commit 2dcd0af568b0cf583645c8a317dd12e344b1c72a Author: Linus Torvalds Date: Sun May 15 15:43:13 2016 -0700 Linux 4.6 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5f95063c686a86e7214988e04f08b9c0003cf83f Merge: 272911b 9a7a076 Author: Linus Torvalds Date: Sun May 15 08:07:35 2016 -0700 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Thomas Gleixner: "Just the missing compat entry for the new pread/writev2" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86: Use compat version for preadv2 and pwritev2 commit 272911b889f47aa5bc3e004804fc2382f0ac6ce6 Merge: 6ba5b85 98397fc Author: Linus Torvalds Date: Sat May 14 14:15:06 2016 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Fix mvneta/bm dependencies, from Arnd Bergmann. 2) RX completion hw bug workaround in bnxt_en, from Michael Chan. 3) Kernel pointer leak in nf_conntrack, from Linus. 4) Hoplimit route attribute limits not enforced properly, from Paolo Abeni. 5) qlcnic driver NULL deref fix from Dan Carpenter. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: arm64: bpf: jit JMP_JSET_{X,K} net/route: enforce hoplimit max value nf_conntrack: avoid kernel pointer value leak in slab name drivers: net: xgene: fix register offset drivers: net: xgene: fix statistics counters race condition drivers: net: xgene: fix ununiform latency across queues drivers: net: xgene: fix sharing of irqs drivers: net: xgene: fix IPv4 forward crash xen-netback: fix extra_info handling in xenvif_tx_err() net: mvneta: bm: fix dependencies again bnxt_en: Add workaround to detect bad opaque in rx completion (part 2) bnxt_en: Add workaround to detect bad opaque in rx completion (part 1) qlcnic: potential NULL dereference in qlcnic_83xx_get_minidump_template() commit 98397fc547e3f4553553a30ea56fa34d613f0a4c Author: Zi Shen Lim Date: Thu May 12 23:37:58 2016 -0700 arm64: bpf: jit JMP_JSET_{X,K} Original implementation commit e54bcde3d69d ("arm64: eBPF JIT compiler") had the relevant code paths, but due to an oversight always fail jiting. As a result, we had been falling back to BPF interpreter whenever a BPF program has JMP_JSET_{X,K} instructions. With this fix, we confirm that the corresponding tests in lib/test_bpf continue to pass, and also jited. ... [ 2.784553] test_bpf: #30 JSET jited:1 188 192 197 PASS [ 2.791373] test_bpf: #31 tcpdump port 22 jited:1 325 677 625 PASS [ 2.808800] test_bpf: #32 tcpdump complex jited:1 323 731 991 PASS ... [ 3.190759] test_bpf: #237 JMP_JSET_K: if (0x3 & 0x2) return 1 jited:1 110 PASS [ 3.192524] test_bpf: #238 JMP_JSET_K: if (0x3 & 0xffffffff) return 1 jited:1 98 PASS [ 3.211014] test_bpf: #249 JMP_JSET_X: if (0x3 & 0x2) return 1 jited:1 120 PASS [ 3.212973] test_bpf: #250 JMP_JSET_X: if (0x3 & 0xffffffff) return 1 jited:1 89 PASS ... Fixes: e54bcde3d69d ("arm64: eBPF JIT compiler") Signed-off-by: Zi Shen Lim Acked-by: Will Deacon Acked-by: Yang Shi Signed-off-by: David S. Miller arch/arm64/net/bpf_jit_comp.c | 1 + 1 file changed, 1 insertion(+) commit 626abd59e51d4d8c6367e03aae252a8aa759ac78 Author: Paolo Abeni Date: Fri May 13 18:33:41 2016 +0200 net/route: enforce hoplimit max value Currently, when creating or updating a route, no check is performed in both ipv4 and ipv6 code to the hoplimit value. The caller can i.e. set hoplimit to 256, and when such route will be used, packets will be sent with hoplimit/ttl equal to 0. This commit adds checks for the RTAX_HOPLIMIT value, in both ipv4 ipv6 route code, substituting any value greater than 255 with 255. This is consistent with what is currently done for ADVMSS and MTU in the ipv4 code. Signed-off-by: Paolo Abeni Signed-off-by: David S. Miller net/ipv4/fib_semantics.c | 2 ++ net/ipv6/route.c | 2 ++ 2 files changed, 4 insertions(+) commit 31b0b385f69d8d5491a4bca288e25e63f1d945d0 Author: Linus Torvalds Date: Sat May 14 11:11:44 2016 -0700 nf_conntrack: avoid kernel pointer value leak in slab name The slab name ends up being visible in the directory structure under /sys, and even if you don't have access rights to the file you can see the filenames. Just use a 64-bit counter instead of the pointer to the 'net' structure to generate a unique name. This code will go away in 4.7 when the conntrack code moves to a single kmemcache, but this is the backportable simple solution to avoiding leaking kernel pointers to user space. Fixes: 5b3501faa874 ("netfilter: nf_conntrack: per netns nf_conntrack_cachep") Signed-off-by: Linus Torvalds Acked-by: Eric Dumazet Cc: stable@vger.kernel.org Signed-off-by: David S. Miller net/netfilter/nf_conntrack_core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 6ba5b85fd4b1bd72ba26cb7d50c7580004df68ac Merge: 1410b74 e4d35be Author: Linus Torvalds Date: Sat May 14 11:59:43 2016 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs fixes from Al Viro: "Overlayfs fixes from Miklos, assorted fixes from me. Stable fodder of varying severity, all sat in -next for a while" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: ovl: ignore permissions on underlying lookup vfs: add lookup_hash() helper vfs: rename: check backing inode being equal vfs: add vfs_select_inode() helper get_rock_ridge_filename(): handle malformed NM entries ecryptfs: fix handling of directory opening atomic_open(): fix the handling of create_error fix the copy vs. map logics in blk_rq_map_user_iov() do_splice_to(): cap the size before passing to ->splice_read() commit b91506586206140154b0b44cccf88c8cc0a4dca5 Merge: 72eec92 e2f2d9a Author: David S. Miller Date: Fri May 13 21:12:07 2016 -0400 Merge branch 'xgene-fixes' Iyappan Subramanian says: ==================== drivers: net: xgene: Bug fixes This patch set addresses the following bug fixes that were found during testing. 