4.7.7-stable review

Signed-off-by Tejun Heo <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/cpuset.c |   17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

kernel/cpuset.c +14 -3

@@ -325,8 +325,7 @@ static struct file_system_type cpuset_fs
 /*
  * Return in pmask the portion of a cpusets's cpus_allowed that
  * are online.  If none are online, walk up the cpuset hierarchy
- * until we find one that does have some online cpus.  The top
- * cpuset always has some cpus online.
+ * until we find one that does have some online cpus.
  *
  * One way or another, we guarantee to return some non-empty subset
  * of cpu_online_mask.

@@ -335,8 +334,20 @@ static struct file_system_type cpuset_fs
  */
 static void guarantee_online_cpus(struct cpuset *cs, struct cpumask *pmask)
 {
-	while (!cpumask_intersects(cs->effective_cpus, cpu_online_mask))
+	while (!cpumask_intersects(cs->effective_cpus, cpu_online_mask)) {
 		cs = parent_cs(cs);
+		if (unlikely(!cs)) {
+			/*
+			 * The top cpuset doesn't have any online cpu as a
+			 * consequence of a race between cpuset_hotplug_work
+			 * and cpu hotplug notifier.  But we know the top
+			 * cpuset's effective_cpus is on its way to to be
+			 * identical to cpu_online_mask.
+			 */
+			cpumask_copy(pmask, cpu_online_mask);
+			return;
+		}
+	}
 	cpumask_and(pmask, cs->effective_cpus, cpu_online_mask);
 }

Greg Kroah-Hartman

author maintainer

2016-10-06 08:27 UTC #3 lore raw

PATCH 3/141 scripts/recordmcount.c: account for .softirqentry.text

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dmitry Vyukov <[email protected]>

commit e436fd61a8f62cb7a16310a42b95ab076ff72eff upstream.

be7635e7287e ("arch, ftrace: for KASAN put hard/soft IRQ entries into separate sections") added .softirqentry.text section, but it was not added to recordmcount. So functions in the section are untracable. Add the section to scripts/recordmcount.c and scripts/recordmcount.pl.

Fixes be7635e7287e ("arch, ftrace: for KASAN put hard/soft IRQ entries into separate sections")

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Dmitry Vyukov <[email protected]>

Acked-by Steve Rostedt <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 scripts/recordmcount.c  |    1 +
 scripts/recordmcount.pl |    1 +
 2 files changed, 2 insertions(+)

scripts/recordmcount.c +1 -0

@@ -363,6 +363,7 @@ is_mcounted_section_name(char const *con
 		strcmp(".sched.text",    txtname) == 0 ||
 		strcmp(".spinlock.text", txtname) == 0 ||
 		strcmp(".irqentry.text", txtname) == 0 ||
+		strcmp(".softirqentry.text", txtname) == 0 ||
 		strcmp(".kprobes.text", txtname) == 0 ||
 		strcmp(".text.unlikely", txtname) == 0;
 }

scripts/recordmcount.pl +1 -0

@@ -134,6 +134,7 @@ my %text_sections = (
      ".sched.text" => 1,
      ".spinlock.text" => 1,
      ".irqentry.text" => 1,
+     ".softirqentry.text" => 1,
      ".kprobes.text" => 1,
      ".text.unlikely" => 1,
 );

Greg Kroah-Hartman

author maintainer

2016-10-06 08:27 UTC #4 lore raw

PATCH 4/141 mtd: nand: davinci: Reinitialize the HW ECC engine in 4bit hwctl

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Karl Beldan <[email protected]>

commit f6d7c1b5598b6407c3f1da795dd54acf99c1990c upstream.

This fixes subpage writes when using 4-bit HW ECC.

There has been numerous reports about ECC errors with devices using this driver for a while. Also the 4-bit ECC has been reported as broken with subpages in [1] and with 16 bits NANDs in the driver and in mach* board files both in mainline and in the vendor BSPs.

What I saw with 4-bit ECC on a 16bits NAND (on an LCDK) which got me to try reinitializing the ECC engine:
- R/W on whole pages properly generates/checks RS code
- try writing the 1st subpage only of a blank page, the subpage is well written and the RS code properly generated, re-reading the same page the HW detects some ECC error, reading the same page again no ECC error is detected

Note that the ECC engine is already reinitialized in the 1-bit case.

Tested on my LCDK with UBI+UBIFS using subpages.
This could potentially get rid of the issue workarounded in [1].

[1] 28c015a9daab ("mtd: davinci-nand: disable subpage write for keystone-nand")

Fixes 6a4123e581b3 ("mtd: nand: davinci_nand, 4-bit ECC for smallpage")

Signed-off-by Karl Beldan <[email protected]>

Acked-by Boris Brezillon <[email protected]>

Signed-off-by Brian Norris <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/mtd/nand/davinci_nand.c |    3 +++
 1 file changed, 3 insertions(+)

drivers/mtd/nand/davinci_nand.c +3 -0

@@ -240,6 +240,9 @@ static void nand_davinci_hwctl_4bit(stru
 	unsigned long flags;
 	u32 val;
 
+	/* Reset ECC hardware */
+	davinci_nand_readl(info, NAND_4BIT_ECC1_OFFSET);
+
 	spin_lock_irqsave(&davinci_nand_lock, flags);
 
 	/* Start 4-bit ECC calculation for read/write */

Greg Kroah-Hartman

author maintainer

2016-10-06 08:27 UTC #8 lore raw

PATCH 8/141 x86/boot: Initialize FPU and X86_FEATURE_ALWAYS even if we dont have CPUID

Link http://lkml.kernel.org/r/8de723afbf0811071185039f9088733188b606c9.1475103911.git.luto@kernel.org open here

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andy Lutomirski <[email protected]>

commit 05fb3c199bb09f5b85de56cc3ede194ac95c5e1f upstream.

Otherwise arch_task_struct_size == 0 and we die. While we're at it, set X86_FEATURE_ALWAYS, too.

Reported-by David Saggiorato <[email protected]>

Tested-by David Saggiorato <[email protected]>

Signed-off-by Andy Lutomirski <[email protected]>

Cc Borislav Petkov <[email protected]>

Cc Brian Gerst <[email protected]>

Cc Dave Hansen <[email protected]>

Cc Denys Vlasenko <[email protected]>

Cc H. Peter Anvin <[email protected]>

Cc Josh Poimboeuf <[email protected]>

Cc Linus Torvalds <[email protected]>

Cc Peter Zijlstra <[email protected]>

Cc Thomas Gleixner <[email protected]>

Fixes aaeb5c01c5b ("x86/fpu, sched: Introduce CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT and use it on x86")

Signed-off-by Ingo Molnar <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/x86/kernel/cpu/common.c |   29 ++++++++++++++---------------
 1 file changed, 14 insertions(+), 15 deletions(-)

arch/x86/kernel/cpu/common.c +14 ~~-15~~

@@ -804,21 +804,20 @@ static void __init early_identify_cpu(st
 		identify_cpu_without_cpuid(c);
 
 	/* cyrix could have cpuid enabled via c_identify()*/
-	if (!have_cpuid_p())
-		return;
-
-	cpu_detect(c);
-	get_cpu_vendor(c);
-	get_cpu_cap(c);
-
-	if (this_cpu->c_early_init)
-		this_cpu->c_early_init(c);
-
-	c->cpu_index = 0;
-	filter_cpuid_features(c, false);
-
-	if (this_cpu->c_bsp_init)
-		this_cpu->c_bsp_init(c);
+	if (have_cpuid_p()) {
+		cpu_detect(c);
+		get_cpu_vendor(c);
+		get_cpu_cap(c);
+
+		if (this_cpu->c_early_init)
+			this_cpu->c_early_init(c);
+
+		c->cpu_index = 0;
+		filter_cpuid_features(c, false);
+
+		if (this_cpu->c_bsp_init)
+			this_cpu->c_bsp_init(c);
+	}
 
 	setup_force_cpu_cap(X86_FEATURE_ALWAYS);
 	fpu__init_system(c);

Greg Kroah-Hartman

author maintainer

2016-10-06 08:27 UTC #12 lore raw

PATCH 13/141 ARM: 8617/1: dma: fix dma_max_pfn()

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Roger Quadros <[email protected]>

commit d248220f0465b818887baa9829e691fe662b2c5e upstream.

Since commit 6ce0d2001692 ("ARM: dma: Use dma_pfn_offset for dma address translation"), dma_to_pfn() already returns the PFN with the physical memory start offset so we don't need to add it again.

This fixes USB mass storage lock-up problem on systems that can't do DMA over the entire physical memory range (e.g.) Keystone 2 systems with 4GB RAM can only do DMA over the first 2GB. [K2E-EVM].

What happens there is that without this patch SCSI layer sets a wrong bounce buffer limit in scsi_calculate_bounce_limit() for the USB mass storage device. dma_max_pfn() evaluates to 0x8fffff and bounce_limit is set to 0x8fffff000 whereas maximum DMA'ble physical memory on Keystone 2 is 0x87fffffff. This results in non DMA'ble pages being given to the USB controller and hence the lock-up.

NOTE: in the above case, USB-SCSI-device's dma_pfn_offset was showing as 0. This should have really been 0x780000 as on K2e, LOWMEM_START is 0x80000000 and HIGHMEM_START is 0x800000000. DMA zone is 2GB so dma_max_pfn should be 0x87ffff. The incorrect dma_pfn_offset for the USB storage device is because USB devices are not correctly inheriting the dma_pfn_offset from the USB host controller. This will be fixed by a separate patch.

Fixes 6ce0d2001692 ("ARM: dma: Use dma_pfn_offset for dma address translation")

Cc Greg Kroah-Hartman <[email protected]>

Cc Santosh Shilimkar <[email protected]>

Cc Arnd Bergmann <[email protected]>

Cc Olof Johansson <[email protected]>

Cc Catalin Marinas <[email protected]>

Cc Linus Walleij <[email protected]>

Reported-by Grygorii Strashko <[email protected]>

Signed-off-by Roger Quadros <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/arm/include/asm/dma-mapping.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

arch/arm/include/asm/dma-mapping.h +1 -1

@@ -112,7 +112,7 @@ static inline dma_addr_t virt_to_dma(str
 /* The ARM override for dma_max_pfn() */
 static inline unsigned long dma_max_pfn(struct device *dev)
 {
-	return PHYS_PFN_OFFSET + dma_to_pfn(dev, *dev->dma_mask);
+	return dma_to_pfn(dev, *dev->dma_mask);
 }
 #define dma_max_pfn(dev) dma_max_pfn(dev)

Greg Kroah-Hartman

author maintainer

2016-10-06 08:27 UTC #15 lore raw

PATCH 16/141 pinctrl: uniphier: fix .pin_dbg_show() callback

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Masahiro Yamada <[email protected]>

commit 10ef8277ec658bf6619da9b3fd65c2db7353c2a4 upstream.

Without this, reading the "pins" in the debugfs causes kernel BUG.

Fixes 6e9088920258 ("pinctrl: UniPhier: add UniPhier pinctrl core support")

Signed-off-by Masahiro Yamada <[email protected]>

Signed-off-by Linus Walleij <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/pinctrl/uniphier/pinctrl-uniphier-core.c |    6 ++++++
 1 file changed, 6 insertions(+)

drivers/pinctrl/uniphier/pinctrl-uniphier-core.c +6 -0

@@ -73,6 +73,12 @@ static void uniphier_pctl_pin_dbg_show(s
 	case UNIPHIER_PIN_PULL_DOWN:
 		pull_dir = "DOWN";
 		break;
+	case UNIPHIER_PIN_PULL_UP_FIXED:
+		pull_dir = "UP(FIXED)";
+		break;
+	case UNIPHIER_PIN_PULL_DOWN_FIXED:
+		pull_dir = "DOWN(FIXED)";
+		break;
 	case UNIPHIER_PIN_PULL_NONE:
 		pull_dir = "NONE";
 		break;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:27 UTC #29 lore raw

PATCH 31/141 iwlwifi: pcie: fix access to scratch buffer

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sara Sharon <[email protected]>

commit d5d0689aefc59c6a5352ca25d7e6d47d03f543ce upstream.

This fixes a pretty ancient bug that hasn't manifested itself until now.
The scratchbuf for command queue is allocated only for 32 slots but is accessed with the queue write pointer - which can be up to 256.
Since the scratch buf size was 16 and there are up to 256 TFDs we never passed a page boundary when accessing the scratch buffer, but when attempting to increase the size of the scratch buffer a panic was quick to follow when trying to access the address resulted in a page boundary.

Signed-off-by Sara Sharon <[email protected]>

Fixes 38c0f334b359 ("iwlwifi: use coherent DMA memory for command header")

Signed-off-by Luca Coelho <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/intel/iwlwifi/pcie/tx.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/net/wireless/intel/iwlwifi/pcie/tx.c +2 -2

@@ -1595,9 +1595,9 @@ static int iwl_pcie_enqueue_hcmd(struct
 
 	/* start the TFD with the scratchbuf */
 	scratch_size = min_t(int, copy_size, IWL_HCMD_SCRATCHBUF_SIZE);
-	memcpy(&txq->scratchbufs[q->write_ptr], &out_cmd->hdr, scratch_size);
+	memcpy(&txq->scratchbufs[idx], &out_cmd->hdr, scratch_size);
 	iwl_pcie_txq_build_tfd(trans, txq,
-			       iwl_pcie_get_scratchbuf_dma(txq, q->write_ptr),
+			       iwl_pcie_get_scratchbuf_dma(txq, idx),
 			       scratch_size, true);
 
 	/* map first command fragment, if any remains */

Greg Kroah-Hartman

author maintainer

2016-10-06 08:27 UTC #30 lore raw

PATCH 32/141 iwlwifi: mvm: free RX reorder buffer on restart

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sara Sharon <[email protected]>

commit 60dec5233cd8651860e8010c953d116fb0f1ba86 upstream.

Restart flow zeroes the rx_ba_sessions counter. Mac80211 asks driver to tear down of the session only afterwards, and as a result driver didn't free the data. Fix it.

Signed-off-by Sara Sharon <[email protected]>

Fixes 10b2b2019d81 ("iwlwifi: mvm: add infrastructure for tracking BA session in driver")

Signed-off-by Luca Coelho <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/intel/iwlwifi/mvm/sta.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

drivers/net/wireless/intel/iwlwifi/mvm/sta.c +4 -3

@@ -1374,11 +1374,12 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *m
 		 */
 		WARN_ON(rcu_access_pointer(mvm->baid_map[baid]));
 		rcu_assign_pointer(mvm->baid_map[baid], baid_data);
-	} else if (mvm->rx_ba_sessions > 0) {
+	} else  {
 		u8 baid = mvm_sta->tid_to_baid[tid];
 
-		/* check that restart flow didn't zero the counter */
-		mvm->rx_ba_sessions--;
+		if (mvm->rx_ba_sessions > 0)
+			/* check that restart flow didn't zero the counter */
+			mvm->rx_ba_sessions--;
 		if (!iwl_mvm_has_new_rx_api(mvm))
 			return 0;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:27 UTC #31 lore raw

PATCH 34/141 iwlwifi: mvm: dont use ret when not initialised

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Emmanuel Grumbach <[email protected]>

commit ff6e58e648ed5f3cc43891767811d5c3c88bbd41 upstream.

fw-dbg code return ret but that variable was either 0 or not initialised. Return 0 always.

Signed-off-by Emmanuel Grumbach <[email protected]>

Fixes 6a95126763fb ("iwlwifi: mvm: send dbg config hcmds to fw if set in tlv")

Signed-off-by Luca Coelho <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c +2 -1

@@ -960,5 +960,6 @@ int iwl_mvm_start_fw_dbg_conf(struct iwl
 	}
 
 	mvm->fw_dbg_conf = conf_id;
-	return ret;
+
+	return 0;
 }

Greg Kroah-Hartman

author maintainer

2016-10-06 08:27 UTC #33 lore raw

PATCH 36/141 gpio: sa1100: fix irq probing for ucb1x00

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Russell King <[email protected]>

commit 56beac95cb88c188d2a885825a5da131edb41fe3 upstream.

ucb1x00 has used IRQ probing since it's dawn to find the GPIO interrupt that it's connected to. However, commit 23393d49fb75 ("gpio: kill off set_irq_flags usage") broke this by disabling IRQ probing on GPIO interrupts. Fix this.

Fixes 23393d49fb75 ("gpio: kill off set_irq_flags usage")

Signed-off-by Linus Walleij <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/gpio/gpio-sa1100.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/gpio/gpio-sa1100.c +1 -1

@@ -155,7 +155,7 @@ static int sa1100_gpio_irqdomain_map(str
 {
 	irq_set_chip_and_handler(irq, &sa1100_gpio_irq_chip,
 				 handle_edge_irq);
-	irq_set_noprobe(irq);
+	irq_set_probe(irq);
 
 	return 0;
 }

Greg Kroah-Hartman

author maintainer

2016-10-06 08:27 UTC #37 lore raw

PATCH 40/141 i40iw: Change mem_resources pointer to a u8

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Shiraz Saleem <[email protected]>

commit 6c7d46fdb8165ece4b0a17fb8f0b9320dbfeffc2 upstream.

iwdev->mem_resources is incorrectly defined as an unsigned long instead of u8. As a result, the offset into the dynamic allocated structures in i40iw_initialize_hw_resources() is incorrectly calculated and would lead to writing of memory regions outside of the allocated buffer.

Fixes 8e06af711bf2 ("i40iw: add main, hdr, status")

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/infiniband/hw/i40iw/i40iw.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/infiniband/hw/i40iw/i40iw.h +1 -1

@@ -232,7 +232,7 @@ struct i40iw_device {
 	struct i40e_client *client;
 	struct i40iw_hw hw;
 	struct i40iw_cm_core cm_core;
-	unsigned long *mem_resources;
+	u8 *mem_resources;
 	unsigned long *allocated_qps;
 	unsigned long *allocated_cqs;
 	unsigned long *allocated_mrs;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:28 UTC #42 lore raw

PATCH 45/141 i40iw: Send last streaming mode message for loopback connections

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tatyana Nikolova <[email protected]>

commit 07c72d7d54d138eb2ca37709a5a3d55fbcc01536 upstream.

Send a zero length last streaming mode message for loopback connections to synchronize between accepting QP and connecting QP. This avoids data transfer to start on the accepting QP before the connecting QP is in RTS. Also remove function i40iw_loopback_nop() as it is no longer used.

Fixes f27b4746f378 ("i40iw: add connection management code")

Signed-off-by Tatyana Nikolova <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/infiniband/hw/i40iw/i40iw_cm.c |   22 +---------------------
 1 file changed, 1 insertion(+), 21 deletions(-)

drivers/infiniband/hw/i40iw/i40iw_cm.c +1 ~~-21~~

@@ -3347,26 +3347,6 @@ int i40iw_cm_disconn(struct i40iw_qp *iw
 }
 
 /**
- * i40iw_loopback_nop - Send a nop
- * @qp: associated hw qp
- */
-static void i40iw_loopback_nop(struct i40iw_sc_qp *qp)
-{
-	u64 *wqe;
-	u64 header;
-
-	wqe = qp->qp_uk.sq_base->elem;
-	set_64bit_val(wqe, 0, 0);
-	set_64bit_val(wqe, 8, 0);
-	set_64bit_val(wqe, 16, 0);
-
-	header = LS_64(I40IWQP_OP_NOP, I40IWQPSQ_OPCODE) |
-	    LS_64(0, I40IWQPSQ_SIGCOMPL) |
-	    LS_64(qp->qp_uk.swqe_polarity, I40IWQPSQ_VALID);
-	set_64bit_val(wqe, 24, header);
-}
-
-/**
  * i40iw_qp_disconnect - free qp and close cm
  * @iwqp: associate qp for the connection
  */

@@ -3638,7 +3618,7 @@ int i40iw_accept(struct iw_cm_id *cm_id,
 	} else {
 		if (iwqp->page)
 			iwqp->sc_qp.qp_uk.sq_base = kmap(iwqp->page);
-		i40iw_loopback_nop(&iwqp->sc_qp);
+		dev->iw_priv_qp_ops->qp_send_lsmm(&iwqp->sc_qp, NULL, 0, 0);
 	}
 
 	if (iwqp->page)

Greg Kroah-Hartman

author maintainer

2016-10-06 08:28 UTC #43 lore raw

PATCH 46/141 i40iw: Update hw_iwarp_state

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mustafa Ismail <[email protected]>

commit 866e0f4d73390ee6f5cd68aa92cf74eef3a2b0f2 upstream.

Update iwqp->hw_iwarp_state to reflect the new state of the CQP modify QP operation. This avoids reissuing a CQP operation to modify a QP to a state that it is already in.

Fixes 4e9042e647ff ("i40iw: add hw and utils files")

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/infiniband/hw/i40iw/i40iw_hw.c |    1 +
 1 file changed, 1 insertion(+)

drivers/infiniband/hw/i40iw/i40iw_hw.c +1 -0

@@ -265,6 +265,7 @@ void i40iw_next_iw_state(struct i40iw_qp
 		info.dont_send_fin = false;
 	if (iwqp->sc_qp.term_flags && (state == I40IW_QP_STATE_ERROR))
 		info.reset_tcp_conn = true;
+	iwqp->hw_iwarp_state = state;
 	i40iw_hw_modify_qp(iwqp->iwdev, iwqp, &info, 0);
 }

Greg Kroah-Hartman

author maintainer

2016-10-06 08:28 UTC #45 lore raw

PATCH 48/141 batman-adv: Add missing refcnt for last_candidate

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sven Eckelmann <[email protected]>

commit 936523441bb64cdc9a5b263e8fd2782e70313a57 upstream.

batadv_find_router dereferences last_bonding_candidate from orig_node without making sure that it has a valid reference. This reference has to be retrieved by increasing the reference counter while holding neigh_list_lock. The lock is required to avoid that batadv_last_bonding_replace removes the current last_bonding_candidate, reduces the reference counter and maybe destroys the object in this process.

Fixes f3b3d9018975 ("batman-adv: add bonding again")

Signed-off-by Sven Eckelmann <[email protected]>

Signed-off-by Marek Lindner <[email protected]>

Signed-off-by Simon Wunderlich <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/batman-adv/routing.c |   28 +++++++++++++++++++++++++++-
 1 file changed, 27 insertions(+), 1 deletion(-)

net/batman-adv/routing.c +27 -1

@@ -456,6 +456,29 @@ static int batadv_check_unicast_packet(s
 }
 
 /**
+ * batadv_last_bonding_get - Get last_bonding_candidate of orig_node
+ * @orig_node: originator node whose last bonding candidate should be retrieved
+ *
+ * Return: last bonding candidate of router or NULL if not found
+ *
+ * The object is returned with refcounter increased by 1.
+ */
+static struct batadv_orig_ifinfo *
+batadv_last_bonding_get(struct batadv_orig_node *orig_node)
+{
+	struct batadv_orig_ifinfo *last_bonding_candidate;
+
+	spin_lock_bh(&orig_node->neigh_list_lock);
+	last_bonding_candidate = orig_node->last_bonding_candidate;
+
+	if (last_bonding_candidate)
+		kref_get(&last_bonding_candidate->refcount);
+	spin_unlock_bh(&orig_node->neigh_list_lock);
+
+	return last_bonding_candidate;
+}
+
+/**
  * batadv_last_bonding_replace - Replace last_bonding_candidate of orig_node
  * @orig_node: originator node whose bonding candidates should be replaced
  * @new_candidate: new bonding candidate or NULL

@@ -525,7 +548,7 @@ batadv_find_router(struct batadv_priv *b
 	 * router - obviously there are no other candidates.
 	 */
 	rcu_read_lock();
-	last_candidate = orig_node->last_bonding_candidate;
+	last_candidate = batadv_last_bonding_get(orig_node);
 	if (last_candidate)
 		last_cand_router = rcu_dereference(last_candidate->router);

@@ -617,6 +640,9 @@ next:
 		batadv_orig_ifinfo_put(next_candidate);
 	}
 
+	if (last_candidate)
+		batadv_orig_ifinfo_put(last_candidate);
+
 	return router;
 }

Greg Kroah-Hartman

author maintainer

2016-10-06 08:28 UTC #46 lore raw

PATCH 50/141 irqchip/gicv3: Silence noisy DEBUG_PER_CPU_MAPS warning

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: James Morse <[email protected]>

commit 727653d6ce7103b245eb8041f55dd5885f4c3289 upstream.

gic_raise_softirq() walks the list of cpus using for_each_cpu(), it calls gic_compute_target_list() which advances the iterator by the number of CPUs in the cluster.

If gic_compute_target_list() reaches the last CPU it leaves the iterator pointing at the last CPU. This means the next time round the for_each_cpu() loop cpumask_next() will be called with an invalid CPU.

This triggers a warning when built with CONFIG_DEBUG_PER_CPU_MAPS:

[    3.077738] GICv3: CPU1: found redistributor 1 region 0:0x000000002f120000
[    3.077943] CPU1: Booted secondary processor [410fd0f0]
[    3.078542] ------------[ cut here ]------------
[    3.078746] WARNING: CPU: 1 PID: 0 at ../include/linux/cpumask.h:121 gic_raise_softirq+0x12c/0x170
[    3.078812] Modules linked in:
[    3.078869]
[    3.078930] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.8.0-rc5+ #5188
[    3.078994] Hardware name: Foundation-v8A (DT)
[    3.079059] task: ffff80087a1a0080 task.stack: ffff80087a19c000
[    3.079145] PC is at gic_raise_softirq+0x12c/0x170
[    3.079226] LR is at gic_raise_softirq+0xa4/0x170
[    3.079296] pc : [<ffff0000083ead24>] lr : [<ffff0000083eac9c>] pstate: 200001c9
[    3.081139] Call trace:
[    3.081202] Exception stack(0xffff80087a19fbe0 to 0xffff80087a19fd10)

[    3.082269] [<ffff0000083ead24>] gic_raise_softirq+0x12c/0x170
[    3.082354] [<ffff00000808e614>] smp_send_reschedule+0x34/0x40
[    3.082433] [<ffff0000080e80a0>] resched_curr+0x50/0x88
[    3.082512] [<ffff0000080e89d0>] check_preempt_curr+0x60/0xd0
[    3.082593] [<ffff0000080e8a60>] ttwu_do_wakeup+0x20/0xe8
[    3.082672] [<ffff0000080e8bb8>] ttwu_do_activate+0x90/0xc0
[    3.082753] [<ffff0000080ea9a4>] try_to_wake_up+0x224/0x370
[    3.082836] [<ffff0000080eabc8>] default_wake_function+0x10/0x18
[    3.082920] [<ffff000008103134>] __wake_up_common+0x5c/0xa0
[    3.083003] [<ffff0000081031f4>] __wake_up_locked+0x14/0x20
[    3.083086] [<ffff000008103f80>] complete+0x40/0x60
[    3.083168] [<ffff00000808df7c>] secondary_start_kernel+0x15c/0x1d0
[    3.083240] [<00000000808911a4>] 0x808911a4
[    3.113401] Detected PIPT I-cache on CPU2

Avoid updating the iterator if the next call to cpumask_next() would cause the for_each_cpu() loop to exit.

There is no change to gic_raise_softirq()'s behaviour, (cpumask_next()s eventual call to _find_next_bit() will return early as start >= nbits), this patch just silences the warning.

Fixes 021f653791ad ("irqchip: gic-v3: Initial support for GICv3")

Signed-off-by James Morse <[email protected]>

Acked-by Marc Zyngier <[email protected]>

Cc linux-arm-kernel at lists.infradead.org

Cc Jason Cooper <[email protected]>

Link http://lkml.kernel.org/r/1474306155-3303-1-git-send-email-james.morse at arm.com

Signed-off-by Thomas Gleixner <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/irqchip/irq-gic-v3.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

drivers/irqchip/irq-gic-v3.c +4 -3

@@ -558,7 +558,7 @@ static struct notifier_block gic_cpu_not
 static u16 gic_compute_target_list(int *base_cpu, const struct cpumask *mask,
 				   unsigned long cluster_id)
 {
-	int cpu = *base_cpu;
+	int next_cpu, cpu = *base_cpu;
 	unsigned long mpidr = cpu_logical_map(cpu);
 	u16 tlist = 0;

@@ -572,9 +572,10 @@ static u16 gic_compute_target_list(int *
 
 		tlist |= 1 << (mpidr & 0xf);
 
-		cpu = cpumask_next(cpu, mask);
-		if (cpu >= nr_cpu_ids)
+		next_cpu = cpumask_next(cpu, mask);
+		if (next_cpu >= nr_cpu_ids)
 			goto out;
+		cpu = next_cpu;
 
 		mpidr = cpu_logical_map(cpu);

Greg Kroah-Hartman

author maintainer

2016-10-06 08:28 UTC #49 lore raw

PATCH 53/141 MIPS: uprobes: remove incorrect set_orig_insn

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Marcin Nowakowski <[email protected]>

commit ddabfa5c2e33f1b495f3e0176de7057850915c0b upstream.

Generic kernel code implements a weak version of set_orig_insn that moves cached 'insn' from arch_uprobe to the original code location when the trap is removed.
MIPS variant used arch_uprobe->orig_inst which was never initialised properly, so this code only inserted a nop instead of the original instruction. With that change orig_inst can also be safely removed.

Signed-off-by Marcin Nowakowski <[email protected]>

Fixes 40e084a506eb ('MIPS: Add uprobes support.')

Patchwork: https://patchwork.linux-mips.org/patch/14299/

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/mips/include/asm/uprobes.h |    1 -
 arch/mips/kernel/uprobes.c      |   18 ------------------
 2 files changed, 19 deletions(-)

arch/mips/include/asm/uprobes.h +0 -1

@@ -36,7 +36,6 @@ struct arch_uprobe {
 	unsigned long	resume_epc;
 	u32	insn[2];
 	u32	ixol[2];
-	union	mips_instruction orig_inst[MAX_UINSN_BYTES / 4];
 };
 
 struct arch_uprobe_task {

arch/mips/kernel/uprobes.c +0 ~~-18~~

@@ -280,24 +280,6 @@ int __weak set_swbp(struct arch_uprobe *
 	return uprobe_write_opcode(mm, vaddr, UPROBE_SWBP_INSN);
 }
 
-/**
- * set_orig_insn - Restore the original instruction.
- * @mm: the probed process address space.
- * @auprobe: arch specific probepoint information.
- * @vaddr: the virtual address to insert the opcode.
- *
- * For mm @mm, restore the original opcode (opcode) at @vaddr.
- * Return 0 (success) or a negative errno.
- *
- * This overrides the weak version in kernel/events/uprobes.c.
- */
-int set_orig_insn(struct arch_uprobe *auprobe, struct mm_struct *mm,
-		 unsigned long vaddr)
-{
-	return uprobe_write_opcode(mm, vaddr,
-			*(uprobe_opcode_t *)&auprobe->orig_inst[0].word);
-}
-
 void __weak arch_uprobe_copy_ixol(struct page *page, unsigned long vaddr,
 				  void *src, unsigned long len)
 {

Greg Kroah-Hartman

author maintainer

2016-10-06 08:28 UTC #52 lore raw

PATCH 56/141 MIPS: uprobes: fix use of uninitialised variable

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Marcin Nowakowski <[email protected]>

commit ca86c9ef2b322ebf24772009fdea037688cbdac1 upstream.

arch_uprobe_pre_xol needs to emulate a branch if a branch instruction has been replaced with a breakpoint, but in fact an uninitialised local variable was passed to the emulator routine instead of the original instruction

Signed-off-by Marcin Nowakowski <[email protected]>

Fixes 40e084a506eb ('MIPS: Add uprobes support.')

Patchwork: https://patchwork.linux-mips.org/patch/14300/

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/mips/kernel/uprobes.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

arch/mips/kernel/uprobes.c +2 -3

@@ -157,7 +157,6 @@ bool is_trap_insn(uprobe_opcode_t *insn)
 int arch_uprobe_pre_xol(struct arch_uprobe *aup, struct pt_regs *regs)
 {
 	struct uprobe_task *utask = current->utask;
-	union mips_instruction insn;
 
 	/*
 	 * Now find the EPC where to resume after the breakpoint has been

@@ -168,10 +167,10 @@ int arch_uprobe_pre_xol(struct arch_upro
 		unsigned long epc;
 
 		epc = regs->cp0_epc;
-		__compute_return_epc_for_insn(regs, insn);
+		__compute_return_epc_for_insn(regs,
+			(union mips_instruction) aup->insn[0]);
 		aup->resume_epc = regs->cp0_epc;
 	}
-
 	utask->autask.saved_trap_nr = current->thread.trap_nr;
 	current->thread.trap_nr = UPROBE_TRAP_NR;
 	regs->cp0_epc = current->utask->xol_vaddr;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:28 UTC #55 lore raw

PATCH 59/141 lib/test_hash.c: fix warning in two-dimensional array init

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <[email protected]>

commit ed76b7a131f41c91b0c725d472f9b969d75ce888 upstream.

lib/test_hash.c: In function 'test_hash_init':
lib/test_hash.c:146:2: warning: missing braces around initializer [-Wmissing-braces]

Fixes 468a9428521e7d00 ("<linux/hash.h>: Add support for architecture-specific functions")

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Geert Uytterhoeven <[email protected]>

Acked-by George Spelvin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 lib/test_hash.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

lib/test_hash.c +1 -1

@@ -143,7 +143,7 @@ static int __init
 test_hash_init(void)
 {
 	char buf[SIZE+1];
-	u32 string_or = 0, hash_or[2][33] = { 0 };
+	u32 string_or = 0, hash_or[2][33] = { { 0, } };
 	unsigned tests = 0;
 	unsigned long long h64 = 0;
 	int i, j;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:28 UTC #61 lore raw

PATCH 65/141 regulator: qcom_smd: Fix voltage ranges for pm8x41

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Stephen Boyd <[email protected]>

commit 290284776bb281759b11faa287b8abccaf74bfcb upstream.

The voltage ranges listed here are wrong. The correct ranges can be seen in the "native" spmi regulator driver qcom_spmi-regulator.c at pldo_ranges[], ftsmps_ranges[] and boost_ranges[] for the pldo, ftsmps, and boost type regulators. Port these ranges over to the RPM SMD regulator driver so that we list the appropriate set of supported voltages on pldos.

Doing this allows us to specify a voltage like 3075000 for l24, whereas before that wasn't a supported voltage.

