivers/macintosh/windfarm_core.c              |   2 +-
 drivers/md/bitmap.c                            |   3 +-
 drivers/md/dm-cache-policy-cleaner.c           |   2 +-
 drivers/md/dm-crypt.c                          |  17 +++-
 drivers/md/dm-raid.c                           |   3 +-
 drivers/md/dm.c                                |   6 +-
 drivers/md/persistent-data/dm-btree-internal.h |   6 ++
 drivers/md/persistent-data/dm-btree-remove.c   |  12 +--
 drivers/md/persistent-data/dm-btree-spine.c    |  37 ++++++++
 drivers/md/persistent-data/dm-btree.c          |   7 +-
 drivers/md/raid0.c                             |  75 ++++++++-------
 drivers/mmc/core/host.c                        |   4 +-
 drivers/mmc/host/dw_mmc.c                      | 109 ++++++++++++++--------
 drivers/mmc/host/sdhci-esdhc-imx.c             |  50 ++++++++--
 drivers/mmc/host/sdhci.c                       |  67 +++++--------
 drivers/mmc/host/sdhci.h                       |   8 +-
 drivers/mtd/nand/pxa3xx_nand.c                 |   3 +
 drivers/mtd/nand/sunxi_nand.c                  |  27 ++----
 drivers/mtd/ubi/io.c                           |   5 +
 drivers/mtd/ubi/vtbl.c                         |   1 +
 drivers/mtd/ubi/wl.c                           |   1 +
 drivers/net/ethernet/intel/igb/igb_main.c      |   2 +-
 drivers/net/wireless/ath/ath10k/htc.c          |   4 +-
 drivers/net/wireless/ath/ath10k/htt_tx.c       |   8 +-
 drivers/net/wireless/ath/ath10k/mac.c          |  16 ++++
 drivers/net/wireless/ath/ath10k/pci.c          |   8 +-
 drivers/net/wireless/ath/ath10k/wmi.c          |   1 +
 drivers/net/wireless/rsi/rsi_91x_sdio_ops.c    |   8 +-
 drivers/net/wireless/rsi/rsi_91x_usb_ops.c     |   8 +-
 drivers/net/xen-netfront.c                     |   3 +-
 drivers/pci/access.c                           |  27 +-----
 drivers/pci/bus.c                              |   2 +
 drivers/pci/quirks.c                           |  20 +++-
 drivers/pcmcia/sa1100_generic.c                |   1 -
 drivers/pcmcia/sa11xx_base.c                   |   3 +-
 drivers/platform/x86/toshiba_acpi.c            |   8 +-
 drivers/power/avs/Kconfig                      |   2 +-
 drivers/scsi/3w-9xxx.c                         |  28 ++++--
 drivers/scsi/ipr.c                             |   2 +-
 drivers/scsi/scsi_error.c                      |  11 ++-
 drivers/spi/spi-pxa2xx.c                       |   4 +
 drivers/spi/spi-xtensa-xtfpga.c                |   4 +-
 drivers/spi/spi.c                              |   3 +-
 drivers/spi/spidev.c                           |   3 +-
 drivers/staging/android/ion/ion.c              |   6 +-
 drivers/staging/speakup/fakekey.c              |   1 +
 drivers/target/iscsi/iscsi_target.c            |  33 ++++---
 drivers/target/iscsi/iscsi_target.h            |   2 +-
 drivers/target/iscsi/iscsi_target_configfs.c   |  14 +--
 drivers/target/iscsi/iscsi_target_login.c      |   8 +-
 drivers/target/iscsi/iscsi_target_tpg.c        |  15 ++-
 drivers/target/iscsi/iscsi_target_tpg.h        |   2 +-
 drivers/target/target_core_pr.c                |   3 +
 drivers/target/target_core_ua.c                |   8 +-
 drivers/target/target_core_xcopy.c             |   6 +-
 drivers/tty/n_tty.c                            |  15 +--
 drivers/tty/serial/8250/8250_core.c            |   8 ++
 drivers/tty/serial/amba-pl011.c                |   4 +-
 drivers/tty/serial/atmel_serial.c              |   2 +-
 drivers/tty/tty_io.c                           |  31 ++++++-
 drivers/usb/chipidea/ci_hdrc_imx.c             |   2 +-
 drivers/usb/chipidea/udc.c                     |  84 +++++++++--------
 drivers/usb/core/config.c                      |   5 +-
 drivers/usb/core/quirks.c                      |  13 +++
 drivers/usb/host/xhci-mem.c                    |  17 ++--
 drivers/usb/host/xhci-ring.c                   |  79 ++++++++++++----
 drivers/usb/host/xhci.c                        |  15 ++-
 drivers/usb/misc/chaoskey.c                    |   2 +-
 drivers/usb/musb/musb_cppi41.c                 |   6 +-
 drivers/usb/musb/musb_dsps.c                   |   7 +-
 drivers/usb/phy/phy-generic.c                  |   3 +-
 drivers/usb/serial/option.c                    |  24 +++++
 drivers/usb/serial/whiteheat.c                 |  31 +++++++
 drivers/video/fbdev/Kconfig                    |   2 +-
 drivers/watchdog/sunxi_wdt.c                   |   2 +-
 fs/block_dev.c                                 |   7 ++
 fs/btrfs/extent_io.c                           |  80 +++++++++++++---
 fs/btrfs/inode.c                               |   3 +-
 fs/cifs/cifsencrypt.c                          |  53 ++++++++++-
 fs/cifs/inode.c                                |  34 -------
 fs/cifs/smb2ops.c                              |   8 +-
 fs/cifs/smb2pdu.c                              |  76 ++++++++++++---