1. IPv4 forward test crash - drivers: net: xgene: fix IPv4 forward crash 2. Sharing of irqs - drivers: net: xgene: fix sharing of irqs 3. Ununiform latency across queues - drivers: net: xgene: fix ununiform latency across queues 4. Fix statistics counters race condition - drivers: net: xgene: fix statistics counters race condition 5. Correcting register offset and field lengths - drivers: net: xgene: fix register offset v2: Address review comments from v1 - Defer TSO fix, and reposting all other patches from v1 v1: - Initial version ==================== Signed-off-by: Iyappan Subramanian Signed-off-by: David S. Miller commit e2f2d9a72605666ec772c865dbe89edbab896d27 Author: Iyappan Subramanian Date: Fri May 13 16:53:01 2016 -0700 drivers: net: xgene: fix register offset This patch fixes SG_RX_DV_GATE_REG_0_ADDR register offset and ring state field lengths. Signed-off-by: Iyappan Subramanian Tested-by: Toan Le Signed-off-by: David S. Miller drivers/net/ethernet/apm/xgene/xgene_enet_hw.h | 6 +++--- drivers/net/ethernet/apm/xgene/xgene_enet_sgmac.h | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) commit 3bb502f83080ad28abdd7404f29aa2fc743b28b5 Author: Iyappan Subramanian Date: Fri May 13 16:53:00 2016 -0700 drivers: net: xgene: fix statistics counters race condition This patch fixes the race condition on updating the statistics counters by moving the counters to the ring structure. Signed-off-by: Iyappan Subramanian Tested-by: Toan Le Signed-off-by: David S. Miller drivers/net/ethernet/apm/xgene/xgene_enet_hw.c | 19 ++++++----- drivers/net/ethernet/apm/xgene/xgene_enet_hw.h | 2 ++ drivers/net/ethernet/apm/xgene/xgene_enet_main.c | 41 +++++++++++++++++------- drivers/net/ethernet/apm/xgene/xgene_enet_main.h | 10 ++++++ 4 files changed, 53 insertions(+), 19 deletions(-) commit 1b090a4839f6c74af2dc42872c9e9dc9d7c60a99 Author: Iyappan Subramanian Date: Fri May 13 16:52:59 2016 -0700 drivers: net: xgene: fix ununiform latency across queues This patch addresses ununiform latency across queues by adding more queues to match with, upto number of CPU cores. Also, number of interrupts are increased and the channel numbers are reordered. Signed-off-by: Iyappan Subramanian Tested-by: Toan Le Signed-off-by: David S. Miller drivers/net/ethernet/apm/xgene/xgene_enet_main.c | 30 ++++++++++++++++++------ drivers/net/ethernet/apm/xgene/xgene_enet_main.h | 8 +++---- 2 files changed, 27 insertions(+), 11 deletions(-) commit 46a22d29a51e40704c2260168c124e260b7d660e Author: Iyappan Subramanian Date: Fri May 13 16:52:58 2016 -0700 drivers: net: xgene: fix sharing of irqs Since hardware doesn't allow sharing of interrupts, this patch fixes the same by removing IRQF_SHARED flag. Signed-off-by: Iyappan Subramanian Tested-by: Toan Le Signed-off-by: David S. Miller drivers/net/ethernet/apm/xgene/xgene_enet_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit b30cfd241fbc6818c7de0cbf89ae83c70a1dac9a Author: Iyappan Subramanian Date: Fri May 13 16:52:57 2016 -0700 drivers: net: xgene: fix IPv4 forward crash This patch fixes the crash observed during IPv4 forward test by setting the drop field in the dbptr. Signed-off-by: Iyappan Subramanian Tested-by: Toan Le Signed-off-by: David S. Miller drivers/net/ethernet/apm/xgene/xgene_enet_cle.c | 11 ++++++----- drivers/net/ethernet/apm/xgene/xgene_enet_cle.h | 2 ++ 2 files changed, 8 insertions(+), 5 deletions(-) commit 1410b74e4061e05a5d2bffb1f99829efce27c8a9 Merge: da92223 09be4c8 Author: Linus Torvalds Date: Fri May 13 16:26:46 2016 -0700 Merge branch 'for-4.6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: "During v4.6-rc1 cgroup namespace support was merged. There is an issue where it's impossible to tell whether a given cgroup mount point is bind mounted or namespaced. Serge has been working on the issue but it took longer than expected to resolve, so the late pull request. Given that it's a completely new feature and the patches don't touch anything else, the risk seems acceptable. However, if this is too late, an alternative is plugging new cgroup ns creation for v4.6 and retrying for v4.7" * 'for-4.6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup: fix compile warning kernfs: kernfs_sop_show_path: don't return 0 after seq_dentry call cgroup, kernfs: make mountinfo show properly scoped path for cgroup namespaces kernfs_path_from_node_locked: don't overwrite nlen commit da92223908f309d5ba63ce7dd568dfb6a7e5d7d2 Merge: 65643e3 f7c17d2 Author: Linus Torvalds Date: Fri May 13 16:16:51 2016 -0700 Merge branch 'for-4.6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue fix from Tejun Heo: "CPU hotplug callbacks can invoke DOWN_FAILED w/o preceding DOWN_PREPARE which can trigger a WARN_ON() in workqueue. The bug has been there for a very long time. It only triggers if CPU down fails at a specific point and I don't think it has adverse effects other than the warning messages. The fix is very low impact" * 'for-4.6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: fix rebind bound workers warning commit 65643e3abe71e970bef656ea0b125dace7c7a1b3 Merge: f7f4d43 53d3bc7 Author: Linus Torvalds Date: Fri May 13 12:21:17 2016 -0700 Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Ingo Molnar: "This is a revert to fix an interactivity problem. The proper fixes for the problems that the reverted commit exposed are now in sched/core (consisting of 3 patches), but were too risky for v4.6 and will arrive in the v4.7 merge window" * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: Revert "sched/fair: Fix fairness issue on migration" commit f7f4d43b23047492903b63b7df3ce2b24cdc58b8 Merge: 1875946 636fa4a Author: Linus Torvalds Date: Fri May 13 11:54:02 2016 -0700 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: "An uncharacteristically large number of bugs popped up in the last week: - various tooling fixes, two crashes and build problems - two Intel PT fixes - an KNL uncore driver fix - an Intel PMU driver fix" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf stat: Fallback to user only counters when perf_event_paranoid > 1 perf evsel: Handle EACCESS + perf_event_paranoid=2 in fallback() perf evsel: Improve EPERM error handling in open_strerror() tools lib traceevent: Do not reassign parg after collapse_tree() perf probe: Check if dwarf_getlocations() is available perf dwarf: Guard !x86_64 definitions under #ifdef else clause perf tools: Use readdir() instead of deprecated readdir_r() perf thread_map: Use readdir() instead of deprecated readdir_r() perf script: Use readdir() instead of deprecated readdir_r() perf tools: Use readdir() instead of deprecated readdir_r() perf/core: Disable the event on a truncated AUX record perf/x86/intel/pt: Generate PMI in the STOP region as well perf/x86: Fix undefined shift on 32-bit kernels perf/x86/msr: Fix SMI overflow perf/x86/intel/uncore: Fix CHA registers configuration procedure for Knights Landing platform perf diff: Fix duplicated output column commit 18759462b6dd8de0f668a346cfe3776fe9370bac Merge: c3548b7 8a934cc Author: Linus Torvalds Date: Fri May 13 09:52:00 2016 -0700 Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Arnd Bergmann: "Three more bug fixes for ARM SoCs this week: - The Atmel sama5d2 was registering the wrong NFC device type - On Atmel sam9x5, the power management controller had an incorrect register area size - On ARM64 Allwinner machine was not secting the generic irqchip code, causing build errors in some configurations" * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: ARM: dts: at91: sam9x5: Fix the memory range assigned to the PMC arm64/sunxi: 4.6-rc1: Add dependency on generic irq chip ARM: dts: at91: sama5d2: use "atmel,sama5d3-nfc" compatible for nfc commit c3548b730dceecf6197d629a425c99801dadfa5e Merge: c42b8fe 9689dab Author: Linus Torvalds Date: Fri May 13 09:46:00 2016 -0700 Merge tag 'regulator-fix-v4.