Fixes da65e367b67e ("regulator: Regulator driver for the Qualcomm RPM")

Reviewed-by Andy Gross <[email protected]>

Signed-off-by Mark Brown <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/regulator/qcom_smd-regulator.c |   17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

drivers/regulator/qcom_smd-regulator.c +9 -8

@@ -221,29 +221,30 @@ static const struct regulator_desc pm8x4
 static const struct regulator_desc pm8841_ftsmps = {
 	.linear_ranges = (struct regulator_linear_range[]) {
 		REGULATOR_LINEAR_RANGE(350000,  0, 184, 5000),
-		REGULATOR_LINEAR_RANGE(700000, 185, 339, 10000),
+		REGULATOR_LINEAR_RANGE(1280000, 185, 261, 10000),
 	},
 	.n_linear_ranges = 2,
-	.n_voltages = 340,
+	.n_voltages = 262,
 	.ops = &rpm_smps_ldo_ops,
 };
 
 static const struct regulator_desc pm8941_boost = {
 	.linear_ranges = (struct regulator_linear_range[]) {
-		REGULATOR_LINEAR_RANGE(4000000, 0, 15, 100000),
+		REGULATOR_LINEAR_RANGE(4000000, 0, 30, 50000),
 	},
 	.n_linear_ranges = 1,
-	.n_voltages = 16,
+	.n_voltages = 31,
 	.ops = &rpm_smps_ldo_ops,
 };
 
 static const struct regulator_desc pm8941_pldo = {
 	.linear_ranges = (struct regulator_linear_range[]) {
-		REGULATOR_LINEAR_RANGE( 750000,  0,  30, 25000),
-		REGULATOR_LINEAR_RANGE(1500000, 31, 99, 50000),
+		REGULATOR_LINEAR_RANGE( 750000,  0,  63, 12500),
+		REGULATOR_LINEAR_RANGE(1550000, 64, 126, 25000),
+		REGULATOR_LINEAR_RANGE(3100000, 127, 163, 50000),
 	},
-	.n_linear_ranges = 2,
-	.n_voltages = 100,
+	.n_linear_ranges = 3,
+	.n_voltages = 164,
 	.ops = &rpm_smps_ldo_ops,
 };

Greg Kroah-Hartman

author maintainer

2016-10-06 08:28 UTC #62 lore raw

PATCH 66/141 regulator: qcom_smd: Fix voltage ranges for pma8084 ftsmps and pldo

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Stephen Boyd <[email protected]>

commit c488f0071eacd10a290df4fb34bbdeb4eb8e7888 upstream.

The voltage ranges listed here are wrong. The pma8084 pldo supports three different overlapping voltage ranges with differing step sizes and the pma8084 ftsmps supports two. These ranges can be seen in the "native" spmi regulator driver (qcom_spmi-regulator.c) at pldo_ranges[] and ftsmps_ranges[] respectively. Port these ranges over to the RPM SMD regulator driver so that we list the appropriate set of supported voltages on these types of regulators.

Fixes ee01d0c91ef1 ("regulator: qcom-smd: Add support for PMA8084")

Reviewed-by Andy Gross <[email protected]>

Signed-off-by Mark Brown <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/regulator/qcom_smd-regulator.c |   13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

drivers/regulator/qcom_smd-regulator.c +7 -6

@@ -178,20 +178,21 @@ static const struct regulator_desc pma80
 static const struct regulator_desc pma8084_ftsmps = {
 	.linear_ranges = (struct regulator_linear_range[]) {
 		REGULATOR_LINEAR_RANGE(350000,  0, 184, 5000),
-		REGULATOR_LINEAR_RANGE(700000, 185, 339, 10000),
+		REGULATOR_LINEAR_RANGE(1280000, 185, 261, 10000),
 	},
 	.n_linear_ranges = 2,
-	.n_voltages = 340,
+	.n_voltages = 262,
 	.ops = &rpm_smps_ldo_ops,
 };
 
 static const struct regulator_desc pma8084_pldo = {
 	.linear_ranges = (struct regulator_linear_range[]) {
-		REGULATOR_LINEAR_RANGE(750000,  0,  30, 25000),
-		REGULATOR_LINEAR_RANGE(1500000, 31, 99, 50000),
+		REGULATOR_LINEAR_RANGE( 750000,  0,  63, 12500),
+		REGULATOR_LINEAR_RANGE(1550000, 64, 126, 25000),
+		REGULATOR_LINEAR_RANGE(3100000, 127, 163, 50000),
 	},
-	.n_linear_ranges = 2,
-	.n_voltages = 100,
+	.n_linear_ranges = 3,
+	.n_voltages = 164,
 	.ops = &rpm_smps_ldo_ops,
 };

Greg Kroah-Hartman

author maintainer

2016-10-06 08:28 UTC #63 lore raw

PATCH 69/141 ARM: sa1100: register clocks early

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Russell King <[email protected]>

commit 198b51e8a6a31d3a6f8e9dd9cade3635d0291f26 upstream.

Since we switched to use pxa_timer, we need to provide the OSTIMER0 clock. However, as the clock is initialised early, we need to provide the clock early as well, so that pxa_timer can find it. Adding the clock to the clkdev table at core_initcall() time is way too late.

Move the initialisation earlier.

Fixes ee3a4020f7c9 ("ARM: 8250/1: sa1100: provide OSTIMER0 clock for pxa_timer")

Acked-by Dmitry Eremin-Solenikov <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/arm/mach-sa1100/clock.c   |    3 +--
 arch/arm/mach-sa1100/generic.c |    1 +
 arch/arm/mach-sa1100/generic.h |    2 ++
 3 files changed, 4 insertions(+), 2 deletions(-)

arch/arm/mach-sa1100/clock.c +1 -2

@@ -140,9 +140,8 @@ static struct clk_lookup sa11xx_clkregs[
 	CLKDEV_INIT(NULL, "OSTIMER0", &clk_36864),
 };
 
-static int __init sa11xx_clk_init(void)
+int __init sa11xx_clk_init(void)
 {
 	clkdev_add_table(sa11xx_clkregs, ARRAY_SIZE(sa11xx_clkregs));
 	return 0;
 }
-core_initcall(sa11xx_clk_init);

arch/arm/mach-sa1100/generic.c +1 -0

@@ -388,6 +388,7 @@ void __init sa1100_init_irq(void)
 	sa11x0_init_irq_nodt(IRQ_GPIO0_SC, irq_resource.start);
 
 	sa1100_init_gpio();
+	sa11xx_clk_init();
 }
 
 /*

arch/arm/mach-sa1100/generic.h +2 -0

@@ -44,3 +44,5 @@ int sa11x0_pm_init(void);
 #else
 static inline int sa11x0_pm_init(void) { return 0; }
 #endif
+
+int sa11xx_clk_init(void);

Greg Kroah-Hartman

author maintainer

2016-10-06 08:28 UTC #64 lore raw

PATCH 70/141 ARM: sa1100: fix 3.6864MHz clock

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Russell King <[email protected]>

commit 02ba38a5b6d6e0bc89c7b74651f1873055028a56 upstream.

pxa_timer wants to be able to call clk_enable() etc on this clock, but our clk_enable() implementation expects non-NULL enable/disable operations. Provide these dummy implementations.

Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = c0204000
[00000000] *pgd=00000000
Internal error: Oops: 80000005 [#1] ARM
Modules linked in:
CPU: 0 PID: 0 Comm: swapper Not tainted 4.8.0-rc2+ #887
Hardware name: Intel-Assabet
task: c0644590 task.stack: c0640000
PC is at 0x0
LR is at clk_enable+0x40/0x58
pc : [<00000000>]    lr : [<c021b178>]    psr: 600000d3

sp : c0641f60 ip : c0641f4c fp : c0641f74
r10: c1ffc7a0 r9 : 6901b118 r8 : 00000001
r7 : c0639a34 r6 : 0000001b r5 : a00000d3 r4 : c0645d70 r3 : c0645d78 r2 : 00000001 r1 : c0641ef0 r0 : c0645d70
Flags: nZCv IRQs off FIQs off Mode SVC_32 ISA ARM Segment none
Control: c020717f Table: c020717f DAC: 00000053 Process swapper (pid: 0, stack limit = 0xc0640188)

Stack: (0xc0641f60 to 0xc0642000)

1f60: 00384000 c08762e4 c0641f98 c0641f78 c063308c c021b144 00000000 00000000 1f80: 00000000 c0660b20 ffffffff c0641fa8 c0641f9c c06220ec c0633058 c0641fb8 1fa0: c0641fac c061f114 c06220dc c0641ff4 c0641fbc c061bb68 c061f0fc ffffffff 1fc0: ffffffff 00000000 c061b6cc c0639a34 c0660cd4 c0642038 c0639a30 c0645434 1fe0: c0204000 c06380f8 00000000 c0641ff8 c0208048 c061b954 00000000 00000000

Backtrace:
[<c021b138>] (clk_enable) from [<c063308c>] (pxa_timer_nodt_init+0x40/0x120)
 r5:c08762e4 r4:00384000
[<c063304c>] (pxa_timer_nodt_init) from [<c06220ec>] (sa1100_timer_init+0x1c/0x20)
 r6:ffffffff r5:c0660b20 r4:00000000
[<c06220d0>] (sa1100_timer_init) from [<c061f114>] (time_init+0x24/0x2c)
[<c061f0f0>] (time_init) from [<c061bb68>] (start_kernel+0x220/0x42c)
[<c061b948>] (start_kernel) from [<c0208048>] (0xc0208048)
 r10:c06380f8 r8:c0204000 r7:c0645434 r6:c0639a30 r5:c0642038 r4:c0660cd4
Code: bad PC value
---[ end trace 0000000000000000 ]---
Kernel panic - not syncing: Attempted to kill the idle task!

Fixes ee3a4020f7c9 ("ARM: 8250/1: sa1100: provide OSTIMER0 clock for pxa_timer")

Acked-by Dmitry Eremin-Solenikov <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/arm/mach-sa1100/clock.c |    2 ++
 1 file changed, 2 insertions(+)

arch/arm/mach-sa1100/clock.c +2 -0

@@ -125,6 +125,8 @@ static unsigned long clk_36864_get_rate(
 }
 
 static struct clkops clk_36864_ops = {
+	.enable		= clk_cpu_enable,
+	.disable	= clk_cpu_disable,
 	.get_rate	= clk_36864_get_rate,
 };

Greg Kroah-Hartman

author maintainer

2016-10-06 08:28 UTC #70 lore raw

PATCH 76/141 blk-mq: actually hook up defer list when running requests

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Omar Sandoval <[email protected]>

commit 52b9c330c6a8a4b5a1819bdaddf4ec76ab571e81 upstream.

If ->queue_rq() returns BLK_MQ_RQ_QUEUE_OK, we use continue and skip over the rest of the loop body. However, dptr is assigned later in the loop body, and the BLK_MQ_RQ_QUEUE_OK case is exactly the case that we'd want it for.

NVMe isn't actually using BLK_MQ_F_DEFER_ISSUE yet, nor is any other in-tree driver, but if the code's going to be there, it might as well work.

Fixes 74c450521dd8 ("blk-mq: add a 'list' parameter to ->queue_rq()")

Signed-off-by Omar Sandoval <[email protected]>

Signed-off-by Jens Axboe <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 block/blk-mq.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

block/blk-mq.c +1 -1

@@ -784,7 +784,7 @@ static void __blk_mq_run_hw_queue(struct
 		switch (ret) {
 		case BLK_MQ_RQ_QUEUE_OK:
 			queued++;
-			continue;
+			break;
 		case BLK_MQ_RQ_QUEUE_BUSY:
 			list_add(&rq->queuelist, &rq_list);
 			__blk_mq_requeue_request(rq);

Greg Kroah-Hartman

author maintainer

2016-10-06 08:28 UTC #72 lore raw

PATCH 78/141 tile: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: James Hogan <[email protected]>

commit cdf8b4633075f2171d440d2e37c9c2609019a81a upstream.

AT_VECTOR_SIZE_ARCH should be defined with the maximum number of NEW_AUX_ENT entries that ARCH_DLINFO can contain, but it wasn't defined for tile at all even though ARCH_DLINFO will contain one NEW_AUX_ENT for the VDSO address.

This shouldn't be a problem as AT_VECTOR_SIZE_BASE includes space for AT_BASE_PLATFORM which tile doesn't use, but lets define it now and add the comment above ARCH_DLINFO as found in several other architectures to remind future modifiers of ARCH_DLINFO to keep AT_VECTOR_SIZE_ARCH up to date.

Fixes 4a556f4f56da ("tile: implement gettimeofday() via vDSO")

Signed-off-by James Hogan <[email protected]>

Cc Chris Metcalf <[email protected]>

Signed-off-by Chris Metcalf <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/tile/include/asm/elf.h         |    1 +
 arch/tile/include/uapi/asm/auxvec.h |    2 ++
 2 files changed, 3 insertions(+)

arch/tile/include/asm/elf.h +1 -0

@@ -129,6 +129,7 @@ extern int dump_task_regs(struct task_st
 struct linux_binprm;
 extern int arch_setup_additional_pages(struct linux_binprm *bprm,
 				       int executable_stack);
+/* update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT entries changes */
 #define ARCH_DLINFO \
 do { \
 	NEW_AUX_ENT(AT_SYSINFO_EHDR, VDSO_BASE); \

arch/tile/include/uapi/asm/auxvec.h +2 -0

@@ -18,4 +18,6 @@
 /* The vDSO location. */
 #define AT_SYSINFO_EHDR         33
 
+#define AT_VECTOR_SIZE_ARCH 1 /* entries in ARCH_DLINFO */
+
 #endif /* _ASM_TILE_AUXVEC_H */

Greg Kroah-Hartman

author maintainer

2016-10-06 08:28 UTC #74 lore raw

PATCH 80/141 iwlmvm: mvm: set correct state in smart-fifo configuration

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: striebit <[email protected]>

commit 849a9627299100ae3f0ce573fc87d2b476f3bb59 upstream.

Currently the state sent in SF configuration is always FULL_ON.
This commit sets the correct state (e.g. INIT_OFF when station is not associated).

Fixes commit f4a3ee493e69 ("iwlwifi: mvm: Always enable the smart FIFO")

Signed-off-by Shaul Triebitz <[email protected]>

Signed-off-by Luca Coelho <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/intel/iwlwifi/mvm/sf.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/net/wireless/intel/iwlwifi/mvm/sf.c +1 -1

@@ -215,7 +215,7 @@ static int iwl_mvm_sf_config(struct iwl_
 			     enum iwl_sf_state new_state)
 {
 	struct iwl_sf_cfg_cmd sf_cmd = {
-		.state = cpu_to_le32(SF_FULL_ON),
+		.state = cpu_to_le32(new_state),
 	};
 	struct ieee80211_sta *sta;
 	int ret = 0;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:28 UTC #78 lore raw

PATCH 85/141 ath9k: Fix programming of minCCA power threshold

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sven Eckelmann <[email protected]>

commit aaab50fcea78ae3414c3afc25aae8d0603df34d0 upstream.

The function ar9003_hw_apply_minccapwr_thresh takes as second parameter not a pointer to the channel but a boolean value describing whether the channel is 2.4GHz or not. This broke (according to the origin commit) the ETSI regulatory compliance on 5GHz channels.

Fixes 3533bf6b15a0 ("ath9k: Fix regulatory compliance")

Signed-off-by Sven Eckelmann <[email protected]>

Cc Simon Wunderlich <[email protected]>

Cc Sujith Manoharan <[email protected]>

Signed-off-by Kalle Valo <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/ath/ath9k/ar9003_eeprom.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/net/wireless/ath/ath9k/ar9003_eeprom.c +1 -1

@@ -4176,7 +4176,7 @@ static void ath9k_hw_ar9300_set_board_va
 	if (!AR_SREV_9330(ah) && !AR_SREV_9340(ah) && !AR_SREV_9531(ah))
 		ar9003_hw_internal_regulator_apply(ah);
 	ar9003_hw_apply_tuning_caps(ah);
-	ar9003_hw_apply_minccapwr_thresh(ah, chan);
+	ar9003_hw_apply_minccapwr_thresh(ah, is2ghz);
 	ar9003_hw_txend_to_xpa_off_apply(ah, is2ghz);
 	ar9003_hw_thermometer_apply(ah);
 	ar9003_hw_thermo_cal_apply(ah);

Greg Kroah-Hartman

author maintainer

2016-10-06 08:28 UTC #85 lore raw

PATCH 92/141 dmaengine: bcm2835: fix 64-bit warning

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <[email protected]>

commit 4aa819c79bb73f3d1bdf5244d0a0f7f15261504c upstream.

When building this driver on arm64, we get a harmless type mismatch warning:

drivers/dma/bcm2835-dma.c: In function 'bcm2835_dma_fill_cb_chain_with_sg':
include/linux/kernel.h:743:17: warning: comparison of distinct pointer types lacks a cast

  (void) (&_min1 == &_min2);  \
                 ^
drivers/dma/bcm2835-dma.c:409:21: note: in expansion of macro 'min'
    cb->cb->length = min(len, max_len);

This changes the type of the 'len' variable to size_t, which avoids the problem.

Fixes 388cc7a281c0 ("dmaengine: bcm2835: add slave_sg support to bcm2835-dma")

Signed-off-by Vinod Koul <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/dma/bcm2835-dma.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

drivers/dma/bcm2835-dma.c +3 -2

@@ -393,11 +393,12 @@ static void bcm2835_dma_fill_cb_chain_wi
 	unsigned int sg_len)
 {
 	struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
-	size_t max_len = bcm2835_dma_max_frame_length(c);
-	unsigned int i, len;
+	size_t len, max_len;
+	unsigned int i;
 	dma_addr_t addr;
 	struct scatterlist *sgent;
 
+	max_len = bcm2835_dma_max_frame_length(c);
 	for_each_sg(sgl, sgent, sg_len, i) {
 		for (addr = sg_dma_address(sgent), len = sg_dma_len(sgent);
 		     len > 0;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:28 UTC #86 lore raw

PATCH 93/141 dmaengine: at_xdmac: fix debug string

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alexandre Belloni <[email protected]>

commit 3935e08768ff777da6496521b1fc36f72823672c upstream.

mbr_ds is an integer, don't use %pad to print it.

Fixes commit 268914f4e7a0 ("dmaengine: at_xdmac: use %pad format string for dma_addr_t")

Reported-by Dan Carpenter <[email protected]>

Signed-off-by Alexandre Belloni <[email protected]>

Signed-off-by Vinod Koul <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/dma/at_xdmac.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/dma/at_xdmac.c +2 -2

@@ -1195,8 +1195,8 @@ static struct at_xdmac_desc *at_xdmac_me
 	desc->lld.mbr_cfg = chan_cc;
 
 	dev_dbg(chan2dev(chan),
-		"%s: lld: mbr_da=%pad, mbr_ds=%pad, mbr_ubc=0x%08x, mbr_cfg=0x%08x\n",
-		__func__, &desc->lld.mbr_da, &desc->lld.mbr_ds, desc->lld.mbr_ubc,
+		"%s: lld: mbr_da=%pad, mbr_ds=0x%08x, mbr_ubc=0x%08x, mbr_cfg=0x%08x\n",
+		__func__, &desc->lld.mbr_da, desc->lld.mbr_ds, desc->lld.mbr_ubc,
 		desc->lld.mbr_cfg);
 
 	return desc;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:28 UTC #89 lore raw

PATCH 96/141 NFS: Dont drop CB requests with invalid principals

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chuck Lever <[email protected]>

commit a4e187d83d88eeaba6252aac0a2ffe5eaa73a818 upstream.

Before commit 778be232a207 ("NFS do not find client in NFSv4 pg_authenticate"), the Linux callback server replied with RPC_AUTH_ERROR / RPC_AUTH_BADCRED, instead of dropping the CB request. Let's restore that behavior so the server has a chance to do something useful about it, and provide a warning that helps admins correct the problem.

Fixes 778be232a207 ("NFS do not find client in NFSv4 ...")

Signed-off-by Chuck Lever <[email protected]>

Tested-by Steve Wise <[email protected]>

Signed-off-by Anna Schumaker <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/nfs/callback_xdr.c |    6 +++++-
 net/sunrpc/svc.c      |    5 +++++
 2 files changed, 10 insertions(+), 1 deletion(-)

fs/nfs/callback_xdr.c +5 -1

@@ -925,7 +925,7 @@ static __be32 nfs4_callback_compound(str
 	if (hdr_arg.minorversion == 0) {
 		cps.clp = nfs4_find_client_ident(SVC_NET(rqstp), hdr_arg.cb_ident);
 		if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp))
-			return rpc_drop_reply;
+			goto out_invalidcred;
 	}
 
 	cps.minorversion = hdr_arg.minorversion;

@@ -953,6 +953,10 @@ static __be32 nfs4_callback_compound(str
 	nfs_put_client(cps.clp);
 	dprintk("%s: done, status = %u\n", __func__, ntohl(status));
 	return rpc_success;
+
+out_invalidcred:
+	pr_warn_ratelimited("NFS: NFSv4 callback contains invalid cred\n");
+	return rpc_autherr_badcred;
 }
 
 /*

net/sunrpc/svc.c +5 -0

@@ -1194,6 +1194,11 @@ svc_process_common(struct svc_rqst *rqst
 				procp->pc_release(rqstp, NULL, rqstp->rq_resp);
 			goto dropit;
 		}
+		if (*statp == rpc_autherr_badcred) {
+			if (procp->pc_release)
+				procp->pc_release(rqstp, NULL, rqstp->rq_resp);
+			goto err_bad_auth;
+		}
 		if (*statp == rpc_success &&
 		    (xdr = procp->pc_encode) &&
 		    !xdr(rqstp, resv->iov_base+resv->iov_len, rqstp->rq_resp)) {

Greg Kroah-Hartman

author maintainer

2016-10-06 08:28 UTC #90 lore raw

PATCH 97/141 pNFS/files: Fix layoutcommit after a commit to DS

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <[email protected]>

commit 73e6c5d854d3f7f75e8b46d3e54aeb5d83fe6b1f upstream.

According to the errata
https://www.rfc-editor.org/errata_search.php?rfc=5661&eid=2751
we should always send layout commit after a commit to DS.

Fixes bc7d4b8fd091 ("nfs/filelayout: set layoutcommit...")

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/nfs/filelayout/filelayout.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

fs/nfs/filelayout/filelayout.c +1 -2

@@ -375,8 +375,7 @@ static int filelayout_commit_done_cb(str
 		return -EAGAIN;
 	}
 
-	if (data->verf.committed == NFS_UNSTABLE)
-		pnfs_set_layoutcommit(data->inode, data->lseg, data->lwb);
+	pnfs_set_layoutcommit(data->inode, data->lseg, data->lwb);
 
 	return 0;
 }

Greg Kroah-Hartman

author maintainer

2016-10-06 08:28 UTC #92 lore raw

PATCH 99/141 watchdog: core: Clear WDOG_HW_RUNNING before calling the stop function

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Guenter Roeck <[email protected]>

commit 3c10bbde10fe4dca52726e246cefa6b0a1dfbd3e upstream.

WDOG_HW_RUNNING indicates that the hardware watchdog is running while the watchdog device is closed. The flag may be set by the driver when it is instantiated to indicate that the watchdog is running, and that the watchdog core needs to send heartbeat requests to the driver until the watchdog device is opened.

When the watchdog device is closed, the flag can be used by the driver's stop function to indicate to the watchdog core that it was unable to stop the watchdog, and that the watchdog core needs to send heartbeat requests. This only works if the flag is actually cleared when the watchdog is stopped. To avoid having to clear the flag in each driver's stop function, clear it in the watchdog core before calling the stop function.

Reported-by Rasmus Villemoes <[email protected]>

Fixes ee142889e32f ("watchdog: Introduce WDOG_HW_RUNNING flag")

Signed-off-by Guenter Roeck <[email protected]>

Signed-off-by Wim Van Sebroeck <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/watchdog/watchdog_dev.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

drivers/watchdog/watchdog_dev.c +4 -2

@@ -258,10 +258,12 @@ static int watchdog_stop(struct watchdog
 		return -EBUSY;
 	}
 
-	if (wdd->ops->stop)
+	if (wdd->ops->stop) {
+		clear_bit(WDOG_HW_RUNNING, &wdd->status);
 		err = wdd->ops->stop(wdd);
-	else
+	} else {
 		set_bit(WDOG_HW_RUNNING, &wdd->status);
+	}
 
 	if (err == 0) {
 		clear_bit(WDOG_ACTIVE, &wdd->status);

Greg Kroah-Hartman

author maintainer

2016-10-06 08:28 UTC #93 lore raw

PATCH 100/141 cxl: fix potential NULL dereference in free_adapter()

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andrew Donnellan <[email protected]>

commit 8fbaa51d43ef2c6a72849ec34060910723a0365f upstream.

If kzalloc() fails when allocating adapter->guest in cxl_guest_init_adapter(), we call free_adapter() before erroring out. free_adapter() in turn attempts to dereference adapter->guest, which in this case is NULL.

In free_adapter(), skip the adapter->guest cleanup if adapter->guest is NULL.

Fixes 14baf4d9c739 ("cxl: Add guest-specific code")

Reported-by Dan Carpenter <[email protected]>

Signed-off-by Andrew Donnellan <[email protected]>

Signed-off-by Michael Ellerman <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/misc/cxl/guest.c |   16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

drivers/misc/cxl/guest.c +9 -7

@@ -1052,16 +1052,18 @@ static void free_adapter(struct cxl *ada
 	struct irq_avail *cur;
 	int i;
 
-	if (adapter->guest->irq_avail) {
-		for (i = 0; i < adapter->guest->irq_nranges; i++) {
-			cur = &adapter->guest->irq_avail[i];
-			kfree(cur->bitmap);
+	if (adapter->guest) {
+		if (adapter->guest->irq_avail) {
+			for (i = 0; i < adapter->guest->irq_nranges; i++) {
+				cur = &adapter->guest->irq_avail[i];
+				kfree(cur->bitmap);
+			}
+			kfree(adapter->guest->irq_avail);
 		}
-		kfree(adapter->guest->irq_avail);
+		kfree(adapter->guest->status);
+		kfree(adapter->guest);
 	}
-	kfree(adapter->guest->status);
 	cxl_remove_adapter_nr(adapter);
-	kfree(adapter->guest);
 	kfree(adapter);
 }

Greg Kroah-Hartman

author maintainer

2016-10-06 08:28 UTC #96 lore raw

PATCH 103/141 brcmfmac: Fix glob_skb leak in brcmf_sdiod_recv_chain

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Florian Fainelli <[email protected]>

commit 3bdae810721b33061d2e541bd78a70f86ca42af3 upstream.

In case brcmf_sdiod_recv_chain() cannot complete a succeful call to brcmf_sdiod_buffrw, we would be leaking glom_skb and not free it as we should, fix this.

Reported-by coverity (CID 1164856)

Fixes a413e39a38573 ("brcmfmac: fix brcmf_sdcard_recv_chain() for host without sg support")

Signed-off-by Florian Fainelli <[email protected]>

Acked-by Arend van Spriel <[email protected]>

Signed-off-by Kalle Valo <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +3 -1

@@ -722,8 +722,10 @@ int brcmf_sdiod_recv_chain(struct brcmf_
 			return -ENOMEM;
 		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
 					 glom_skb);
-		if (err)
+		if (err) {
+			brcmu_pkt_buf_free_skb(glom_skb);
 			goto done;
+		}
 
 		skb_queue_walk(pktq, skb) {
 			memcpy(skb->data, glom_skb->data, skb->len);

Greg Kroah-Hartman

author maintainer

2016-10-06 08:29 UTC #99 lore raw

PATCH 106/141 staging: comedi: adv_pci1760: Do not return EINVAL for CMDF_ROUND_DOWN.

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Phil Turnbull <[email protected]>

commit c71f20ee76342376e3c4c67cdbe7421d8c4e886e upstream.

The CMDF_ROUND_DOWN case falls through and so always returns -EINVAL.

Fixes 14b93bb6bbf0 ("staging: comedi: adv_pci_dio: separate out PCI-1760 support")

Signed-off-by Phil Turnbull <[email protected]>

Reviewed-by Ian Abbott <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/staging/comedi/drivers/adv_pci1760.c |    1 +
 1 file changed, 1 insertion(+)

drivers/staging/comedi/drivers/adv_pci1760.c +1 -0

@@ -196,6 +196,7 @@ static int pci1760_pwm_ns_to_div(unsigne
 		break;
 	case CMDF_ROUND_DOWN:
 		divisor = ns / PCI1760_PWM_TIMEBASE;
+		break;
 	default:
 		return -EINVAL;
 	}

Greg Kroah-Hartman

author maintainer

2016-10-06 08:29 UTC #103 lore raw

PATCH 110/141 IB/core: Fix possible memory leak in cma_resolve_iboe_route()

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Wei Yongjun <[email protected]>

commit 23d70503ee187819a3775c7ac73f17c5bfe3fad0 upstream.

'work' and 'route->path_rec' are malloced in cma_resolve_iboe_route() and should be freed before leaving from the error handling cases, otherwise it will cause memory leak.

Fixes 200298326b27 ('IB/core: Validate route when we init ah')

Signed-off-by Wei Yongjun <[email protected]>

Reviewed-by Haggai Eran <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/infiniband/core/cma.c |   18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

drivers/infiniband/core/cma.c +12 -6

@@ -2452,18 +2452,24 @@ static int cma_resolve_iboe_route(struct
 
 	if (addr->dev_addr.bound_dev_if) {
 		ndev = dev_get_by_index(&init_net, addr->dev_addr.bound_dev_if);
-		if (!ndev)
-			return -ENODEV;
+		if (!ndev) {
+			ret = -ENODEV;
+			goto err2;
+		}
 
 		if (ndev->flags & IFF_LOOPBACK) {
 			dev_put(ndev);
-			if (!id_priv->id.device->get_netdev)
-				return -EOPNOTSUPP;
+			if (!id_priv->id.device->get_netdev) {
+				ret = -EOPNOTSUPP;
+				goto err2;
+			}
 
 			ndev = id_priv->id.device->get_netdev(id_priv->id.device,
 							      id_priv->id.port_num);
-			if (!ndev)
-				return -ENODEV;
+			if (!ndev) {
+				ret = -ENODEV;
+				goto err2;
+			}
 		}
 
 		route->path_rec->net = &init_net;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:29 UTC #104 lore raw

PATCH 111/141 kernel/fork: fix CLONE_CHILD_CLEARTID regression in nscd

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Michal Hocko <[email protected]>

commit 735f2770a770156100f534646158cb58cb8b2939 upstream.

Commit fec1d0115240 ("[PATCH] Disable CLONE_CHILD_CLEARTID for abnormal exit") has caused a subtle regression in nscd which uses CLONE_CHILD_CLEARTID to clear the nscd_certainly_running flag in the shared databases, so that the clients are notified when nscd is restarted. Now, when nscd uses a non-persistent database, clients that have it mapped keep thinking the database is being updated by nscd, when in fact nscd has created a new (anonymous) one (for non-persistent databases it uses an unlinked file as backend).

The original proposal for the CLONE_CHILD_CLEARTID change claimed
(https://lkml.org/lkml/2006/10/25/233):

: The NPTL library uses the CLONE_CHILD_CLEARTID flag on clone() syscalls : on behalf of pthread_create() library calls. This feature is used to : request that the kernel clear the thread-id in user space (at an address : provided in the syscall) when the thread disassociates itself from the : address space, which is done in mm_release().
:
: Unfortunately, when a multi-threaded process incurs a core dump (such as : from a SIGSEGV), the core-dumping thread sends SIGKILL signals to all of : the other threads, which then proceed to clear their user-space tids : before synchronizing in exit_mm() with the start of core dumping. This : misrepresents the state of process's address space at the time of the : SIGSEGV and makes it more difficult for someone to debug NPTL and glibc : problems (misleading him/her to conclude that the threads had gone away : before the fault).
:
: The fix below is to simply avoid the CLONE_CHILD_CLEARTID action if a : core dump has been initiated.

The resulting patch from Roland (https://lkml.org/lkml/2006/10/26/269)
seems to have a larger scope than the original patch asked for. It seems that limitting the scope of the check to core dumping should work for SIGSEGV issue describe above.

[Changelog partly based on Andreas' description]

Fixes fec1d0115240 ("[PATCH] Disable CLONE_CHILD_CLEARTID for abnormal exit")

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Michal Hocko <[email protected]>

Tested-by William Preston <[email protected]>

Acked-by Oleg Nesterov <[email protected]>

Cc Roland McGrath <[email protected]>

Cc Andreas Schwab <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/fork.c |   10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

kernel/fork.c +4 -6

@@ -938,14 +938,12 @@ void mm_release(struct task_struct *tsk,
 	deactivate_mm(tsk, mm);
 
 	/*
-	 * If we're exiting normally, clear a user-space tid field if
-	 * requested.  We leave this alone when dying by signal, to leave
-	 * the value intact in a core dump, and to save the unnecessary
-	 * trouble, say, a killed vfork parent shouldn't touch this mm.
-	 * Userland only wants this done for a sys_exit.
+	 * Signal userspace if we're not exiting with a core dump
+	 * because we want to leave the value intact for debugging
+	 * purposes.
 	 */
 	if (tsk->clear_child_tid) {
-		if (!(tsk->flags & PF_SIGNALED) &&
+		if (!(tsk->signal->flags & SIGNAL_GROUP_COREDUMP) &&
 		    atomic_read(&mm->mm_users) > 1) {
 			/*
 			 * We don't check the error code - if userspace has

Greg Kroah-Hartman

author maintainer

2016-10-06 08:29 UTC #106 lore raw

PATCH 113/141 pNFS/flexfiles: Fix layoutstat periodic reporting

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <[email protected]>

commit 1c8d477a77e2d1d3504419e7f2e02e6422becf9a upstream.

Putting the periodicity timer in the mirror instances is causing non-scalable reporting behaviour and missed reporting intervals. When you recall layouts and/or implement client side mirroring, it leads to consecutive reports with only a few ms between RPC calls.

Fixes d0379a5d066a9 ("pNFS/flexfiles: Support server-supplied...")