 fs/dcache.c                                    |  12 ++-
 fs/internal.h                                  |   1 +
 fs/namei.c                                     |  39 +++++++-
 fs/nfs/filelayout/filelayout.c                 |  31 +++----
 fs/nfs/pagelist.c                              |   2 +-
 fs/nfs/read.c                                  |   3 +
 fs/nfs/write.c                                 |   5 +-
 fs/ocfs2/dlm/dlmmaster.c                       |   9 +-
 fs/ocfs2/dlm/dlmrecovery.c                     |   8 +-
 fs/open.c                                      |  49 +++++-----
 fs/overlayfs/inode.c                           |  25 ++---
 fs/overlayfs/overlayfs.h                       |   1 +
 fs/overlayfs/super.c                           |   1 +
 fs/ubifs/xattr.c                               |   3 -
 include/linux/dcache.h                         |   2 +
 include/linux/fs.h                             |   2 -
 include/linux/mmc/core.h                       |   1 +
 include/linux/security.h                       |   2 +-
 include/net/netfilter/nf_queue.h               |   2 +
 include/net/netfilter/nf_tables.h              |   2 +-
 include/target/iscsi/iscsi_target_core.h       |   1 -
 include/xen/interface/sched.h                  |   8 ++
 ipc/msg.c                                      |  14 +--
 ipc/shm.c                                      |  13 +--
 ipc/util.c                                     |   8 +-
 kernel/events/core.c                           |   8 --
 kernel/events/internal.h                       |  10 ++
 kernel/events/ring_buffer.c                    |  27 +++++-
 kernel/irq/proc.c                              |  19 +++-
 kernel/sched/core.c                            |  25 +++--
 kernel/sched/fair.c                            |  25 ++---
 kernel/sched/sched.h                           |   5 +-
 kernel/time/timekeeping.c                      |   2 +-
 lib/iommu-common.c                             |   6 +-
 mm/hugetlb.c                                   |   8 ++
 mm/migrate.c                                   |   2 +-
 mm/slab.c                                      |  13 ++-
 net/batman-adv/distributed-arp-table.c         |   7 +-
 net/batman-adv/multicast.c                     |  81 +++++++++++-----
 net/batman-adv/network-coding.c                |   7 +-
 net/batman-adv/originator.c                    |   5 +
 net/batman-adv/soft-interface.c                |  10 +-
 net/batman-adv/translation-table.c             |  37 ++++++--
 net/batman-adv/types.h                         |  15 +--
 net/bluetooth/smp.c                            |  12 +--
 net/ipv4/inet_connection_sock.c                |   2 +-
 net/netfilter/core.c                           |   1 +
 net/netfilter/ipvs/ip_vs_core.c                |  16 +++-
 net/netfilter/ipvs/ip_vs_ctl.c                 |  78 ++++++++++------
 net/netfilter/ipvs/ip_vs_sched.c               |  12 +--
 net/netfilter/ipvs/ip_vs_sync.c                |   2 +-
 net/netfilter/ipvs/ip_vs_xmit.c                |  34 ++++++-
 net/netfilter/nf_conntrack_expect.c            |   3 +-
 net/netfilter/nf_conntrack_netlink.c           |   5 -
 net/netfilter/nf_internals.h                   |   1 +
 net/netfilter/nf_log.c                         |   9 +-
 net/netfilter/nf_queue.c                       |  17 ++++
 net/netfilter/nf_tables_core.c                 |   7 +-
 net/netfilter/nfnetlink.c                      |   8 +-
 net/netfilter/nfnetlink_queue_core.c           |  24 ++++-
 net/netfilter/nft_compat.c                     |  24 +++--
 net/sunrpc/xprtrdma/svc_rdma_sendto.c          |  10 +-
 sound/arm/Kconfig                              |  15 +--
 sound/pci/hda/patch_cirrus.c                   |   1 +
 sound/pci/hda/patch_realtek.c                  |  32 ++++---
 sound/pci/hda/patch_sigmatel.c                 |   6 +-
 sound/soc/au1x/db1200.c                        |   4 +
 sound/soc/codecs/sgtl5000.c                    |   4 +-
 sound/soc/dwc/designware_i2s.c                 |   4 +-
 sound/soc/pxa/Kconfig                          |   2 -
 sound/soc/pxa/pxa2xx-ac97.c                    |   4 +-
 sound/synth/emux/emux_oss.c                    |   3 +-
 tools/lib/traceevent/event-parse.c             |  23 ++++-
 tools/perf/arch/alpha/Build                    |   1 +
 tools/perf/arch/mips/Build                     |   1 +
 tools/perf/arch/parisc/Build                   |   1 +
 tools/perf/builtin-stat.c                      |   5 +-
 tools/perf/util/header.c                       |   4 +-
 tools/perf/util/hist.c                         |   3 +
 tools/perf/util/symbol-elf.c                   |  35 +++----
 virt/kvm/eventfd.c                             | 124 +++++++++++++++----------
 virt/kvm/kvm_main.c                            |  19 +++-
 231 files changed, 2253 insertions(+), 958 deletions(-)