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A small collection of driver specific fixes for the regulator subsysetem: - Fix handling of probe deferral for GPIO regulators - Fix a typo in the module alias for DA9053 - Fix the definition of BUCK9 in the S2MPS11 driver. This change looks larger than it is because an irregularity in the hardware means that the macro used to define bucks 6-10 needs duplicating and tweaking to have a separate macro for 9 - Fix a series of errors in the definitions of the LDOs the AXP20x regulators, some of which had always been present and some of which were introduced in the merge window" * tag 'regulator-fix-v4.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: da9063: Correct module alias prefix to fix module autoloading regulator: axp20x: Fix axp22x ldo_io registration error on cold boot regulator: axp20x: Fix axp22x ldo_io voltage ranges regulator: axp20x: Fix LDO4 linear voltage range regulator: s2mps11: Fix invalid selector mask and voltages for buck9 regulator: gpio: check return value of of_get_named_gpio commit c42b8fe941e361bb05de23a11c04d5a4adc61cc8 Merge: 90fa7c7 2a2cd52 Author: Linus Torvalds Date: Fri May 13 09:40:32 2016 -0700 Merge tag 'regmap-fix-v4.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap fixes from Mark Brown: "This is rather too late so it'd be completely understandable if you don't want to pull it at this point, I had thought I'd sent this earlier but it seems I didn't. Everything has been in -next for some time now. The main set of fixes here are mopping up some more issues with MMIO, fixing handling of endianness configuration in DT (which just wasn't working at all) and cases where the register and value endianness are different. There is also a fix for bulk register reads on SPMI" * tag 'regmap-fix-v4.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: spmi: Fix regmap_spmi_ext_read in multi-byte case regmap: mmio: Explicitly say little endian is the defualt in the bus config regmap: mmio: Parse endianness definitions from DT regmap: Fix implicit inclusion of device.h regmap: mmio: Fix value endianness selection regmap: fix documentation to match code commit 90fa7c7fa38730f918c950ecf05120f223718b89 Merge: 9dcf8a5 93f0750 Author: Linus Torvalds Date: Fri May 13 09:34:59 2016 -0700 Merge tag 'media/v4.6-6' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fix from Mauro Carvalho Chehab: "A revert fixing a breakage that caused an OOPS on all VB2-based DVB drivers. We already have a proper fix, but it sounds safer to keep it being tested for a while and not hurry, to avoid the risk of another regression, specially since this is meant to be c/c to stable. So, for now, let's just revert the broken patch" * tag 'media/v4.6-6' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: Revert "[media] videobuf2-v4l2: Verify planes array in buffer dequeueing" commit 9dcf8a58c702e8b25a84baf0882dc6492002831e Merge: dc0f2f8 e02aacb Author: Linus Torvalds Date: Fri May 13 09:27:05 2016 -0700 Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux Pull drm fixes from Dave Airlie: "A bunch of radeon displayport mode setting fixes, and some misc i915 fixes. There is one revert, the MST audio code in i915 was causing some oopses, so we've decided just to drop it until next kernel when we can fix it properly" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/amdgpu: fix DP mode validation drm/radeon: fix DP mode validation drm/i915: Bail out of pipe config compute loop on LPT drm/radeon: fix PLL sharing on DCE6.1 (v2) drm/radeon: fix DP link training issue with second 4K monitor Revert "drm/i915: start adding dp mst audio" drm/i915/bdw: Add missing delay during L3 SQC credit programming drm/i915/lvds: separate border enable readout from panel fitter drm/i915: Update CDCLK_FREQ register on BDW after changing cdclk frequency commit dc0f2f87eaf92a1c04fc8fdad4a9d855160d6448 Merge: a2ccb68 df27b26 Author: Linus Torvalds Date: Fri May 13 09:21:31 2016 -0700 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: "This fixes a bug in the RSA self-test that may cause crashes on some architectures such as SPARC" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: testmgr - Use kmalloc memory for RSA input commit 9689dab30a52f5df313771e07206d7b3d8ca44f7 Merge: 44549e8 f40d489 ac40b44 8d48794 3b67262 Author: Mark Brown Date: Fri May 13 11:11:08 2016 +0100 Merge remote-tracking branches 'regulator/fix/axp20x', 'regulator/fix/da9063', 'regulator/fix/gpio' and 'regulator/fix/s2mps11' into regulator-linus commit 2a2cd5219023ea2e485c3e37486c24177a6da55a Merge: 066a0e0 0dbdb76 2596e07 dec8e8f Author: Mark Brown Date: Fri May 13 10:36:10 2016 +0100 Merge remote-tracking branches 'regmap/fix/be', 'regmap/fix/doc' and 'regmap/fix/spmi' into regmap-linus commit 066a0e0b49afe9531f0e464a1ef05b24d0c95986 Merge: 44549e8 2ed94f6 Author: Mark Brown Date: Fri May 13 10:36:09 2016 +0100 Merge remote-tracking branch 'regmap/fix/mmio' into regmap-linus commit e02aacb6dec0c656379f0c1ff06c5bbb2bcb1e53 Merge: 58a6e2e c47b9e0 Author: Dave Airlie Date: Fri May 13 16:03:39 2016 +1000 Merge branch 'drm-fixes-4.6' of git://people.freedesktop.org/~agd5f/linux into drm-fixes DP mode validation regression fix. * 'drm-fixes-4.6' of git://people.freedesktop.org/~agd5f/linux: drm/amdgpu: fix DP mode validation drm/radeon: fix DP mode validation commit 72eec92accabe3ec34f27a9d3cd459bf5a877c33 Author: Paul Durrant Date: Thu May 12 14:43:03 2016 +0100 xen-netback: fix extra_info handling in xenvif_tx_err() Patch 562abd39 "xen-netback: support multiple extra info fragments passed from frontend" contained a mistake which can result in an in- correct number of responses being generated when handling errors encountered when processing packets containing extra info fragments. This patch fixes the problem. Signed-off-by: Paul Durrant Reported-by: Jan Beulich Cc: Wei Liu Acked-by: Wei Liu Signed-off-by: David S. Miller drivers/net/xen-netback/netback.c | 1 + 1 file changed, 1 insertion(+) commit 636fa4a7b0d2987b7395cd2e259962cdca16e887 Merge: 9f448cd 42ef8a7 Author: Ingo Molnar Date: Fri May 13 07:35:12 2016 +0200 Merge tag 'perf-urgent-for-mingo-20160512' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/urgent fixes from Arnaldo Carvalho de Melo: - Fallback to usermode-only counters when perf_event_paranoid > 1, which is the case now (Arnaldo Carvalho de Melo) - Do not reassign parg after collapse_tree() in libtraceevent, which may