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/nfs/flexfilelayout/flexfilelayout.c |    8 ++++----
 fs/nfs/flexfilelayout/flexfilelayout.h |    2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

fs/nfs/flexfilelayout/flexfilelayout.c +4 -4

@@ -37,6 +37,7 @@ ff_layout_alloc_layout_hdr(struct inode
 	if (ffl) {
 		INIT_LIST_HEAD(&ffl->error_list);
 		INIT_LIST_HEAD(&ffl->mirrors);
+		ffl->last_report_time = ktime_get();
 		return &ffl->generic_hdr;
 	} else
 		return NULL;

@@ -640,19 +641,18 @@ nfs4_ff_layoutstat_start_io(struct nfs4_
 {
 	static const ktime_t notime = {0};
 	s64 report_interval = FF_LAYOUTSTATS_REPORT_INTERVAL;
+	struct nfs4_flexfile_layout *ffl = FF_LAYOUT_FROM_HDR(mirror->layout);
 
 	nfs4_ff_start_busy_timer(&layoutstat->busy_timer, now);
 	if (ktime_equal(mirror->start_time, notime))
 		mirror->start_time = now;
-	if (ktime_equal(mirror->last_report_time, notime))
-		mirror->last_report_time = now;
 	if (mirror->report_interval != 0)
 		report_interval = (s64)mirror->report_interval * 1000LL;
 	else if (layoutstats_timer != 0)
 		report_interval = (s64)layoutstats_timer * 1000LL;
-	if (ktime_to_ms(ktime_sub(now, mirror->last_report_time)) >=
+	if (ktime_to_ms(ktime_sub(now, ffl->last_report_time)) >=
 			report_interval) {
-		mirror->last_report_time = now;
+		ffl->last_report_time = now;
 		return true;
 	}

fs/nfs/flexfilelayout/flexfilelayout.h +1 -1

@@ -84,7 +84,6 @@ struct nfs4_ff_layout_mirror {
 	struct nfs4_ff_layoutstat	read_stat;
 	struct nfs4_ff_layoutstat	write_stat;
 	ktime_t				start_time;
-	ktime_t				last_report_time;
 	u32				report_interval;
 };

@@ -101,6 +100,7 @@ struct nfs4_flexfile_layout {
 	struct pnfs_ds_commit_info commit_info;
 	struct list_head	mirrors;
 	struct list_head	error_list; /* nfs4_ff_layout_ds_err */
+	ktime_t			last_report_time; /* Layoutstat report times */
 };
 
 static inline struct nfs4_flexfile_layout *

Greg Kroah-Hartman

author maintainer

2016-10-06 08:29 UTC #109 lore raw

PATCH 117/141 ceph: do not modify fi->frag in need_reset_readdir()

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Nicolas Iooss <[email protected]>

commit 0f5aa88a7bb28b73253fb42b3df8202142769f39 upstream.

Commit f3c4ebe65ea1 ("ceph: using hash value to compose dentry offset") modified "if (fpos_frag(new_pos) != fi->frag)" to "if (fi->frag |= fpos_frag(new_pos))" in need_reset_readdir(), thus replacing a comparison operator with an assignment one.

This looks like a typo which is reported by clang when building the kernel with some warning flags:

    fs/ceph/dir.c:600:22: error: using the result of an assignment as a
    condition without parentheses [-Werror,-Wparentheses]
            } else if (fi->frag |= fpos_frag(new_pos)) {
                       ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~
    fs/ceph/dir.c:600:22: note: place parentheses around the assignment
    to silence this warning
            } else if (fi->frag |= fpos_frag(new_pos)) {
                                ^
                       (                             )
    fs/ceph/dir.c:600:22: note: use '!=' to turn this compound
    assignment into an inequality comparison
            } else if (fi->frag |= fpos_frag(new_pos)) {
                                ^~
                                !=

Fixes f3c4ebe65ea1 ("ceph: using hash value to compose dentry offset")

Signed-off-by Nicolas Iooss <[email protected]>

Signed-off-by Ilya Dryomov <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/ceph/dir.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

fs/ceph/dir.c +1 -1

@@ -597,7 +597,7 @@ static bool need_reset_readdir(struct ce
 	if (is_hash_order(new_pos)) {
 		/* no need to reset last_name for a forward seek when
 		 * dentries are sotred in hash order */
-	} else if (fi->frag |= fpos_frag(new_pos)) {
+	} else if (fi->frag != fpos_frag(new_pos)) {
 		return true;
 	}
 	rinfo = fi->last_readdir ? &fi->last_readdir->r_reply_info : NULL;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:29 UTC #111 lore raw

PATCH 119/141 ath10k: fix get rx_status from htt context

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ashok Raj Nagarajan <[email protected]>

commit 237e15dfd5d651868726111c3a9d828bec700490 upstream.

On handling amsdu on rx path, get the rx_status from htt context. Without this fix, we are seeing warnings when running DBDC traffic like this.

WARNING: CPU: 0 PID: 0 at net/mac80211/rx.c:4105 ieee80211_rx_napi+0x88/0x7d8 [mac80211]()

[ 1715.878248] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W 3.18.21 #1
[ 1715.878273] [<c001d3f4>] (unwind_backtrace) from [<c001a4b0>] (show_stack+0x10/0x14)
[ 1715.878293] [<c001a4b0>] (show_stack) from [<c01bee64>] (dump_stack+0x70/0xbc)
[ 1715.878315] [<c01bee64>] (dump_stack) from [<c002a61c>] (warn_slowpath_common+0x64/0x88)
[ 1715.878339] [<c002a61c>] (warn_slowpath_common) from [<c002a6d0>] (warn_slowpath_null+0x18/0x20)
[ 1715.878395] [<c002a6d0>] (warn_slowpath_null) from [<bf4caa98>] (ieee80211_rx_napi+0x88/0x7d8 [mac80211])
[ 1715.878474] [<bf4caa98>] (ieee80211_rx_napi [mac80211]) from [<bf568658>] (ath10k_htt_t2h_msg_handler+0xb48/0xbfc [ath10k_core])
[ 1715.878535] [<bf568658>] (ath10k_htt_t2h_msg_handler [ath10k_core]) from [<bf568708>] (ath10k_htt_t2h_msg_handler+0xbf8/0xbfc [ath10k_core])
[ 1715.878597] [<bf568708>] (ath10k_htt_t2h_msg_handler [ath10k_core]) from [<bf569160>] (ath10k_htt_txrx_compl_task+0xa54/0x1170 [ath10k_core])
[ 1715.878639] [<bf569160>] (ath10k_htt_txrx_compl_task [ath10k_core]) from [<c002db14>] (tasklet_action+0xb4/0x130)
[ 1715.878659] [<c002db14>] (tasklet_action) from [<c002d110>] (__do_softirq+0xe0/0x210)
[ 1715.878678] [<c002d110>] (__do_softirq) from [<c002d4b4>] (irq_exit+0x84/0xe0)
[ 1715.878700] [<c002d4b4>] (irq_exit) from [<c005a544>] (__handle_domain_irq+0x98/0xd0)
[ 1715.878722] [<c005a544>] (__handle_domain_irq) from [<c00085f4>] (gic_handle_irq+0x38/0x5c)
[ 1715.878741] [<c00085f4>] (gic_handle_irq) from [<c0009680>] (__irq_svc+0x40/0x74)
[ 1715.878753] Exception stack(0xc05f9f50 to 0xc05f9f98)
[ 1715.878767] 9f40: ffffffed 00000000 00399e1e c000a220
[ 1715.878786] 9f60: 00000000 c05f6780 c05f8000 00000000 c05f5db8 ffffffed c05f8000 c04d1980
[ 1715.878802] 9f80: 00000000 c05f9f98 c0018110 c0018114 60000013 ffffffff
[ 1715.878822] [<c0009680>] (__irq_svc) from [<c0018114>] (arch_cpu_idle+0x2c/0x50)
[ 1715.878844] [<c0018114>] (arch_cpu_idle) from [<c00530d4>] (cpu_startup_entry+0x108/0x234)
[ 1715.878866] [<c00530d4>] (cpu_startup_entry) from [<c05c7be0>] (start_kernel+0x33c/0x3b8)
[ 1715.878879] ---[ end trace 6d5e1cc0fef8ed6a ]---
[ 1715.878899] ------------[ cut here ]------------

Fixes 18235664e7f9 ("ath10k: cleanup amsdu processing for rx indication")

Signed-off-by Ashok Raj Nagarajan <[email protected]>

Signed-off-by Kalle Valo <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/ath/ath10k/htt_rx.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

drivers/net/wireless/ath/ath10k/htt_rx.c +5 -5

@@ -1524,7 +1524,7 @@ static void ath10k_htt_rx_h_filter(struc
 static int ath10k_htt_rx_handle_amsdu(struct ath10k_htt *htt)
 {
 	struct ath10k *ar = htt->ar;
-	static struct ieee80211_rx_status rx_status;
+	struct ieee80211_rx_status *rx_status = &htt->rx_status;
 	struct sk_buff_head amsdu;
 	int ret;

@@ -1548,11 +1548,11 @@ static int ath10k_htt_rx_handle_amsdu(st
 		return ret;
 	}
 
-	ath10k_htt_rx_h_ppdu(ar, &amsdu, &rx_status, 0xffff);
+	ath10k_htt_rx_h_ppdu(ar, &amsdu, rx_status, 0xffff);
 	ath10k_htt_rx_h_unchain(ar, &amsdu, ret > 0);
-	ath10k_htt_rx_h_filter(ar, &amsdu, &rx_status);
-	ath10k_htt_rx_h_mpdu(ar, &amsdu, &rx_status);
-	ath10k_htt_rx_h_deliver(ar, &amsdu, &rx_status);
+	ath10k_htt_rx_h_filter(ar, &amsdu, rx_status);
+	ath10k_htt_rx_h_mpdu(ar, &amsdu, rx_status);
+	ath10k_htt_rx_h_deliver(ar, &amsdu, rx_status);
 
 	return 0;
 }

Greg Kroah-Hartman

author maintainer

2016-10-06 08:29 UTC #112 lore raw

PATCH 120/141 IB/core: Fix use after free in send_leave function

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Erez Shitrit <[email protected]>

commit 68c6bcdd8bd00394c234b915ab9b97c74104130c upstream.

The function send_leave sets the member: group->query_id (group->query_id = ret) after calling the sa_query, but leave_handler can be executed before the setting and it might delete the group object, and will get a memory corruption.

Additionally, this patch gets rid of group->query_id variable which is not used.

Fixes faec2f7b96b5 ('IB/sa: Track multicast join/leave requests')

Signed-off-by Erez Shitrit <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/infiniband/core/multicast.c |   13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

drivers/infiniband/core/multicast.c +2 ~~-11~~

@@ -118,7 +118,6 @@ struct mcast_group {
 	atomic_t		refcount;
 	enum mcast_group_state	state;
 	struct ib_sa_query	*query;
-	int			query_id;
 	u16			pkey_index;
 	u8			leave_state;
 	int			retries;

@@ -352,11 +351,7 @@ static int send_join(struct mcast_group
 				       member->multicast.comp_mask,
 				       3000, GFP_KERNEL, join_handler, group,
 				       &group->query);
-	if (ret >= 0) {
-		group->query_id = ret;
-		ret = 0;
-	}
-	return ret;
+	return (ret > 0) ? 0 : ret;
 }
 
 static int send_leave(struct mcast_group *group, u8 leave_state)

@@ -376,11 +371,7 @@ static int send_leave(struct mcast_group
 				       IB_SA_MCMEMBER_REC_JOIN_STATE,
 				       3000, GFP_KERNEL, leave_handler,
 				       group, &group->query);
-	if (ret >= 0) {
-		group->query_id = ret;
-		ret = 0;
-	}
-	return ret;
+	return (ret > 0) ? 0 : ret;
 }
 
 static void join_group(struct mcast_group *group, struct mcast_member *member,

Greg Kroah-Hartman

author maintainer

2016-10-06 08:29 UTC #127 lore raw

PATCH 133/141 dm log writes: fix bug with too large bios

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mikulas Patocka <[email protected]>

commit 7efb367320f56fc4d549875b6f3a6940018ef2e5 upstream.

bio_alloc() can allocate a bio with at most BIO_MAX_PAGES (256) vector entries. However, the incoming bio may have more vector entries if it was allocated by other means. For example, bcache submits bios with more than BIO_MAX_PAGES entries. This results in bio_alloc() failure.

To avoid the failure, change the code so that it allocates bio with at most BIO_MAX_PAGES entries. If the incoming bio has more entries, bio_add_page() will fail and a new bio will be allocated - the code that handles bio_add_page() failure already exists in the dm-log-writes target.

Signed-off-by Mikulas Patocka <[email protected]>

Reviewed-by Josef Bacik <[email protected]>

Signed-off-by Mike Snitzer <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/md/dm-log-writes.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/md/dm-log-writes.c +2 -2

@@ -259,7 +259,7 @@ static int log_one_block(struct log_writ
 	sector++;
 
 	atomic_inc(&lc->io_blocks);
-	bio = bio_alloc(GFP_KERNEL, block->vec_cnt);
+	bio = bio_alloc(GFP_KERNEL, min(block->vec_cnt, BIO_MAX_PAGES));
 	if (!bio) {
 		DMERR("Couldn't alloc log bio");
 		goto error;

@@ -280,7 +280,7 @@ static int log_one_block(struct log_writ
 		if (ret != block->vecs[i].bv_len) {
 			atomic_inc(&lc->io_blocks);
 			submit_bio(WRITE, bio);
-			bio = bio_alloc(GFP_KERNEL, block->vec_cnt - i);
+			bio = bio_alloc(GFP_KERNEL, min(block->vec_cnt - i, BIO_MAX_PAGES));
 			if (!bio) {
 				DMERR("Couldn't alloc log bio");
 				goto error;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:29 UTC #131 lore raw

PATCH 137/141 USB: serial: cp210x: Add ID for a Juniper console

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kyle Jones <[email protected]>

commit decc5360f23e9efe0252094f47f57f254dcbb3a9 upstream.

Signed-off-by Kyle Jones <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/usb/serial/cp210x.c |    1 +
 1 file changed, 1 insertion(+)

drivers/usb/serial/cp210x.c +1 -0

@@ -118,6 +118,7 @@ static const struct usb_device_id id_tab
 	{ USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */
 	{ USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */
 	{ USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */
+	{ USB_DEVICE(0x10C4, 0x8470) }, /* Juniper Networks BX Series System Console */
 	{ USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */
 	{ USB_DEVICE(0x10C4, 0x84B6) }, /* Starizona Hyperion */
 	{ USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */

Greg Kroah-Hartman

author maintainer

2016-10-06 08:29 UTC #132 lore raw

PATCH 138/141 Revert "usbtmc: convert to devm_kzalloc"

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Greg Kroah-Hartman <[email protected]>

commit ab21b63e8aedfc73565dd9cdd51eb338341177cb upstream.

This reverts commit e6c7efdcb76f11b04e3d3f71c8d764ab75c9423b.

Turns out it was totally wrong. The memory is supposed to be bound to the kref, as the original code was doing correctly, not the device/driver binding as the devm_kzalloc() would cause.

This fixes an oops when read would be called after the device was unbound from the driver.

Reported-by Ladislav Michl <[email protected]>

Cc Andy Shevchenko <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/usb/class/usbtmc.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

drivers/usb/class/usbtmc.c +2 -1

@@ -141,6 +141,7 @@ static void usbtmc_delete(struct kref *k
 	struct usbtmc_device_data *data = to_usbtmc_data(kref);
 
 	usb_put_dev(data->usb_dev);
+	kfree(data);
 }
 
 static int usbtmc_open(struct inode *inode, struct file *filp)

@@ -1379,7 +1380,7 @@ static int usbtmc_probe(struct usb_inter
 
 	dev_dbg(&intf->dev, "%s called\n", __func__);
 
-	data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
+	data = kmalloc(sizeof(*data), GFP_KERNEL);
 	if (!data)
 		return -ENOMEM;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:29 UTC #135 lore raw

PATCH 141/141 ALSA: hda - Add the top speaker pin config for HP Spectre x360

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <[email protected]>

commit 0eec880966e77bdbee0112989a2be67d92e39929 upstream.

HP Spectre x360 with CX20724 codec has two speaker outputs while the BIOS sets up only the bottom one (NID 0x17) and disables the top one (NID 0x1d).

This patch adds a fixup simply defining the proper pincfg for NID 0x1d so that the top speaker works as is.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=169071

Signed-off-by Takashi Iwai <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 sound/pci/hda/patch_conexant.c |   10 ++++++++++
 1 file changed, 10 insertions(+)

sound/pci/hda/patch_conexant.c +10 -0

@@ -261,6 +261,7 @@ enum {
 	CXT_FIXUP_HP_530,
 	CXT_FIXUP_CAP_MIX_AMP_5047,
 	CXT_FIXUP_MUTE_LED_EAPD,
+	CXT_FIXUP_HP_SPECTRE,
 };
 
 /* for hda_fixup_thinkpad_acpi() */

@@ -765,6 +766,14 @@ static const struct hda_fixup cxt_fixups
 		.type = HDA_FIXUP_FUNC,
 		.v.func = cxt_fixup_mute_led_eapd,
 	},
+	[CXT_FIXUP_HP_SPECTRE] = {
+		.type = HDA_FIXUP_PINS,
+		.v.pins = (const struct hda_pintbl[]) {
+			/* enable NID 0x1d for the speaker on top */
+			{ 0x1d, 0x91170111 },
+			{ }
+		}
+	},
 };
 
 static const struct snd_pci_quirk cxt5045_fixups[] = {

@@ -814,6 +823,7 @@ static const struct snd_pci_quirk cxt506
 	SND_PCI_QUIRK(0x1025, 0x0543, "Acer Aspire One 522", CXT_FIXUP_STEREO_DMIC),
 	SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_ASPIRE_DMIC),
 	SND_PCI_QUIRK(0x1025, 0x054f, "Acer Aspire 4830T", CXT_FIXUP_ASPIRE_DMIC),
+	SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
 	SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN),
 	SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO),
 	SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),

Greg Kroah-Hartman

author maintainer

2016-10-06 08:32 UTC #2 lore raw

PATCH 2/141 cgroup: fix invalid controller enable rejections with cgroup namespace

Link https://github.com/systemd/systemd/pull/3589#issuecomment-249089541

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tejun Heo <[email protected]>

commit 9157056da8f8c4a6305f15619e269f164b63a6de upstream.

On the v2 hierarchy, "cgroup.subtree_control" rejects controller enables if the cgroup has processes in it. The enforcement of this logic assumes that the cgroup wouldn't have any css_sets associated with it if there are no tasks in the cgroup, which is no longer true since a79a908fd2b0 ("cgroup: introduce cgroup namespaces").

When a cgroup namespace is created, it pins the css_set of the creating task to use it as the root css_set of the namespace. This extra reference stays as long as the namespace is around and makes "cgroup.subtree_control" think that the namespace root cgroup is not empty even when it is and thus reject controller enables.

Fix it by making cgroup_subtree_control() walk and test emptiness of each css_set instead of testing whether the list_head is empty.

While at it, update the comment of cgroup_task_count() to indicate that the returned value may be higher than the number of tasks, which has always been true due to temporary references and doesn't break anything.

Signed-off-by Tejun Heo <[email protected]>

Reported-by Evgeny Vereshchagin <[email protected]>

Cc Serge E. Hallyn <[email protected]>

Cc Aditya Kali <[email protected]>

Cc Eric W. Biederman <[email protected]>

Fixes a79a908fd2b0 ("cgroup: introduce cgroup namespaces")

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/cgroup.c |   29 +++++++++++++++++++++++++----
 1 file changed, 25 insertions(+), 4 deletions(-)

kernel/cgroup.c +25 -4

@@ -3452,9 +3452,28 @@ static ssize_t cgroup_subtree_control_wr
 	 * Except for the root, subtree_control must be zero for a cgroup
 	 * with tasks so that child cgroups don't compete against tasks.
 	 */
-	if (enable && cgroup_parent(cgrp) && !list_empty(&cgrp->cset_links)) {
-		ret = -EBUSY;
-		goto out_unlock;
+	if (enable && cgroup_parent(cgrp)) {
+		struct cgrp_cset_link *link;
+
+		/*
+		 * Because namespaces pin csets too, @cgrp->cset_links
+		 * might not be empty even when @cgrp is empty.  Walk and
+		 * verify each cset.
+		 */
+		spin_lock_irq(&css_set_lock);
+
+		ret = 0;
+		list_for_each_entry(link, &cgrp->cset_links, cset_link) {
+			if (css_set_populated(link->cset)) {
+				ret = -EBUSY;
+				break;
+			}
+		}
+
+		spin_unlock_irq(&css_set_lock);
+
+		if (ret)
+			goto out_unlock;
 	}
 
 	/* save and update control masks and prepare csses */

@@ -3905,7 +3924,9 @@ void cgroup_file_notify(struct cgroup_fi
  * cgroup_task_count - count the number of tasks in a cgroup.
  * @cgrp: the cgroup in question
  *
- * Return the number of tasks in the cgroup.
+ * Return the number of tasks in the cgroup.  The returned number can be
+ * higher than the actual number of tasks due to css_set references from
+ * namespace roots and temporary usages.
  */
 static int cgroup_task_count(const struct cgroup *cgrp)
 {

Greg Kroah-Hartman

author maintainer

2016-10-06 08:32 UTC #5 lore raw

PATCH 5/141 mm,ksm: fix endless looping in allocating memory when ksm enable

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: zhong jiang <[email protected]>

commit 5b398e416e880159fe55eefd93c6588fa072cd66 upstream.

I hit the following hung task when runing a OOM LTP test case with 4.1 kernel.

Call trace:
[<ffffffc000086a88>] __switch_to+0x74/0x8c
[<ffffffc000a1bae0>] __schedule+0x23c/0x7bc
[<ffffffc000a1c09c>] schedule+0x3c/0x94
[<ffffffc000a1eb84>] rwsem_down_write_failed+0x214/0x350
[<ffffffc000a1e32c>] down_write+0x64/0x80
[<ffffffc00021f794>] __ksm_exit+0x90/0x19c
[<ffffffc0000be650>] mmput+0x118/0x11c
[<ffffffc0000c3ec4>] do_exit+0x2dc/0xa74
[<ffffffc0000c46f8>] do_group_exit+0x4c/0xe4
[<ffffffc0000d0f34>] get_signal+0x444/0x5e0
[<ffffffc000089fcc>] do_signal+0x1d8/0x450
[<ffffffc00008a35c>] do_notify_resume+0x70/0x78

The oom victim cannot terminate because it needs to take mmap_sem for write while the lock is held by ksmd for read which loops in the page allocator

ksm_do_scan
scan_get_next_rmap_item
down_read
get_next_rmap_item
alloc_rmap_item #ksmd will loop permanently.

There is no way forward because the oom victim cannot release any memory in 4.1 based kernel. Since 4.6 we have the oom reaper which would solve this problem because it would release the memory asynchronously. Nevertheless we can relax alloc_rmap_item requirements and use __GFP_NORETRY because the allocation failure is acceptable as ksm_do_scan would just retry later after the lock got dropped.

Such a patch would be also easy to backport to older stable kernels which do not have oom_reaper.

While we are at it add GFP_NOWARN so the admin doesn't have to be alarmed by the allocation failure.

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by zhong jiang <[email protected]>

Acked-by Michal Hocko <[email protected]>

Acked-by Hugh Dickins <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 mm/ksm.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

mm/ksm.c +2 -1

@@ -283,7 +283,8 @@ static inline struct rmap_item *alloc_rm
 {
 	struct rmap_item *rmap_item;
 
-	rmap_item = kmem_cache_zalloc(rmap_item_cache, GFP_KERNEL);
+	rmap_item = kmem_cache_zalloc(rmap_item_cache, GFP_KERNEL |
+						__GFP_NORETRY | __GFP_NOWARN);
 	if (rmap_item)
 		ksm_rmap_items++;
 	return rmap_item;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:33 UTC #13 lore raw

PATCH 14/141 mwifiex: illegal assignment

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Heinrich Schuchardt <[email protected]>

commit 3fdbda446fbcd7fb750179c01338e81cf04e46c7 upstream.

Variable adapter is incorrectly initialized.

Fixes bf00dc22bc7a ("mwifiex: AMSDU Rx frame handling in AP mode")

Signed-off-by Heinrich Schuchardt <[email protected]>

Acked-by Amitkumar Karwar <[email protected]>

Signed-off-by Kalle Valo <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/marvell/mwifiex/uap_txrx.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/net/wireless/marvell/mwifiex/uap_txrx.c +1 -1

@@ -272,7 +272,7 @@ int mwifiex_handle_uap_rx_forward(struct
 int mwifiex_uap_recv_packet(struct mwifiex_private *priv,
 			    struct sk_buff *skb)
 {
-	struct mwifiex_adapter *adapter = adapter;
+	struct mwifiex_adapter *adapter = priv->adapter;
 	struct mwifiex_sta_node *src_node;
 	struct ethhdr *p_ethhdr;
 	struct sk_buff *skb_uap;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:33 UTC #14 lore raw

PATCH 15/141 i40e: avoid null pointer dereference

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Heinrich Schuchardt <[email protected]>

commit cd956722167ba4fdba9c1ce3eed251b04ea2e10f upstream.

In function i40e_debug_aq parameter desc is assumed to be possibly NULL. Do not dereference it before checking the value.

Fixes f905dd62be88 ("i40e/i40evf: add max buf len to aq debug print helper")

Signed-off-by Heinrich Schuchardt <[email protected]>

Tested-by Andrew Bowers <[email protected]>

Signed-off-by Jeff Kirsher <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/intel/i40e/i40e_common.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

drivers/net/ethernet/intel/i40e/i40e_common.c +3 -1

@@ -297,13 +297,15 @@ void i40e_debug_aq(struct i40e_hw *hw, e
 		   void *buffer, u16 buf_len)
 {
 	struct i40e_aq_desc *aq_desc = (struct i40e_aq_desc *)desc;
-	u16 len = le16_to_cpu(aq_desc->datalen);
+	u16 len;
 	u8 *buf = (u8 *)buffer;
 	u16 i = 0;
 
 	if ((!(mask & hw->debug_mask)) || (desc == NULL))
 		return;
 
+	len = le16_to_cpu(aq_desc->datalen);
+
 	i40e_debug(hw, mask,
 		   "AQ CMD: opcode 0x%04X, flags 0x%04X, datalen 0x%04X, retval 0x%04X\n",
 		   le16_to_cpu(aq_desc->opcode),

Greg Kroah-Hartman

author maintainer

2016-10-06 08:33 UTC #16 lore raw

PATCH 17/141 pinctrl: Flag strict is a field in struct pinmux_ops

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andy Shevchenko <[email protected]>

commit 7440926ed9623dceca3310c5f437d06c859dc02b upstream.

Documentation incorrectly refers to struct pinctrl_desc, where no such flag is available. Replace the name of the struct.

Fixes commit 8c4c2016345f ("pinctrl: move strict option to pinmux_ops")

Signed-off-by Andy Shevchenko <[email protected]>

Signed-off-by Linus Walleij <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 Documentation/pinctrl.txt |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Documentation/pinctrl.txt +1 -1

@@ -831,7 +831,7 @@ separate memory range only intended for
 range dealing with pin config and pin multiplexing get placed into a
 different memory range and a separate section of the data sheet.
 
-A flag "strict" in struct pinctrl_desc is available to check and deny
+A flag "strict" in struct pinmux_ops is available to check and deny
 simultaneous access to the same pin from GPIO and pin multiplexing
 consumers on hardware of this type. The pinctrl driver should set this flag
 accordingly.

Greg Kroah-Hartman

author maintainer

2016-10-06 08:33 UTC #17 lore raw

PATCH 18/141 i2c: mux: demux-pinctrl: run properly with multiple instances

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Wolfram Sang <[email protected]>

commit e35478eac030990e23a56bf11dc074c5a069124a upstream.

We can't use a static property for all the changesets, so we now create dynamic ones for each changeset.

Signed-off-by Wolfram Sang <[email protected]>

Fixes 50a5ba87690814 ("i2c: mux: demux-pinctrl: add driver")

Signed-off-by Wolfram Sang <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/i2c/muxes/i2c-demux-pinctrl.c |   14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

drivers/i2c/muxes/i2c-demux-pinctrl.c +10 -4

@@ -37,8 +37,6 @@ struct i2c_demux_pinctrl_priv {
 	struct i2c_demux_pinctrl_chan chan[];
 };
 
-static struct property status_okay = { .name = "status", .length = 3, .value = "ok" };
-
 static int i2c_demux_master_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
 {
 	struct i2c_demux_pinctrl_priv *priv = adap->algo_data;

@@ -192,6 +190,7 @@ static int i2c_demux_pinctrl_probe(struc
 {
 	struct device_node *np = pdev->dev.of_node;
 	struct i2c_demux_pinctrl_priv *priv;
+	struct property *props;
 	int num_chan, i, j, err;
 
 	num_chan = of_count_phandle_with_args(np, "i2c-parent", NULL);

@@ -202,7 +201,10 @@ static int i2c_demux_pinctrl_probe(struc
 
 	priv = devm_kzalloc(&pdev->dev, sizeof(*priv)
 			   + num_chan * sizeof(struct i2c_demux_pinctrl_chan), GFP_KERNEL);
-	if (!priv)
+
+	props = devm_kcalloc(&pdev->dev, num_chan, sizeof(*props), GFP_KERNEL);
+
+	if (!priv || !props)
 		return -ENOMEM;
 
 	err = of_property_read_string(np, "i2c-bus-name", &priv->bus_name);

@@ -220,8 +222,12 @@ static int i2c_demux_pinctrl_probe(struc
 		}
 		priv->chan[i].parent_np = adap_np;
 
+		props[i].name = devm_kstrdup(&pdev->dev, "status", GFP_KERNEL);
+		props[i].value = devm_kstrdup(&pdev->dev, "ok", GFP_KERNEL);
+		props[i].length = 3;
+
 		of_changeset_init(&priv->chan[i].chgset);
-		of_changeset_update_property(&priv->chan[i].chgset, adap_np, &status_okay);
+		of_changeset_update_property(&priv->chan[i].chgset, adap_np, &props[i]);
 	}
 
 	priv->num_chan = num_chan;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:33 UTC #18 lore raw

PATCH 19/141 rcuperf: Dont treat gp_exp mis-setting as a WARN

Fixes http://lkml.kernel.org/r/57411b10.mFvG0+AgcrMXGtcj%[email protected] open here

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Boqun Feng <[email protected]>

commit af06d4f74a7d2132c805339bfd5ab771b5706f42 upstream.

0day found a boot warning triggered in rcu_perf_writer() on !SMP kernel:

	WARN_ON(rcu_gp_is_normal() && gp_exp);

, the root cause of which is trying to measure expedited grace periods(by setting gp_exp to true by default) when all the grace periods are normal(TINY RCU only has normal grace periods).

However, such a mis-setting would only result in failing to measure the performance for a specific kind of grace periods, therefore using a WARN_ON to check this is a little overkilling. We could handle this inside rcuperf module via some error messages to tell users about the mis-settings.

Therefore this patch removes the WARN_ON in rcu_perf_writer() and handles those checkings in rcu_perf_init() with plain if() code.

Moreover, this patch changes the default value of gp_exp to 1) align with rcutorture tests and 2) make the default setting work for all RCU implementations by default.

Signed-off-by Boqun Feng <[email protected]>

Signed-off-by Paul E. McKenney <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/rcu/rcuperf.c |   14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

kernel/rcu/rcuperf.c +11 -3

@@ -58,7 +58,7 @@ MODULE_AUTHOR("Paul E. McKenney <paulmck
 #define VERBOSE_PERFOUT_ERRSTRING(s) \
 	do { if (verbose) pr_alert("%s" PERF_FLAG "!!! %s\n", perf_type, s); } while (0)
 
-torture_param(bool, gp_exp, true, "Use expedited GP wait primitives");
+torture_param(bool, gp_exp, false, "Use expedited GP wait primitives");
 torture_param(int, holdoff, 10, "Holdoff time before test start (s)");
 torture_param(int, nreaders, -1, "Number of RCU reader threads");
 torture_param(int, nwriters, -1, "Number of RCU updater threads");

@@ -363,8 +363,6 @@ rcu_perf_writer(void *arg)
 	u64 *wdpp = writer_durations[me];
 
 	VERBOSE_PERFOUT_STRING("rcu_perf_writer task started");
-	WARN_ON(rcu_gp_is_expedited() && !rcu_gp_is_normal() && !gp_exp);
-	WARN_ON(rcu_gp_is_normal() && gp_exp);
 	WARN_ON(!wdpp);
 	set_cpus_allowed_ptr(current, cpumask_of(me % nr_cpu_ids));
 	sp.sched_priority = 1;

@@ -631,6 +629,16 @@ rcu_perf_init(void)
 		firsterr = -ENOMEM;
 		goto unwind;
 	}
+	if (rcu_gp_is_expedited() && !rcu_gp_is_normal() && !gp_exp) {
+		VERBOSE_PERFOUT_ERRSTRING("All grace periods expedited, no normal ones to measure!");
+		firsterr = -EINVAL;
+		goto unwind;
+	}
+	if (rcu_gp_is_normal() && gp_exp) {
+		VERBOSE_PERFOUT_ERRSTRING("All grace periods normal, no expedited ones to measure!");
+		firsterr = -EINVAL;
+		goto unwind;
+	}
 	for (i = 0; i < nrealwriters; i++) {
 		writer_durations[i] =
 			kcalloc(MAX_MEAS, sizeof(*writer_durations[i]),

Greg Kroah-Hartman

author maintainer

2016-10-06 08:33 UTC #19 lore raw

PATCH 20/141 drivers/perf: arm_pmu: Fix leak in error path

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Stefan Wahren <[email protected]>

commit 753246840d012ae34ea80a1d40bc1546c62fb957 upstream.

In case of a IRQ type mismatch in of_pmu_irq_cfg() the device node for interrupt affinity isn't freed. So fix this issue by calling of_node_put().

Signed-off-by Stefan Wahren <[email protected]>

Fixes fa8ad7889d83 ("arm: perf: factor arm_pmu core out to drivers")

Signed-off-by Will Deacon <[email protected]>

Signed-off-by Catalin Marinas <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/perf/arm_pmu.c |    1 +
 1 file changed, 1 insertion(+)

drivers/perf/arm_pmu.c +1 -0

@@ -921,6 +921,7 @@ static int of_pmu_irq_cfg(struct arm_pmu
 			if (i > 0 && spi != using_spi) {
 				pr_err("PPI/SPI IRQ type mismatch for %s!\n",
 					dn->name);
+				of_node_put(dn);
 				kfree(irqs);
 				return -EINVAL;
 			}

Greg Kroah-Hartman

author maintainer

2016-10-06 08:33 UTC #20 lore raw

PATCH 21/141 perf/core: Use this_cpu_ptr() when stopping AUX events

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Will Deacon <[email protected]>

commit 8b6a3fe8fab97716990a3abde1a01fb5a34552a3 upstream.

When tearing down an AUX buf for an event via perf_mmap_close(), __perf_event_output_stop() is called on the event's CPU to ensure that trace generation is halted before the process of unmapping and freeing the buffer pages begins.