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jason Wang <[email protected]>

commit 85da11ca587c8eb73993a1b503052391a73586f9 upstream.

This patch factors out core eventfd assign/deassign logic and leaves the argument checking and bus index selection to callers.

---
 virt/kvm/eventfd.c |   85 +++++++++++++++++++++++++++++++----------------------
 1 file changed, 50 insertions(+), 35 deletions(-)

@@ -771,40 +771,14 @@ static enum kvm_bus ioeventfd_bus_from_f
 	return KVM_MMIO_BUS;
 }
 
-static int
-kvm_assign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
+static int kvm_assign_ioeventfd_idx(struct kvm *kvm,
+				enum kvm_bus bus_idx,
+				struct kvm_ioeventfd *args)
 {
-	enum kvm_bus              bus_idx;
-	struct _ioeventfd        *p;
-	struct eventfd_ctx       *eventfd;
-	int                       ret;
 
-	bus_idx = ioeventfd_bus_from_flags(args->flags);
-	/* must be natural-word sized, or 0 to ignore length */
-	switch (args->len) {
-	case 0:
-	case 1:
-	case 2:
-	case 4:
-	case 8:
-		break;
-	default:
-		return -EINVAL;
-	}
-
-	/* check for range overflow */
-	if (args->addr + args->len < args->addr)
-		return -EINVAL;
-
-	/* check for extra flags that we don't understand */
-	if (args->flags & ~KVM_IOEVENTFD_VALID_FLAG_MASK)
-		return -EINVAL;
-
-	/* ioeventfd with no length can't be combined with DATAMATCH */
-	if (!args->len &&
-	    args->flags & (KVM_IOEVENTFD_FLAG_PIO |
-			   KVM_IOEVENTFD_FLAG_DATAMATCH))
-		return -EINVAL;
+	struct eventfd_ctx *eventfd;
+	struct _ioeventfd *p;
+	int ret;
 
 	eventfd = eventfd_ctx_fdget(args->fd);
 	if (IS_ERR(eventfd))

@@ -873,14 +847,13 @@ fail:
 }
 
 static int
-kvm_deassign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
+kvm_deassign_ioeventfd_idx(struct kvm *kvm, enum kvm_bus bus_idx,
+			   struct kvm_ioeventfd *args)
 {
-	enum kvm_bus              bus_idx;
 	struct _ioeventfd        *p, *tmp;
 	struct eventfd_ctx       *eventfd;
 	int                       ret = -ENOENT;
 
-	bus_idx = ioeventfd_bus_from_flags(args->flags);
 	eventfd = eventfd_ctx_fdget(args->fd);
 	if (IS_ERR(eventfd))
 		return PTR_ERR(eventfd);

@@ -918,6 +891,48 @@ kvm_deassign_ioeventfd(struct kvm *kvm,
 	return ret;
 }
 
+static int kvm_deassign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
+{
+	enum kvm_bus bus_idx = ioeventfd_bus_from_flags(args->flags);
+
+	return kvm_deassign_ioeventfd_idx(kvm, bus_idx, args);
+}
+
+static int
+kvm_assign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
+{
+	enum kvm_bus              bus_idx;
+
+	bus_idx = ioeventfd_bus_from_flags(args->flags);
+	/* must be natural-word sized, or 0 to ignore length */
+	switch (args->len) {
+	case 0:
+	case 1:
+	case 2:
+	case 4:
+	case 8:
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	/* check for range overflow */
+	if (args->addr + args->len < args->addr)
+		return -EINVAL;
+
+	/* check for extra flags that we don't understand */
+	if (args->flags & ~KVM_IOEVENTFD_VALID_FLAG_MASK)
+		return -EINVAL;
+
+	/* ioeventfd with no length can't be combined with DATAMATCH */
+	if (!args->len &&
+	    args->flags & (KVM_IOEVENTFD_FLAG_PIO |
+			   KVM_IOEVENTFD_FLAG_DATAMATCH))
+		return -EINVAL;
+
+	return kvm_assign_ioeventfd_idx(kvm, bus_idx, args);
+}
+
 int
 kvm_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
 {

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jenny Derzhavetz <[email protected]>

commit a4c15cd957cbd728f685645de7a150df5912591a upstream.