cause tool crashes (Steven Rostedt) - Fix the build on Fedora Rawhide, where readdir_r() is deprecated and also wrt -Werror=unused-const-variable= + x86_32_regoffset_table on !x86_64 (Arnaldo Carvalho de Melo) - Fix the build on Ubuntu 12.04.5, where dwarf_getlocations() isn't available, i.e. libdw-dev < 0.157 (Arnaldo Carvalho de Melo) Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit a2ccb68b1e6add42c0bf3ade73cd11c98d32b890 Merge: 02c9c0e 6d0a07e Author: Linus Torvalds Date: Thu May 12 18:44:24 2016 -0700 Merge branch 'akpm' (patches from Andrew) Merge fixes from Andrew Morton: "4 fixes" * emailed patches from Andrew Morton : mm: thp: calculate the mapcount correctly for THP pages during WP faults ksm: fix conflict between mmput and scan_get_next_rmap_item ocfs2: fix posix_acl_create deadlock ocfs2: revert using ocfs2_acl_chmod to avoid inode cluster lock hang commit 6d0a07edd17cfc12fdc1f36de8072fa17cc3666f Author: Andrea Arcangeli Date: Thu May 12 15:42:25 2016 -0700 mm: thp: calculate the mapcount correctly for THP pages during WP faults This will provide fully accuracy to the mapcount calculation in the write protect faults, so page pinning will not get broken by false positive copy-on-writes. total_mapcount() isn't the right calculation needed in reuse_swap_page(), so this introduces a page_trans_huge_mapcount() that is effectively the full accurate return value for page_mapcount() if dealing with Transparent Hugepages, however we only use the page_trans_huge_mapcount() during COW faults where it strictly needed, due to its higher runtime cost. This also provide at practical zero cost the total_mapcount information which is needed to know if we can still relocate the page anon_vma to the local vma. If page_trans_huge_mapcount() returns 1 we can reuse the page no matter if it's a pte or a pmd_trans_huge triggering the fault, but we can only relocate the page anon_vma to the local vma->anon_vma if we're sure it's only this "vma" mapping the whole THP physical range. Kirill A. Shutemov discovered the problem with moving the page anon_vma to the local vma->anon_vma in a previous version of this patch and another problem in the way page_move_anon_rmap() was called. Andrew Morton discovered that CONFIG_SWAP=n wouldn't build in a previous version, because reuse_swap_page must be a macro to call page_trans_huge_mapcount from swap.h, so this uses a macro again instead of an inline function. With this change at least it's a less dangerous usage than it was before, because "page" is used only once now, while with the previous code reuse_swap_page(page++) would have called page_mapcount on page+1 and it would have increased page twice instead of just once. Dean Luick noticed an uninitialized variable that could result in a rmap inefficiency for the non-THP case in a previous version. Mike Marciniszyn said: : Our RDMA tests are seeing an issue with memory locking that bisects to : commit 61f5d698cc97 ("mm: re-enable THP") : : The test program registers two rather large MRs (512M) and RDMA : writes data to a passive peer using the first and RDMA reads it back : into the second MR and compares that data. The sizes are chosen randomly : between 0 and 1024 bytes. : : The test will get through a few (<= 4 iterations) and then gets a : compare error. : : Tracing indicates the kernel logical addresses associated with the individual : pages at registration ARE correct , the data in the "RDMA read response only" : packets ARE correct. : : The "corruption" occurs when the packet crosse two pages that are not physically : contiguous. The second page reads back as zero in the program. : : It looks like the user VA at the point of the compare error no longer points to : the same physical address as was registered. : : This patch totally resolves the issue! Link: http://lkml.kernel.org/r/1462547040-1737-2-git-send-email-aarcange@redhat.com Signed-off-by: Andrea Arcangeli Reviewed-by: "Kirill A. Shutemov" Reviewed-by: Dean Luick Tested-by: Alex Williamson Tested-by: Mike Marciniszyn Tested-by: Josh Collier Cc: Marc Haber Cc: [4.5] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/mm.h | 9 +++++++ include/linux/swap.h | 6 ++--- mm/huge_memory.c | 71 +++++++++++++++++++++++++++++++++++++++++++++------- mm/memory.c | 22 ++++++++++------ mm/swapfile.c | 13 +++++----- 5 files changed, 95 insertions(+), 26 deletions(-) commit 7496fea9a6bf644afe360af795b121a77635b37d Author: Zhou Chengming Date: Thu May 12 15:42:21 2016 -0700 ksm: fix conflict between mmput and scan_get_next_rmap_item A concurrency issue about KSM in the function scan_get_next_rmap_item. task A (ksmd): |task B (the mm's task): | mm = slot->mm; | down_read(&mm->mmap_sem); | | ... | | spin_lock(&ksm_mmlist_lock); | | ksm_scan.mm_slot go to the next slot; | | spin_unlock(&ksm_mmlist_lock); | |mmput() -> | ksm_exit(): | |spin_lock(&ksm_mmlist_lock); |if (mm_slot && ksm_scan.mm_slot != mm_slot) { | if (!mm_slot->rmap_list) { | easy_to_free = 1; | ... | |if (easy_to_free) { | mmdrop(mm); | ... | |So this mm_struct may be freed in the mmput(). | up_read(&mm->mmap_sem); | As we can see above, the ksmd thread may access a mm_struct that already been freed to the kmem_cache. Suppose a fork will get this mm_struct from the kmem_cache, the ksmd thread then call up_read(&mm->mmap_sem), will cause mmap_sem.count to become -1. As suggested by Andrea Arcangeli, unmerge_and_remove_all_rmap_items has the same SMP race condition, so fix it too. My prev fix in function scan_get_next_rmap_item will introduce a different SMP race condition, so just invert the up_read/spin_unlock order as Andrea Arcangeli said. Link: http://lkml.kernel.org/r/1462708815-31301-1-git-send-email-zhouchengming1@huawei.com Signed-off-by: Zhou Chengming Suggested-by: Andrea Arcangeli Reviewed-by: Andrea Arcangeli Cc: Hugh Dickins Cc: Kirill A. Shutemov Cc: Vlastimil Babka Cc: Geliang Tang Cc: Minchan Kim Cc: Hanjun Guo Cc: Ding Tianhong Cc: Li Bin Cc: Zhen Lei Cc: Xishi Qiu Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/ksm.