The callback is performed via cpu_function_call(), which ensures that it runs with interrupts disabled and is therefore not preemptible. Unfortunately, the current code grabs the per-cpu context pointer using get_cpu_ptr(), which unnecessarily disables preemption and doesn't pair the call with put_cpu_ptr(), leading to a preempt_count() imbalance and a BUG when freeing the AUX buffer later on:

  WARNING: CPU: 1 PID: 2249 at kernel/events/ring_buffer.c:539 __rb_free_aux+0x10c/0x120
  Modules linked in:
  [...]
  Call Trace:
   [<ffffffff813379dd>] dump_stack+0x4f/0x72
   [<ffffffff81059ff6>] __warn+0xc6/0xe0
   [<ffffffff8105a0c8>] warn_slowpath_null+0x18/0x20
   [<ffffffff8112761c>] __rb_free_aux+0x10c/0x120
   [<ffffffff81128163>] rb_free_aux+0x13/0x20
   [<ffffffff8112515e>] perf_mmap_close+0x29e/0x2f0
   [<ffffffff8111da30>] ? perf_iterate_ctx+0xe0/0xe0
   [<ffffffff8115f685>] remove_vma+0x25/0x60
   [<ffffffff81161796>] exit_mmap+0x106/0x140
   [<ffffffff8105725c>] mmput+0x1c/0xd0
   [<ffffffff8105cac3>] do_exit+0x253/0xbf0
   [<ffffffff8105e32e>] do_group_exit+0x3e/0xb0
   [<ffffffff81068d49>] get_signal+0x249/0x640
   [<ffffffff8101c273>] do_signal+0x23/0x640
   [<ffffffff81905f42>] ? _raw_write_unlock_irq+0x12/0x30
   [<ffffffff81905f69>] ? _raw_spin_unlock_irq+0x9/0x10
   [<ffffffff81901896>] ? __schedule+0x2c6/0x710
   [<ffffffff810022a4>] exit_to_usermode_loop+0x74/0x90
   [<ffffffff81002a56>] prepare_exit_to_usermode+0x26/0x30
   [<ffffffff81906d1b>] retint_user+0x8/0x10

This patch uses this_cpu_ptr() instead of get_cpu_ptr(), since preemption is already disabled by the caller.

Signed-off-by Will Deacon <[email protected]>

Reviewed-by Alexander Shishkin <[email protected]>

Cc Arnaldo Carvalho de Melo <[email protected]>

Cc Linus Torvalds <[email protected]>

Cc Peter Zijlstra <[email protected]>

Cc Thomas Gleixner <[email protected]>

Cc Vince Weaver <[email protected]>

Fixes 95ff4ca26c49 ("perf/core: Free AUX pages in unmap path")

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Ingo Molnar <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/events/core.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

kernel/events/core.c +1 -1

@@ -6064,7 +6064,7 @@ static int __perf_pmu_output_stop(void *
 {
 	struct perf_event *event = info;
 	struct pmu *pmu = event->pmu;
-	struct perf_cpu_context *cpuctx = get_cpu_ptr(pmu->pmu_cpu_context);
+	struct perf_cpu_context *cpuctx = this_cpu_ptr(pmu->pmu_cpu_context);
 	struct remote_output ro = {
 		.rb	= event->rb,
 	};

Greg Kroah-Hartman

author maintainer

2016-10-06 08:34 UTC #21 lore raw

PATCH 22/141 mmc: tegra: Only advertise UHS modes if IO regulator is present

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jon Hunter <[email protected]>

commit 4f6aa3264af4d44caaa649dd3ff1fe98f5817251 upstream.

To support UHS modes for Tegra an external regulator must be present to adjust the IO voltage accordingly. Even if the regulator is not present but the host supports the UHS modes and the device supports the UHS modes, then we will attempt to switch to a high-speed mode. Without an external regulator, Tegra will fail to switch to the high-speed mode.

It has been found that with some SD cards, that once it has been switch to operate at a high-speed mode, all subsequent commands issues to the card will fail and so it will not be possible to switch back to a non high-speed mode and so the SD card initialisation will fail.

The SDHCI core does not require that the host have an external regulator when switching to UHS modes and therefore, the Tegra SDHCI host controller should only advertise the UHS modes as being supported if the regulator for the IO voltage is present. Fortunately, Tegra has a vendor specific register which can be used to control which modes are advertised via the SDHCI_CAPABILITIES register. Hence, if there is no IO voltage regulator available for the Tegra SDHCI host, then don't advertise the UHS modes.

Note that if the regulator is not available, we also don't advertise that the SDHCI is compatible with v3.0 of the SDHCI specification because this will read the SDHCI_CAPABILITIES_1 register which will enable other UHS modes.

This fixes commit 7ad2ed1dfcbe ("mmc: tegra: enable UHS-I modes") which enables UHS mode without checking if the board can support them.

Fixes 7ad2ed1dfcbe ("mmc: tegra: enable UHS-I modes")

Signed-off-by Jon Hunter <[email protected]>

Acked-by Adrian Hunter <[email protected]>

Signed-off-by Ulf Hansson <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/mmc/host/sdhci-tegra.c |   49 ++++++++++++++++++++++++-----------------
 1 file changed, 29 insertions(+), 20 deletions(-)

drivers/mmc/host/sdhci-tegra.c +29 ~~-20~~

@@ -148,28 +148,37 @@ static void tegra_sdhci_reset(struct sdh
 		return;
 
 	misc_ctrl = sdhci_readl(host, SDHCI_TEGRA_VENDOR_MISC_CTRL);
-	/* Erratum: Enable SDHCI spec v3.00 support */
-	if (soc_data->nvquirks & NVQUIRK_ENABLE_SDHCI_SPEC_300)
-		misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_SDHCI_SPEC_300;
-	/* Advertise UHS modes as supported by host */
-	if (soc_data->nvquirks & NVQUIRK_ENABLE_SDR50)
-		misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_SDR50;
-	else
-		misc_ctrl &= ~SDHCI_MISC_CTRL_ENABLE_SDR50;
-	if (soc_data->nvquirks & NVQUIRK_ENABLE_DDR50)
-		misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_DDR50;
-	else
-		misc_ctrl &= ~SDHCI_MISC_CTRL_ENABLE_DDR50;
-	if (soc_data->nvquirks & NVQUIRK_ENABLE_SDR104)
-		misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_SDR104;
-	else
-		misc_ctrl &= ~SDHCI_MISC_CTRL_ENABLE_SDR104;
-	sdhci_writel(host, misc_ctrl, SDHCI_TEGRA_VENDOR_MISC_CTRL);
-
 	clk_ctrl = sdhci_readl(host, SDHCI_TEGRA_VENDOR_CLOCK_CTRL);
+
+	misc_ctrl &= ~(SDHCI_MISC_CTRL_ENABLE_SDHCI_SPEC_300 |
+		       SDHCI_MISC_CTRL_ENABLE_SDR50 |
+		       SDHCI_MISC_CTRL_ENABLE_DDR50 |
+		       SDHCI_MISC_CTRL_ENABLE_SDR104);
+
 	clk_ctrl &= ~SDHCI_CLOCK_CTRL_SPI_MODE_CLKEN_OVERRIDE;
-	if (soc_data->nvquirks & SDHCI_MISC_CTRL_ENABLE_SDR50)
-		clk_ctrl |= SDHCI_CLOCK_CTRL_SDR50_TUNING_OVERRIDE;
+
+	/*
+	 * If the board does not define a regulator for the SDHCI
+	 * IO voltage, then don't advertise support for UHS modes
+	 * even if the device supports it because the IO voltage
+	 * cannot be configured.
+	 */
+	if (!IS_ERR(host->mmc->supply.vqmmc)) {
+		/* Erratum: Enable SDHCI spec v3.00 support */
+		if (soc_data->nvquirks & NVQUIRK_ENABLE_SDHCI_SPEC_300)
+			misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_SDHCI_SPEC_300;
+		/* Advertise UHS modes as supported by host */
+		if (soc_data->nvquirks & NVQUIRK_ENABLE_SDR50)
+			misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_SDR50;
+		if (soc_data->nvquirks & NVQUIRK_ENABLE_DDR50)
+			misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_DDR50;
+		if (soc_data->nvquirks & NVQUIRK_ENABLE_SDR104)
+			misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_SDR104;
+		if (soc_data->nvquirks & SDHCI_MISC_CTRL_ENABLE_SDR50)
+			clk_ctrl |= SDHCI_CLOCK_CTRL_SDR50_TUNING_OVERRIDE;
+	}
+
+	sdhci_writel(host, misc_ctrl, SDHCI_TEGRA_VENDOR_MISC_CTRL);
 	sdhci_writel(host, clk_ctrl, SDHCI_TEGRA_VENDOR_CLOCK_CTRL);
 
 	if (soc_data->nvquirks & NVQUIRK_HAS_PADCALIB)

Greg Kroah-Hartman

author maintainer

2016-10-06 08:34 UTC #22 lore raw

PATCH 23/141 nvmem: Declare nvmem_cell_read() consistently

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Guenter Roeck <[email protected]>

commit a6c50912508d80164a5e607993b617be85a46d73 upstream.

nvmem_cell_read() is declared as void * if CONFIG_NVMEM is enabled, and as char * otherwise. This can result in a build warning if CONFIG_NVMEM is not enabled and a caller asigns the result to a type other than char * without using a typecast. Use a consistent declaration to avoid the problem.

Fixes e2a5402ec7c6 ("nvmem: Add nvmem_device based consumer apis.")

Cc Srinivas Kandagatla <[email protected]>

Signed-off-by Guenter Roeck <[email protected]>

Signed-off-by Srinivas Kandagatla <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 include/linux/nvmem-consumer.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

include/linux/nvmem-consumer.h +1 -1

@@ -74,7 +74,7 @@ static inline void nvmem_cell_put(struct
 {
 }
 
-static inline char *nvmem_cell_read(struct nvmem_cell *cell, size_t *len)
+static inline void *nvmem_cell_read(struct nvmem_cell *cell, size_t *len)
 {
 	return ERR_PTR(-ENOSYS);
 }

Greg Kroah-Hartman

author maintainer

2016-10-06 08:34 UTC #6 lore raw

PATCH 6/141 can: dev: fix deadlock reported after bus-off

[1] https://github.com/victronenergy/venus/issues/24

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sergei Miroshnichenko <[email protected]>

commit 9abefcb1aaa58b9d5aa40a8bb12c87d02415e4c8 upstream.

A timer was used to restart after the bus-off state, leading to a relatively large can_restart() executed in an interrupt context, which in turn sets up pinctrl. When this happens during system boot, there is a high probability of grabbing the pinctrl_list_mutex, which is locked already by the probe() of other device, making the kernel suspect a deadlock condition [1].

To resolve this issue, the restart_timer is replaced by a delayed work.

Signed-off-by Sergei Miroshnichenko <[email protected]>

Signed-off-by Marc Kleine-Budde <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/can/dev.c   |   27 +++++++++++++++++----------
 include/linux/can/dev.h |    3 ++-
 2 files changed, 19 insertions(+), 11 deletions(-)

drivers/net/can/dev.c +17 ~~-10~~

@@ -21,6 +21,7 @@
 #include <linux/slab.h>
 #include <linux/netdevice.h>
 #include <linux/if_arp.h>
+#include <linux/workqueue.h>
 #include <linux/can.h>
 #include <linux/can/dev.h>
 #include <linux/can/skb.h>

@@ -471,9 +472,8 @@ EXPORT_SYMBOL_GPL(can_free_echo_skb);
 /*
  * CAN device restart for bus-off recovery
  */
-static void can_restart(unsigned long data)
+static void can_restart(struct net_device *dev)
 {
-	struct net_device *dev = (struct net_device *)data;
 	struct can_priv *priv = netdev_priv(dev);
 	struct net_device_stats *stats = &dev->stats;
 	struct sk_buff *skb;

@@ -513,6 +513,14 @@ restart:
 		netdev_err(dev, "Error %d during restart", err);
 }
 
+static void can_restart_work(struct work_struct *work)
+{
+	struct delayed_work *dwork = to_delayed_work(work);
+	struct can_priv *priv = container_of(dwork, struct can_priv, restart_work);
+
+	can_restart(priv->dev);
+}
+
 int can_restart_now(struct net_device *dev)
 {
 	struct can_priv *priv = netdev_priv(dev);

@@ -526,8 +534,8 @@ int can_restart_now(struct net_device *d
 	if (priv->state != CAN_STATE_BUS_OFF)
 		return -EBUSY;
 
-	/* Runs as soon as possible in the timer context */
-	mod_timer(&priv->restart_timer, jiffies);
+	cancel_delayed_work_sync(&priv->restart_work);
+	can_restart(dev);
 
 	return 0;
 }

@@ -548,8 +556,8 @@ void can_bus_off(struct net_device *dev)
 	netif_carrier_off(dev);
 
 	if (priv->restart_ms)
-		mod_timer(&priv->restart_timer,
-			  jiffies + (priv->restart_ms * HZ) / 1000);
+		schedule_delayed_work(&priv->restart_work,
+				      msecs_to_jiffies(priv->restart_ms));
 }
 EXPORT_SYMBOL_GPL(can_bus_off);

@@ -658,6 +666,7 @@ struct net_device *alloc_candev(int size
 		return NULL;
 
 	priv = netdev_priv(dev);
+	priv->dev = dev;
 
 	if (echo_skb_max) {
 		priv->echo_skb_max = echo_skb_max;

@@ -667,7 +676,7 @@ struct net_device *alloc_candev(int size
 
 	priv->state = CAN_STATE_STOPPED;
 
-	init_timer(&priv->restart_timer);
+	INIT_DELAYED_WORK(&priv->restart_work, can_restart_work);
 
 	return dev;
 }

@@ -748,8 +757,6 @@ int open_candev(struct net_device *dev)
 	if (!netif_carrier_ok(dev))
 		netif_carrier_on(dev);
 
-	setup_timer(&priv->restart_timer, can_restart, (unsigned long)dev);
-
 	return 0;
 }
 EXPORT_SYMBOL_GPL(open_candev);

@@ -764,7 +771,7 @@ void close_candev(struct net_device *dev
 {
 	struct can_priv *priv = netdev_priv(dev);
 
-	del_timer_sync(&priv->restart_timer);
+	cancel_delayed_work_sync(&priv->restart_work);
 	can_flush_echo_skb(dev);
 }
 EXPORT_SYMBOL_GPL(close_candev);

include/linux/can/dev.h +2 -1

@@ -32,6 +32,7 @@ enum can_mode {
  * CAN common private data
  */
 struct can_priv {
+	struct net_device *dev;
 	struct can_device_stats can_stats;
 
 	struct can_bittiming bittiming, data_bittiming;

@@ -47,7 +48,7 @@ struct can_priv {
 	u32 ctrlmode_static;	/* static enabled options for driver/hardware */
 
 	int restart_ms;
-	struct timer_list restart_timer;
+	struct delayed_work restart_work;
 
 	int (*do_set_bittiming)(struct net_device *dev);
 	int (*do_set_data_bittiming)(struct net_device *dev);

Greg Kroah-Hartman

author maintainer

2016-10-06 08:34 UTC #23 lore raw

PATCH 24/141 hwmon: (adt7411) set bit 3 in CFG1 register

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Michael Walle <[email protected]>

commit b53893aae441a034bf4dbbad42fe218561d7d81f upstream.

According to the datasheet you should only write 1 to this bit. If it is not set, at least AIN3 will return bad values on newer silicon revisions.

Fixes d84ca5b345c2 ("hwmon: Add driver for ADT7411 voltage and temperature sensor")

Signed-off-by Michael Walle <[email protected]>

Signed-off-by Guenter Roeck <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/hwmon/adt7411.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

drivers/hwmon/adt7411.c +4 -1

@@ -30,6 +30,7 @@
 
 #define ADT7411_REG_CFG1			0x18
 #define ADT7411_CFG1_START_MONITOR		(1 << 0)
+#define ADT7411_CFG1_RESERVED_BIT3		(1 << 3)
 
 #define ADT7411_REG_CFG2			0x19
 #define ADT7411_CFG2_DISABLE_AVG		(1 << 5)

@@ -296,8 +297,10 @@ static int adt7411_probe(struct i2c_clie
 	mutex_init(&data->device_lock);
 	mutex_init(&data->update_lock);
 
+	/* According to the datasheet, we must only write 1 to bit 3 */
 	ret = adt7411_modify_bit(client, ADT7411_REG_CFG1,
-				 ADT7411_CFG1_START_MONITOR, 1);
+				 ADT7411_CFG1_RESERVED_BIT3
+				 | ADT7411_CFG1_START_MONITOR, 1);
 	if (ret < 0)
 		return ret;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:34 UTC #24 lore raw

PATCH 26/141 spi: sh-msiof: Avoid invalid clock generator parameters

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <[email protected]>

commit c3ccf357c3d75bd2924e049b6a991f7c0c111068 upstream.

The conversion from a look-up table to a calculation for clock generator parameters forgot to take into account that BRDV x 1/1 is valid only if BRPS is x 1/1 or x 1/2, leading to undefined behavior (e.g. arbitrary clock rates).

This limitation is documented for the MSIOF module in all supported SH/R-Mobile and R-Car Gen2/Gen3 ARM SoCs.

Tested on r8a7791/koelsch and r8a7795/salvator-x.

Fixes 65d5665bb260b034 ("spi: sh-msiof: Update calculation of frequency dividing")

Signed-off-by Geert Uytterhoeven <[email protected]>

Signed-off-by Mark Brown <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/spi/spi-sh-msiof.c |    3 +++
 1 file changed, 3 insertions(+)

drivers/spi/spi-sh-msiof.c +3 -0

@@ -263,6 +263,9 @@ static void sh_msiof_spi_set_clk_regs(st
 
 	for (k = 0; k < ARRAY_SIZE(sh_msiof_spi_div_table); k++) {
 		brps = DIV_ROUND_UP(div, sh_msiof_spi_div_table[k].div);
+		/* SCR_BRDV_DIV_1 is valid only if BRPS is x 1/1 or x 1/2 */
+		if (sh_msiof_spi_div_table[k].div == 1 && brps > 2)
+			continue;
 		if (brps <= 32) /* max of brdv is 32 */
 			break;
 	}

Greg Kroah-Hartman

author maintainer

2016-10-06 08:34 UTC #25 lore raw

PATCH 27/141 iwlwifi: mvm: checksum IPv6 fragmented packet

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sara Sharon <[email protected]>

commit ecf51424152bad1b2727409f42ddf1bd86f44b7d upstream.

Our HW does not support checksum of fragmented packets. Fix code accordingly to checksum those packets in the driver.

Signed-off-by Sara Sharon <[email protected]>

Fixes 5e6a98dc4863 ("iwlwifi: mvm: enable TCP/UDP checksum support for 9000 family")

Signed-off-by Luca Coelho <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/intel/iwlwifi/mvm/tx.c |   21 ++++++---------------
 1 file changed, 6 insertions(+), 15 deletions(-)

drivers/net/wireless/intel/iwlwifi/mvm/tx.c +6 ~~-15~~

@@ -138,28 +138,19 @@ static void iwl_mvm_tx_csum(struct iwl_m
 
 		protocol = ipv6h->nexthdr;
 		while (protocol != NEXTHDR_NONE && ipv6_ext_hdr(protocol)) {
+			struct ipv6_opt_hdr *hp;
+
 			/* only supported extension headers */
 			if (protocol != NEXTHDR_ROUTING &&
 			    protocol != NEXTHDR_HOP &&
-			    protocol != NEXTHDR_DEST &&
-			    protocol != NEXTHDR_FRAGMENT) {
+			    protocol != NEXTHDR_DEST) {
 				skb_checksum_help(skb);
 				return;
 			}
 
-			if (protocol == NEXTHDR_FRAGMENT) {
-				struct frag_hdr *hp =
-					OPT_HDR(struct frag_hdr, skb, off);
-
-				protocol = hp->nexthdr;
-				off += sizeof(struct frag_hdr);
-			} else {
-				struct ipv6_opt_hdr *hp =
-					OPT_HDR(struct ipv6_opt_hdr, skb, off);
-
-				protocol = hp->nexthdr;
-				off += ipv6_optlen(hp);
-			}
+			hp = OPT_HDR(struct ipv6_opt_hdr, skb, off);
+			protocol = hp->nexthdr;
+			off += ipv6_optlen(hp);
 		}
 		/* if we get here - protocol now should be TCP/UDP */
 #endif

Greg Kroah-Hartman

author maintainer

2016-10-06 08:34 UTC #26 lore raw

PATCH 28/141 iwlwifi: mvm: fix txq aggregation bug

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Oren Givon <[email protected]>

commit 2c4a247e42526d9aae8f5ce1f190b893532f2806 upstream.

Fix an issue where nullfunc frames and block ack requests had the same tid as aggregation frames and were queued on a non aggregation queue. The pending frames counter included those frames but the check whether to decrement the pending frames counter relied on the tid status and not on the txq id. The result was an inconsistent state of the pending frames counter followed by a failure to remove the station. This failure triggered SYSASSERT 0x3421.

In addition, fix a situation in DQA mode where the number of pending frames turned negative. This was due to the TX queue being on the IWL_EMPTYING_HW_QUEUE_DELBA state and its frames were still decremented.

Even though the SYSASSERT issue is fixed when DQA is disabled, the issue is not completely solved when DQA is enabled and should still be fixed.

Signed-off-by Oren Givon <[email protected]>

Fixes cf961e16620f ("iwlwifi: mvm: support dqa-mode agg on non-shared queue")

Signed-off-by Luca Coelho <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/intel/iwlwifi/mvm/tx.c |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

drivers/net/wireless/intel/iwlwifi/mvm/tx.c +9 -1

@@ -1303,7 +1303,15 @@ static void iwl_mvm_rx_tx_cmd_single(str
 			bool send_eosp_ndp = false;
 
 			spin_lock_bh(&mvmsta->lock);
-			txq_agg = (mvmsta->tid_data[tid].state == IWL_AGG_ON);
+			if (iwl_mvm_is_dqa_supported(mvm)) {
+				enum iwl_mvm_agg_state state;
+
+				state = mvmsta->tid_data[tid].state;
+				txq_agg = (state == IWL_AGG_ON ||
+					state == IWL_EMPTYING_HW_QUEUE_DELBA);
+			} else {
+				txq_agg = txq_id >= mvm->first_agg_queue;
+			}
 
 			if (!is_ndp) {
 				tid_data->next_reclaimed = next_reclaimed;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:35 UTC #27 lore raw

PATCH 29/141 iwlwifi: mvm: write the correct internal TXF index

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Golan Ben-Ami <[email protected]>

commit e7c9bd1cc632e924a69bf704385484386bb10933 upstream.

The TX fifos are arranged consecutively in the SMEM, beginning with the regular fifos, and tailed by the internal fifos. In the current code, while trying to read the internal fifos, we read the fifos beginning with the index zero.
By doing this we actually re-read the regular fifos.

In order to read the internal fifos, start the reading index from the number of regular fifos configured by the fw.

Signed-off-by Golan Ben-Ami <[email protected]>

Fixes 39654cb3a6a2 ("iwlwifi: don't access a nonexistent register upon assert")

Signed-off-by Luca Coelho <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c +2 -1

@@ -288,7 +288,8 @@ static void iwl_mvm_dump_fifos(struct iw
 			fifo_hdr->fifo_num = cpu_to_le32(i);
 
 			/* Mark the number of TXF we're pulling now */
-			iwl_trans_write_prph(mvm->trans, TXF_CPU2_NUM, i);
+			iwl_trans_write_prph(mvm->trans, TXF_CPU2_NUM, i +
+				ARRAY_SIZE(mvm->shared_mem_cfg.txfifo_size));
 
 			fifo_hdr->available_bytes =
 				cpu_to_le32(iwl_trans_read_prph(mvm->trans,

Greg Kroah-Hartman

author maintainer

2016-10-06 08:35 UTC #28 lore raw

PATCH 30/141 iwlwifi: mvm: unmap the paging memory before freeing it

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Emmanuel Grumbach <[email protected]>

commit 3edbc7dabab8ce85aa75c5e290ecda7a3692ebc9 upstream.

This led to a DMA splat.

Fixes a6c4fb4441f4 ("iwlwifi: mvm: Add FW paging mechanism for the UMAC on PCI")

Signed-off-by Emmanuel Grumbach <[email protected]>

Signed-off-by Luca Coelho <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/intel/iwlwifi/mvm/fw.c |   12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

drivers/net/wireless/intel/iwlwifi/mvm/fw.c +8 -4

@@ -139,17 +139,21 @@ void iwl_free_fw_paging(struct iwl_mvm *
 		return;
 
 	for (i = 0; i < NUM_OF_FW_PAGING_BLOCKS; i++) {
-		if (!mvm->fw_paging_db[i].fw_paging_block) {
+		struct iwl_fw_paging *paging = &mvm->fw_paging_db[i];
+
+		if (!paging->fw_paging_block) {
 			IWL_DEBUG_FW(mvm,
 				     "Paging: block %d already freed, continue to next page\n",
 				     i);
 
 			continue;
 		}
+		dma_unmap_page(mvm->trans->dev, paging->fw_paging_phys,
+			       paging->fw_paging_size, DMA_BIDIRECTIONAL);
 
-		__free_pages(mvm->fw_paging_db[i].fw_paging_block,
-			     get_order(mvm->fw_paging_db[i].fw_paging_size));
-		mvm->fw_paging_db[i].fw_paging_block = NULL;
+		__free_pages(paging->fw_paging_block,
+			     get_order(paging->fw_paging_size));
+		paging->fw_paging_block = NULL;
 	}
 	kfree(mvm->trans->paging_download_buf);
 	mvm->trans->paging_download_buf = NULL;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:35 UTC #7 lore raw

PATCH 7/141 x86/init: Fix cr4_init_shadow() on CR4-less machines

Link http://lkml.kernel.org/r/43a20f81fb504013bf613913dc25574b45336a61.1475091074.git.luto@kernel.org open here

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andy Lutomirski <[email protected]>

commit e1bfc11c5a6f40222a698a818dc269113245820e upstream.

cr4_init_shadow() will panic on 486-like machines without CR4. Fix it using __read_cr4_safe().

Reported-by [email protected]

Signed-off-by Andy Lutomirski <[email protected]>

Reviewed-by Borislav Petkov <[email protected]>

Cc Borislav Petkov <[email protected]>

Cc Brian Gerst <[email protected]>

Cc Denys Vlasenko <[email protected]>

Cc H. Peter Anvin <[email protected]>

Cc Josh Poimboeuf <[email protected]>

Cc Linus Torvalds <[email protected]>

Cc Peter Zijlstra <[email protected]>

Cc Thomas Gleixner <[email protected]>

Fixes 1e02ce4cccdc ("x86: Store a per-cpu shadow copy of CR4")

Signed-off-by Ingo Molnar <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/x86/include/asm/tlbflush.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

arch/x86/include/asm/tlbflush.h +1 -1

@@ -81,7 +81,7 @@ DECLARE_PER_CPU_SHARED_ALIGNED(struct tl
 /* Initialize cr4 shadow for this CPU. */
 static inline void cr4_init_shadow(void)
 {
-	this_cpu_write(cpu_tlbstate.cr4, __read_cr4());
+	this_cpu_write(cpu_tlbstate.cr4, __read_cr4_safe());
 }
 
 /* Set in this cpu's CR4. */

Greg Kroah-Hartman

author maintainer

2016-10-06 08:36 UTC #32 lore raw

PATCH 35/141 usb: gadget: fsl_qe_udc: signedness bug in qe_get_frame()

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email protected]>

commit f4693b08cc901912a87369c46537b94ed4084ea0 upstream.

We can't assign -EINVAL to a u16.

Fixes 3948f0e0c999 ('usb: add Freescale QE/CPM USB peripheral controller driver')

Acked-by Peter Chen <[email protected]>

Signed-off-by Felipe Balbi <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/usb/gadget/udc/fsl_qe_udc.c |    7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

drivers/usb/gadget/udc/fsl_qe_udc.c +2 -5

@@ -1878,11 +1878,8 @@ static int qe_get_frame(struct usb_gadge
 
 	tmp = in_be16(&udc->usb_param->frame_n);
 	if (tmp & 0x8000)
-		tmp = tmp & 0x07ff;
-	else
-		tmp = -EINVAL;
-
-	return (int)tmp;
+		return tmp & 0x07ff;
+	return -EINVAL;
 }
 
 static int fsl_qe_start(struct usb_gadget *gadget,

Greg Kroah-Hartman

author maintainer

2016-10-06 08:36 UTC #34 lore raw

PATCH 37/141 mac80211: check skb_linearize() return value

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johannes Berg <[email protected]>

commit 0b97a484e52cb423662eb98904aad82dafcc1f10 upstream.

The A-MSDU TX code (within TXQs) didn't always check the return value of skb_linearize() properly, resulting in potentially passing a frag- list SKB down to the driver even when it said it can't handle it. Fix that.

Fixes 6e0456b545456 ("mac80211: add A-MSDU tx support")

Signed-off-by Johannes Berg <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/mac80211/tx.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

net/mac80211/tx.c +6 -2

@@ -1330,8 +1330,12 @@ out:
 	spin_unlock_bh(&txqi->queue.lock);
 
 	if (skb && skb_has_frag_list(skb) &&
-	    !ieee80211_hw_check(&local->hw, TX_FRAG_LIST))
-		skb_linearize(skb);
+	    !ieee80211_hw_check(&local->hw, TX_FRAG_LIST)) {
+		if (skb_linearize(skb)) {
+			ieee80211_free_txskb(&local->hw, skb);
+			return NULL;
+		}
+	}
 
 	return skb;
 }

Greg Kroah-Hartman

author maintainer

2016-10-06 08:36 UTC #35 lore raw

PATCH 38/141 i40iw: Protect req_resource_num update

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mustafa Ismail <[email protected]>

commit 44856be3e95c87f03e850ef4fdf8c0503c2dde18 upstream.

In i40iw_alloc_resource(), ensure that the update to req_resource_num is protected by the lock.

Fixes 8e06af711bf2 ("i40iw: add main, hdr, status")

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/infiniband/hw/i40iw/i40iw.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/infiniband/hw/i40iw/i40iw.h +1 -1

@@ -435,8 +435,8 @@ static inline int i40iw_alloc_resource(s
 	*next = resource_num + 1;
 	if (*next == max_resources)
 		*next = 0;
-	spin_unlock_irqrestore(&iwdev->resource_lock, flags);
 	*req_resource_num = resource_num;
+	spin_unlock_irqrestore(&iwdev->resource_lock, flags);
 
 	return 0;
 }

Greg Kroah-Hartman

author maintainer

2016-10-06 08:36 UTC #36 lore raw

PATCH 39/141 i40iw: Add missing check for interface already open

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mustafa Ismail <[email protected]>

commit faa739fb5df56aadab96bcd2f6eb3486cc3a3aec upstream.

In i40iw_open(), check if interface is already open and return success if it is.

Fixes 8e06af711bf2 ("i40iw: add main, hdr, status")

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/infiniband/hw/i40iw/i40iw_main.c |    4 ++++
 1 file changed, 4 insertions(+)

drivers/infiniband/hw/i40iw/i40iw_main.c +4 -0

@@ -1558,6 +1558,10 @@ static int i40iw_open(struct i40e_info *
 	enum i40iw_status_code status;
 	struct i40iw_handler *hdl;
 
+	hdl = i40iw_find_netdev(ldev->netdev);
+	if (hdl)
+		return 0;
+
 	hdl = kzalloc(sizeof(*hdl), GFP_KERNEL);
 	if (!hdl)
 		return -ENOMEM;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:36 UTC #38 lore raw

PATCH 41/141 i40iw: Fix double free of allocated_buffer

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mustafa Ismail <[email protected]>

commit d41d0910d97f05be987d2d60de7e8685c108963b upstream.

Memory allocated for iwqp; iwqp->allocated_buffer is freed twice in the create_qp error path. Correct this by having it freed only once in i40iw_free_qp_resources().

Fixes d37498417947 ("i40iw: add files for iwarp interface")

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/infiniband/hw/i40iw/i40iw_verbs.c |    1 -
 1 file changed, 1 deletion(-)

drivers/infiniband/hw/i40iw/i40iw_verbs.c +0 -1

@@ -794,7 +794,6 @@ static struct ib_qp *i40iw_create_qp(str
 	return &iwqp->ibqp;
 error:
 	i40iw_free_qp_resources(iwdev, iwqp, qp_num);
-	kfree(mem);
 	return ERR_PTR(err_code);
 }

Greg Kroah-Hartman

author maintainer

2016-10-06 08:36 UTC #39 lore raw

PATCH 42/141 i40iw: Do not set self-referencing pointer to NULL after kfree

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mustafa Ismail <[email protected]>

commit 7eaf8313b1cfe93417a22bdc3f7380cac2a3dc6d upstream.

In i40iw_free_virt_mem(), do not set mem->va to NULL after freeing it as mem->va is a self-referencing pointer to mem.

Fixes 4e9042e647ff ("i40iw: add hw and utils files")

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/infiniband/hw/i40iw/i40iw_utils.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

drivers/infiniband/hw/i40iw/i40iw_utils.c +4 -1

@@ -673,8 +673,11 @@ enum i40iw_status_code i40iw_free_virt_m
 {
 	if (!mem)
 		return I40IW_ERR_PARAM;
+	/*
+	 * mem->va points to the parent of mem, so both mem and mem->va
+	 * can not be touched once mem->va is freed
+	 */
 	kfree(mem->va);
-	mem->va = NULL;
 	return 0;
 }

Greg Kroah-Hartman

author maintainer

2016-10-06 08:36 UTC #40 lore raw

PATCH 43/141 i40iw: Avoid writing to freed memory

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mustafa Ismail <[email protected]>

commit 433c58139f6a7d59824aadd23d6c9cac1d4e6100 upstream.

iwpbl->iwmr points to the structure that contains iwpbl, which is iwmr. Setting this to NULL would result in writing to freed memory. So just free iwmr, and return.

Fixes d37498417947 ("i40iw: add files for iwarp interface")

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/infiniband/hw/i40iw/i40iw_verbs.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

drivers/infiniband/hw/i40iw/i40iw_verbs.c +1 -2

@@ -1924,8 +1924,7 @@ static int i40iw_dereg_mr(struct ib_mr *
 		}
 		if (iwpbl->pbl_allocated)
 			i40iw_free_pble(iwdev->pble_rsrc, palloc);
-		kfree(iwpbl->iwmr);
-		iwpbl->iwmr = NULL;
+		kfree(iwmr);
 		return 0;
 	}

Greg Kroah-Hartman

author maintainer

2016-10-06 08:37 UTC #9 lore raw

PATCH 10/141 drm/nouveau/fifo/nv04: avoid ramht race against cookie insertion

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ilia Mirkin <[email protected]>

commit 666ca3d8f19082f40745d75f3cc7cc0200ee87e3 upstream.

Signed-off-by Ilia Mirkin <[email protected]>

Signed-off-by Ben Skeggs <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.c |    3 +++
 1 file changed, 3 insertions(+)

drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.c +3 -0

@@ -37,7 +37,10 @@ nv04_fifo_dma_object_dtor(struct nvkm_fi
 {
 	struct nv04_fifo_chan *chan = nv04_fifo_chan(base);
 	struct nvkm_instmem *imem = chan->fifo->base.engine.subdev.device->imem;
+
+	mutex_lock(&chan->fifo->base.engine.subdev.mutex);
 	nvkm_ramht_remove(imem->ramht, cookie);
+	mutex_unlock(&chan->fifo->base.engine.subdev.mutex);
 }
 
 static int

Greg Kroah-Hartman

author maintainer

2016-10-06 08:37 UTC #10 lore raw

PATCH 11/141 drm/radeon/si/dpm: add workaround for for Jet parts

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alex Deucher <[email protected]>

commit 670bb4fd21c966d0d2a59ad4a99bb4889f9a2987 upstream.