As documented in iscsit_sequence_cmd:
/*
* Existing callers for iscsit_sequence_cmd() will silently
* ignore commands with CMDSN_LOWER_THAN_EXP, so force this
* return for CMDSN_MAXCMDSN_OVERRUN as well..
*/

We need to silently finish a command when it's in ISTATE_REMOVE. This fixes an teardown hang we were seeing where a mis-behaved initiator (triggered by allocation error injections) sent us a cmdsn which was lower than expected.

---
 drivers/infiniband/ulp/isert/ib_isert.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

@@ -2996,9 +2996,16 @@ isert_get_dataout(struct iscsi_conn *con
 static int
 isert_immediate_queue(struct iscsi_conn *conn, struct iscsi_cmd *cmd, int state)
 {
-	int ret;
+	struct isert_cmd *isert_cmd = iscsit_priv_cmd(cmd);
+	int ret = 0;
 
 	switch (state) {
+	case ISTATE_REMOVE:
+		spin_lock_bh(&conn->cmd_lock);
+		list_del_init(&cmd->i_conn_node);
+		spin_unlock_bh(&conn->cmd_lock);
+		isert_put_cmd(isert_cmd, true);
+		break;
 	case ISTATE_SEND_NOPIN_WANT_RESPONSE:
 		ret = isert_put_nopin(cmd, conn, false);
 		break;

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jenny Derzhavetz <[email protected]>

commit 3e03c4b01da3e6a5f3081eb0aa252490fe83e352 upstream.

The iscsi target core teardown sequence calls wait_conn for all active commands to finish gracefully by:
- move the queue-pair to error state
- drain all the completions
- wait for the core to finish handling all session commands

However, when tearing down a session while there are sequenced commands that are still waiting for unsolicited data outs, we can block forever as these are missing an extra reference put.

We basically need the equivalent of iscsit_free_queue_reqs_for_conn() which is called after wait_conn has returned. Address this by an explicit walk on conn_cmd_list and put the extra reference.

---
 drivers/infiniband/ulp/isert/ib_isert.c |   38 +++++++++++++++++++++++++++++++-
 1 file changed, 37 insertions(+), 1 deletion(-)

@@ -3370,6 +3370,41 @@ isert_wait4flush(struct isert_conn *iser
 	wait_for_completion(&isert_conn->wait_comp_err);
 }
 
+/**
+ * isert_put_unsol_pending_cmds() - Drop commands waiting for
+ *     unsolicitate dataout
+ * @conn:    iscsi connection
+ *
+ * We might still have commands that are waiting for unsolicited
+ * dataouts messages. We must put the extra reference on those
+ * before blocking on the target_wait_for_session_cmds
+ */
+static void
+isert_put_unsol_pending_cmds(struct iscsi_conn *conn)
+{
+	struct iscsi_cmd *cmd, *tmp;
+	static LIST_HEAD(drop_cmd_list);
+
+	spin_lock_bh(&conn->cmd_lock);
+	list_for_each_entry_safe(cmd, tmp, &conn->conn_cmd_list, i_conn_node) {
+		if ((cmd->cmd_flags & ICF_NON_IMMEDIATE_UNSOLICITED_DATA) &&
+		    (cmd->write_data_done < conn->sess->sess_ops->FirstBurstLength) &&
+		    (cmd->write_data_done < cmd->se_cmd.data_length))
+			list_move_tail(&cmd->i_conn_node, &drop_cmd_list);
+	}
+	spin_unlock_bh(&conn->cmd_lock);
+
+	list_for_each_entry_safe(cmd, tmp, &drop_cmd_list, i_conn_node) {
+		list_del_init(&cmd->i_conn_node);
+		if (cmd->i_state != ISTATE_REMOVE) {
+			struct isert_cmd *isert_cmd = iscsit_priv_cmd(cmd);
+
+			isert_info("conn %p dropping cmd %p\n", conn, cmd);
+			isert_put_cmd(isert_cmd, true);
+		}
+	}
+}
+
 static void isert_wait_conn(struct iscsi_conn *conn)
 {
 	struct isert_conn *isert_conn = conn->context;

@@ -3388,8 +3423,9 @@ static void isert_wait_conn(struct iscsi
 	isert_conn_terminate(isert_conn);
 	mutex_unlock(&isert_conn->mutex);
 
-	isert_wait4cmds(conn);
 	isert_wait4flush(isert_conn);
+	isert_put_unsol_pending_cmds(conn);
+	isert_wait4cmds(conn);
 	isert_wait4logout(isert_conn);
 
 	queue_work(isert_release_wq, &isert_conn->release_work);

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jason Wang <[email protected]>

commit eefd6b06b17c5478e7c24bea6f64beaa2c431ca6 upstream.

We register wildcard mmio eventfd on two buses, once for KVM_MMIO_BUS and once on KVM_FAST_MMIO_BUS but with a single iodev instance. This will lead to an issue: kvm_io_bus_destroy() knows nothing about the devices on two buses pointing to a single dev. Which will lead to double free[1] during exit. Fix this by allocating two instances of iodevs then registering one on KVM_MMIO_BUS and another on KVM_FAST_MMIO_BUS.