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) commit c25a1e0671fbca7b2c0d0757d533bd2650d6dc0c Author: Junxiao Bi Date: Thu May 12 15:42:18 2016 -0700 ocfs2: fix posix_acl_create deadlock Commit 702e5bc68ad2 ("ocfs2: use generic posix ACL infrastructure") refactored code to use posix_acl_create. The problem with this function is that it is not mindful of the cluster wide inode lock making it unsuitable for use with ocfs2 inode creation with ACLs. For example, when used in ocfs2_mknod, this function can cause deadlock as follows. The parent dir inode lock is taken when calling posix_acl_create -> get_acl -> ocfs2_iop_get_acl which takes the inode lock again. This can cause deadlock if there is a blocked remote lock request waiting for the lock to be downconverted. And same deadlock happened in ocfs2_reflink. This fix is to revert back using ocfs2_init_acl. Fixes: 702e5bc68ad2 ("ocfs2: use generic posix ACL infrastructure") Signed-off-by: Tariq Saeed Signed-off-by: Junxiao Bi Cc: Mark Fasheh Cc: Joel Becker Cc: Joseph Qi Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/ocfs2/acl.c | 63 +++++++++++++++++++++++++++++++++++++++++++++++++ fs/ocfs2/acl.h | 4 ++++ fs/ocfs2/namei.c | 23 ++---------------- fs/ocfs2/refcounttree.c | 17 ++----------- fs/ocfs2/xattr.c | 14 ++++------- fs/ocfs2/xattr.h | 4 +--- 6 files changed, 77 insertions(+), 48 deletions(-) commit 5ee0fbd50fdf1c1329de8bee35ea9d7c6a81a2e0 Author: Junxiao Bi Date: Thu May 12 15:42:15 2016 -0700 ocfs2: revert using ocfs2_acl_chmod to avoid inode cluster lock hang Commit 743b5f1434f5 ("ocfs2: take inode lock in ocfs2_iop_set/get_acl()") introduced this issue. ocfs2_setattr called by chmod command holds cluster wide inode lock when calling posix_acl_chmod. This latter function in turn calls ocfs2_iop_get_acl and ocfs2_iop_set_acl. These two are also called directly from vfs layer for getfacl/setfacl commands and therefore acquire the cluster wide inode lock. If a remote conversion request comes after the first inode lock in ocfs2_setattr, OCFS2_LOCK_BLOCKED will be set. And this will cause the second call to inode lock from the ocfs2_iop_get_acl() to block indefinetly. The deleted version of ocfs2_acl_chmod() calls __posix_acl_chmod() which does not call back into the filesystem. Therefore, we restore ocfs2_acl_chmod(), modify it slightly for locking as needed, and use that instead. Fixes: 743b5f1434f5 ("ocfs2: take inode lock in ocfs2_iop_set/get_acl()") Signed-off-by: Tariq Saeed Signed-off-by: Junxiao Bi Cc: Mark Fasheh Cc: Joel Becker Cc: Joseph Qi Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/ocfs2/acl.c | 24 ++++++++++++++++++++++++ fs/ocfs2/acl.h | 1 + fs/ocfs2/file.c | 4 ++-- 3 files changed, 27 insertions(+), 2 deletions(-) commit 2073dbad172f5d55545c1aadc5f7ce8792dfc060 Author: Arnd Bergmann Date: Wed May 11 22:13:23 2016 +0200 net: mvneta: bm: fix dependencies again I tried to fix this before, but my previous fix was incomplete and we can still get the same link error in randconfig builds because of the way that Kconfig treats the default y if MVNETA=y && MVNETA_BM_ENABLE line that does not actually trigger when MVNETA_BM_ENABLE=m, unlike I intended. Changing the line to use MVNETA_BM_ENABLE!=n however has the desired effect and hopefully makes all configurations work as expected. Signed-off-by: Arnd Bergmann Fixes: 019ded3aa7c9 ("net: mvneta: bm: clarify dependencies") Acked-by: Gregory CLEMENT Signed-off-by: David S. Miller drivers/net/ethernet/marvell/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 02c9c0e9b9d9e26f56aa74245c1a5a843878f899 Merge: e5ad8b6 23c8a81 Author: Linus Torvalds Date: Thu May 12 13:00:33 2016 -0700 Merge tag 'keys-fixes-20160512' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull keyring fix from David Howells: "Fix ASN.1 indefinite length object parsing" * tag 'keys-fixes-20160512' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: KEYS: Fix ASN.1 indefinite length object parsing commit e5ad8b6d1ef82a83b1469fe66e40e06f07f46222 Merge: ed1e33d 84add30 Author: Linus Torvalds Date: Thu May 12 12:55:42 2016 -0700 Merge tag 'sound-4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "This is a pretty boring pull request as you wish: including a few small and trivial HD-audio and USB-audio quirks and a couple of small regression fixes in HD-audio" * tag 'sound-4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: usb-audio: Yet another Phoneix Audio device quirk ALSA: hda - Fix regression on ATI HDMI audio ALSA: hda - Fix subwoofer pin on ASUS N751 and N551 ALSA: hda - Fix broken reconfig ALSA: hda - Fix white noise on Asus UX501VW headset ALSA: usb-audio: Quirk for yet another Phoenix Audio devices (v2) commit ed1e33dded773ead96d047a34286e27feafd0505 Merge: 422ce5a c52c545 Author: Linus Torvalds Date: Thu May 12 12:47:49 2016 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input subsystem fixes from Dmitry Torokhov. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: twl6040-vibra - fix DT node memory management Input: max8997-haptic - fix NULL pointer dereference Input: byd - update copyright header commit 42ef8a78c1f49f53f29f0f3a6f9a5bcbc653233e Author: Arnaldo Carvalho de Melo Date: Thu May 12 16:25:18 2016 -0300 perf stat: Fallback to user only counters when perf_event_paranoid > 1 After 0161028b7c8a ("perf/core: Change the default paranoia level to 2") 'perf stat' fails for users without CAP_SYS_ADMIN, so just use 'perf_evsel__fallback()' to have the same behaviour as 'perf record', i.e. set perf_event_attr.exclude_kernel to 1. Now: [acme@jouet linux]$ perf stat usleep 1 Performance counter stats for 'usleep 1': 0.352536 task-clock:u (msec) # 0.423 CPUs utilized 0 context-switches:u # 0.000 K/sec 0 cpu-migrations:u # 0.000 K/sec 49 page-faults:u # 0.139 M/sec 309,407 cycles:u # 0.878 GHz 243,791 instructions:u # 0.79 insn per cycle 49,622 branches:u # 140.757 M/sec 3,884 branch-misses:u # 7.83% of all branches 0.000834174 seconds time elapsed [acme@jouet linux]$ Reported-by: Ingo Molnar Cc: Adrian Hunter Cc: Andy Lutomirski Cc: David Ahern Cc: Jiri Olsa Cc: Kees Cook Cc: Linus Torvalds Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Wang Nan Link: http://lkml.kernel.org/n/tip-b20jmx4dxt5hpaa9t2rroi0o@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-stat.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 08094828b711dd32de57e9e3314935e19db71b3d Author: Arnaldo Carvalho de Melo Date: Thu May 12 16:07:47 2016 -0300 perf evsel: Handle EACCESS + perf_event_paranoid=2 in fallback() Now with the default for the kernel.perf_event_paranoid sysctl being 2 [1] we need to fall back to :u, i.e. to set perf_event_attr.exclude_kernel to 1. Before: [acme@jouet linux]$ perf record usleep 1 Error: You may not have permission to collect stats. Consider tweaking /proc/sys/kernel/perf_event_paranoid, which controls use of the performance events system by unprivileged users (without CAP_SYS_ADMIN). The current value is 2: -1: Allow use of (almost) all events by all users >= 0: Disallow raw tracepoint access by users without CAP_IOC_LOCK >= 1: Disallow CPU event access by users without CAP_SYS_ADMIN >= 2: Disallow kernel profiling by users without CAP_SYS_ADMIN [acme@jouet linux]$ After: [acme@jouet linux]$ perf record usleep 1 [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.016 