Add clock quirks for Jet parts.

Reviewed-by Sonny Jiang <[email protected]>

Tested-by Sonny Jiang <[email protected]>

Signed-off-by Alex Deucher <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/gpu/drm/radeon/si_dpm.c |    6 ++++++
 1 file changed, 6 insertions(+)

drivers/gpu/drm/radeon/si_dpm.c +6 -0

@@ -3015,6 +3015,12 @@ static void si_apply_state_adjust_rules(
 	if (rdev->pdev->device == 0x6811 &&
 	    rdev->pdev->revision == 0x81)
 		max_mclk = 120000;
+	/* limit sclk/mclk on Jet parts for stability */
+	if (rdev->pdev->device == 0x6665 &&
+	    rdev->pdev->revision == 0xc3) {
+		max_sclk = 75000;
+		max_mclk = 80000;
+	}
 
 	if (rps->vce_active) {
 		rps->evclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:37 UTC #11 lore raw

PATCH 12/141 ARM: 8616/1: dt: Respect property size when parsing CPUs

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Robin Murphy <[email protected]>

commit ba6dea4f7cedb4b1c17e36f4087675d817c2e24b upstream.

Whilst MPIDR values themselves are less than 32 bits, it is still perfectly valid for a DT to have #address-cells > 1 in the CPUs node, resulting in the "reg" property having leading zero cell(s). In that situation, the big-endian nature of the data conspires with the current behaviour of only reading the first cell to cause the kernel to think all CPUs have ID 0, and become resoundingly unhappy as a consequence.

Take the full property length into account when parsing CPUs so as to be correct under any circumstances.

Cc Russell King <[email protected]>

Signed-off-by Robin Murphy <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/arm/kernel/devtree.c |   14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

arch/arm/kernel/devtree.c +11 -3

@@ -87,6 +87,8 @@ void __init arm_dt_init_cpu_maps(void)
 		return;
 
 	for_each_child_of_node(cpus, cpu) {
+		const __be32 *cell;
+		int prop_bytes;
 		u32 hwid;
 
 		if (of_node_cmp(cpu->type, "cpu"))

@@ -98,7 +100,8 @@ void __init arm_dt_init_cpu_maps(void)
 		 * properties is considered invalid to build the
 		 * cpu_logical_map.
 		 */
-		if (of_property_read_u32(cpu, "reg", &hwid)) {
+		cell = of_get_property(cpu, "reg", &prop_bytes);
+		if (!cell || prop_bytes < sizeof(*cell)) {
 			pr_debug(" * %s missing reg property\n",
 				     cpu->full_name);
 			of_node_put(cpu);

@@ -106,10 +109,15 @@ void __init arm_dt_init_cpu_maps(void)
 		}
 
 		/*
-		 * 8 MSBs must be set to 0 in the DT since the reg property
+		 * Bits n:24 must be set to 0 in the DT since the reg property
 		 * defines the MPIDR[23:0].
 		 */
-		if (hwid & ~MPIDR_HWID_BITMASK) {
+		do {
+			hwid = be32_to_cpu(*cell++);
+			prop_bytes -= sizeof(*cell);
+		} while (!hwid && prop_bytes > 0);
+
+		if (prop_bytes || (hwid & ~MPIDR_HWID_BITMASK)) {
 			of_node_put(cpu);
 			return;
 		}

Greg Kroah-Hartman

author maintainer

2016-10-06 08:38 UTC #50 lore raw

PATCH 54/141 MIPS: fix uretprobe implementation

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Marcin Nowakowski <[email protected]>

commit db06068a4fd44a57b642b369d2a295b8448f6b65 upstream.

arch_uretprobe_hijack_return_addr should replace the return address for a call with a trampoline address.

Signed-off-by Marcin Nowakowski <[email protected]>

Fixes 40e084a506eb ('MIPS: Add uprobes support.')

Patchwork: https://patchwork.linux-mips.org/patch/14298/

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/mips/kernel/uprobes.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

arch/mips/kernel/uprobes.c +1 -1

@@ -257,7 +257,7 @@ unsigned long arch_uretprobe_hijack_retu
 	ra = regs->regs[31];
 
 	/* Replace the return address with the trampoline address */
-	regs->regs[31] = ra;
+	regs->regs[31] = trampoline_vaddr;
 
 	return ra;
 }

Greg Kroah-Hartman

author maintainer

2016-10-06 08:38 UTC #51 lore raw

PATCH 55/141 MIPS: Malta: Fix IOCU disable switch read for MIPS64

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Paul Burton <[email protected]>

commit 305723ab439e14debc1d339aa04e835d488b8253 upstream.

Malta boards used with CPU emulators feature a switch to disable use of an IOCU. Software has to check this switch & ignore any present IOCU if the switch is closed. The read used to do this was unsafe for 64 bit kernels, as it simply casted the address 0xbf403000 to a pointer & dereferenced it. Whilst in a 32 bit kernel this would access kseg1, in a 64 bit kernel this attempts to access xuseg & results in an address error exception.

Fix by accessing a correctly formed ckseg1 address generated using the CKSEG1ADDR macro.

Whilst modifying this code, define the name of the register and the bit we care about within it, which indicates whether PCI DMA is routed to the IOCU or straight to DRAM. The code previously checked that bit 0 was also set, but the least significant 7 bits of the CONFIG_GEN0 register contain the value of the MReqInfo signal provided to the IOCU OCP bus, so singling out bit 0 makes little sense & that part of the check is dropped.

Signed-off-by Paul Burton <[email protected]>

Fixes b6d92b4a6bdb ("MIPS: Add option to disable software I/O coherency.")

Cc Matt Redfearn <[email protected]>

Cc Masahiro Yamada <[email protected]>

Cc Kees Cook <[email protected]>

Patchwork: https://patchwork.linux-mips.org/patch/14187/

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/mips/mti-malta/malta-setup.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

arch/mips/mti-malta/malta-setup.c +7 -1

@@ -39,6 +39,9 @@
 #include <linux/console.h>
 #endif
 
+#define ROCIT_CONFIG_GEN0		0x1f403000
+#define  ROCIT_CONFIG_GEN0_PCI_IOCU	BIT(7)
+
 extern void malta_be_init(void);
 extern int malta_be_handler(struct pt_regs *regs, int is_fixup);

@@ -107,6 +110,8 @@ static void __init fd_activate(void)
 static int __init plat_enable_iocoherency(void)
 {
 	int supported = 0;
+	u32 cfg;
+
 	if (mips_revision_sconid == MIPS_REVISION_SCON_BONITO) {
 		if (BONITO_PCICACHECTRL & BONITO_PCICACHECTRL_CPUCOH_PRES) {
 			BONITO_PCICACHECTRL |= BONITO_PCICACHECTRL_CPUCOH_EN;

@@ -129,7 +134,8 @@ static int __init plat_enable_iocoherenc
 	} else if (mips_cm_numiocu() != 0) {
 		/* Nothing special needs to be done to enable coherency */
 		pr_info("CMP IOCU detected\n");
-		if ((*(unsigned int *)0xbf403000 & 0x81) != 0x81) {
+		cfg = __raw_readl((u32 *)CKSEG1ADDR(ROCIT_CONFIG_GEN0));
+		if (!(cfg & ROCIT_CONFIG_GEN0_PCI_IOCU)) {
 			pr_crit("IOCU OPERATION DISABLED BY SWITCH - DEFAULTING TO SW IO COHERENCY\n");
 			return 0;
 		}

Greg Kroah-Hartman

author maintainer

2016-10-06 08:38 UTC #53 lore raw

PATCH 57/141 printk: fix parsing of "brl=" option

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Nicolas Iooss <[email protected]>

commit ae6c33ba6e37eea3012fe2640b22400ef3f2d0f3 upstream.

Commit bbeddf52adc1 ("printk: move braille console support into separate braille.[ch] files") moved the parsing of braille-related options into _braille_console_setup(), changing the type of variable str from char* to char**. In this commit, memcmp(str, "brl,", 4) was correctly updated to memcmp(*str, "brl,", 4) but not memcmp(str, "brl=", 4).

Update the code to make "brl=" option work again and replace memcmp() with strncmp() to make the compiler able to detect such an issue.

Fixes bbeddf52adc1 ("printk: move braille console support into separate braille.[ch] files")

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Nicolas Iooss <[email protected]>

Cc Joe Perches <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/printk/braille.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

kernel/printk/braille.c +2 -2

@@ -9,10 +9,10 @@
 
 char *_braille_console_setup(char **str, char **brl_options)
 {
-	if (!memcmp(*str, "brl,", 4)) {
+	if (!strncmp(*str, "brl,", 4)) {
 		*brl_options = "";
 		*str += 4;
-	} else if (!memcmp(str, "brl=", 4)) {
+	} else if (!strncmp(*str, "brl=", 4)) {
 		*brl_options = *str + 4;
 		*str = strchr(*brl_options, ',');
 		if (!*str)

Greg Kroah-Hartman

author maintainer

2016-10-06 08:38 UTC #54 lore raw

PATCH 58/141 Bluetooth: split sk_filter in l2cap_sock_recv_cb

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Daniel Borkmann <[email protected]>

commit dbb50887c8f619fc5c3489783ebc3122bc134a31 upstream.

During an audit for sk_filter(), we found that rx_busy_skb handling in l2cap_sock_recv_cb() and l2cap_sock_recvmsg() looks not quite as intended.

The assumption from commit e328140fdacb ("Bluetooth: Use event-driven approach for handling ERTM receive buffer") is that errors returned from sock_queue_rcv_skb() are due to receive buffer shortage. However, nothing should prevent doing a setsockopt() with SO_ATTACH_FILTER on the socket, that could drop some of the incoming skbs when handled in sock_queue_rcv_skb().

In that case sock_queue_rcv_skb() will return with -EPERM, propagated from sk_filter() and if in L2CAP_MODE_ERTM mode, wrong assumption was that we failed due to receive buffer being full. From that point onwards, due to the to-be-dropped skb being held in rx_busy_skb, we cannot make any forward progress as rx_busy_skb is never cleared from l2cap_sock_recvmsg(), due to the filter drop verdict over and over coming from sk_filter(). Meanwhile, in l2cap_sock_recv_cb() all new incoming skbs are being dropped due to rx_busy_skb being occupied.

Instead, just use __sock_queue_rcv_skb() where an error really tells that there's a receive buffer issue. Split the sk_filter() and enable it for non-segmented modes at queuing time since at this point in time the skb has already been through the ERTM state machine and it has been acked, so dropping is not allowed. Instead, for ERTM and streaming mode, call sk_filter() in l2cap_data_rcv() so the packet can be dropped before the state machine sees it.

Fixes e328140fdacb ("Bluetooth: Use event-driven approach for handling ERTM receive buffer")

Signed-off-by Daniel Borkmann <[email protected]>

Signed-off-by Mat Martineau <[email protected]>

Acked-by Willem de Bruijn <[email protected]>

Signed-off-by Marcel Holtmann <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/bluetooth/l2cap_core.c |    8 ++++++++
 net/bluetooth/l2cap_sock.c |   14 ++++++++++++--
 2 files changed, 20 insertions(+), 2 deletions(-)

net/bluetooth/l2cap_core.c +8 -0

@@ -32,6 +32,7 @@
 
 #include <linux/debugfs.h>
 #include <linux/crc16.h>
+#include <linux/filter.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>

@@ -5835,6 +5836,9 @@ static int l2cap_reassemble_sdu(struct l
 		if (chan->sdu)
 			break;
 
+		if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE))
+			break;
+
 		chan->sdu_len = get_unaligned_le16(skb->data);
 		skb_pull(skb, L2CAP_SDULEN_SIZE);

@@ -6610,6 +6614,10 @@ static int l2cap_data_rcv(struct l2cap_c
 		goto drop;
 	}
 
+	if ((chan->mode == L2CAP_MODE_ERTM ||
+	     chan->mode == L2CAP_MODE_STREAMING) && sk_filter(chan->data, skb))
+		goto drop;
+
 	if (!control->sframe) {
 		int err;

net/bluetooth/l2cap_sock.c +12 -2

@@ -1019,7 +1019,7 @@ static int l2cap_sock_recvmsg(struct soc
 		goto done;
 
 	if (pi->rx_busy_skb) {
-		if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
+		if (!__sock_queue_rcv_skb(sk, pi->rx_busy_skb))
 			pi->rx_busy_skb = NULL;
 		else
 			goto done;

@@ -1270,7 +1270,17 @@ static int l2cap_sock_recv_cb(struct l2c
 		goto done;
 	}
 
-	err = sock_queue_rcv_skb(sk, skb);
+	if (chan->mode != L2CAP_MODE_ERTM &&
+	    chan->mode != L2CAP_MODE_STREAMING) {
+		/* Even if no filter is attached, we could potentially
+		 * get errors from security modules, etc.
+		 */
+		err = sk_filter(sk, skb);
+		if (err)
+			goto done;
+	}
+
+	err = __sock_queue_rcv_skb(sk, skb);
 
 	/* For ERTM, handle one skb that doesn't fit into the recv
 	 * buffer.  This is important to do because the data frames

Greg Kroah-Hartman

author maintainer

2016-10-06 08:38 UTC #56 lore raw

PATCH 60/141 tpm: fix byte-order for the value read by tpm2_get_tpm_pt

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: [email protected] <[email protected]>

commit 1b0612b04090e416828c0dd5ed197b0913d834a0 upstream.

The result must be converted from BE byte order, which is used by the TPM2 protocol. This has not popped out because tpm2_get_tpm_pt() has been only used for probing.

Fixes 7a1d7e6dd76a ("tpm: TPM 2.0 baseline support")

Change-Id I7d71cd379b1a3b7659d20a1b6008216762596590

Signed-off-by Andrey Pronin <[email protected]>

Reviewed-by Jason Gunthorpe <[email protected]>

Reviewed-by Jarkko Sakkinen <[email protected]>

Signed-off-by Jarkko Sakkinen <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/char/tpm/tpm2-cmd.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/char/tpm/tpm2-cmd.c +1 -1

@@ -703,7 +703,7 @@ ssize_t tpm2_get_tpm_pt(struct tpm_chip
 
 	rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), desc);
 	if (!rc)
-		*value = cmd.params.get_tpm_pt_out.value;
+		*value = be32_to_cpu(cmd.params.get_tpm_pt_out.value);
 
 	return rc;
 }

Greg Kroah-Hartman

author maintainer

2016-10-06 08:38 UTC #57 lore raw

PATCH 61/141 regulator: pwm: Fix regulator ramp delay for continuous mode

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Douglas Anderson <[email protected]>

commit c2588393e6315ab68207323d37d2a73713d6bc81 upstream.

The original commit adding support for continuous voltage mode didn't handle the regulator ramp delay properly. It treated the delay as a fixed delay in uS despite the property being defined as uV / uS. Let's adjust it. Luckily there appear to be no users of this ramp delay for PWM regulators (as per grepping through device trees in linuxnext).

Note also that the upper bound of usleep_range probably shouldn't be a full 1 ms longer than the lower bound since I've seen plenty of hardware with a ramp rate of ~5000 uS / uV and for small jumps the total delays are in the tens of uS. 1000 is way too much. We'll try to be dynamic and use 10%.

NOTE: This commit doesn't add support for regulator-enable-ramp-delay. That could be done in a future patch when someone has a user of that featre.

Though this patch is shows as "fixing" a bug, there are no actual known users of continuous mode PWM regulator w/ ramp delay in mainline and so this likely won't have any effect on anyone unless they are working out-of-tree with private patches. For anyone in this state, it is highly encouraged to also pick Boris Brezillon's WIP patches to get yourself a reliable and glitch-free regulator.

Fixes 4773be185a0f ("regulator: pwm-regulator: Add support for continuous-voltage")

Signed-off-by Douglas Anderson <[email protected]>

Acked-by Laxman Dewangan <[email protected]>

Signed-off-by Mark Brown <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/regulator/pwm-regulator.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

drivers/regulator/pwm-regulator.c +7 -2

@@ -132,6 +132,7 @@ static int pwm_regulator_set_voltage(str
 	unsigned int duty_pulse;
 	u64 req_period;
 	u32 rem;
+	int old_uV = pwm_regulator_get_voltage(rdev);
 	int ret;
 
 	pwm_get_args(drvdata->pwm, &pargs);

@@ -166,8 +167,12 @@ static int pwm_regulator_set_voltage(str
 	}
 	drvdata->volt_uV = min_uV;
 
-	/* Delay required by PWM regulator to settle to the new voltage */
-	usleep_range(ramp_delay, ramp_delay + 1000);
+	if ((ramp_delay == 0) || !pwm_regulator_is_enabled(rdev))
+		return 0;
+
+	/* Ramp delay is in uV/uS. Adjust to uS and delay */
+	ramp_delay = DIV_ROUND_UP(abs(min_uV - old_uV), ramp_delay);
+	usleep_range(ramp_delay, ramp_delay + DIV_ROUND_UP(ramp_delay, 10));
 
 	return 0;
 }

Greg Kroah-Hartman

author maintainer

2016-10-06 08:39 UTC #58 lore raw

PATCH 62/141 regulator: qcom_spmi: Add support for S4 supply on pm8941

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Stephen Boyd <[email protected]>

commit c333dfe8dba7d3e47e97e1cee3c38123e19ae73c upstream.

The S4 supply is sometimes called the boost regulator because it outputs 5V. Typically it's connected to the 5vs1 and 5vs2 switches for use in USB OTG and HDMI applications. Add support for this regulator which was mistakenly left out from the initial submission of this driver.

Cc Bjorn Andersson <[email protected]>

Fixes e92a4047419c ("regulator: Add QCOM SPMI regulator driver")

Signed-off-by Mark Brown <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt |    4 ++--
 drivers/regulator/qcom_spmi-regulator.c                             |    1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt +2 -2

@@ -113,8 +113,8 @@ pm8916:
 	l14, l15, l16, l17, l18
 
 pm8941:
-	s1, s2, s3, l1, l2, l3, l4, l5, l6, l7, l8, l9, l10, l11, l12, l13, l14,
-	l15, l16, l17, l18, l19, l20, l21, l22, l23, l24, lvs1, lvs2, lvs3,
+	s1, s2, s3, s4, l1, l2, l3, l4, l5, l6, l7, l8, l9, l10, l11, l12, l13,
+	l14, l15, l16, l17, l18, l19, l20, l21, l22, l23, l24, lvs1, lvs2, lvs3,
 	mvs1, mvs2
 
 pm8994:

drivers/regulator/qcom_spmi-regulator.c +1 -0

@@ -1496,6 +1496,7 @@ static const struct spmi_regulator_data
 	{ "s1", 0x1400, "vdd_s1", },
 	{ "s2", 0x1700, "vdd_s2", },
 	{ "s3", 0x1a00, "vdd_s3", },
+	{ "s4", 0xa000, },
 	{ "l1", 0x4000, "vdd_l1_l3", },
 	{ "l2", 0x4100, "vdd_l2_lvs_1_2_3", },
 	{ "l3", 0x4200, "vdd_l1_l3", },

Greg Kroah-Hartman

author maintainer

2016-10-06 08:39 UTC #59 lore raw

PATCH 63/141 regulator: qcom_spmi: Add support for get_mode/set_mode on switches

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Stephen Boyd <[email protected]>

commit 919163f6362ac23138d31fc8befdd52e5d7e488d upstream.

The voltage switches support mode switching, so add support for these ops to those types of regulators.

Cc Bjorn Andersson <[email protected]>

Fixes e92a4047419c ("regulator: Add QCOM SPMI regulator driver")

Signed-off-by Mark Brown <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/regulator/qcom_spmi-regulator.c |    2 ++
 1 file changed, 2 insertions(+)

drivers/regulator/qcom_spmi-regulator.c +2 -0

@@ -1085,6 +1085,8 @@ static struct regulator_ops spmi_vs_ops
 	.set_pull_down		= spmi_regulator_common_set_pull_down,
 	.set_soft_start		= spmi_regulator_common_set_soft_start,
 	.set_over_current_protection = spmi_regulator_vs_ocp,
+	.set_mode		= spmi_regulator_common_set_mode,
+	.get_mode		= spmi_regulator_common_get_mode,
 };
 
 static struct regulator_ops spmi_boost_ops = {

Greg Kroah-Hartman

author maintainer

2016-10-06 08:39 UTC #60 lore raw

PATCH 64/141 regulator: qcom_spmi: Update mvs1/mvs2 switches on pm8941

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Stephen Boyd <[email protected]>

commit 93bfe79b03365f410aa91caf04263173c008ecdf upstream.

The mvs1 and mvs2 switches are actually called 5vs1 and 5vs2 on some datasheets. Let's rename them to match the datasheets and also match the RPM based regulator driver which calls these by their 5vs names (see qcom_smd-regulator.c). There aren't any users of these regulators so far, so there aren't any concerns of DT ABI breakage here. While we're here making updates to the switches, also mandate usage of the OCP irq for these switches too.

Cc Bjorn Andersson <[email protected]>

Fixes e92a4047419c ("regulator: Add QCOM SPMI regulator driver")

Signed-off-by Mark Brown <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt |    2 +-
 drivers/regulator/qcom_spmi-regulator.c                             |    4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt +1 -1

@@ -115,7 +115,7 @@ pm8916:
 pm8941:
 	s1, s2, s3, s4, l1, l2, l3, l4, l5, l6, l7, l8, l9, l10, l11, l12, l13,
 	l14, l15, l16, l17, l18, l19, l20, l21, l22, l23, l24, lvs1, lvs2, lvs3,
-	mvs1, mvs2
+	5vs1, 5vs2
 
 pm8994:
 	s1, s2, s3, s4, s5, s6, s7, s8, s9, s10, s11, s12, l1, l2, l3, l4, l5,

drivers/regulator/qcom_spmi-regulator.c +2 -2

@@ -1526,8 +1526,8 @@ static const struct spmi_regulator_data
 	{ "lvs1", 0x8000, "vdd_l2_lvs_1_2_3", },
 	{ "lvs2", 0x8100, "vdd_l2_lvs_1_2_3", },
 	{ "lvs3", 0x8200, "vdd_l2_lvs_1_2_3", },
-	{ "mvs1", 0x8300, "vin_5vs", },
-	{ "mvs2", 0x8400, "vin_5vs", },
+	{ "5vs1", 0x8300, "vin_5vs", "ocp-5vs1", },
+	{ "5vs2", 0x8400, "vin_5vs", "ocp-5vs2", },
 	{ }
 };

Greg Kroah-Hartman

author maintainer

2016-10-06 08:40 UTC #65 lore raw

PATCH 71/141 ARM: sa1100: clear reset status prior to reboot

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Russell King <[email protected]>

commit da60626e7d02a4f385cae80e450afc8b07035368 upstream.

Clear the current reset status prior to rebooting the platform. This adds the bit missing from 04fef228fb00 ("[ARM] pxa: introduce reset_status and clear_reset_status for driver's usage").

Fixes 04fef228fb00 ("[ARM] pxa: introduce reset_status and clear_reset_status for driver's usage")

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/arm/mach-sa1100/generic.c |    3 +++
 1 file changed, 3 insertions(+)

arch/arm/mach-sa1100/generic.c +3 -0

@@ -34,6 +34,7 @@
 
 #include <mach/hardware.h>
 #include <mach/irqs.h>
+#include <mach/reset.h>
 
 #include "generic.h"
 #include <clocksource/pxa.h>

@@ -95,6 +96,8 @@ static void sa1100_power_off(void)
 
 void sa11x0_restart(enum reboot_mode mode, const char *cmd)
 {
+	clear_reset_status(RESET_STATUS_ALL);
+
 	if (mode == REBOOT_SOFT) {
 		/* Jump into ROM at address 0 */
 		soft_restart(0);

Greg Kroah-Hartman

author maintainer

2016-10-06 08:40 UTC #66 lore raw

PATCH 72/141 ARM: shmobile: fix regulator quirk for Gen2

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Wolfram Sang <[email protected]>

commit c2f321126e31cd69365e65ecd4a7c774e4fc71d2 upstream.

The current implementation only works if the da9xxx devices are added before their drivers are registered. Only then it can apply the fixes to both devices. Otherwise, the driver for the first device gets probed before the fix for the second device can be applied. This is what fails when using the IP core switcher or when having the i2c master driver as a module.

So, we need to disable both da9xxx once we detected one of them. We now use i2c_transfer with hardcoded i2c_messages and device addresses, so we don't need the da9xxx client devices to be instantiated. Because the fixup is used on specific boards only, the addresses are not going to change.

Fixes 663fbb52159cca ("ARM: shmobile: R-Car Gen2: Add da9063/da9210 regulator quirk")

Signed-off-by Wolfram Sang <[email protected]>

Reviewed-by Geert Uytterhoeven <[email protected]>

Tested-by Geert Uytterhoeven <[email protected]> (r8a7791/koelsch)

Tested-by Kuninori Morimoto <[email protected]>

Signed-off-by Simon Horman <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c |   62 ++++++++-------------
 1 file changed, 26 insertions(+), 36 deletions(-)

arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c +26 ~~-36~~

@@ -41,39 +41,26 @@
 
 #define REGULATOR_IRQ_MASK	BIT(2)	/* IRQ2, active low */
 
-static void __iomem *irqc;
-
-static const u8 da9063_mask_regs[] = {
-	DA9063_REG_IRQ_MASK_A,
-	DA9063_REG_IRQ_MASK_B,
-	DA9063_REG_IRQ_MASK_C,
-	DA9063_REG_IRQ_MASK_D,
-};
-
-/* DA9210 System Control and Event Registers */
+/* start of DA9210 System Control and Event Registers */
 #define DA9210_REG_MASK_A		0x54
-#define DA9210_REG_MASK_B		0x55
-
-static const u8 da9210_mask_regs[] = {
-	DA9210_REG_MASK_A,
-	DA9210_REG_MASK_B,
-};
 
-static void da9xxx_mask_irqs(struct i2c_client *client, const u8 regs[],
-			     unsigned int nregs)
-{
-	unsigned int i;
-
-	dev_info(&client->dev, "Masking %s interrupt sources\n", client->name);
+static void __iomem *irqc;
 
-	for (i = 0; i < nregs; i++) {
-		int error = i2c_smbus_write_byte_data(client, regs[i], ~0);
-		if (error) {
-			dev_err(&client->dev, "i2c error %d\n", error);
-			return;
-		}
-	}
-}
+/* first byte sets the memory pointer, following are consecutive reg values */
+static u8 da9063_irq_clr[] = { DA9063_REG_IRQ_MASK_A, 0xff, 0xff, 0xff, 0xff };
+static u8 da9210_irq_clr[] = { DA9210_REG_MASK_A, 0xff, 0xff };
+
+static struct i2c_msg da9xxx_msgs[2] = {
+	{
+		.addr = 0x58,
+		.len = ARRAY_SIZE(da9063_irq_clr),
+		.buf = da9063_irq_clr,
+	}, {
+		.addr = 0x68,
+		.len = ARRAY_SIZE(da9210_irq_clr),
+		.buf = da9210_irq_clr,
+	},
+};
 
 static int regulator_quirk_notify(struct notifier_block *nb,
 				  unsigned long action, void *data)

@@ -93,12 +80,15 @@ static int regulator_quirk_notify(struct
 	client = to_i2c_client(dev);
 	dev_dbg(dev, "Detected %s\n", client->name);
 
-	if ((client->addr == 0x58 && !strcmp(client->name, "da9063")))
-		da9xxx_mask_irqs(client, da9063_mask_regs,
-				 ARRAY_SIZE(da9063_mask_regs));
-	else if (client->addr == 0x68 && !strcmp(client->name, "da9210"))
-		da9xxx_mask_irqs(client, da9210_mask_regs,
-				 ARRAY_SIZE(da9210_mask_regs));
+	if ((client->addr == 0x58 && !strcmp(client->name, "da9063")) ||
+	    (client->addr == 0x68 && !strcmp(client->name, "da9210"))) {
+		int ret;
+
+		dev_info(&client->dev, "clearing da9063/da9210 interrupts\n");
+		ret = i2c_transfer(client->adapter, da9xxx_msgs, ARRAY_SIZE(da9xxx_msgs));
+		if (ret != ARRAY_SIZE(da9xxx_msgs))
+			dev_err(&client->dev, "i2c error %d\n", ret);
+	}
 
 	mon = ioread32(irqc + IRQC_MONITOR);
 	if (mon & REGULATOR_IRQ_MASK)

Greg Kroah-Hartman

author maintainer

2016-10-06 08:40 UTC #67 lore raw

PATCH 73/141 ARM: sa1111: fix pcmcia suspend/resume

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Russell King <[email protected]>

commit 06dfe5cc0cc684e735cb0232fdb756d30780b05d upstream.

SA1111 PCMCIA was broken when PCMCIA switched to using dev_pm_ops for the PCMCIA socket class. PCMCIA used to handle suspend/resume via the socket hosting device, which happened at normal device suspend/resume time.

However, the referenced commit changed this: much of the resume now happens much earlier, in the noirq resume handler of dev_pm_ops.

However, on SA1111, the PCMCIA device is not accessible as the SA1111 has not been resumed at _noirq time. It's slightly worse than that, because the SA1111 has already been put to sleep at _noirq time, so suspend doesn't work properly.

Fix this by converting the core SA1111 code to use dev_pm_ops as well, and performing its own suspend/resume at noirq time.

This fixes these errors in the kernel log:

pcmcia_socket pcmcia_socket0: time out after reset pcmcia_socket pcmcia_socket1: time out after reset

and the resulting lack of PCMCIA cards after a S2RAM cycle.

Fixes d7646f7632549 ("pcmcia: use dev_pm_ops for class pcmcia_socket_class")

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/arm/common/sa1111.c |   22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

arch/arm/common/sa1111.c +13 -9

@@ -869,9 +869,9 @@ struct sa1111_save_data {
 
 #ifdef CONFIG_PM
 
-static int sa1111_suspend(struct platform_device *dev, pm_message_t state)
+static int sa1111_suspend_noirq(struct device *dev)
 {
-	struct sa1111 *sachip = platform_get_drvdata(dev);
+	struct sa1111 *sachip = dev_get_drvdata(dev);
 	struct sa1111_save_data *save;
 	unsigned long flags;
 	unsigned int val;

@@ -934,9 +934,9 @@ static int sa1111_suspend(struct platfor
  *	restored by their respective drivers, and must be called
  *	via LDM after this function.
  */
-static int sa1111_resume(struct platform_device *dev)
+static int sa1111_resume_noirq(struct device *dev)
 {
-	struct sa1111 *sachip = platform_get_drvdata(dev);
+	struct sa1111 *sachip = dev_get_drvdata(dev);
 	struct sa1111_save_data *save;
 	unsigned long flags, id;
 	void __iomem *base;

@@ -952,7 +952,7 @@ static int sa1111_resume(struct platform
 	id = sa1111_readl(sachip->base + SA1111_SKID);
 	if ((id & SKID_ID_MASK) != SKID_SA1111_ID) {
 		__sa1111_remove(sachip);
-		platform_set_drvdata(dev, NULL);
+		dev_set_drvdata(dev, NULL);
 		kfree(save);
 		return 0;
 	}

@@ -1003,8 +1003,8 @@ static int sa1111_resume(struct platform
 }
 
 #else
-#define sa1111_suspend NULL
-#define sa1111_resume  NULL
+#define sa1111_suspend_noirq NULL
+#define sa1111_resume_noirq  NULL
 #endif
 
 static int sa1111_probe(struct platform_device *pdev)

@@ -1038,6 +1038,11 @@ static int sa1111_remove(struct platform
 	return 0;
 }
 
+static struct dev_pm_ops sa1111_pm_ops = {
+	.suspend_noirq = sa1111_suspend_noirq,
+	.resume_noirq = sa1111_resume_noirq,
+};
+
 /*
  *	Not sure if this should be on the system bus or not yet.
  *	We really want some way to register a system device at

@@ -1050,10 +1055,9 @@ static int sa1111_remove(struct platform
 static struct platform_driver sa1111_device_driver = {
 	.probe		= sa1111_probe,
 	.remove		= sa1111_remove,
-	.suspend	= sa1111_suspend,
-	.resume		= sa1111_resume,
 	.driver		= {
 		.name	= "sa1111",
+		.pm	= &sa1111_pm_ops,
 	},
 };

Greg Kroah-Hartman

author maintainer

2016-10-06 08:40 UTC #44 lore raw

PATCH 47/141 i40iw: Receive notification events correctly

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Shiraz Saleem <[email protected]>

commit b71121b4b70a995c0b794026e84c880c4f26c361 upstream.

Device notifications are not received after the first interface is closed; since there is an unregister for notifications on every interface close. Correct this by unregistering for device notifications only when the last interface is closed. Also, make all operations on the i40iw_notifiers_registered atomic as it can be read/modified concurrently.

Fixes 8e06af711bf2 ("i40iw: add main, hdr, status")

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/infiniband/hw/i40iw/i40iw_main.c |    8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

drivers/infiniband/hw/i40iw/i40iw_main.c +3 -5

@@ -100,7 +100,7 @@ static struct notifier_block i40iw_net_n
 	.notifier_call = i40iw_net_event
 };
 
-static int i40iw_notifiers_registered;
+static atomic_t i40iw_notifiers_registered;
 
 /**
  * i40iw_find_i40e_handler - find a handler given a client info

@@ -1342,12 +1342,11 @@ exit:
  */
 static void i40iw_register_notifiers(void)
 {
-	if (!i40iw_notifiers_registered) {
+	if (atomic_inc_return(&i40iw_notifiers_registered) == 1) {
 		register_inetaddr_notifier(&i40iw_inetaddr_notifier);
 		register_inet6addr_notifier(&i40iw_inetaddr6_notifier);
 		register_netevent_notifier(&i40iw_net_notifier);
 	}
-	i40iw_notifiers_registered++;
 }
 
 /**

@@ -1429,8 +1428,7 @@ static void i40iw_deinit_device(struct i
 			i40iw_del_macip_entry(iwdev, (u8)iwdev->mac_ip_table_idx);
 		/* fallthrough */
 	case INET_NOTIFIER:
-		if (i40iw_notifiers_registered > 0) {
-			i40iw_notifiers_registered--;
+		if (!atomic_dec_return(&i40iw_notifiers_registered)) {
 			unregister_netevent_notifier(&i40iw_net_notifier);
 			unregister_inetaddr_notifier(&i40iw_inetaddr_notifier);
 			unregister_inet6addr_notifier(&i40iw_inetaddr6_notifier);

Greg Kroah-Hartman

author maintainer

2016-10-06 08:40 UTC #68 lore raw

PATCH 74/141 pcmcia: ds: fix suspend/resume

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Russell King <[email protected]>

commit ad8d52b897a14711e026889053befbbee7fd51ba upstream.