CPU: 1 PID: 2894 Comm: qemu-system-x86 Not tainted 3.19.0-26-generic #28-Ubuntu
Hardware name: LENOVO 2356BG6/2356BG6, BIOS G7ET96WW (2.56 ) 09/12/2013
task: ffff88009ae0c4b0 ti: ffff88020e7f0000 task.ti: ffff88020e7f0000
RIP: 0010:[<ffffffffc07e25d8>]  [<ffffffffc07e25d8>] ioeventfd_release+0x28/0x60 [kvm]
RSP: 0018:ffff88020e7f3bc8  EFLAGS: 00010292
RAX: dead000000200200 RBX: ffff8801ec19c900 RCX: 000000018200016d
RDX: ffff8801ec19cf80 RSI: ffffea0008bf1d40 RDI: ffff8801ec19c900
RBP: ffff88020e7f3bd8 R08: 000000002fc75a01 R09: 000000018200016d
R10: ffffffffc07df6ae R11: ffff88022fc75a98 R12: ffff88021e7cc000
R13: ffff88021e7cca48 R14: ffff88021e7cca50 R15: ffff8801ec19c880
FS:  00007fc1ee3e6700(0000) GS:ffff88023e240000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8f389d8000 CR3: 000000023dc13000 CR4: 00000000001427e0
Stack:
ffff88021e7cc000 0000000000000000 ffff88020e7f3be8 ffffffffc07e2622
ffff88020e7f3c38 ffffffffc07df69a ffff880232524160 ffff88020e792d80
 0000000000000000 ffff880219b78c00 0000000000000008 ffff8802321686a8
Call Trace:
[<ffffffffc07e2622>] ioeventfd_destructor+0x12/0x20 [kvm]
[<ffffffffc07df69a>] kvm_put_kvm+0xca/0x210 [kvm]
[<ffffffffc07df818>] kvm_vcpu_release+0x18/0x20 [kvm]
[<ffffffff811f69f7>] __fput+0xe7/0x250
[<ffffffff811f6bae>] ____fput+0xe/0x10
[<ffffffff81093f04>] task_work_run+0xd4/0xf0
[<ffffffff81079358>] do_exit+0x368/0xa50
[<ffffffff81082c8f>] ? recalc_sigpending+0x1f/0x60
[<ffffffff81079ad5>] do_group_exit+0x45/0xb0
[<ffffffff81085c71>] get_signal+0x291/0x750
[<ffffffff810144d8>] do_signal+0x28/0xab0
[<ffffffff810f3a3b>] ? do_futex+0xdb/0x5d0
[<ffffffff810b7028>] ? __wake_up_locked_key+0x18/0x20
[<ffffffff810f3fa6>] ? SyS_futex+0x76/0x170
[<ffffffff81014fc9>] do_notify_resume+0x69/0xb0
[<ffffffff817cb9af>] int_signal+0x12/0x17
Code: 5d c3 90 0f 1f 44 00 00 55 48 89 e5 53 48 89 fb 48 83 ec 08 48 8b 7f 20 e8 06 d6 a5 c0 48 8b 43 08 48 8b 13 48 89 df 48 89 42 08 <48> 89 10 48 b8 00 01 10 00 00
 RIP  [<ffffffffc07e25d8>] ioeventfd_release+0x28/0x60 [kvm]
 RSP <ffff88020e7f3bc8>

---
 virt/kvm/eventfd.c |   43 +++++++++++++++++++++++++------------------
 1 file changed, 25 insertions(+), 18 deletions(-)

@@ -817,16 +817,6 @@ static int kvm_assign_ioeventfd_idx(stru
 	if (ret < 0)
 		goto unlock_fail;
 
-	/* When length is ignored, MMIO is also put on a separate bus, for
-	 * faster lookups.
-	 */
-	if (!args->len && bus_idx == KVM_MMIO_BUS) {
-		ret = kvm_io_bus_register_dev(kvm, KVM_FAST_MMIO_BUS,
-					      p->addr, 0, &p->dev);
-		if (ret < 0)
-			goto register_fail;
-	}
-
 	kvm->buses[bus_idx]->ioeventfd_count++;
 	list_add_tail(&p->list, &kvm->ioeventfds);
 

@@ -834,8 +824,6 @@ static int kvm_assign_ioeventfd_idx(stru
 
 	return 0;
 
-register_fail:
-	kvm_io_bus_unregister_dev(kvm, bus_idx, &p->dev);
 unlock_fail:
 	mutex_unlock(&kvm->slots_lock);
 

@@ -874,10 +862,6 @@ kvm_deassign_ioeventfd_idx(struct kvm *k
 			continue;
 
 		kvm_io_bus_unregister_dev(kvm, bus_idx, &p->dev);
-		if (!p->length && p->bus_idx == KVM_MMIO_BUS) {
-			kvm_io_bus_unregister_dev(kvm, KVM_FAST_MMIO_BUS,
-						  &p->dev);
-		}
 		kvm->buses[bus_idx]->ioeventfd_count--;
 		ioeventfd_release(p);
 		ret = 0;