MB perf.data (7 samples) ] [acme@jouet linux]$ perf evlist cycles:u [acme@jouet linux]$ perf evlist -v cycles:u: size: 112, { sample_period, sample_freq }: 4000, sample_type: IP|TID|TIME|PERIOD, disabled: 1, inherit: 1, exclude_kernel: 1, mmap: 1, comm: 1, freq: 1, enable_on_exec: 1, task: 1, sample_id_all: 1, exclude_guest: 1, mmap2: 1, comm_exec: 1 [acme@jouet linux]$ And if the user turns on verbose mode, an explanation will appear: [acme@jouet linux]$ perf record -v usleep 1 Warning: kernel.perf_event_paranoid=2, trying to fall back to excluding kernel samples mmap size 528384B [ perf record: Woken up 1 times to write data ] Looking at the vmlinux_path (8 entries long) Using /lib/modules/4.6.0-rc7+/build/vmlinux for symbols [ perf record: Captured and wrote 0.016 MB perf.data (7 samples) ] [acme@jouet linux]$ [1] 0161028b7c8a ("perf/core: Change the default paranoia level to 2") Reported-by: Ingo Molnar Cc: Adrian Hunter Cc: Andy Lutomirski Cc: David Ahern Cc: Jiri Olsa Cc: Kees Cook Cc: Linus Torvalds Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Wang Nan Link: http://lkml.kernel.org/n/tip-b20jmx4dxt5hpaa9t2rroi0o@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/evsel.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) commit c47b9e0944e483309d66c807d650ac8b8ceafb57 Author: Alex Deucher Date: Wed May 11 16:21:03 2016 -0400 drm/amdgpu: fix DP mode validation Switch the order of the loops to walk the rates on the top so we exhaust all DP 1.1 rate/lane combinations before trying DP 1.2 rate/lane combos. This avoids selecting rates that are supported by the monitor, but not the connector leading to valid modes getting rejected. bug: https://bugs.freedesktop.org/show_bug.cgi?id=95206 Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/atombios_dp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit ff0bd441bdfbfa09d05fdba9829a0401a46635c1 Author: Alex Deucher Date: Wed May 11 16:16:53 2016 -0400 drm/radeon: fix DP mode validation Switch the order of the loops to walk the rates on the top so we exhaust all DP 1.1 rate/lane combinations before trying DP 1.2 rate/lane combos. This avoids selecting rates that are supported by the monitor, but not the connector leading to valid modes getting rejected. bug: https://bugs.freedesktop.org/show_bug.cgi?id=95206 Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/radeon/atombios_dp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 7d173913a6420f2818afeca70b268f064441f69b Author: Arnaldo Carvalho de Melo Date: Thu May 12 15:44:55 2016 -0300 perf evsel: Improve EPERM error handling in open_strerror() We were showing a hardcoded default value for the kernel.perf_event_paranoid sysctl, now that it became more paranoid (1 -> 2 [1]), this would need to be updated, instead show the current value: [acme@jouet linux]$ perf record ls Error: You may not have permission to collect stats. Consider tweaking /proc/sys/kernel/perf_event_paranoid, which controls use of the performance events system by unprivileged users (without CAP_SYS_ADMIN). The current value is 2: -1: Allow use of (almost) all events by all users >= 0: Disallow raw tracepoint access by users without CAP_IOC_LOCK >= 1: Disallow CPU event access by users without CAP_SYS_ADMIN >= 2: Disallow kernel profiling by users without CAP_SYS_ADMIN [acme@jouet linux]$ [1] 0161028b7c8a ("perf/core: Change the default paranoia level to 2") Reported-by: Ingo Molnar Cc: Adrian Hunter Cc: Andy Lutomirski Cc: David Ahern Cc: Jiri Olsa Cc: Kees Cook Cc: Linus Torvalds Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Wang Nan Link: http://lkml.kernel.org/n/tip-0gc4rdpg8d025r5not8s8028@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/evsel.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 422ce5a97570cb8a37d016b6bc2021ae4dac5499 Merge: 685764b 5305a7b Author: Linus Torvalds Date: Thu May 12 11:23:08 2016 -0700 Merge tag 'pinctrl-v4.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pinctrl fix from Linus Walleij: "A single last pin control fix for v4.6. t's tagged for stable and only hits a single driver with two added lines so should be safe. Tested in linux-next. - The pull up/down logic for the AT91 PIO4 controller was tilted: we need to mask the reverse pull when unmasking a pull direction. Setting both pull up & pull down is illegal and makes no sense" * tag 'pinctrl-v4.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: at91-pio4: fix pull-up/down logic commit f7c17d26f43d5cc1b7a6b896cd2fa24a079739b9 Author: Wanpeng Li Date: Wed May 11 17:55:18 2016 +0800 workqueue: fix rebind bound workers warning ------------[ cut here ]------------ WARNING: CPU: 0 PID: 16 at kernel/workqueue.c:4559 rebind_workers+0x1c0/0x1d0 Modules linked in: CPU: 0 PID: 16 Comm: cpuhp/0 Not tainted 4.6.0-rc4+ #31 Hardware name: IBM IBM System x3550 M4 Server -[7914IUW]-/00Y8603, BIOS -[D7E128FUS-1.40]- 07/23/2013 0000000000000000 ffff881037babb58 ffffffff8139d885 0000000000000010 0000000000000000 0000000000000000 0000000000000000 ffff881037babba8 ffffffff8108505d ffff881037ba0000 000011cf3e7d6e60 0000000000000046 Call Trace: dump_stack+0x89/0xd4 __warn+0xfd/0x120 warn_slowpath_null+0x1d/0x20 rebind_workers+0x1c0/0x1d0 workqueue_cpu_up_callback+0xf5/0x1d0 notifier_call_chain+0x64/0x90 ? trace_hardirqs_on_caller+0xf2/0x220 ? notify_prepare+0x80/0x80 __raw_notifier_call_chain+0xe/0x10 __cpu_notify+0x35/0x50 notify_down_prepare+0x5e/0x80 ? notify_prepare+0x80/0x80 cpuhp_invoke_callback+0x73/0x330 ? __schedule+0x33e/0x8a0 cpuhp_down_callbacks+0x51/0xc0 cpuhp_thread_fun+0xc1/0xf0 smpboot_thread_fn+0x159/0x2a0 ? smpboot_create_threads+0x80/0x80 kthread+0xef/0x110 ? wait_for_completion+0xf0/0x120 ? schedule_tail+0x35/0xf0 ret_from_fork+0x22/0x50 ? __init_kthread_worker+0x70/0x70 ---[ end trace eb12ae47d2382d8f ]--- notify_down_prepare: attempt to take down CPU 0 failed This bug can be reproduced by below config w/ nohz_full= all cpus: CONFIG_BOOTPARAM_HOTPLUG_CPU0=y CONFIG_DEBUG_HOTPLUG_CPU0=y CONFIG_NO_HZ_FULL=y As Thomas pointed out: | If a down prepare callback fails, then DOWN_FAILED is invoked for all | callbacks which have successfully executed DOWN_PREPARE. | | But, workqueue has actually two notifiers. One which handles | UP/DOWN_FAILED/ONLINE and one which handles DOWN_PREPARE. | | Now look at the priorities of those callbacks: | | CPU_PRI_WORKQUEUE_UP = 5 | CPU_PRI_WORKQUEUE_DOWN = -5 | | So the call order on DOWN_PREPARE is: | | CB 1 | CB ... | CB workqueue_up() -> Ignores DOWN_PREPARE | CB ... | CB X ---> Fails | | So we call up to CB X with DOWN_FAILED | | CB 1 | CB ... | CB workqueue_up() -> Handles DOWN_FAILED | CB ... | CB X-1 | | So the problem is