PCMCIA suspend/resume no longer works since the commit mentioned below, as the callbacks are no longer made. Convert the driver to the new dev_pm_ops, which restores the suspend/resume functionality. Tested on the arm arch Assabet platform.

Fixes aa8e54b559479 ("PM / sleep: Go direct_complete if driver has no callbacks")

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/pcmcia/ds.c |   12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

drivers/pcmcia/ds.c +7 -5

@@ -977,7 +977,7 @@ static int pcmcia_bus_uevent(struct devi
 
 /************************ runtime PM support ***************************/
 
-static int pcmcia_dev_suspend(struct device *dev, pm_message_t state);
+static int pcmcia_dev_suspend(struct device *dev);
 static int pcmcia_dev_resume(struct device *dev);
 
 static int runtime_suspend(struct device *dev)

@@ -985,7 +985,7 @@ static int runtime_suspend(struct device
 	int rc;
 
 	device_lock(dev);
-	rc = pcmcia_dev_suspend(dev, PMSG_SUSPEND);
+	rc = pcmcia_dev_suspend(dev);
 	device_unlock(dev);
 	return rc;
 }

@@ -1135,7 +1135,7 @@ ATTRIBUTE_GROUPS(pcmcia_dev);
 
 /* PM support, also needed for reset */
 
-static int pcmcia_dev_suspend(struct device *dev, pm_message_t state)
+static int pcmcia_dev_suspend(struct device *dev)
 {
 	struct pcmcia_device *p_dev = to_pcmcia_dev(dev);
 	struct pcmcia_driver *p_drv = NULL;

@@ -1410,6 +1410,9 @@ static struct class_interface pcmcia_bus
 	.remove_dev = &pcmcia_bus_remove_socket,
 };
 
+static const struct dev_pm_ops pcmcia_bus_pm_ops = {
+	SET_SYSTEM_SLEEP_PM_OPS(pcmcia_dev_suspend, pcmcia_dev_resume)
+};
 
 struct bus_type pcmcia_bus_type = {
 	.name = "pcmcia",

@@ -1418,8 +1421,7 @@ struct bus_type pcmcia_bus_type = {
 	.dev_groups = pcmcia_dev_groups,
 	.probe = pcmcia_device_probe,
 	.remove = pcmcia_device_remove,
-	.suspend = pcmcia_dev_suspend,
-	.resume = pcmcia_dev_resume,
+	.pm = &pcmcia_bus_pm_ops,
 };

Greg Kroah-Hartman

author maintainer

2016-10-06 08:41 UTC #69 lore raw

PATCH 75/141 hwrng: omap - Fix assumption that runtime_get_sync will always succeed

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Nishanth Menon <[email protected]>

commit 61dc0a446e5d08f2de8a24b45f69a1e302bb1b1b upstream.

pm_runtime_get_sync does return a error value that must be checked for error conditions, else, due to various reasons, the device maynot be enabled and the system will crash due to lack of clock to the hardware module.

Before:
12.562784] [00000000] *pgd=fe193835
12.562792] Internal error: : 1406 [#1] SMP ARM
[...]
12.562864] CPU: 1 PID: 241 Comm: modprobe Not tainted 4.7.0-rc4-next-20160624 #2 12.562867] Hardware name: Generic DRA74X (Flattened Device Tree) 12.562872] task: ed51f140 ti: ed44c000 task.ti: ed44c000
12.562886] PC is at omap4_rng_init+0x20/0x84 [omap_rng]
12.562899] LR is at set_current_rng+0xc0/0x154 [rng_core]
[...]

After the proper checks:

[   94.366705] omap_rng 48090000.rng: _od_fail_runtime_resume: FIXME:
missing hwmod/omap_dev info
[   94.375767] omap_rng 48090000.rng: Failed to runtime_get device -19
[   94.382351] omap_rng 48090000.rng: initialization failed.

Fixes 665d92fa85b5 ("hwrng: OMAP: convert to use runtime PM")

Cc Paul Walmsley <[email protected]>

Signed-off-by Nishanth Menon <[email protected]>

Signed-off-by Herbert Xu <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/char/hw_random/omap-rng.c |   16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

drivers/char/hw_random/omap-rng.c +14 -2

@@ -384,7 +384,12 @@ static int omap_rng_probe(struct platfor
 	}
 
 	pm_runtime_enable(&pdev->dev);
-	pm_runtime_get_sync(&pdev->dev);
+	ret = pm_runtime_get_sync(&pdev->dev);
+	if (ret) {
+		dev_err(&pdev->dev, "Failed to runtime_get device: %d\n", ret);
+		pm_runtime_put_noidle(&pdev->dev);
+		goto err_ioremap;
+	}
 
 	ret = (dev->of_node) ? of_get_omap_rng_device_details(priv, pdev) :
 				get_omap_rng_device_details(priv);

@@ -435,8 +440,15 @@ static int __maybe_unused omap_rng_suspe
 static int __maybe_unused omap_rng_resume(struct device *dev)
 {
 	struct omap_rng_dev *priv = dev_get_drvdata(dev);
+	int ret;
+
+	ret = pm_runtime_get_sync(dev);
+	if (ret) {
+		dev_err(dev, "Failed to runtime_get device: %d\n", ret);
+		pm_runtime_put_noidle(dev);
+		return ret;
+	}
 
-	pm_runtime_get_sync(dev);
 	priv->pdata->init(priv);
 
 	return 0;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:41 UTC #71 lore raw

PATCH 77/141 pstore: drop file opened reference count

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Geliang Tang <[email protected]>

commit 52d210d961a62a9662e27f14d6505d6741b2fb02 upstream.

In ee1d267423a1 ("pstore: add pstore unregister") I added:
.owner = THIS_MODULE,
in both pstore_fs_type and pstore_file_operations to increase a reference count when pstore filesystem is mounted and pstore file is opened.

But, it's repetitive. There is no need to increase the opened reference count. We only need to increase the mounted reference count. When a file is opened, the filesystem can't be unmounted. Hence the pstore module can't be unloaded either.

So I drop the opened reference count in this patch.

Fixes ee1d267423a1 ("pstore: add pstore unregister")

Signed-off-by Geliang Tang <[email protected]>

Signed-off-by Kees Cook <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/pstore/inode.c |    1 -
 1 file changed, 1 deletion(-)

fs/pstore/inode.c +0 -1

@@ -178,7 +178,6 @@ static loff_t pstore_file_llseek(struct
 }
 
 static const struct file_operations pstore_file_operations = {
-	.owner		= THIS_MODULE,
 	.open		= pstore_file_open,
 	.read		= pstore_file_read,
 	.llseek		= pstore_file_llseek,

Greg Kroah-Hartman

author maintainer

2016-10-06 08:41 UTC #73 lore raw

PATCH 79/141 fm10k: fix incorrect index calculation in fm10k_write_reta

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jacob Keller <[email protected]>

commit 34875887f360d7bd0b7f0a89f7c6d65eca616ee3 upstream.

The index calculated when looping through the indir array passed to fm10k_write_reta was incorrectly calculated as the first part i needs to be multiplied by 4.

Fixes 0cfea7a65738 ("fm10k: fix possible null pointer deref after kcalloc", 2016-04-13)

Signed-off-by Jacob Keller <[email protected]>

Tested-by Krishneil Singh <[email protected]>

Signed-off-by Jeff Kirsher <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c +3 -2

@@ -983,9 +983,10 @@ void fm10k_write_reta(struct fm10k_intfc
 		/* generate a new table if we weren't given one */
 		for (j = 0; j < 4; j++) {
 			if (indir)
-				n = indir[i + j];
+				n = indir[4 * i + j];
 			else
-				n = ethtool_rxfh_indir_default(i + j, rss_i);
+				n = ethtool_rxfh_indir_default(4 * i + j,
+							       rss_i);
 
 			table[j] = n;
 		}

Greg Kroah-Hartman

author maintainer

2016-10-06 08:41 UTC #75 lore raw

PATCH 82/141 em28xx-i2c: rt_mutex_trylock() returns zero on failure

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email protected]>

commit e44c153b30c9a0580fc2b5a93f3c6d593def2278 upstream.

The code is checking for negative returns but it should be checking for zero.

Fixes aab3125c43d8 ('[media] em28xx: add support for registering multiple i2c buses')

Signed-off-by Mauro Carvalho Chehab <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/media/usb/em28xx/em28xx-i2c.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

drivers/media/usb/em28xx/em28xx-i2c.c +2 -3

@@ -507,9 +507,8 @@ static int em28xx_i2c_xfer(struct i2c_ad
 	if (dev->disconnected)
 		return -ENODEV;
 
-	rc = rt_mutex_trylock(&dev->i2c_bus_lock);
-	if (rc < 0)
-		return rc;
+	if (!rt_mutex_trylock(&dev->i2c_bus_lock))
+		return -EAGAIN;
 
 	/* Switch I2C bus if needed */
 	if (bus != dev->cur_i2c_bus &&

Greg Kroah-Hartman

author maintainer

2016-10-06 08:42 UTC #47 lore raw

PATCH 51/141 ARM: 8618/1: decompressor: reset ttbcr fields to use TTBR0 on ARMv7

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Srinivas Ramana <[email protected]>

commit 117e5e9c4cfcb7628f08de074fbfefec1bb678b7 upstream.

If the bootloader uses the long descriptor format and jumps to kernel decompressor code, TTBCR may not be in a right state. Before enabling the MMU, it is required to clear the TTBCR.PD0 field to use TTBR0 for translation table walks.

The commit dbece45894d3a ("ARM: 7501/1: decompressor:
reset ttbcr for VMSA ARMv7 cores") does the reset of TTBCR.N, but doesn't consider all the bits for the size of TTBCR.N.

Clear TTBCR.PD0 field and reset all the three bits of TTBCR.N to indicate the use of TTBR0 and the correct base address width.

Fixes dbece45894d3 ("ARM: 7501/1: decompressor: reset ttbcr for VMSA ARMv7 cores")

Acked-by Robin Murphy <[email protected]>

Signed-off-by Srinivas Ramana <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/arm/boot/compressed/head.S |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

arch/arm/boot/compressed/head.S +1 -1

@@ -779,7 +779,7 @@ __armv7_mmu_cache_on:
 		orrne	r0, r0, #1		@ MMU enabled
 		movne	r1, #0xfffffffd		@ domain 0 = client
 		bic     r6, r6, #1 << 31        @ 32-bit translation system
-		bic     r6, r6, #3 << 0         @ use only ttbr0
+		bic     r6, r6, #(7 << 0) | (1 << 4)	@ use only ttbr0
 		mcrne	p15, 0, r3, c2, c0, 0	@ load page table pointer
 		mcrne	p15, 0, r1, c3, c0, 0	@ load domain access control
 		mcrne   p15, 0, r6, c2, c0, 2   @ load ttb control

Greg Kroah-Hartman

author maintainer

2016-10-06 08:42 UTC #48 lore raw

PATCH 52/141 arm64: debug: avoid resetting stepping state machine when TIF_SINGLESTEP

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Will Deacon <[email protected]>

commit 3a402a709500c5a3faca2111668c33d96555e35a upstream.

When TIF_SINGLESTEP is set for a task, the single-step state machine is enabled and we must take care not to reset it to the active-not-pending state if it is already in the active-pending state.

Unfortunately, that's exactly what user_enable_single_step does, by unconditionally setting the SS bit in the SPSR for the current task. This causes failures in the GDB testsuite, where GDB ends up missing expected step traps if the instruction being stepped generates another trap, e.g. PTRACE_EVENT_FORK from an SVC instruction.

This patch fixes the problem by preserving the current state of the stepping state machine when TIF_SINGLESTEP is set on the current thread.

Cc <[email protected]>

Reported-by Yao Qi <[email protected]>

Signed-off-by Will Deacon <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/arm64/kernel/debug-monitors.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

arch/arm64/kernel/debug-monitors.c +4 -2

@@ -417,8 +417,10 @@ int kernel_active_single_step(void)
 /* ptrace API */
 void user_enable_single_step(struct task_struct *task)
 {
-	set_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP);
-	set_regs_spsr_ss(task_pt_regs(task));
+	struct thread_info *ti = task_thread_info(task);
+
+	if (!test_and_set_ti_thread_flag(ti, TIF_SINGLESTEP))
+		set_regs_spsr_ss(task_pt_regs(task));
 }
 
 void user_disable_single_step(struct task_struct *task)

Greg Kroah-Hartman

author maintainer

2016-10-06 08:42 UTC #41 lore raw

PATCH 44/141 i40iw: Add missing NULL check for MPA private data

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Shiraz Saleem <[email protected]>

commit 5dfd5e5e3bc68ab3912acc712c8180942094fc69 upstream.

Add NULL check for pdata and pdata->addr before the memcpy in i40iw_form_cm_frame(). This fixes a NULL pointer de-reference which occurs when the MPA private data pointer is NULL. Also only copy pdata->size bytes in the memcpy to prevent reading past the length of the private data buffer provided by upper layer.

Fixes f27b4746f378 ("i40iw: add connection management code")

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/infiniband/hw/i40iw/i40iw_cm.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/infiniband/hw/i40iw/i40iw_cm.c +2 -2

@@ -535,8 +535,8 @@ static struct i40iw_puda_buf *i40iw_form
 		buf += hdr_len;
 	}
 
-	if (pd_len)
-		memcpy(buf, pdata->addr, pd_len);
+	if (pdata && pdata->addr)
+		memcpy(buf, pdata->addr, pdata->size);
 
 	atomic_set(&sqbuf->refcount, 1);

Greg Kroah-Hartman

author maintainer

2016-10-06 08:42 UTC #77 lore raw

PATCH 84/141 gspca: avoid unused variable warnings

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <[email protected]>

commit d7e92e15e92fc987640772bf110586898b5f15aa upstream.

When CONFIG_INPUT is disabled, multiple gspca backend drivers print compile-time warnings about unused variables:

media/usb/gspca/cpia1.c: In function 'sd_stopN':
media/usb/gspca/cpia1.c:1627:13: error: unused variable 'sd' [-Werror=unused-variable] media/usb/gspca/konica.c: In function 'sd_stopN':
media/usb/gspca/konica.c:246:13: error: unused variable 'sd' [-Werror=unused-variable]

This annotates the variables as __maybe_unused, to let the compiler know that they are declared intentionally.

Fixes ee186fd96a5f ("[media] gscpa_t613: Add support for the camera button")

Fixes c2f644aeeba3 ("[media] gspca_cpia1: Add support for button")

Fixes b517af722860 ("V4L/DVB: gspca_konica: New gspca subdriver for konica chipset using cams")

Signed-off-by Hans Verkuil <[email protected]>

Signed-off-by Mauro Carvalho Chehab <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/media/usb/gspca/cpia1.c  |    2 +-
 drivers/media/usb/gspca/konica.c |    2 +-
 drivers/media/usb/gspca/t613.c   |    2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

drivers/media/usb/gspca/cpia1.c +1 -1

@@ -1624,7 +1624,7 @@ static int sd_start(struct gspca_dev *gs
 
 static void sd_stopN(struct gspca_dev *gspca_dev)
 {
-	struct sd *sd = (struct sd *) gspca_dev;
+	struct sd *sd __maybe_unused = (struct sd *) gspca_dev;
 
 	command_pause(gspca_dev);

drivers/media/usb/gspca/konica.c +1 -1

@@ -243,7 +243,7 @@ static int sd_start(struct gspca_dev *gs
 
 static void sd_stopN(struct gspca_dev *gspca_dev)
 {
-	struct sd *sd = (struct sd *) gspca_dev;
+	struct sd *sd __maybe_unused = (struct sd *) gspca_dev;
 
 	konica_stream_off(gspca_dev);
 #if IS_ENABLED(CONFIG_INPUT)

drivers/media/usb/gspca/t613.c +1 -1

@@ -837,7 +837,7 @@ static void sd_pkt_scan(struct gspca_dev
 			u8 *data,			/* isoc packet */
 			int len)			/* iso packet length */
 {
-	struct sd *sd = (struct sd *) gspca_dev;
+	struct sd *sd __maybe_unused = (struct sd *) gspca_dev;
 	int pkt_type;
 
 	if (data[0] == 0x5a) {

Greg Kroah-Hartman

author maintainer

2016-10-06 08:43 UTC #87 lore raw

PATCH 94/141 NFS/pnfs: Do not clobber existing pgio_done_cb in nfs4_proc_read_setup

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <[email protected]>

commit ca857cc1d4cf17aba4bbb3b95d35454ad96924b3 upstream.

If a pNFS client sets hdr->pgio_done_cb, then we should not overwrite that in nfs4_proc_read_setup()

Fixes 75bf47ebf6b5 ("pNFS/flexfile: Fix erroneous fall back to...")

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/nfs/nfs4proc.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

fs/nfs/nfs4proc.c +2 -1

@@ -4393,7 +4393,8 @@ static void nfs4_proc_read_setup(struct
 				 struct rpc_message *msg)
 {
 	hdr->timestamp   = jiffies;
-	hdr->pgio_done_cb = nfs4_read_done_cb;
+	if (!hdr->pgio_done_cb)
+		hdr->pgio_done_cb = nfs4_read_done_cb;
 	msg->rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_READ];
 	nfs4_init_sequence(&hdr->args.seq_args, &hdr->res.seq_res, 0);
 }

Greg Kroah-Hartman

author maintainer

2016-10-06 08:43 UTC #88 lore raw

PATCH 95/141 svc: Avoid garbage replies when pc_func() returns rpc_drop_reply

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chuck Lever <[email protected]>

commit 0533b13072f4bf35738290d2cf9e299c7bc6c42a upstream.

If an RPC program does not set vs_dispatch and pc_func() returns rpc_drop_reply, the server sends a reply anyway containing a single word containing the value RPC_DROP_REPLY (in network byte-order, of course). This is a nonsense RPC message.

Fixes 9e701c610923 ("svcrpc: simpler request dropping")

Signed-off-by Chuck Lever <[email protected]>

Tested-by Steve Wise <[email protected]>

Signed-off-by Anna Schumaker <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/sunrpc/svc.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

net/sunrpc/svc.c +2 -1

@@ -1188,7 +1188,8 @@ svc_process_common(struct svc_rqst *rqst
 		*statp = procp->pc_func(rqstp, rqstp->rq_argp, rqstp->rq_resp);
 
 		/* Encode reply */
-		if (test_bit(RQ_DROPME, &rqstp->rq_flags)) {
+		if (*statp == rpc_drop_reply ||
+		    test_bit(RQ_DROPME, &rqstp->rq_flags)) {
 			if (procp->pc_release)
 				procp->pc_release(rqstp, NULL, rqstp->rq_resp);
 			goto dropit;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:43 UTC #91 lore raw

PATCH 98/141 pNFS/flexfiles: Fix layoutcommit after a commit to DS

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <[email protected]>

commit c001c87a63aa2f35358e33eb05e45e4cbcb34f54 upstream.

We should always do a layoutcommit after commit to DS, except if the layout segment we're using has set FF_FLAGS_NO_LAYOUTCOMMIT.

Fixes d67ae825a59d ("pnfs/flexfiles: Add the FlexFile Layout Driver")

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/nfs/flexfilelayout/flexfilelayout.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

fs/nfs/flexfilelayout/flexfilelayout.c +1 -2

@@ -1529,8 +1529,7 @@ static int ff_layout_commit_done_cb(stru
 		return -EAGAIN;
 	}
 
-	if (data->verf.committed == NFS_UNSTABLE
-	    && ff_layout_need_layoutcommit(data->lseg))
+	if (ff_layout_need_layoutcommit(data->lseg))
 		pnfs_set_layoutcommit(data->inode, data->lseg, data->lwb);
 
 	return 0;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:44 UTC #94 lore raw

PATCH 101/141 xprtrdma: Remove FMRs from the unmap list after unmapping

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chuck Lever <[email protected]>

commit 38f1932e60ba249660bbae585f61ef2dee3313a4 upstream.

ib_unmap_fmr() takes a list of FMRs to unmap. However, it does not remove the FMRs from this list as it processes them. Other ib_unmap_fmr() call sites are careful to remove FMRs from the list after ib_unmap_fmr() returns.

Since commit 7c7a5390dc6c8 ("xprtrdma: Add ro_unmap_sync method for FMR") fmr_op_unmap_sync passes more than one FMR to ib_unmap_fmr(), but it didn't bother to remove the FMRs from that list once the call was complete.

I've noticed some instability that could be related to list tangling by the new fmr_op_unmap_sync() logic. In an abundance of caution, add some defensive logic to clean up properly after ib_unmap_fmr().

Fixes 7c7a5390dc6c8 ("xprtrdma: Add ro_unmap_sync method for FMR")

Signed-off-by Chuck Lever <[email protected]>

Tested-by Steve Wise <[email protected]>

Signed-off-by Anna Schumaker <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/sunrpc/xprtrdma/fmr_ops.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

net/sunrpc/xprtrdma/fmr_ops.c +7 -2

@@ -63,9 +63,12 @@ static int
 __fmr_unmap(struct rpcrdma_mw *mw)
 {
 	LIST_HEAD(l);
+	int rc;
 
 	list_add(&mw->fmr.fmr->list, &l);
-	return ib_unmap_fmr(&l);
+	rc = ib_unmap_fmr(&l);
+	list_del_init(&mw->fmr.fmr->list);
+	return rc;
 }
 
 /* Deferred reset of a single FMR. Generate a fresh rkey by

@@ -267,7 +270,7 @@ fmr_op_unmap_sync(struct rpcrdma_xprt *r
 		seg = &req->rl_segments[i];
 		mw = seg->rl_mw;
 
-		list_add(&mw->fmr.fmr->list, &unmap_list);
+		list_add_tail(&mw->fmr.fmr->list, &unmap_list);
 
 		i += seg->mr_nsegs;
 	}

@@ -280,7 +283,9 @@ fmr_op_unmap_sync(struct rpcrdma_xprt *r
 	 */
 	for (i = 0, nchunks = req->rl_nchunks; nchunks; nchunks--) {
 		seg = &req->rl_segments[i];
+		mw = seg->rl_mw;
 
+		list_del_init(&mw->fmr.fmr->list);
 		__fmr_dma_unmap(r_xprt, seg);
 		rpcrdma_put_mw(r_xprt, seg->rl_mw);

Greg Kroah-Hartman

author maintainer

2016-10-06 08:44 UTC #95 lore raw

PATCH 102/141 ASoC: Intel: Skylake: Fix error return code in skl_probe()

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Wei Yongjun <[email protected]>

commit 979cf59acc9d634cc140aadd0d2915947ab303cc upstream.

Fix to return error code -ENODEV from the error handling case instead of 0, as done elsewhere in this function.

Fixes 87b2bdf02278 ("ASoC: Intel: Skylake: Initialize NHLT table")

Signed-off-by Wei Yongjun <[email protected]>

Acked-by Vinod Koul <[email protected]>

Signed-off-by Mark Brown <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 sound/soc/intel/skylake/skl.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

sound/soc/intel/skylake/skl.c +3 -1

@@ -659,8 +659,10 @@ static int skl_probe(struct pci_dev *pci
 
 	skl->nhlt = skl_nhlt_init(bus->dev);
 
-	if (skl->nhlt == NULL)
+	if (skl->nhlt == NULL) {
+		err = -ENODEV;
 		goto out_free;
+	}
 
 	skl_nhlt_update_topology_bin(skl);

Greg Kroah-Hartman

author maintainer

2016-10-06 08:44 UTC #97 lore raw

PATCH 104/141 brcmsmac: Free packet if dma_mapping_error() fails in dma_rxfill

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Florian Fainelli <[email protected]>

commit 5c5fa1f464ac954982df1d96b9f9a5103d21aedd upstream.

In case dma_mapping_error() returns an error in dma_rxfill, we would be leaking a packet that we allocated with brcmu_pkt_buf_get_skb().

Reported-by coverity (CID 1081819)

Fixes 67d0cf50bd32 ("brcmsmac: Fix WARNING caused by lack of calls to dma_mapping_error()")

Signed-off-by Florian Fainelli <[email protected]>

Acked-by Arend van Spriel <[email protected]>

Signed-off-by Kalle Valo <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/broadcom/brcm80211/brcmsmac/dma.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

drivers/net/wireless/broadcom/brcm80211/brcmsmac/dma.c +3 -1

@@ -1079,8 +1079,10 @@ bool dma_rxfill(struct dma_pub *pub)
 
 		pa = dma_map_single(di->dmadev, p->data, di->rxbufsize,
 				    DMA_FROM_DEVICE);
-		if (dma_mapping_error(di->dmadev, pa))
+		if (dma_mapping_error(di->dmadev, pa)) {
+			brcmu_pkt_buf_free_skb(p);
 			return false;
+		}
 
 		/* save the free packet pointer */
 		di->rxp[rxout] = p;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:44 UTC #98 lore raw

PATCH 105/141 brcmsmac: Initialize power in brcms_c_stf_ss_algo_channel_get()

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Florian Fainelli <[email protected]>

commit f823a2aa8f4674c095a5413b9e3ba12d82df06f2 upstream.

wlc_phy_txpower_get_current() does a logical OR of power->flags, which presumes that power.flags was initiliazed earlier by the caller, unfortunately, this is not the case, so make sure we zero out the struct tx_power before calling into wlc_phy_txpower_get_current().

Reported-by coverity (CID 146011)

Fixes 5b435de0d7868 ("net: wireless: add brcm80211 drivers")

Signed-off-by Florian Fainelli <[email protected]>

Acked-by Arend van Spriel <[email protected]>

Signed-off-by Kalle Valo <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/broadcom/brcm80211/brcmsmac/stf.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/net/wireless/broadcom/brcm80211/brcmsmac/stf.c +1 -1

@@ -87,7 +87,7 @@ void
 brcms_c_stf_ss_algo_channel_get(struct brcms_c_info *wlc, u16 *ss_algo_channel,
 			    u16 chanspec)
 {
-	struct tx_power power;
+	struct tx_power power = { };
 	u8 siso_mcs_id, cdd_mcs_id, stbc_mcs_id;
 
 	/* Clear previous settings */

Greg Kroah-Hartman

author maintainer

2016-10-06 08:45 UTC #100 lore raw

PATCH 107/141 powerpc/prom: Fix sub-processor option passed to ibm, client-architecture-support

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Michael Ellerman <[email protected]>

commit 66443efa83dc73775100b7442962ce2cb0d4472e upstream.

When booting from an OpenFirmware which supports it, we use the "ibm,client-architecture-support" firmware call to communicate our capabilities to firmware.

The format of the structure we pass to firmware is specified in PAPR (Power Architecture Platform Requirements), or the public version LoPAPR (Linux on Power Architecture Platform Reference).

Referring to table 244 in LoPAPR v1.1, option vector 5 contains a 4 byte field at bytes 17-20 for the "Platform Facilities Enable". This is followed by a 1 byte field at byte 21 for "Sub-Processor Represenation Level".

Comparing to the code, there we have the Platform Facilities options (OV5_PFO_*) at byte 17, but we fail to pad that field out to its full width of 4 bytes. This means the OV5_SUB_PROCESSORS option is incorrectly placed at byte 18.

Fix it by adding zero bytes for bytes 18, 19, 20, and comment the bytes to hopefully make it clearer in future.

As far as I'm aware nothing actually consumes this value at this time, so the effect of this bug is nil in practice.

It does mean we've been incorrectly setting bit 15 of the "Platform Facilities Enable" option for the past ~3 1/2 years, so we should avoid allocating that bit to anything else in future.

Fixes df77c7992029 ("powerpc/pseries: Update ibm,architecture.vec for PAPR 2.7/POWER8")

Signed-off-by Michael Ellerman <[email protected]>

Signed-off-by Benjamin Herrenschmidt <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/powerpc/kernel/prom_init.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

arch/powerpc/kernel/prom_init.c +6 -3

@@ -695,7 +695,7 @@ unsigned char ibm_architecture_vec[] = {
 	OV4_MIN_ENT_CAP,		/* minimum VP entitled capacity */
 
 	/* option vector 5: PAPR/OF options */
-	VECTOR_LENGTH(18),		/* length */
+	VECTOR_LENGTH(21),		/* length */
 	0,				/* don't ignore, don't halt */
 	OV5_FEAT(OV5_LPAR) | OV5_FEAT(OV5_SPLPAR) | OV5_FEAT(OV5_LARGE_PAGES) |
 	OV5_FEAT(OV5_DRCONF_MEMORY) | OV5_FEAT(OV5_DONATE_DEDICATE_CPU) |

@@ -726,8 +726,11 @@ unsigned char ibm_architecture_vec[] = {
 	0,
 	0,
 	OV5_FEAT(OV5_PFO_HW_RNG) | OV5_FEAT(OV5_PFO_HW_ENCR) |
-	OV5_FEAT(OV5_PFO_HW_842),
-	OV5_FEAT(OV5_SUB_PROCESSORS),
+	OV5_FEAT(OV5_PFO_HW_842),				/* Byte 17 */
+	0,							/* Byte 18 */
+	0,							/* Byte 19 */
+	0,							/* Byte 20 */
+	OV5_FEAT(OV5_SUB_PROCESSORS),				/* Byte 21 */
 
 	/* option vector 6: IBM PAPR hints */
 	VECTOR_LENGTH(3),		/* length */

Greg Kroah-Hartman

author maintainer

2016-10-06 08:45 UTC #101 lore raw

PATCH 108/141 sysctl: handle error writing UINT_MAX to u32 fields

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Subash Abhinov Kasiviswanathan <[email protected]>

commit e7d316a02f683864a12389f8808570e37fb90aa3 upstream.

We have scripts which write to certain fields on 3.18 kernels but this seems to be failing on 4.4 kernels. An entry which we write to here is xfrm_aevent_rseqth which is u32.

echo 4294967295 > /proc/sys/net/core/xfrm_aevent_rseqth

Commit 230633d109e3 ("kernel/sysctl.c: detect overflows when converting to int") prevented writing to sysctl entries when integer overflow occurs. However, this does not apply to unsigned integers.

Heinrich suggested that we introduce a new option to handle 64 bit limits and set min as 0 and max as UINT_MAX. This might not work as it leads to issues similar to __do_proc_doulongvec_minmax. Alternatively, we would need to change the datatype of the entry to 64 bit.

static int __do_proc_doulongvec_minmax(void *data, struct ctl_table
{
i = (unsigned long *) data; //This cast is causing to read beyond the size of data (u32)
vleft = table->maxlen / sizeof(unsigned long); //vleft is 0 because maxlen is sizeof(u32) which is lesser than sizeof(unsigned long) on x86_64.

Introduce a new proc handler proc_douintvec. Individual proc entries will need to be updated to use the new handler.

[[email protected]: coding-style fixes]

Fixes 230633d109e3 ("kernel/sysctl.c:detect overflows when converting to int")

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Subash Abhinov Kasiviswanathan <[email protected]>

Cc Heinrich Schuchardt <[email protected]>

Cc Kees Cook <[email protected]>

Cc "David S. Miller" <[email protected]>

Cc Ingo Molnar <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 include/linux/sysctl.h |    2 ++
 kernel/sysctl.c        |   45 +++++++++++++++++++++++++++++++++++++++++++--
 2 files changed, 45 insertions(+), 2 deletions(-)

include/linux/sysctl.h +2 -0

@@ -41,6 +41,8 @@ extern int proc_dostring(struct ctl_tabl
 			 void __user *, size_t *, loff_t *);
 extern int proc_dointvec(struct ctl_table *, int,
 			 void __user *, size_t *, loff_t *);
+extern int proc_douintvec(struct ctl_table *, int,
+			 void __user *, size_t *, loff_t *);
 extern int proc_dointvec_minmax(struct ctl_table *, int,
 				void __user *, size_t *, loff_t *);
 extern int proc_dointvec_jiffies(struct ctl_table *, int,

kernel/sysctl.c +43 -2

69 lines not on this page · raw message

Greg Kroah-Hartman

author maintainer

2016-10-06 08:45 UTC #102 lore raw

PATCH 109/141 ASoC: omap-mcpdm: Fix irq resource handling

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Peter Ujfalusi <[email protected]>

commit a8719670687c46ed2e904c0d05fa4cd7e4950cd1 upstream.

Fixes ddd17531ad908 ("ASoC: omap-mcpdm: Clean up with devm_* function")

Managed irq request will not doing any good in ASoC probe level as it is not going to free up the irq when the driver is unbound from the sound card.

Signed-off-by Peter Ujfalusi <[email protected]>

Reported-by Russell King <[email protected]>

Signed-off-by Mark Brown <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 sound/soc/omap/omap-mcpdm.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

sound/soc/omap/omap-mcpdm.c +3 -2

@@ -390,8 +390,8 @@ static int omap_mcpdm_probe(struct snd_s
 	pm_runtime_get_sync(mcpdm->dev);
 	omap_mcpdm_write(mcpdm, MCPDM_REG_CTRL, 0x00);
 
-	ret = devm_request_irq(mcpdm->dev, mcpdm->irq, omap_mcpdm_irq_handler,
-				0, "McPDM", (void *)mcpdm);
+	ret = request_irq(mcpdm->irq, omap_mcpdm_irq_handler, 0, "McPDM",
+			  (void *)mcpdm);
 
 	pm_runtime_put_sync(mcpdm->dev);

@@ -416,6 +416,7 @@ static int omap_mcpdm_remove(struct snd_
 {
 	struct omap_mcpdm *mcpdm = snd_soc_dai_get_drvdata(dai);
 
+	free_irq(mcpdm->irq, (void *)mcpdm);
 	pm_runtime_disable(mcpdm->dev);
 
 	return 0;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:45 UTC #105 lore raw

PATCH 112/141 SUNRPC: Silence WARN_ON when NFSv4.1 over RDMA is in use

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chuck Lever <[email protected]>

commit 16590a228109e2f318d2cc6466221134cfab723a upstream.

Using NFSv4.1 on RDMA should be safe, so broaden the new checks in rpc_create().

WARN_ON_ONCE is used, matching most other WARN call sites in clnt.c.

Fixes 39a9beab5acb ("rpc: share one xps between all backchannels")

Fixes d50039ea5ee6 ("nfsd4/rpc: move backchannel create logic...")