@@ -894,14 +878,19 @@ kvm_deassign_ioeventfd_idx(struct kvm *k
 static int kvm_deassign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
 {
 	enum kvm_bus bus_idx = ioeventfd_bus_from_flags(args->flags);
+	int ret = kvm_deassign_ioeventfd_idx(kvm, bus_idx, args);
+
+	if (!args->len && bus_idx == KVM_MMIO_BUS)
+		kvm_deassign_ioeventfd_idx(kvm, KVM_FAST_MMIO_BUS, args);
 
-	return kvm_deassign_ioeventfd_idx(kvm, bus_idx, args);
+	return ret;
 }
 
 static int
 kvm_assign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
 {
 	enum kvm_bus              bus_idx;
+	int ret;
 
 	bus_idx = ioeventfd_bus_from_flags(args->flags);
 	/* must be natural-word sized, or 0 to ignore length */

@@ -930,7 +919,25 @@ kvm_assign_ioeventfd(struct kvm *kvm, st
 			   KVM_IOEVENTFD_FLAG_DATAMATCH))
 		return -EINVAL;
 
-	return kvm_assign_ioeventfd_idx(kvm, bus_idx, args);
+	ret = kvm_assign_ioeventfd_idx(kvm, bus_idx, args);
+	if (ret)
+		goto fail;
+
+	/* When length is ignored, MMIO is also put on a separate bus, for
+	 * faster lookups.
+	 */
+	if (!args->len && bus_idx == KVM_MMIO_BUS) {
+		ret = kvm_assign_ioeventfd_idx(kvm, KVM_FAST_MMIO_BUS, args);
+		if (ret < 0)
+			goto fast_fail;
+	}
+
+	return 0;
+
+fast_fail:
+	kvm_deassign_ioeventfd_idx(kvm, bus_idx, args);
+fail:
+	return ret;
 }
 
 int

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Thomas Huth <[email protected]>

commit 3eb4ee68254235e4f47bc0410538fcdaede39589 upstream.

Access to the kvm->buses (like with the kvm_io_bus_read() and -write() functions) has to be protected via the kvm->srcu lock.
The kvmppc_h_logical_ci_load() and -store() functions are missing this lock so far, so let's add it there, too.
This fixes the problem that the kernel reports "suspicious RCU usage" when lock debugging is enabled.

---
 arch/powerpc/kvm/book3s.c |    6 ++++++
 1 file changed, 6 insertions(+)

@@ -826,12 +826,15 @@ int kvmppc_h_logical_ci_load(struct kvm_
 	unsigned long size = kvmppc_get_gpr(vcpu, 4);
 	unsigned long addr = kvmppc_get_gpr(vcpu, 5);
 	u64 buf;
+	int srcu_idx;
 	int ret;
 
 	if (!is_power_of_2(size) || (size > sizeof(buf)))
 		return H_TOO_HARD;
 
+	srcu_idx = srcu_read_lock(&vcpu->kvm->srcu);
 	ret = kvm_io_bus_read(vcpu, KVM_MMIO_BUS, addr, size, &buf);
+	srcu_read_unlock(&vcpu->kvm->srcu, srcu_idx);
 	if (ret != 0)
 		return H_TOO_HARD;
 

@@ -866,6 +869,7 @@ int kvmppc_h_logical_ci_store(struct kvm
 	unsigned long addr = kvmppc_get_gpr(vcpu, 5);
 	unsigned long val = kvmppc_get_gpr(vcpu, 6);
 	u64 buf;
+	int srcu_idx;
 	int ret;
 
 	switch (size) {

@@ -889,7 +893,9 @@ int kvmppc_h_logical_ci_store(struct kvm
 		return H_TOO_HARD;
 	}
 
+	srcu_idx = srcu_read_lock(&vcpu->kvm->srcu);
 	ret = kvm_io_bus_write(vcpu, KVM_MMIO_BUS, addr, size, &buf);
+	srcu_read_unlock(&vcpu->kvm->srcu, srcu_idx);
 	if (ret != 0)
 		return H_TOO_HARD;
 

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: "Gautham R. Shenoy" <[email protected]>

commit 7e022e717f54897e396504306d0c9b61452adf4e upstream.

In guest_exit_cont we call kvmhv_commence_exit which expects the trap number as the argument. However r3 doesn't contain the trap number at this point and as a result we would be calling the function with a spurious trap number.

Fix this by copying r12 into r3 before calling kvmhv_commence_exit as r12 contains the trap number.

---
 arch/powerpc/kvm/book3s_hv_rmhandlers.S |    1 +
 1 file changed, 1 insertion(+)

@@ -1171,6 +1171,7 @@ mc_cont:
 	bl	kvmhv_accumulate_time
 #endif
 
+	mr 	r3, r12
 	/* Increment exit count, poke other threads to exit */
 	bl	kvmhv_commence_exit
 	nop

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andy Grover <[email protected]>

commit 76c28f1fcfeb42b47f798fe498351ee1d60086ae upstream.

Revert commit 1997e6259, which causes double brackets on ipv6 inaddr_any addresses.

Since we have np_sockaddr, if we need a textual representation we can use "%pISc".

Change iscsit_add_network_portal() and iscsit_add_np() signatures to remove *ip_str parameter.

Fix and extend some comments earlier in the function.

Tested to work for :: and ::1 via iscsiadm, previously :: failed, see
https://bugzilla.redhat.com/show_bug.cgi?id=1249107 .

---
 drivers/target/iscsi/iscsi_target.c          |   33 +++++++++++++--------------
 drivers/target/iscsi/iscsi_target.h          |    2 -
 drivers/target/iscsi/iscsi_target_configfs.c |   14 +++++------
 drivers/target/iscsi/iscsi_target_login.c    |    8 +++---
 drivers/target/iscsi/iscsi_target_tpg.c      |   15 +++++-------
 drivers/target/iscsi/iscsi_target_tpg.h      |    2 -
 include/target/iscsi/iscsi_target_core.h     |    1 
 7 files changed, 36 insertions(+), 39 deletions(-)

@@ -341,7 +341,6 @@ static struct iscsi_np *iscsit_get_np(
 
 struct iscsi_np *iscsit_add_np(
 	struct __kernel_sockaddr_storage *sockaddr,
-	char *ip_str,
 	int network_transport)
 {
 	struct sockaddr_in *sock_in;

@@ -370,11 +369,9 @@ struct iscsi_np *iscsit_add_np(
 	np->np_flags |= NPF_IP_NETWORK;
 	if (sockaddr->ss_family == AF_INET6) {
 		sock_in6 = (struct sockaddr_in6 *)sockaddr;
-		snprintf(np->np_ip, IPV6_ADDRESS_SPACE, "%s", ip_str);
 		np->np_port = ntohs(sock_in6->sin6_port);
 	} else {
 		sock_in = (struct sockaddr_in *)sockaddr;
-		sprintf(np->np_ip, "%s", ip_str);
 		np->np_port = ntohs(sock_in->sin_port);
 	}
 

@@ -411,8 +408,8 @@ struct iscsi_np *iscsit_add_np(
 	list_add_tail(&np->np_list, &g_np_list);
 	mutex_unlock(&np_lock);
 
-	pr_debug("CORE[0] - Added Network Portal: %s:%hu on %s\n",
-		np->np_ip, np->np_port, np->np_transport->name);
+	pr_debug("CORE[0] - Added Network Portal: %pISc:%hu on %s\n",
+		&np->np_sockaddr, np->np_port, np->np_transport->name);
 
 	return np;
 }

@@ -481,8 +478,8 @@ int iscsit_del_np(struct iscsi_np *np)
 	list_del(&np->np_list);
 	mutex_unlock(&np_lock);
 
-	pr_debug("CORE[0] - Removed Network Portal: %s:%hu on %s\n",
-		np->np_ip, np->np_port, np->np_transport->name);
+	pr_debug("CORE[0] - Removed Network Portal: %pISc:%hu on %s\n",
+		&np->np_sockaddr, np->np_port, np->np_transport->name);
 
 	iscsit_put_transport(np->np_transport);
 	kfree(np);

@@ -3467,7 +3464,6 @@ iscsit_build_sendtargets_response(struct
 						tpg_np_list) {
 				struct iscsi_np *np = tpg_np->tpg_np;
 				bool inaddr_any = iscsit_check_inaddr_any(np);
-				char *fmt_str;
 
 				if (np->np_network_transport != network_transport)
 					continue;

@@ -3495,15 +3491,18 @@ iscsit_build_sendtargets_response(struct
 					}
 				}
 
-				if (np->np_sockaddr.ss_family == AF_INET6)
-					fmt_str = "TargetAddress=[%s]:%hu,%hu";
-				else
-					fmt_str = "TargetAddress=%s:%hu,%hu";
-
-				len = sprintf(buf, fmt_str,
-					inaddr_any ? conn->local_ip : np->np_ip,
-					np->np_port,
-					tpg->tpgt);
+				if (inaddr_any) {
+					len = sprintf(buf, "TargetAddress="
+						      "%s:%hu,%hu",
+						      conn->local_ip,
+						      np->np_port,
+						      tpg->tpgt);
+				} else {
+					len = sprintf(buf, "TargetAddress="
+						      "%pISpc,%hu",
+						      &np->np_sockaddr,
+						      tpg->tpgt);
+				}
 				len += 1;
 
 				if ((len + payload_len) > buffer_len) {

@@ -13,7 +13,7 @@ extern int iscsit_deaccess_np(struct isc
 extern bool iscsit_check_np_match(struct __kernel_sockaddr_storage *,
 				struct iscsi_np *, int);
 extern struct iscsi_np *iscsit_add_np(struct __kernel_sockaddr_storage *,
-				char *, int);
+				int);
 extern int iscsit_reset_np_thread(struct iscsi_np *, struct iscsi_tpg_np *,
 				struct iscsi_portal_group *, bool);
 extern int iscsit_del_np(struct iscsi_np *);