Signed-off-by Chuck Lever <[email protected]>

Reviewed-by J. Bruce Fields <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/sunrpc/clnt.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

net/sunrpc/clnt.c +2 -2

@@ -453,7 +453,7 @@ static struct rpc_clnt *rpc_create_xprt(
 	struct rpc_xprt_switch *xps;
 
 	if (args->bc_xprt && args->bc_xprt->xpt_bc_xps) {
-		WARN_ON(args->protocol != XPRT_TRANSPORT_BC_TCP);
+		WARN_ON_ONCE(!(args->protocol & XPRT_TRANSPORT_BC));
 		xps = args->bc_xprt->xpt_bc_xps;
 		xprt_switch_get(xps);
 	} else {

@@ -520,7 +520,7 @@ struct rpc_clnt *rpc_create(struct rpc_c
 	char servername[48];
 
 	if (args->bc_xprt) {
-		WARN_ON(args->protocol != XPRT_TRANSPORT_BC_TCP);
+		WARN_ON_ONCE(!(args->protocol & XPRT_TRANSPORT_BC));
 		xprt = args->bc_xprt->xpt_bc_xprt;
 		if (xprt) {
 			xprt_get(xprt);

Greg Kroah-Hartman

author maintainer

2016-10-06 08:45 UTC #79 lore raw

PATCH 86/141 mailbox: mailbox-test: set tdev->signal to NULL after freeing

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sudeep Holla <[email protected]>

commit 9ef3c5112139cc5c5666ee096e05bc1e00e94015 upstream.

tdev->signal is not set NULL after it's freed. This will cause random exceptions when the stale pointer is accessed after tdev->signal is freed. Also, since tdev->signal allocation is skipped the next time it's written, this leads to continuous fault finally leading to the total death of the system.

Fixes d1c2f87c9a8f ("mailbox: mailbox-test: Prevent memory leak")

Signed-off-by Sudeep Holla <[email protected]>

Acked-by Lee Jones <[email protected]>

Signed-off-by Jassi Brar <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/mailbox/mailbox-test.c |    1 +
 1 file changed, 1 insertion(+)

drivers/mailbox/mailbox-test.c +1 -0

@@ -133,6 +133,7 @@ static ssize_t mbox_test_message_write(s
 out:
 	kfree(tdev->signal);
 	kfree(tdev->message);
+	tdev->signal = NULL;
 
 	return ret < 0 ? ret : count;
 }

Greg Kroah-Hartman

author maintainer

2016-10-06 08:46 UTC #107 lore raw

PATCH 114/141 lib/test_hash.c: fix warning in preprocessor symbol evaluation

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <[email protected]>

commit e6173ba42bbdba05fd4f3021c0beda0506271507 upstream.

Some versions of gcc don't like tests for the value of an undefined preprocessor symbol, even in the #else branch of an #ifndef:

    lib/test_hash.c:224:7: warning: "HAVE_ARCH__HASH_32" is not defined [-Wundef]
     #elif HAVE_ARCH__HASH_32 != 1
	   ^
    lib/test_hash.c:229:7: warning: "HAVE_ARCH_HASH_32" is not defined [-Wundef]
     #elif HAVE_ARCH_HASH_32 != 1
	   ^
    lib/test_hash.c:234:7: warning: "HAVE_ARCH_HASH_64" is not defined [-Wundef]
     #elif HAVE_ARCH_HASH_64 != 1
	   ^

Seen with gcc 4.9, not seen with 4.1.2.

Change the logic to only check the value inside an #ifdef to fix this.

Fixes 468a9428521e7d00 ("<linux/hash.h>: Add support for architecture-specific functions")

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Geert Uytterhoeven <[email protected]>

Acked-by George Spelvin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 lib/test_hash.c |   24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

lib/test_hash.c +15 -9

@@ -219,21 +219,27 @@ test_hash_init(void)
 	}
 
 	/* Issue notices about skipped tests. */
-#ifndef HAVE_ARCH__HASH_32
-	pr_info("__hash_32() has no arch implementation to test.");
-#elif HAVE_ARCH__HASH_32 != 1
+#ifdef HAVE_ARCH__HASH_32
+#if HAVE_ARCH__HASH_32 != 1
 	pr_info("__hash_32() is arch-specific; not compared to generic.");
 #endif
-#ifndef HAVE_ARCH_HASH_32
-	pr_info("hash_32() has no arch implementation to test.");
-#elif HAVE_ARCH_HASH_32 != 1
+#else
+	pr_info("__hash_32() has no arch implementation to test.");
+#endif
+#ifdef HAVE_ARCH_HASH_32
+#if HAVE_ARCH_HASH_32 != 1
 	pr_info("hash_32() is arch-specific; not compared to generic.");
 #endif
-#ifndef HAVE_ARCH_HASH_64
-	pr_info("hash_64() has no arch implementation to test.");
-#elif HAVE_ARCH_HASH_64 != 1
+#else
+	pr_info("hash_32() has no arch implementation to test.");
+#endif
+#ifdef HAVE_ARCH_HASH_64
+#if HAVE_ARCH_HASH_64 != 1
 	pr_info("hash_64() is arch-specific; not compared to generic.");
 #endif
+#else
+	pr_info("hash_64() has no arch implementation to test.");
+#endif
 
 	pr_notice("%u tests passed.", tests);

Greg Kroah-Hartman

author maintainer

2016-10-06 08:46 UTC #108 lore raw

PATCH 115/141 dmaengine: at_xdmac: fix to pass correct device identity to free_irq()

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Wei Yongjun <[email protected]>

commit 6a8b0c6b18f62a277ffb2139d0c0253fe35d7feb upstream.

free_irq() expects the same device identity that was passed to corresponding request_irq(), otherwise the IRQ is not freed.

Fixes e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver")

Signed-off-by Wei Yongjun <[email protected]>

Acked-by Ludovic Desroches <[email protected]>

Signed-off-by Vinod Koul <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/dma/at_xdmac.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/dma/at_xdmac.c +2 -2

@@ -2067,7 +2067,7 @@ err_dma_unregister:
 err_clk_disable:
 	clk_disable_unprepare(atxdmac->clk);
 err_free_irq:
-	free_irq(atxdmac->irq, atxdmac->dma.dev);
+	free_irq(atxdmac->irq, atxdmac);
 	return ret;
 }

@@ -2081,7 +2081,7 @@ static int at_xdmac_remove(struct platfo
 	dma_async_device_unregister(&atxdmac->dma);
 	clk_disable_unprepare(atxdmac->clk);
 
-	free_irq(atxdmac->irq, atxdmac->dma.dev);
+	free_irq(atxdmac->irq, atxdmac);
 
 	for (i = 0; i < atxdmac->dma.chancnt; i++) {
 		struct at_xdmac_chan *atchan = &atxdmac->chan[i];

Greg Kroah-Hartman

author maintainer

2016-10-06 08:46 UTC #110 lore raw

PATCH 118/141 IB/ipoib: Fix memory corruption in ipoib cm mode connect flow

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Erez Shitrit <[email protected]>

commit 546481c2816ea3c061ee9d5658eb48070f69212e upstream.

When a new CM connection is being requested, ipoib driver copies data from the path pointer in the CM/tx object, the path object might be invalid at the point and memory corruption will happened later when now the CM driver will try using that data.

The next scenario demonstrates it:

	neigh_add_path --> ipoib_cm_create_tx -->
	queue_work (pointer to path is in the cm/tx struct)
	#while the work is still in the queue,
	#the port goes down and causes the ipoib_flush_paths:
	ipoib_flush_paths --> path_free --> kfree(path)
	#at this point the work scheduled starts.
	ipoib_cm_tx_start --> copy from the (invalid)path pointer:
	(memcpy(&pathrec, &p->path->pathrec, sizeof pathrec);)
	 -> memory corruption.

To fix that the driver now starts the CM/tx connection only if that specific path exists in the general paths database.
This check is protected with the relevant locks, and uses the gid from the neigh member in the CM/tx object which is valid according to the ref count that was taken by the CM/tx.

Fixes 839fcaba35 ('IPoIB: Connected mode experimental support')

Signed-off-by Erez Shitrit <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/infiniband/ulp/ipoib/ipoib.h      |    1 +
 drivers/infiniband/ulp/ipoib/ipoib_cm.c   |   16 ++++++++++++++++
 drivers/infiniband/ulp/ipoib/ipoib_main.c |    2 +-
 3 files changed, 18 insertions(+), 1 deletion(-)

drivers/infiniband/ulp/ipoib/ipoib.h +1 -0

@@ -478,6 +478,7 @@ void ipoib_send(struct net_device *dev,
 		struct ipoib_ah *address, u32 qpn);
 void ipoib_reap_ah(struct work_struct *work);
 
+struct ipoib_path *__path_find(struct net_device *dev, void *gid);
 void ipoib_mark_paths_invalid(struct net_device *dev);
 void ipoib_flush_paths(struct net_device *dev);
 int ipoib_check_sm_sendonly_fullmember_support(struct ipoib_dev_priv *priv);

drivers/infiniband/ulp/ipoib/ipoib_cm.c +16 -0

@@ -1318,6 +1318,8 @@ void ipoib_cm_destroy_tx(struct ipoib_cm
 	}
 }
 
+#define QPN_AND_OPTIONS_OFFSET	4
+
 static void ipoib_cm_tx_start(struct work_struct *work)
 {
 	struct ipoib_dev_priv *priv = container_of(work, struct ipoib_dev_priv,

@@ -1326,6 +1328,7 @@ static void ipoib_cm_tx_start(struct wor
 	struct ipoib_neigh *neigh;
 	struct ipoib_cm_tx *p;
 	unsigned long flags;
+	struct ipoib_path *path;
 	int ret;
 
 	struct ib_sa_path_rec pathrec;

@@ -1338,7 +1341,19 @@ static void ipoib_cm_tx_start(struct wor
 		p = list_entry(priv->cm.start_list.next, typeof(*p), list);
 		list_del_init(&p->list);
 		neigh = p->neigh;
+
 		qpn = IPOIB_QPN(neigh->daddr);
+		/*
+		 * As long as the search is with these 2 locks,
+		 * path existence indicates its validity.
+		 */
+		path = __path_find(dev, neigh->daddr + QPN_AND_OPTIONS_OFFSET);
+		if (!path) {
+			pr_info("%s ignore not valid path %pI6\n",
+				__func__,
+				neigh->daddr + QPN_AND_OPTIONS_OFFSET);
+			goto free_neigh;
+		}
 		memcpy(&pathrec, &p->path->pathrec, sizeof pathrec);
 
 		spin_unlock_irqrestore(&priv->lock, flags);

@@ -1350,6 +1365,7 @@ static void ipoib_cm_tx_start(struct wor
 		spin_lock_irqsave(&priv->lock, flags);
 
 		if (ret) {
+free_neigh:
 			neigh = p->neigh;
 			if (neigh) {
 				neigh->cm = NULL;

drivers/infiniband/ulp/ipoib/ipoib_main.c +1 -1

@@ -485,7 +485,7 @@ int ipoib_set_mode(struct net_device *de
 	return -EINVAL;
 }
 
-static struct ipoib_path *__path_find(struct net_device *dev, void *gid)
+struct ipoib_path *__path_find(struct net_device *dev, void *gid)
 {
 	struct ipoib_dev_priv *priv = netdev_priv(dev);
 	struct rb_node *n = priv->path_tree.rb_node;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:47 UTC #113 lore raw

PATCH 121/141 regmap: rbtree: Avoid overlapping nodes

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Lars-Peter Clausen <[email protected]>

commit 1bc8da4e143c0fd8807e061a66d91d5972601ab1 upstream.

When searching for a suitable node that should be used for inserting a new register, which does not fall within the range of any existing node, we not only looks for nodes which are directly adjacent to the new register, but for nodes within a certain proximity. This is done to avoid creating lots of small nodes with just a few registers spacing in between, which would increase memory usage as well as tree traversal time.

This means there might be multiple node candidates which fall within the proximity range of the new register. If we choose the first node we encounter, under certain register insertion patterns it is possible to end up with overlapping ranges. This will break order in the rbtree and can cause the cached register value to become corrupted.

E.g. take the simplified example where the proximity range is 2 and the register insertion sequence is 1, 4, 2, 3, 5.
* Insert of register 1 creates a new node, this is the root of the rbtree
* Insert of register 4 creates a new node, which is inserted to the right of the root.
* Insert of register 2 gets inserted to the first node
* Insert of register 3 gets inserted to the first node
* Insert of register 5 also gets inserted into the first node since this is the first node encountered and it is within the proximity range. Now there are two overlapping nodes.

To avoid this always choose the node that is closest to the new register. This will ensure that nodes will not overlap. The tree traversal is still done as a binary search, we just don't stop at the first node found. So the complexity of the algorithm stays within the same order.

Ideally if a new register is in the range of two adjacent blocks those blocks should be merged, but that is a much more invasive change and left for later.

The issue was initially introduced in commit 472fdec7380c ("regmap: rbtree:
Reduce number of nodes, take 2"), but became much more exposed by commit 6399aea629b0 ("regmap: rbtree: When adding a reg do a bsearch for target node") which changed the order in which nodes are looked-up.

Fixes 6399aea629b0 ("regmap: rbtree: When adding a reg do a bsearch for target node")

Signed-off-by Lars-Peter Clausen <[email protected]>

Signed-off-by Mark Brown <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/base/regmap/regcache-rbtree.c |   38 +++++++++++++++++++++++++---------
 1 file changed, 28 insertions(+), 10 deletions(-)

drivers/base/regmap/regcache-rbtree.c +28 ~~-10~~

@@ -404,6 +404,7 @@ static int regcache_rbtree_write(struct
 		unsigned int new_base_reg, new_top_reg;
 		unsigned int min, max;
 		unsigned int max_dist;
+		unsigned int dist, best_dist = UINT_MAX;
 
 		max_dist = map->reg_stride * sizeof(*rbnode_tmp) /
 			map->cache_word_size;

@@ -423,24 +424,41 @@ static int regcache_rbtree_write(struct
 				&base_reg, &top_reg);
 
 			if (base_reg <= max && top_reg >= min) {
-				new_base_reg = min(reg, base_reg);
-				new_top_reg = max(reg, top_reg);
-			} else {
-				if (max < base_reg)
-					node = node->rb_left;
+				if (reg < base_reg)
+					dist = base_reg - reg;
+				else if (reg > top_reg)
+					dist = reg - top_reg;
 				else
-					node = node->rb_right;
-
-				continue;
+					dist = 0;
+				if (dist < best_dist) {
+					rbnode = rbnode_tmp;
+					best_dist = dist;
+					new_base_reg = min(reg, base_reg);
+					new_top_reg = max(reg, top_reg);
+				}
 			}
 
-			ret = regcache_rbtree_insert_to_block(map, rbnode_tmp,
+			/*
+			 * Keep looking, we want to choose the closest block,
+			 * otherwise we might end up creating overlapping
+			 * blocks, which breaks the rbtree.
+			 */
+			if (reg < base_reg)
+				node = node->rb_left;
+			else if (reg > top_reg)
+				node = node->rb_right;
+			else
+				break;
+		}
+
+		if (rbnode) {
+			ret = regcache_rbtree_insert_to_block(map, rbnode,
 							      new_base_reg,
 							      new_top_reg, reg,
 							      value);
 			if (ret)
 				return ret;
-			rbtree_ctx->cached_rbnode = rbnode_tmp;
+			rbtree_ctx->cached_rbnode = rbnode;
 			return 0;
 		}

Greg Kroah-Hartman

author maintainer

2016-10-06 08:47 UTC #114 lore raw

PATCH 122/141 scsi: ses: use scsi_is_sas_rphy instead of is_sas_attached

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johannes Thumshirn <[email protected]>

commit 835831c57e9b0cccc24e96a812542875471d75b5 upstream.

Use scsi_is_sas_rphy() instead of is_sas_attached() to decide whether we should obtain the SAS address from a scsi device or not. This will prevent us from tripping on the BUG_ON() in sas_sdev_to_rdev() if the rphy isn't attached to the SAS transport class, like it is with hpsa's logical devices.

Fixes 3f8d6f2a0 ('ses: fix discovery of SATA devices in SAS enclosures')

Signed-off-by Johannes Thumshirn <[email protected]>

Reviewed-by James E.J. Bottomley <[email protected]>

Signed-off-by Martin K. Petersen <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/scsi/ses.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/scsi/ses.c +1 -1

@@ -587,7 +587,7 @@ static void ses_match_to_enclosure(struc
 
 	ses_enclosure_data_process(edev, to_scsi_device(edev->edev.parent), 0);
 
-	if (is_sas_attached(sdev))
+	if (scsi_is_sas_rphy(&sdev->sdev_gendev))
 		efd.addr = sas_get_address(sdev);
 
 	if (efd.addr) {

Greg Kroah-Hartman

author maintainer

2016-10-06 08:47 UTC #80 lore raw

PATCH 87/141 avr32: off by one in at32_init_pio()

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email protected]>

commit 55f1cf83d5cf885c75267269729805852039c834 upstream.

The pio_dev[] array has MAX_NR_PIO_DEVICES elements so the > should be

Quoted 1 line

=.

Fixes 5f97f7f9400d ('[PATCH] avr32 architecture')

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/avr32/mach-at32ap/pio.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

arch/avr32/mach-at32ap/pio.c +1 -1

@@ -435,7 +435,7 @@ void __init at32_init_pio(struct platfor
 	struct resource *regs;
 	struct pio_device *pio;
 
-	if (pdev->id > MAX_NR_PIO_DEVICES) {
+	if (pdev->id >= MAX_NR_PIO_DEVICES) {
 		dev_err(&pdev->dev, "only %d PIO devices supported\n",
 			MAX_NR_PIO_DEVICES);
 		return;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:47 UTC #117 lore raw

PATCH 123/141 IB/ipoib: Dont allow MC joins during light MC flush

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alex Vesker <[email protected]>

commit 344bacca8cd811809fc33a249f2738ab757d327f upstream.

This fix solves a race between light flush and on the fly joins. Light flush doesn't set the device to down and unset IPOIB_OPER_UP flag, this means that if while flushing we have a MC join in progress and the QP was attached to BC MGID we can have a mismatches when re-attaching a QP to the BC MGID.

The light flush would set the broadcast group to NULL causing an on the fly join to rejoin and reattach to the BC MCG as well as adding the BC MGID to the multicast list. The flush process would later on remove the BC MGID and detach it from the QP. On the next flush the BC MGID is present in the multicast list but not found when trying to detach it because of the previous double attach and single detach.

[18332.714265] ------------[ cut here ]------------
[18332.717775] WARNING: CPU: 6 PID: 3767 at drivers/infiniband/core/verbs.c:280 ib_dealloc_pd+0xff/0x120 [ib_core]
...
[18332.775198] Hardware name: Red Hat KVM, BIOS Bochs 01/01/2011
[18332.779411]  0000000000000000 ffff8800b50dfbb0 ffffffff813fed47 0000000000000000
[18332.784960]  0000000000000000 ffff8800b50dfbf0 ffffffff8109add1 0000011832f58300
[18332.790547]  ffff880226a596c0 ffff880032482000 ffff880032482830 ffff880226a59280
[18332.796199] Call Trace:
[18332.798015]  [<ffffffff813fed47>] dump_stack+0x63/0x8c
[18332.801831]  [<ffffffff8109add1>] __warn+0xd1/0xf0
[18332.805403]  [<ffffffff8109aebd>] warn_slowpath_null+0x1d/0x20
[18332.809706]  [<ffffffffa025d90f>] ib_dealloc_pd+0xff/0x120 [ib_core]
[18332.814384]  [<ffffffffa04f3d7c>] ipoib_transport_dev_cleanup+0xfc/0x1d0 [ib_ipoib]
[18332.820031]  [<ffffffffa04ed648>] ipoib_ib_dev_cleanup+0x98/0x110 [ib_ipoib]
[18332.825220]  [<ffffffffa04e62c8>] ipoib_dev_cleanup+0x2d8/0x550 [ib_ipoib]
[18332.830290]  [<ffffffffa04e656f>] ipoib_uninit+0x2f/0x40 [ib_ipoib]
[18332.834911]  [<ffffffff81772a8a>] rollback_registered_many+0x1aa/0x2c0
[18332.839741]  [<ffffffff81772bd1>] rollback_registered+0x31/0x40
[18332.844091]  [<ffffffff81773b18>] unregister_netdevice_queue+0x48/0x80
[18332.848880]  [<ffffffffa04f489b>] ipoib_vlan_delete+0x1fb/0x290 [ib_ipoib]
[18332.853848]  [<ffffffffa04df1cd>] delete_child+0x7d/0xf0 [ib_ipoib]
[18332.858474]  [<ffffffff81520c08>] dev_attr_store+0x18/0x30
[18332.862510]  [<ffffffff8127fe4a>] sysfs_kf_write+0x3a/0x50
[18332.866349]  [<ffffffff8127f4e0>] kernfs_fop_write+0x120/0x170
[18332.870471]  [<ffffffff81207198>] __vfs_write+0x28/0xe0
[18332.874152]  [<ffffffff810e09bf>] ? percpu_down_read+0x1f/0x50
[18332.878274]  [<ffffffff81208062>] vfs_write+0xa2/0x1a0
[18332.881896]  [<ffffffff812093a6>] SyS_write+0x46/0xa0
[18332.885632]  [<ffffffff810039b7>] do_syscall_64+0x57/0xb0
[18332.889709]  [<ffffffff81883321>] entry_SYSCALL64_slow_path+0x25/0x25
[18332.894727] ---[ end trace 09ebbe31f831ef17 ]---

Fixes ee1e2c82c245 ("IPoIB: Refresh paths instead of flushing them on SM change events")

Signed-off-by Alex Vesker <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/infiniband/ulp/ipoib/ipoib_ib.c |    9 +++++++++
 1 file changed, 9 insertions(+)

drivers/infiniband/ulp/ipoib/ipoib_ib.c +9 -0

@@ -1161,8 +1161,17 @@ static void __ipoib_ib_dev_flush(struct
 	}
 
 	if (level == IPOIB_FLUSH_LIGHT) {
+		int oper_up;
 		ipoib_mark_paths_invalid(dev);
+		/* Set IPoIB operation as down to prevent races between:
+		 * the flush flow which leaves MCG and on the fly joins
+		 * which can happen during that time. mcast restart task
+		 * should deal with join requests we missed.
+		 */
+		oper_up = test_and_clear_bit(IPOIB_FLAG_OPER_UP, &priv->flags);
 		ipoib_mcast_dev_flush(dev);
+		if (oper_up)
+			set_bit(IPOIB_FLAG_OPER_UP, &priv->flags);
 		ipoib_flush_ah(dev);
 	}

Greg Kroah-Hartman

author maintainer

2016-10-06 08:47 UTC #81 lore raw

PATCH 88/141 qla2xxx: Fix BBCR offset

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sawan Chandak <[email protected]>

commit 061b5c3c48a1e276f8fd539bfa8aab8b359ffc31 upstream.

Fixes 969a619 ("qla2xxx: Add support for buffer to buffer credit value for ISP27XX.")

Signed-off-by Sawan Chandak <[email protected]>

Signed-off-by Himanshu Madhani <[email protected]>

Reviewed-by Hannes Reinecke <[email protected]>

Signed-off-by Martin K. Petersen <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/scsi/qla2xxx/qla_fw.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/scsi/qla2xxx/qla_fw.h +1 -1

@@ -1288,7 +1288,7 @@ struct vp_rpt_id_entry_24xx {
 
 	uint8_t vp_idx_map[16];
 
-	uint8_t reserved_4[28];
+	uint8_t reserved_4[24];
 	uint16_t bbcr;
 	uint8_t reserved_5[6];
 };

Greg Kroah-Hartman

author maintainer

2016-10-06 08:47 UTC #82 lore raw

PATCH 89/141 fnic: pci_dma_mapping_error() doesnt return an error code

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email protected]>

commit dd7328e4c53649c1c7ec36bc1cf5b229b8662047 upstream.

pci_dma_mapping_error() returns true on error and false on success.

Fixes fd6ddfa4c1dd ('fnic: check pci_map_single() return value')

Signed-off-by Martin K. Petersen <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/scsi/fnic/fnic_fcs.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

drivers/scsi/fnic/fnic_fcs.c +4 -4

@@ -954,8 +954,8 @@ int fnic_alloc_rq_frame(struct vnic_rq *
 	skb_put(skb, len);
 	pa = pci_map_single(fnic->pdev, skb->data, len, PCI_DMA_FROMDEVICE);
 
-	r = pci_dma_mapping_error(fnic->pdev, pa);
-	if (r) {
+	if (pci_dma_mapping_error(fnic->pdev, pa)) {
+		r = -ENOMEM;
 		printk(KERN_ERR "PCI mapping failed with error %d\n", r);
 		goto free_skb;
 	}

@@ -1093,8 +1093,8 @@ static int fnic_send_frame(struct fnic *
 
 	pa = pci_map_single(fnic->pdev, eth_hdr, tot_len, PCI_DMA_TODEVICE);
 
-	ret = pci_dma_mapping_error(fnic->pdev, pa);
-	if (ret) {
+	if (pci_dma_mapping_error(fnic->pdev, pa)) {
+		ret = -ENOMEM;
 		printk(KERN_ERR "DMA map failed with error %d\n", ret);
 		goto free_skb_on_err;
 	}

Greg Kroah-Hartman

author maintainer

2016-10-06 08:47 UTC #83 lore raw

PATCH 90/141 mm, kasan: account for object redzone in SLUBs nearest_obj()

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alexander Potapenko <[email protected]>

commit c146a2b98eb5898eb0fab15a332257a4102ecae9 upstream.

When looking up the nearest SLUB object for a given address, correctly calculate its offset if SLAB_RED_ZONE is enabled for that cache.

Previously, when KASAN had detected an error on an object from a cache with SLAB_RED_ZONE set, the actual start address of the object was miscalculated, which led to random stacks having been reported.

When looking up the nearest SLUB object for a given address, correctly calculate its offset if SLAB_RED_ZONE is enabled for that cache.

Fixes 7ed2f9e663854db ("mm, kasan: SLAB support")

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Alexander Potapenko <[email protected]>

Cc Andrey Konovalov <[email protected]>

Cc Christoph Lameter <[email protected]>

Cc Dmitry Vyukov <[email protected]>

Cc Steven Rostedt (Red Hat) <[email protected]>

Cc Joonsoo Kim <[email protected]>

Cc Kostya Serebryany <[email protected]>

Cc Andrey Ryabinin <[email protected]>

Cc Kuthonuzo Luruo <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 include/linux/slub_def.h |   10 ++++++----
 mm/slub.c                |    2 +-
 2 files changed, 7 insertions(+), 5 deletions(-)

include/linux/slub_def.h +6 -4

@@ -114,15 +114,17 @@ static inline void sysfs_slab_remove(str
 void object_err(struct kmem_cache *s, struct page *page,
 		u8 *object, char *reason);
 
+void *fixup_red_left(struct kmem_cache *s, void *p);
+
 static inline void *nearest_obj(struct kmem_cache *cache, struct page *page,
 				void *x) {
 	void *object = x - (x - page_address(page)) % cache->size;
 	void *last_object = page_address(page) +
 		(page->objects - 1) * cache->size;
-	if (unlikely(object > last_object))
-		return last_object;
-	else
-		return object;
+	void *result = (unlikely(object > last_object)) ? last_object : object;
+
+	result = fixup_red_left(cache, result);
+	return result;
 }
 
 #endif /* _LINUX_SLUB_DEF_H */

mm/slub.c +1 -1

@@ -124,7 +124,7 @@ static inline int kmem_cache_debug(struc
 #endif
 }
 
-static inline void *fixup_red_left(struct kmem_cache *s, void *p)
+inline void *fixup_red_left(struct kmem_cache *s, void *p)
 {
 	if (kmem_cache_debug(s) && s->flags & SLAB_RED_ZONE)
 		p += s->red_left_pad;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:47 UTC #84 lore raw

PATCH 91/141 tracing: Have HIST_TRIGGERS select TRACING

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tom Zanussi <[email protected]>

commit 7ad8fb61c4abf589596f0a4da34d987471481569 upstream.

The kbuild test robot reported a compile error if HIST_TRIGGERS was enabled but nothing else that selected TRACING was configured in.

HIST_TRIGGERS should directly select it and not rely on anything else to do it.

Link http://lkml.kernel.org/r/[email protected] open here

Reported-by kbuild test robot <[email protected]>

Fixes 7ef224d1d0e3a ("tracing: Add 'hist' event trigger command")

Signed-off-by Tom Zanussi <[email protected]>

Signed-off-by Steven Rostedt <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/trace/Kconfig |    1 +
 1 file changed, 1 insertion(+)

kernel/trace/Kconfig +1 -0

@@ -542,6 +542,7 @@ config HIST_TRIGGERS
 	bool "Histogram triggers"
 	depends on ARCH_HAVE_NMI_SAFE_CMPXCHG
 	select TRACING_MAP
+	select TRACING
 	default n
 	help
 	  Hist triggers allow one or more arbitrary trace event fields

Greg Kroah-Hartman

author maintainer

2016-10-06 08:48 UTC #76 lore raw

PATCH 83/141 v4l: vsp1: Fix crash when resetting pipeline

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Laurent Pinchart <[email protected]>

commit d69e40fade97b6b19837c1772efa516bc28cc870 upstream.

The vsp1_pipeline_reset() function loops over pipeline inputs and output and resets them. When doing so it assumes both that the pipeline has been correctly configured with an output, and that inputs are are stored in the pipe inputs array at positions 0 to num_inputs-1.

Both the assumptions are incorrect. The pipeline might need to be reset after a failed attempts to configure it, without any output specified. Furthermore, inputs are stored in a positiong equal to their RPF index, possibly creating holes in the inputs array if the RPFs are not used in sequence.

Fix both issues by looping over the whole inputs array and skipping unused entries, and ignoring the output when not set.

Fixes ff7e97c94d9f ("[media] v4l: vsp1: Store pipeline pointer in rwpf")

Signed-off-by Laurent Pinchart <[email protected]>

Signed-off-by Mauro Carvalho Chehab <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/media/platform/vsp1/vsp1_pipe.c |   14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

drivers/media/platform/vsp1/vsp1_pipe.c +9 -5

@@ -172,13 +172,17 @@ void vsp1_pipeline_reset(struct vsp1_pip
 			bru->inputs[i].rpf = NULL;
 	}
 
-	for (i = 0; i < pipe->num_inputs; ++i) {
-		pipe->inputs[i]->pipe = NULL;
-		pipe->inputs[i] = NULL;
+	for (i = 0; i < ARRAY_SIZE(pipe->inputs); ++i) {
+		if (pipe->inputs[i]) {
+			pipe->inputs[i]->pipe = NULL;
+			pipe->inputs[i] = NULL;
+		}
 	}
 
-	pipe->output->pipe = NULL;
-	pipe->output = NULL;
+	if (pipe->output) {
+		pipe->output->pipe = NULL;
+		pipe->output = NULL;
+	}
 
 	INIT_LIST_HEAD(&pipe->entities);
 	pipe->state = VSP1_PIPELINE_STOPPED;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:48 UTC #119 lore raw

PATCH 125/141 IB/mlx4: Fix code indentation in QP1 MAD flow

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jack Morgenstein <[email protected]>

commit baa0be7026e2f7d1d40bfd45909044169e9e3c68 upstream.

The indentation in the QP1 GRH flow in procedure build_mlx_header is really confusing. Fix it, in preparation for a commit which touches this code.

Fixes 1ffeb2eb8be9 ("IB/mlx4: SR-IOV IB context objects and proxy/tunnel SQP support")

Signed-off-by Jack Morgenstein <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/infiniband/hw/mlx4/qp.c |   36 +++++++++++++++++++-----------------
 1 file changed, 19 insertions(+), 17 deletions(-)

drivers/infiniband/hw/mlx4/qp.c +19 ~~-17~~

@@ -2492,24 +2492,26 @@ static int build_mlx_header(struct mlx4_
 		sqp->ud_header.grh.flow_label    =
 			ah->av.ib.sl_tclass_flowlabel & cpu_to_be32(0xfffff);
 		sqp->ud_header.grh.hop_limit     = ah->av.ib.hop_limit;
-		if (is_eth)
+		if (is_eth) {
 			memcpy(sqp->ud_header.grh.source_gid.raw, sgid.raw, 16);
-		else {
-		if (mlx4_is_mfunc(to_mdev(ib_dev)->dev)) {
-			/* When multi-function is enabled, the ib_core gid
-			 * indexes don't necessarily match the hw ones, so
-			 * we must use our own cache */
-			sqp->ud_header.grh.source_gid.global.subnet_prefix =
-				to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
-						       subnet_prefix;
-			sqp->ud_header.grh.source_gid.global.interface_id =
-				to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
-					       guid_cache[ah->av.ib.gid_index];
-		} else
-			ib_get_cached_gid(ib_dev,
-					  be32_to_cpu(ah->av.ib.port_pd) >> 24,
-					  ah->av.ib.gid_index,
-					  &sqp->ud_header.grh.source_gid, NULL);
+		} else {
+			if (mlx4_is_mfunc(to_mdev(ib_dev)->dev)) {
+				/* When multi-function is enabled, the ib_core gid
+				 * indexes don't necessarily match the hw ones, so
+				 * we must use our own cache
+				 */
+				sqp->ud_header.grh.source_gid.global.subnet_prefix =
+					to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
+							       subnet_prefix;
+				sqp->ud_header.grh.source_gid.global.interface_id =
+					to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
+						       guid_cache[ah->av.ib.gid_index];
+			} else {
+				ib_get_cached_gid(ib_dev,
+						  be32_to_cpu(ah->av.ib.port_pd) >> 24,
+						  ah->av.ib.gid_index,
+						  &sqp->ud_header.grh.source_gid, NULL);
+			}
 		}
 		memcpy(sqp->ud_header.grh.destination_gid.raw,
 		       ah->av.ib.dgid, 16);

Greg Kroah-Hartman

author maintainer

2016-10-06 08:48 UTC #128 lore raw

PATCH 134/141 usb: misc: legousbtower: Fix NULL pointer deference

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Greg Kroah-Hartman <[email protected]>

commit 2fae9e5a7babada041e2e161699ade2447a01989 upstream.

This patch fixes a NULL pointer dereference caused by a race codition in the probe function of the legousbtower driver. It re-structures the probe function to only register the interface after successfully reading the board's firmware ID.

The probe function does not deregister the usb interface after an error receiving the devices firmware ID. The device file registered (/dev/usb/legousbtower%d) may be read/written globally before the probe function returns. When tower_delete is called in the probe function (after an r/w has been initiated), core dev structures are deleted while the file operation functions are still running. If the 0 address is mappable on the machine, this vulnerability can be used to create a Local Priviege Escalation exploit via a write-what-where condition by remapping dev->interrupt_out_buffer in tower_write. A forged USB device and local program execution would be required for LPE. The USB device would have to delay the control message in tower_probe and accept the control urb in tower_open whilst guest code initiated a write to the device file as tower_delete is called from the error in tower_probe.

This bug has existed since 2003. Patch tested by emulated device.