@@ -100,7 +100,7 @@ static ssize_t lio_target_np_store_sctp(
 		 * Use existing np->np_sockaddr for SCTP network portal reference
 		 */
 		tpg_np_sctp = iscsit_tpg_add_network_portal(tpg, &np->np_sockaddr,
-					np->np_ip, tpg_np, ISCSI_SCTP_TCP);
+					tpg_np, ISCSI_SCTP_TCP);
 		if (!tpg_np_sctp || IS_ERR(tpg_np_sctp))
 			goto out;
 	} else {

@@ -178,7 +178,7 @@ static ssize_t lio_target_np_store_iser(
 		}
 
 		tpg_np_iser = iscsit_tpg_add_network_portal(tpg, &np->np_sockaddr,
-				np->np_ip, tpg_np, ISCSI_INFINIBAND);
+				tpg_np, ISCSI_INFINIBAND);
 		if (IS_ERR(tpg_np_iser)) {
 			rc = PTR_ERR(tpg_np_iser);
 			goto out;

@@ -249,8 +249,8 @@ static struct se_tpg_np *lio_target_call
 			return ERR_PTR(-EINVAL);
 		}
 		str++; /* Skip over leading "[" */
-		*str2 = '\0'; /* Terminate the IPv6 address */
-		str2++; /* Skip over the "]" */
+		*str2 = '\0'; /* Terminate the unbracketed IPv6 address */
+		str2++; /* Skip over the \0 */
 		port_str = strstr(str2, ":");
 		if (!port_str) {
 			pr_err("Unable to locate \":port\""

@@ -317,7 +317,7 @@ static struct se_tpg_np *lio_target_call
 	 * sys/kernel/config/iscsi/$IQN/$TPG/np/$IP:$PORT/
 	 *
 	 */
-	tpg_np = iscsit_tpg_add_network_portal(tpg, &sockaddr, str, NULL,
+	tpg_np = iscsit_tpg_add_network_portal(tpg, &sockaddr, NULL,
 				ISCSI_TCP);
 	if (IS_ERR(tpg_np)) {
 		iscsit_put_tpg(tpg);

@@ -345,8 +345,8 @@ static void lio_target_call_delnpfromtpg
 
 	se_tpg = &tpg->tpg_se_tpg;
 	pr_debug("LIO_Target_ConfigFS: DEREGISTER -> %s TPGT: %hu"
-		" PORTAL: %s:%hu\n", config_item_name(&se_tpg->se_tpg_wwn->wwn_group.cg_item),
-		tpg->tpgt, tpg_np->tpg_np->np_ip, tpg_np->tpg_np->np_port);
+		" PORTAL: %pISc:%hu\n", config_item_name(&se_tpg->se_tpg_wwn->wwn_group.cg_item),
+		tpg->tpgt, &tpg_np->tpg_np->np_sockaddr, tpg_np->tpg_np->np_port);
 
 	ret = iscsit_tpg_del_network_portal(tpg, tpg_np);
 	if (ret < 0)

@@ -879,8 +879,8 @@ static void iscsi_handle_login_thread_ti
 	struct iscsi_np *np = (struct iscsi_np *) data;
 
 	spin_lock_bh(&np->np_thread_lock);
-	pr_err("iSCSI Login timeout on Network Portal %s:%hu\n",
-			np->np_ip, np->np_port);
+	pr_err("iSCSI Login timeout on Network Portal %pISc:%hu\n",
+			&np->np_sockaddr, np->np_port);
 
 	if (np->np_login_timer_flags & ISCSI_TF_STOP) {
 		spin_unlock_bh(&np->np_thread_lock);

@@ -1358,8 +1358,8 @@ static int __iscsi_target_login_thread(s
 	spin_lock_bh(&np->np_thread_lock);
 	if (np->np_thread_state != ISCSI_NP_THREAD_ACTIVE) {
 		spin_unlock_bh(&np->np_thread_lock);
-		pr_err("iSCSI Network Portal on %s:%hu currently not"
-			" active.\n", np->np_ip, np->np_port);
+		pr_err("iSCSI Network Portal on %pISc:%hu currently not"
+			" active.\n", &np->np_sockaddr, np->np_port);
 		iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
 				ISCSI_LOGIN_STATUS_SVC_UNAVAILABLE);
 		goto new_sess_out;

@@ -460,7 +460,6 @@ static bool iscsit_tpg_check_network_por
 struct iscsi_tpg_np *iscsit_tpg_add_network_portal(
 	struct iscsi_portal_group *tpg,
 	struct __kernel_sockaddr_storage *sockaddr,
-	char *ip_str,
 	struct iscsi_tpg_np *tpg_np_parent,
 	int network_transport)
 {