Reported-by James Patrick-Evans <[email protected]>

Tested-by James Patrick-Evans <[email protected]>

Signed-off-by James Patrick-Evans <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/usb/misc/legousbtower.c |   35 +++++++++++++++++------------------
 1 file changed, 17 insertions(+), 18 deletions(-)

drivers/usb/misc/legousbtower.c +17 ~~-18~~

@@ -898,24 +898,6 @@ static int tower_probe (struct usb_inter
 	dev->interrupt_in_interval = interrupt_in_interval ? interrupt_in_interval : dev->interrupt_in_endpoint->bInterval;
 	dev->interrupt_out_interval = interrupt_out_interval ? interrupt_out_interval : dev->interrupt_out_endpoint->bInterval;
 
-	/* we can register the device now, as it is ready */
-	usb_set_intfdata (interface, dev);
-
-	retval = usb_register_dev (interface, &tower_class);
-
-	if (retval) {
-		/* something prevented us from registering this driver */
-		dev_err(idev, "Not able to get a minor for this device.\n");
-		usb_set_intfdata (interface, NULL);
-		goto error;
-	}
-	dev->minor = interface->minor;
-
-	/* let the user know what node this device is now attached to */
-	dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major "
-		 "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE),
-		 USB_MAJOR, dev->minor);
-
 	/* get the firmware version and log it */
 	result = usb_control_msg (udev,
 				  usb_rcvctrlpipe(udev, 0),

@@ -936,6 +918,23 @@ static int tower_probe (struct usb_inter
 		 get_version_reply.minor,
 		 le16_to_cpu(get_version_reply.build_no));
 
+	/* we can register the device now, as it is ready */
+	usb_set_intfdata (interface, dev);
+
+	retval = usb_register_dev (interface, &tower_class);
+
+	if (retval) {
+		/* something prevented us from registering this driver */
+		dev_err(idev, "Not able to get a minor for this device.\n");
+		usb_set_intfdata (interface, NULL);
+		goto error;
+	}
+	dev->minor = interface->minor;
+
+	/* let the user know what node this device is now attached to */
+	dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major "
+		 "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE),
+		 USB_MAJOR, dev->minor);
 
 exit:
 	return retval;

Greg Kroah-Hartman

author maintainer

2016-10-06 08:48 UTC #129 lore raw

PATCH 135/141 Staging: fbtft: Fix bug in fbtft-core

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ksenija Stanojevic <[email protected]>

commit fc1e2c8ea85e109acf09e74789e9b852f6eed251 upstream.

Commit 367e8560e8d7a62d96e9b1d644028a3816e04206 introduced a bug in fbtft-core where fps is always 0, this is because variable update_time is not assigned correctly.

Signed-off-by Ksenija Stanojevic <[email protected]>

Fixes 367e8560e8d7 ("Staging: fbtbt: Replace timespec with ktime_t")

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/staging/fbtft/fbtft-core.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/staging/fbtft/fbtft-core.c +2 -2

@@ -391,11 +391,11 @@ static void fbtft_update_display(struct
 
 	if (unlikely(timeit)) {
 		ts_end = ktime_get();
-		if (ktime_to_ns(par->update_time))
+		if (!ktime_to_ns(par->update_time))
 			par->update_time = ts_start;
 
-		par->update_time = ts_start;
 		fps = ktime_us_delta(ts_start, par->update_time);
+		par->update_time = ts_start;
 		fps = fps ? 1000000 / fps : 0;
 
 		throughput = ktime_us_delta(ts_end, ts_start);

Greg Kroah-Hartman

author maintainer

2016-10-06 08:48 UTC #130 lore raw

PATCH 136/141 usb: usbip: vudc: fix left shift overflow

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Nicolas Iooss <[email protected]>

commit 238b7bd91b16d5a08326f858db42229b212e53d8 upstream.

In v_recv_cmd_submit(), urb_p->urb->pipe has the type unsigned int (which is 32-bit long on x86_64) but 11<<30 results in a 34-bit integer. Therefore the 2 leading bits are truncated and

    urb_p->urb->pipe &= ~(11 << 30);

has the same meaning as

    urb_p->urb->pipe &= ~(3 << 30);

This second statement seems to be how the code was intended to be written, as PIPE_ constants have values between 0 and 3.

The overflow has been detected with a clang warning:

    drivers/usb/usbip/vudc_rx.c:145:27: warning: signed shift result
    (0x2C0000000) requires 35 bits to represent, but 'int' only has 32
    bits [-Wshift-overflow]
            urb_p->urb->pipe &= ~(11 << 30);
                                  ~~ ^  ~~

Fixes 79c02cb1fd5c ("usbip: vudc: Add vudc_rx")

Signed-off-by Nicolas Iooss <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/usb/usbip/vudc_rx.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/usb/usbip/vudc_rx.c +1 -1

@@ -142,7 +142,7 @@ static int v_recv_cmd_submit(struct vudc
 	urb_p->urb->status = -EINPROGRESS;
 
 	/* FIXME: more pipe setup to please usbip_common */
-	urb_p->urb->pipe &= ~(11 << 30);
+	urb_p->urb->pipe &= ~(3 << 30);
 	switch (urb_p->ep->type) {
 	case USB_ENDPOINT_XFER_BULK:
 		urb_p->urb->pipe |= (PIPE_BULK << 30);

Greg Kroah-Hartman

author maintainer

2016-10-06 08:49 UTC #133 lore raw

PATCH 139/141 ALSA: hda - Adding one more ALC255 pin definition for headset problem

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hui Wang <[email protected]>

commit 392c9da24a994f238c5d7ea611c6245be4617014 upstream.

We have two new Dell laptop models, they have the same ALC255 pin definition, but not in the pin quirk table yet, as a result, the headset microphone can't work. After adding the definition in the table, the headset microphone works well.

Signed-off-by Hui Wang <[email protected]>

Signed-off-by Takashi Iwai <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 sound/pci/hda/patch_realtek.c |    4 ++++
 1 file changed, 4 insertions(+)

sound/pci/hda/patch_realtek.c +4 -0

@@ -5830,6 +5830,10 @@ static const struct snd_hda_pin_quirk al
 		{0x14, 0x90170120},
 		{0x21, 0x02211030}),
 	SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+		{0x14, 0x90170110},
+		{0x1b, 0x02011020},
+		{0x21, 0x0221101f}),
+	SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
 		{0x14, 0x90170130},
 		{0x1b, 0x01014020},
 		{0x21, 0x0221103f}),

Greg Kroah-Hartman

author maintainer

2016-10-06 08:49 UTC #134 lore raw

PATCH 140/141 ALSA: hda - Fix headset mic detection problem for several Dell laptops

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hui Wang <[email protected]>

commit 3f640970a41429f0a076c01270bbd014c9eae61c upstream.

One of the laptops has the codec ALC256 on it, applying the ALC255_FIXUP_DELL1_MIC_NO_PRESENCE can fix the problem, the rest of laptops have the codec ALC295 on them, they are similar to machines with ALC225, applying the ALC269_FIXUP_DELL1_MIC_NO_PRESENCE can fix the problem.

Signed-off-by Hui Wang <[email protected]>

Signed-off-by Takashi Iwai <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 sound/pci/hda/patch_realtek.c |   13 +++++++++++++
 1 file changed, 13 insertions(+)

sound/pci/hda/patch_realtek.c +13 -0

@@ -5790,6 +5790,13 @@ static const struct hda_model_fixup alc2
 	{0x14, 0x90170110}, \
 	{0x15, 0x0221401f}
 
+#define ALC295_STANDARD_PINS \
+	{0x12, 0xb7a60130}, \
+	{0x14, 0x90170110}, \
+	{0x17, 0x21014020}, \
+	{0x18, 0x21a19030}, \
+	{0x21, 0x04211020}
+
 #define ALC298_STANDARD_PINS \
 	{0x12, 0x90a60130}, \
 	{0x21, 0x03211020}

@@ -5899,6 +5906,10 @@ static const struct snd_hda_pin_quirk al
 		{0x14, 0x90170120},
 		{0x21, 0x02211030}),
 	SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+		{0x12, 0xb7a60130},
+		{0x14, 0x90170110},
+		{0x21, 0x02211020}),
+	SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
 		ALC256_STANDARD_PINS),
 	SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4,
 		{0x12, 0x90a60130},

@@ -6009,6 +6020,8 @@ static const struct snd_hda_pin_quirk al
 	SND_HDA_PIN_QUIRK(0x10ec0293, 0x1028, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
 		ALC292_STANDARD_PINS,
 		{0x13, 0x90a60140}),
+	SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
+		ALC295_STANDARD_PINS),
 	SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
 		ALC298_STANDARD_PINS,
 		{0x17, 0x90170110}),

Greg Kroah-Hartman

author maintainer

2016-10-06 08:49 UTC #120 lore raw

PATCH 126/141 IB/mlx4: Use correct subnet-prefix in QP1 mads under SR-IOV

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jack Morgenstein <[email protected]>

commit 8ec07bf8a8b57d6c58927a16a0a22c0115cf2855 upstream.

When sending QP1 MAD packets which use a GRH, the source GID (which consists of the 64-bit subnet prefix, and the 64 bit port GUID) must be included in the packet GRH.

For SR-IOV, a GID cache is used, since the source GID needs to be the slave's source GID, and not the Hypervisor's GID. This cache also included a subnet_prefix. Unfortunately, the subnet_prefix field in the cache was never initialized (to the default subnet prefix 0xfe80::0). As a result, this field remained all zeroes. Therefore, when SR-IOV was active, all QP1 packets which included a GRH had a source GID subnet prefix of all-zeroes.

However, the subnet-prefix should initially be 0xfe80::0 (the default subnet prefix). In addition, if OpenSM modifies a port's subnet prefix, the new subnet prefix must be used in the GRH when sending QP1 packets. To fix this we now initialize the subnet prefix in the SR-IOV GID cache to the default subnet prefix. We update the cached value if/when OpenSM modifies the port's subnet prefix. We take this cached value when sending QP1 packets when SR-IOV is active.

Note that the value is stored as an atomic64. This eliminates any need for locking when the subnet prefix is being updated.

Note also that we depend on the FW generating the "port management change" event for tracking subnet-prefix changes performed by OpenSM. If running early FW (before 2.9.4630), subnet prefix changes will not be tracked (but the default subnet prefix still will be stored in the cache; therefore users who do not modify the subnet prefix will not have a problem). IF there is a need for such tracking also for early FW, we will add that capability in a subsequent patch.

Fixes 1ffeb2eb8be9 ("IB/mlx4: SR-IOV IB context objects and proxy/tunnel SQP support")

Signed-off-by Jack Morgenstein <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/infiniband/hw/mlx4/mad.c     |   23 +++++++++++++++++++++++
 drivers/infiniband/hw/mlx4/mlx4_ib.h |    2 +-
 drivers/infiniband/hw/mlx4/qp.c      |    5 +++--
 3 files changed, 27 insertions(+), 3 deletions(-)

drivers/infiniband/hw/mlx4/mad.c +23 -0

@@ -1128,6 +1128,27 @@ void handle_port_mgmt_change_event(struc
 
 		/* Generate GUID changed event */
 		if (changed_attr & MLX4_EQ_PORT_INFO_GID_PFX_CHANGE_MASK) {
+			if (mlx4_is_master(dev->dev)) {
+				union ib_gid gid;
+				int err = 0;
+
+				if (!eqe->event.port_mgmt_change.params.port_info.gid_prefix)
+					err = __mlx4_ib_query_gid(&dev->ib_dev, port, 0, &gid, 1);
+				else
+					gid.global.subnet_prefix =
+						eqe->event.port_mgmt_change.params.port_info.gid_prefix;
+				if (err) {
+					pr_warn("Could not change QP1 subnet prefix for port %d: query_gid error (%d)\n",
+						port, err);
+				} else {
+					pr_debug("Changing QP1 subnet prefix for port %d. old=0x%llx. new=0x%llx\n",
+						 port,
+						 (u64)atomic64_read(&dev->sriov.demux[port - 1].subnet_prefix),
+						 be64_to_cpu(gid.global.subnet_prefix));
+					atomic64_set(&dev->sriov.demux[port - 1].subnet_prefix,
+						     be64_to_cpu(gid.global.subnet_prefix));
+				}
+			}
 			mlx4_ib_dispatch_event(dev, port, IB_EVENT_GID_CHANGE);
 			/*if master, notify all slaves*/
 			if (mlx4_is_master(dev->dev))

@@ -2202,6 +2223,8 @@ int mlx4_ib_init_sriov(struct mlx4_ib_de
 		if (err)
 			goto demux_err;
 		dev->sriov.demux[i].guid_cache[0] = gid.global.interface_id;
+		atomic64_set(&dev->sriov.demux[i].subnet_prefix,
+			     be64_to_cpu(gid.global.subnet_prefix));
 		err = alloc_pv_object(dev, mlx4_master_func_num(dev->dev), i + 1,
 				      &dev->sriov.sqps[i]);
 		if (err)

drivers/infiniband/hw/mlx4/mlx4_ib.h +1 -1

@@ -448,7 +448,7 @@ struct mlx4_ib_demux_ctx {
 	struct workqueue_struct *wq;
 	struct workqueue_struct *ud_wq;
 	spinlock_t ud_lock;
-	__be64 subnet_prefix;
+	atomic64_t subnet_prefix;
 	__be64 guid_cache[128];
 	struct mlx4_ib_dev *dev;
 	/* the following lock protects both mcg_table and mcg_mgid0_list */

drivers/infiniband/hw/mlx4/qp.c +3 -2

@@ -2501,8 +2501,9 @@ static int build_mlx_header(struct mlx4_
 				 * we must use our own cache
 				 */
 				sqp->ud_header.grh.source_gid.global.subnet_prefix =
-					to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
-							       subnet_prefix;
+					cpu_to_be64(atomic64_read(&(to_mdev(ib_dev)->sriov.
+								    demux[sqp->qp.port - 1].
+								    subnet_prefix)));
 				sqp->ud_header.grh.source_gid.global.interface_id =
 					to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
 						       guid_cache[ah->av.ib.gid_index];

Greg Kroah-Hartman

author maintainer

2016-10-06 08:49 UTC #121 lore raw

PATCH 127/141 IB/mlx5: Enable MAD_IFC commands for IB ports only

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Noa Osherovich <[email protected]>

commit 7fae6655a0c897875bd34501ec092232b526d3e4 upstream.

MAD_IFC command is supported only for physical functions (PF) and when physical port is IB. The proposed fix enforces it.

Fixes d603c809ef91 ("IB/mlx5: Fix decision on using MAD_IFC")

Reported-by David Chang <[email protected]>

Signed-off-by Noa Osherovich <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/infiniband/hw/mlx5/main.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

drivers/infiniband/hw/mlx5/main.c +3 -1

@@ -287,7 +287,9 @@ __be16 mlx5_get_roce_udp_sport(struct ml
 
 static int mlx5_use_mad_ifc(struct mlx5_ib_dev *dev)
 {
-	return !MLX5_CAP_GEN(dev->mdev, ib_virt);
+	if (MLX5_CAP_GEN(dev->mdev, port_type) == MLX5_CAP_PORT_TYPE_IB)
+		return !MLX5_CAP_GEN(dev->mdev, ib_virt);
+	return 0;
 }
 
 enum {

Greg Kroah-Hartman

author maintainer

2016-10-06 08:49 UTC #122 lore raw

PATCH 128/141 IB/mlx5: Set source mac address in FTE

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Maor Gottlieb <[email protected]>

commit ee3da804ad1b1dd4c766199a6e8443542b0aaaef upstream.

Set the source mac address in the FTE when L2 specification is provided.

Fixes 038d2ef87572 ('IB/mlx5: Add flow steering support')

Signed-off-by Maor Gottlieb <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/infiniband/hw/mlx5/main.c |    7 +++++++
 1 file changed, 7 insertions(+)

drivers/infiniband/hw/mlx5/main.c +7 -0

@@ -1277,6 +1277,13 @@ static int parse_flow_attr(u32 *match_c,
 					     dmac_47_16),
 				ib_spec->eth.val.dst_mac);
 
+		ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_c,
+					     smac_47_16),
+				ib_spec->eth.mask.src_mac);
+		ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_v,
+					     smac_47_16),
+				ib_spec->eth.val.src_mac);
+
 		if (ib_spec->eth.mask.vlan_tag) {
 			MLX5_SET(fte_match_set_lyr_2_4, outer_headers_c,
 				 vlan_tag, 1);

Greg Kroah-Hartman

author maintainer

2016-10-06 08:49 UTC #123 lore raw

PATCH 129/141 batman-adv: remove unused callback from batadv_algo_ops struct

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Marek Lindner <[email protected]>

commit d9f179877e50ae2681fe7b0b83e0d9f63b6165ad upstream.

Signed-off-by Marek Lindner <[email protected]>

Signed-off-by Sven Eckelmann <[email protected]>

Signed-off-by Simon Wunderlich <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/batman-adv/originator.c |    5 -----
 net/batman-adv/types.h      |    3 ---
 2 files changed, 8 deletions(-)

net/batman-adv/originator.c +0 -5

@@ -251,10 +251,8 @@ static void batadv_neigh_node_release(st
 	struct hlist_node *node_tmp;
 	struct batadv_neigh_node *neigh_node;
 	struct batadv_neigh_ifinfo *neigh_ifinfo;
-	struct batadv_algo_ops *bao;
 
 	neigh_node = container_of(ref, struct batadv_neigh_node, refcount);
-	bao = neigh_node->orig_node->bat_priv->bat_algo_ops;
 
 	hlist_for_each_entry_safe(neigh_ifinfo, node_tmp,
 				  &neigh_node->ifinfo_list, list) {

@@ -263,9 +261,6 @@ static void batadv_neigh_node_release(st
 
 	batadv_hardif_neigh_put(neigh_node->hardif_neigh);
 
-	if (bao->bat_neigh_free)
-		bao->bat_neigh_free(neigh_node);
-
 	batadv_hardif_put(neigh_node->if_incoming);
 
 	kfree_rcu(neigh_node, rcu);

net/batman-adv/types.h +0 -3

@@ -1284,8 +1284,6 @@ struct batadv_forw_packet {
  *  better than neigh2 for their respective outgoing interface from the metric
  *  prospective
  * @bat_neigh_print: print the single hop neighbor list (optional)
- * @bat_neigh_free: free the resources allocated by the routing algorithm for a
- *  neigh_node object
  * @bat_orig_print: print the originator table (optional)
  * @bat_orig_free: free the resources allocated by the routing algorithm for an
  *  orig_node object

@@ -1316,7 +1314,6 @@ struct batadv_algo_ops {
 		 struct batadv_neigh_node *neigh2,
 		 struct batadv_hard_iface *if_outgoing2);
 	void (*bat_neigh_print)(struct batadv_priv *priv, struct seq_file *seq);
-	void (*bat_neigh_free)(struct batadv_neigh_node *neigh);
 	/* orig_node handling API */
 	void (*bat_orig_print)(struct batadv_priv *priv, struct seq_file *seq,
 			       struct batadv_hard_iface *hard_iface);

Greg Kroah-Hartman

author maintainer

2016-10-06 08:50 UTC #124 lore raw

PATCH 130/141 tpm_crb: drop struct resource res from struct crb_priv

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jarkko Sakkinen <[email protected]>

commit 14ddfbf488a0223b19abf7e4634e6e676a91a12d upstream.

The iomem resource is needed only temporarily so it is better to pass it on instead of storing it permanently. Named the variable as io_res so that the code better documents itself.

Signed-off-by Jarkko Sakkinen <[email protected]>

Reviewed-by Stefan Berger <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/char/tpm/tpm_crb.c |   29 ++++++++++++++++-------------
 1 file changed, 16 insertions(+), 13 deletions(-)

drivers/char/tpm/tpm_crb.c +16 ~~-13~~

@@ -77,7 +77,6 @@ enum crb_flags {
 
 struct crb_priv {
 	unsigned int flags;
-	struct resource res;
 	void __iomem *iobase;
 	struct crb_control_area __iomem *cca;
 	u8 __iomem *cmd;

@@ -224,19 +223,19 @@ static int crb_init(struct acpi_device *
 
 static int crb_check_resource(struct acpi_resource *ares, void *data)
 {
-	struct crb_priv *priv = data;
+	struct resource *io_res = data;
 	struct resource res;
 
 	if (acpi_dev_resource_memory(ares, &res)) {
-		priv->res = res;
-		priv->res.name = NULL;
+		*io_res = res;
+		io_res->name = NULL;
 	}
 
 	return 1;
 }
 
 static void __iomem *crb_map_res(struct device *dev, struct crb_priv *priv,
-				 u64 start, u32 size)
+				 struct resource *io_res, u64 start, u32 size)
 {
 	struct resource new_res = {
 		.start	= start,

@@ -248,50 +247,54 @@ static void __iomem *crb_map_res(struct
 	if (start != new_res.start)
 		return (void __iomem *) ERR_PTR(-EINVAL);
 
-	if (!resource_contains(&priv->res, &new_res))
+	if (!resource_contains(io_res, &new_res))
 		return devm_ioremap_resource(dev, &new_res);
 
-	return priv->iobase + (new_res.start - priv->res.start);
+	return priv->iobase + (new_res.start - io_res->start);
 }
 
 static int crb_map_io(struct acpi_device *device, struct crb_priv *priv,
 		      struct acpi_table_tpm2 *buf)
 {
 	struct list_head resources;
+	struct resource io_res;
 	struct device *dev = &device->dev;
 	u64 pa;
 	int ret;
 
 	INIT_LIST_HEAD(&resources);
 	ret = acpi_dev_get_resources(device, &resources, crb_check_resource,
-				     priv);
+				     &io_res);
 	if (ret < 0)
 		return ret;
 	acpi_dev_free_resource_list(&resources);
 
-	if (resource_type(&priv->res) != IORESOURCE_MEM) {
+	if (resource_type(&io_res) != IORESOURCE_MEM) {
 		dev_err(dev,
 			FW_BUG "TPM2 ACPI table does not define a memory resource\n");
 		return -EINVAL;
 	}
 
-	priv->iobase = devm_ioremap_resource(dev, &priv->res);
+	priv->iobase = devm_ioremap_resource(dev, &io_res);
 	if (IS_ERR(priv->iobase))
 		return PTR_ERR(priv->iobase);
 
-	priv->cca = crb_map_res(dev, priv, buf->control_address, 0x1000);
+	priv->cca = crb_map_res(dev, priv, &io_res, buf->control_address,
+				0x1000);
 	if (IS_ERR(priv->cca))
 		return PTR_ERR(priv->cca);
 
 	pa = ((u64) ioread32(&priv->cca->cmd_pa_high) << 32) |
 	      (u64) ioread32(&priv->cca->cmd_pa_low);
-	priv->cmd = crb_map_res(dev, priv, pa, ioread32(&priv->cca->cmd_size));
+	priv->cmd = crb_map_res(dev, priv, &io_res, pa,
+				ioread32(&priv->cca->cmd_size));
 	if (IS_ERR(priv->cmd))
 		return PTR_ERR(priv->cmd);
 
 	memcpy_fromio(&pa, &priv->cca->rsp_pa, 8);
 	pa = le64_to_cpu(pa);
-	priv->rsp = crb_map_res(dev, priv, pa, ioread32(&priv->cca->rsp_size));
+	priv->rsp = crb_map_res(dev, priv, &io_res, pa,
+				ioread32(&priv->cca->rsp_size));
 	return PTR_ERR_OR_ZERO(priv->rsp);
 }

Greg Kroah-Hartman

author maintainer

2016-10-06 08:50 UTC #125 lore raw

PATCH 131/141 tpm_crb: fix mapping of the buffers

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jarkko Sakkinen <[email protected]>

commit 422eac3f7deae34dbaffd08e03e27f37a5394a56 upstream.

On my Lenovo x250 the following situation occurs:

[18697.813871] tpm_crb MSFT0101:00: can't request region for resource

[mem 0xacdff080-0xacdfffff]

The mapping of the control area overlaps the mapping of the command buffer. The control area is mapped over page, which is not right. It should mapped over sizeof(struct crb_control_area).

Fixing this issue unmasks another issue. Command and response buffers can overlap and they do interleave on this machine. According to the PTP specification the overlapping means that they are mapped to the same buffer.

The commit has been also on a Haswell NUC where things worked before applying this fix so that the both code paths for response buffer initialization are tested.

Fixes 1bd047be37d9 ("tpm_crb: Use devm_ioremap_resource")

Signed-off-by Jarkko Sakkinen <[email protected]>

Reviewed-by Jason Gunthorpe <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/char/tpm/tpm_crb.c |   39 ++++++++++++++++++++++++++++-----------
 1 file changed, 28 insertions(+), 11 deletions(-)

drivers/char/tpm/tpm_crb.c +28 ~~-11~~

@@ -259,7 +259,10 @@ static int crb_map_io(struct acpi_device
 	struct list_head resources;
 	struct resource io_res;
 	struct device *dev = &device->dev;
-	u64 pa;
+	u64 cmd_pa;
+	u32 cmd_size;
+	u64 rsp_pa;
+	u32 rsp_size;
 	int ret;
 
 	INIT_LIST_HEAD(&resources);

@@ -280,22 +283,36 @@ static int crb_map_io(struct acpi_device
 		return PTR_ERR(priv->iobase);
 
 	priv->cca = crb_map_res(dev, priv, &io_res, buf->control_address,
-				0x1000);
+				sizeof(struct crb_control_area));
 	if (IS_ERR(priv->cca))
 		return PTR_ERR(priv->cca);
 
-	pa = ((u64) ioread32(&priv->cca->cmd_pa_high) << 32) |
-	      (u64) ioread32(&priv->cca->cmd_pa_low);
-	priv->cmd = crb_map_res(dev, priv, &io_res, pa,
-				ioread32(&priv->cca->cmd_size));
+	cmd_pa = ((u64) ioread32(&priv->cca->cmd_pa_high) << 32) |
+		  (u64) ioread32(&priv->cca->cmd_pa_low);
+	cmd_size = ioread32(&priv->cca->cmd_size);
+	priv->cmd = crb_map_res(dev, priv, &io_res, cmd_pa, cmd_size);
 	if (IS_ERR(priv->cmd))
 		return PTR_ERR(priv->cmd);
 
-	memcpy_fromio(&pa, &priv->cca->rsp_pa, 8);
-	pa = le64_to_cpu(pa);
-	priv->rsp = crb_map_res(dev, priv, &io_res, pa,
-				ioread32(&priv->cca->rsp_size));
-	return PTR_ERR_OR_ZERO(priv->rsp);
+	memcpy_fromio(&rsp_pa, &priv->cca->rsp_pa, 8);
+	rsp_pa = le64_to_cpu(rsp_pa);
+	rsp_size = ioread32(&priv->cca->rsp_size);
+
+	if (cmd_pa != rsp_pa) {
+		priv->rsp = crb_map_res(dev, priv, &io_res, rsp_pa, rsp_size);
+		return PTR_ERR_OR_ZERO(priv->rsp);
+	}
+
+	/* According to the PTP specification, overlapping command and response
+	 * buffer sizes must be identical.
+	 */
+	if (cmd_size != rsp_size) {
+		dev_err(dev, FW_BUG "overlapping command and response buffer sizes are not identical");
+		return -EINVAL;
+	}
+
+	priv->rsp = priv->cmd;
+	return 0;
 }
 
 static int crb_acpi_add(struct acpi_device *device)

Greg Kroah-Hartman

author maintainer

2016-10-06 08:50 UTC #126 lore raw

PATCH 132/141 aio: mark AIO pseudo-fs noexec

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jann Horn <[email protected]>

commit 22f6b4d34fcf039c63a94e7670e0da24f8575a5a upstream.

This ensures that do_mmap() won't implicitly make AIO memory mappings executable if the READ_IMPLIES_EXEC personality flag is set. Such behavior is problematic because the security_mmap_file LSM hook doesn't catch this case, potentially permitting an attacker to bypass a W^X policy enforced by SELinux.

I have tested the patch on my machine.

To test the behavior, compile and run this:

    #define _GNU_SOURCE
    #include <unistd.h>
    #include <sys/personality.h>
    #include <linux/aio_abi.h>
    #include <err.h>
    #include <stdlib.h>
    #include <stdio.h>
    #include <sys/syscall.h>

    int main(void) {
        personality(READ_IMPLIES_EXEC);
        aio_context_t ctx = 0;
        if (syscall(__NR_io_setup, 1, &ctx))
            err(1, "io_setup");

        char cmd[1000];
        sprintf(cmd, "cat /proc/%d/maps | grep -F '/[aio]'",
            (int)getpid());
        system(cmd);
        return 0;
    }

In the output, "rw-s" is good, "rwxs" is bad.

Signed-off-by Jann Horn <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/aio.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

fs/aio.c +6 -1

@@ -239,7 +239,12 @@ static struct dentry *aio_mount(struct f
 	static const struct dentry_operations ops = {
 		.d_dname	= simple_dname,
 	};
-	return mount_pseudo(fs_type, "aio:", NULL, &ops, AIO_RING_MAGIC);
+	struct dentry *root = mount_pseudo(fs_type, "aio:", NULL, &ops,
+					   AIO_RING_MAGIC);
+
+	if (!IS_ERR(root))
+		root->d_sb->s_iflags |= SB_I_NOEXEC;
+	return root;
 }
 
 /* aio_setup

Greg Kroah-Hartman

author maintainer

2016-10-06 08:50 UTC #118 lore raw

PATCH 124/141 IB/mlx4: Fix incorrect MC join state bit-masking on SR-IOV

4.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alex Vesker <[email protected]>

commit e5ac40cd66c2f3cd11bc5edc658f012661b16347 upstream.

Because of an incorrect bit-masking done on the join state bits, when handling a join request we failed to detect a difference between the group join state and the request join state when joining as send only full member (0x8). This caused the MC join request not to be sent. This issue is relevant only when SRIOV is enabled and SM supports send only full member.

This fix separates scope bits and join states bits a nibble each.

Fixes b9c5d6a64358 ('IB/mlx4: Add multicast group (MCG) paravirtualization for SR-IOV')

Signed-off-by Alex Vesker <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/infiniband/hw/mlx4/mcg.c |   14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

drivers/infiniband/hw/mlx4/mcg.c +7 -7

@@ -489,7 +489,7 @@ static u8 get_leave_state(struct mcast_g
 		if (!group->members[i])
 			leave_state |= (1 << i);
 
-	return leave_state & (group->rec.scope_join_state & 7);
+	return leave_state & (group->rec.scope_join_state & 0xf);
 }
 
 static int join_group(struct mcast_group *group, int slave, u8 join_mask)

@@ -564,8 +564,8 @@ static void mlx4_ib_mcg_timeout_handler(
 		} else
 			mcg_warn_group(group, "DRIVER BUG\n");
 	} else if (group->state == MCAST_LEAVE_SENT) {
-		if (group->rec.scope_join_state & 7)
-			group->rec.scope_join_state &= 0xf8;
+		if (group->rec.scope_join_state & 0xf)
+			group->rec.scope_join_state &= 0xf0;
 		group->state = MCAST_IDLE;
 		mutex_unlock(&group->lock);
 		if (release_group(group, 1))

@@ -605,7 +605,7 @@ static int handle_leave_req(struct mcast
 static int handle_join_req(struct mcast_group *group, u8 join_mask,
 			   struct mcast_req *req)
 {
-	u8 group_join_state = group->rec.scope_join_state & 7;
+	u8 group_join_state = group->rec.scope_join_state & 0xf;
 	int ref = 0;
 	u16 status;
 	struct ib_sa_mcmember_data *sa_data = (struct ib_sa_mcmember_data *)req->sa_mad.data;

@@ -690,8 +690,8 @@ static void mlx4_ib_mcg_work_handler(str
 			u8 cur_join_state;
 
 			resp_join_state = ((struct ib_sa_mcmember_data *)
-						group->response_sa_mad.data)->scope_join_state & 7;
-			cur_join_state = group->rec.scope_join_state & 7;
+						group->response_sa_mad.data)->scope_join_state & 0xf;
+			cur_join_state = group->rec.scope_join_state & 0xf;
 
 			if (method == IB_MGMT_METHOD_GET_RESP) {
 				/* successfull join */

@@ -710,7 +710,7 @@ process_requests:
 		req = list_first_entry(&group->pending_list, struct mcast_req,
 				       group_list);
 		sa_data = (struct ib_sa_mcmember_data *)req->sa_mad.data;
-		req_join_state = sa_data->scope_join_state & 0x7;
+		req_join_state = sa_data->scope_join_state & 0xf;
 
 		/* For a leave request, we will immediately answer the VF, and
 		 * update our internal counters. The actual leave will be sent

James Bottomley

2016-10-06 13:25 UTC #115 lore raw

Re: [PATCH 4.7 122/141] scsi: ses: use scsi_is_sas_rphy instead of is_sas_attached

Quoted 2 lines · Greg Kroah-Hartman

4.7-stable review patch. If anyone has any objections, please let me know.

This doesn't build if SCSI_SAS_ATTRS isn't set without this patch:

commit c1a23f6d64552b4480208aa584ec7e9c13d6d9c3

Author: Johannes Thumshirn <[email protected]>
Date:   Wed Aug 17 11:46:16 2016 +0200

scsi: sas: provide stub implementation for scsi_is_sas_rphy

Does it?

James

Quoted 39 lines

------------------
From: Johannes Thumshirn <[email protected]>
commit 835831c57e9b0cccc24e96a812542875471d75b5 upstream.
Use scsi_is_sas_rphy() instead of is_sas_attached() to decide whether we
should obtain the SAS address from a scsi device or not. This will prevent us from tripping on the BUG_ON() in sas_sdev_to_rdev() if the rphy isn't attached to the SAS transport class, like it is with hpsa's
logical devices.
Fixes 3f8d6f2a0 ('ses: fix discovery of SATA devices in SAS
enclosures')
Signed-off-by Johannes Thumshirn <[email protected]>
Reviewed-by James E.J. Bottomley <[email protected]>
Signed-off-by Martin K. Petersen <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 drivers/scsi/ses.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/ses.c +1 -2
@@ -587,7 +587,7 @@ static void ses_match_to_enclosure(struc
 
 	ses_enclosure_data_process(edev, to_scsi_device(edev
->edev.parent), 0);
 
-	if (is_sas_attached(sdev))
+	if (scsi_is_sas_rphy(&sdev->sdev_gendev))
 		efd.addr = sas_get_address(sdev);
 
 	if (efd.addr) {

Guenter Roeck

2016-10-06 18:54 UTC #136 lore raw

Quoted 8 lines · Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.7.7 release. There are 141 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat Oct 8 07:44:08 UTC 2016. Anything received after that time might be too late.

Build results:

	total: 149 pass: 148 fail: 1

Failed builds:
powerpc:ppc6xx_defconfig

Qemu test results:

	total: 108 pass: 108 fail: 0

Adding upstream commit c1a23f6d6455 ("scsi: sas: provide stub implementation for scsi_is_sas_rphy") fixes the build problem.

Details are available at http://kerneltests.org/builders.

Guenter

Shuah Khan

2016-10-06 19:57 UTC #138 lore raw