that the workqueue stuff handles DOWN_FAILED in the up | callback, while it should do it in the down callback. Which is not a good idea | either because it wants to be called early on rollback... | | Brilliant stuff, isn't it? The hotplug rework will solve this problem because | the callbacks become symetric, but for the existing mess, we need some | workaround in the workqueue code. The boot CPU handles housekeeping duty(unbound timers, workqueues, timekeeping, ...) on behalf of full dynticks CPUs. It must remain online when nohz full is enabled. There is a priority set to every notifier_blocks: workqueue_cpu_up > tick_nohz_cpu_down > workqueue_cpu_down So tick_nohz_cpu_down callback failed when down prepare cpu 0, and notifier_blocks behind tick_nohz_cpu_down will not be called any more, which leads to workers are actually not unbound. Then hotplug state machine will fallback to undo and online cpu 0 again. Workers will be rebound unconditionally even if they are not unbound and trigger the warning in this progress. This patch fix it by catching !DISASSOCIATED to avoid rebind bound workers. Cc: Tejun Heo Cc: Lai Jiangshan Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: Frédéric Weisbecker Cc: stable@vger.kernel.org Suggested-by: Lai Jiangshan Signed-off-by: Wanpeng Li kernel/workqueue.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 8a934ccbf90959877beec27780469e85f1c3f101 Merge: 2348548 aab0a4c Author: Arnd Bergmann Date: Thu May 12 17:44:53 2016 +0200 Merge tag 'at91-fixes2' of git://git.kernel.org/pub/scm/linux/kernel/git/nferre/linux-at91 into fixes Merge "Second AT91 fix PR for 4.6" from Nicolas Ferre: - fix a regression on the clock subsystem while switching to syscon/regmap due to a stricter check of the register map. * tag 'at91-fixes2' of git://git.kernel.org/pub/scm/linux/kernel/git/nferre/linux-at91: ARM: dts: at91: sam9x5: Fix the memory range assigned to the PMC commit 09be4c824ebdbf3c043a07d2d9537a0164a1ecfe Author: Felipe Balbi Date: Thu May 12 12:34:38 2016 +0300 cgroup: fix compile warning commit 4f41fc59620f ("cgroup, kernfs: make mountinfo show properly scoped path for cgroup namespaces") added the following compile warning: kernel/cgroup.c: In function ‘cgroup_show_path’: kernel/cgroup.c:1634:15: warning: unused variable ‘ret’ [-Wunused-variable] int len = 0, ret = 0; ^ fix it. Fixes: 4f41fc59620f ("cgroup, kernfs: make mountinfo show properly scoped path for cgroup namespaces") Signed-off-by: Felipe Balbi Signed-off-by: Tejun Heo kernel/cgroup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3cc9b23c8137e9bb4eaf6d97d825b7f0dc711d0c Author: Serge E. Hallyn Date: Thu May 12 00:29:45 2016 -0500 kernfs: kernfs_sop_show_path: don't return 0 after seq_dentry call Our caller expects 0 on success, not >0. This fixes a bug in the patch cgroup, kernfs: make mountinfo show properly scoped path for cgroup namespaces where /sys does not show up in mountinfo, breaking criu. Thanks for catching this, Andrei. Reported-by: Andrei Vagin Signed-off-by: Serge Hallyn Signed-off-by: Tejun Heo fs/kernfs/mount.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 106b816cb46ebd87408b4ed99a2e16203114daa6 Author: Steven Rostedt Date: Wed May 11 15:09:36 2016 -0400 tools lib traceevent: Do not reassign parg after collapse_tree() At the end of process_filter(), collapse_tree() was changed to update the parg parameter, but the reassignment after the call wasn't removed. What happens is that the "current_op" gets modified and freed and parg is assigned to the new allocated argument. But after the call to collapse_tree(), parg is assigned again to the just freed "current_op", and this causes the tool to crash. The current_op variable must also be assigned to NULL in case of error, otherwise it will cause it to be free()ed twice. Signed-off-by: Steven Rostedt Acked-by: Namhyung Kim Cc: stable@vger.kernel.org # 3.14+ Fixes: 42d6194d133c ("tools lib traceevent: Refactor process_filter()") Link: http://lkml.kernel.org/r/20160511150936.678c18a1@gandalf.local.home Signed-off-by: Arnaldo Carvalho de Melo tools/lib/traceevent/parse-filter.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 4924734570a073049450b11f7c59ce5992b03343 Author: Arnaldo Carvalho de Melo Date: Tue Apr 5 11:33:41 2016 -0300 perf probe: Check if dwarf_getlocations() is available If not, tell the user that: config/Makefile:273: Old libdw.h, finding variables at given 'perf probe' point will not work, install elfutils-devel/libdw-dev >= 0.157 And return -ENOTSUPP in die_get_var_range(), failing features that need it, like the one pointed out above. This fixes the build on older systems, such as Ubuntu 12.04.5. Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Vinson Lee Cc: Wang Nan Link: http://lkml.kernel.org/n/tip-9l7luqkq4gfnx7vrklkq4obs@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/build/Makefile.feature | 2 ++ tools/build/feature/Makefile | 4 ++++ tools/build/feature/test-all.c | 5 +++++ tools/build/feature/test-dwarf_getlocations.c | 12 ++++++++++++ tools/perf/config/Makefile | 6 ++++++ tools/perf/util/dwarf-aux.c | 9 +++++++++ 6 files changed, 38 insertions(+) commit 62aa0e177d278462145a29c30d3c8501ae57e200 Author: Arnaldo Carvalho de Melo Date: Fri Apr 8 12:04:29 2016 -0300 perf dwarf: Guard !x86_64 definitions under #ifdef else clause To fix the build on Fedora Rawhide (gcc 6.0.0 20160311 (Red Hat 6.0.0-0.17): CC /tmp/build/perf/arch/x86/util/dwarf-regs.o arch/x86/util/dwarf-regs.c:66:36: error: 'x86_32_regoffset_table' defined but not used [-Werror=unused-const-variable=] static const struct pt_regs_offset x86_32_regoffset_table[] = { ^~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: http://lkml.kernel.org/n/tip-fghuksc1u8ln82bof4lwcj0o@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/arch/x86/util/dwarf-regs.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 22a9f41b555673e7499b97acf3ffb07bf0af31ad Author: Arnaldo Carvalho de Melo Date: Fri Apr 8 11:53:02 2016 -0300 perf tools: Use readdir() instead of deprecated readdir_r() The readdir() function is thread safe as long as just one thread uses a DIR, which is the case when parsing tracepoint event definitions, to avoid breaking the build with glibc-2.23.90 (upcoming 2.24), use it instead of readdir_r(). See: http://man7.org/linux/man-pages/man3/readdir.3.html "However, in modern implementations (including the glibc implementation), concurrent calls to readdir() that specify different directory streams are thread-safe. In cases where multiple threads must read from the same directory stream, using readdir() with external synchronization is still preferable to the use of the deprecated readdir_r(3) function." Noticed while building on a Fedora Rawhide docker container. Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: http://lkml.kernel.org/n/tip-wddn49r6bz6wq4ee3dxbl7lo@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/parse-events.c | 60 +++++++++++++++++++++--------------------- 1 file changed, 30 insertions(+), 30 deletions(-) commit 7839b9f32e45075d9eb48da8480faef3dbd019f0 Author: Arnaldo Carvalho de Melo Date: Fri Apr 8 11:31:24 2016 -0300 perf thread_map: Use readdir() instead of deprecated readdir_r() The readdir() function is thread safe as long as just one thread uses a DIR, which is the case in thread_map, so, to avoid breaking the build with glibc-2.23.90 (upcoming 2.24), use it instead of readdir_r(). See: http://man7.org/linux/man-pages/man3/readdir.3.html "However, in modern implementations (including the glibc implementation), concurrent calls to readdir() that specify different directory streams are thread-safe. In cases where multiple threads must read from the same directory stream, using readdir() with external synchronization is still preferable to the use of the deprecated readdir_r(3) function." Noticed while building on a Fedora Rawhide docker container. Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: http://lkml.kernel.org/n/tip-del8h2a0f40z75j4r42l96l0@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/thread_map.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 9a5f3bf332bbd42625b71553ca9ffdffa9fc4785 Author: Arnaldo Carvalho de Melo Date: Fri Apr 8 11:25:59 2016 -0300 perf script: Use readdir() instead of deprecated readdir_r() The readdir() function is thread safe as long as just one thread uses a DIR, which is the case in 'perf script', so, to avoid breaking the build with glibc-2.23.90 (upcoming 2.24), use it instead of readdir_r(). See: http://man7.org/linux/man-pages/man3/readdir.3.html "However, in modern implementations (including the glibc implementation), concurrent calls to readdir() that specify different directory streams are thread-safe. In cases where multiple threads must read from the same directory stream, using readdir() with external synchronization is still preferable to the use of the deprecated readdir_r(3) function." Noticed while building on a Fedora Rawhide docker container. Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: http://lkml.kernel.org/n/tip-mt3xz7n2hl49ni2vx7kuq74g@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-script.c | 70 ++++++++++++++++++++++----------------------- 1 file changed, 34 insertions(+), 36 deletions(-) commit 2515e614834f362eed36fb5ea5d359d94a525263 Author: Arnaldo Carvalho de Melo Date: Fri Apr 8 11:32:15 2016 -0300 perf tools: Use readdir() instead of deprecated readdir_r() The readdir() function is thread safe as long as just one thread uses a DIR, which is the case when synthesizing events for pre-existing threads by traversing /proc, so, to avoid breaking the build with glibc-2.23.90 (upcoming 2.24), use it instead of readdir_r(). See: http://man7.org/linux/man-pages/man3/readdir.3.html "However, in modern implementations (including the glibc implementation), concurrent calls to readdir() that specify different directory streams are thread-safe. In cases where multiple threads must read from the same directory stream, using readdir() with external synchronization is still preferable to the use of the deprecated readdir_r(3) function." Noticed while building on a Fedora Rawhide docker container. CC /tmp/build/perf/util/event.o util/event.c: In function '__event__synthesize_thread': util/event.c:466:2: error: 'readdir_r' is deprecated [-Werror=deprecated-declarations] while (!readdir_r(tasks, &dirent, &next) && next) { ^~~~~ In file included from /usr/include/features.h:368:0, from /usr/include/stdint.h:25, from /usr/lib/gcc/x86_64-redhat-linux/6.0.0/include/stdint.h:9, from /git/linux/tools/include/linux/types.h:6, from util/event.c:1: /usr/include/dirent.h:189:12: note: declared here Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: http://lkml.kernel.org/n/tip-i1vj7nyjp2p750rirxgrfd3c@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/event.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 9f448cd3cbcec8995935e60b27802ae56aac8cc0 Author: Alexander Shishkin Date: Tue May 10 16:18:33 2016 +0300 perf/core: Disable the event on a truncated AUX record When the PMU driver reports a truncated AUX record, it effectively means that there is no more usable room in the event's AUX buffer (even though there may still be some room, so that perf_aux_output_begin() doesn't take action). At this point the consumer still has to be woken up and the event has to be disabled, otherwise the event will just keep spinning between perf_aux_output_begin() and perf_aux_output_end() until its context gets unscheduled. Again, for cpu-wide events this means never, so once in this condition, they will be forever losing data. Fix this by disabling the event and waking up the consumer in case of a truncated AUX record. Reported-by: Markus Metzger Signed-off-by: Alexander Shishkin Signed-off-by: Peter Zijlstra (Intel) Cc: Cc: Arnaldo Carvalho de Melo Cc: Arnaldo Carvalho de Melo Cc: Borislav Petkov Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Cc: vince@deater.net Link: http://lkml.kernel.org/r/1462886313-13660-3-git-send-email-alexander.shishkin@linux.intel.com Signed-off-by: Ingo Molnar kernel/events/ring_buffer.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit ab92b232ae05c382c3df0e3d6a5c6d16b639ac8c Author: Alexander Shishkin Date: Tue May 10 16:18:32 2016 +0300 perf/x86/intel/pt: Generate PMI in the STOP region as well Currently, the PT driver always sets the PMI bit one region (page) before the STOP region so that we can wake up the consumer before we run out of room in the buffer and have to disable the event. However, we also need an interrupt in the last output region, so that we actually get to disable the event (if no more room from new data is available at that point), otherwise hardware just quietly refuses to start, but the event is scheduled in and we end up losing trace data till the event gets removed. For a cpu-wide event it is even worse since there may not be any re-scheduling at all and no chance for the ring buffer code to notice that its buffer is filled up and the event needs to be disabled (so that the consumer can re-enable it when it finishes reading the data out). In other words, all the trace data will be lost after the buffer gets filled up. This patch makes PT also generate a PMI when the last output region is full. Reported-by: Markus Metzger Signed-off-by: Alexander Shishkin Signed-off-by: Peter Zijlstra (Intel) Cc: Cc: Arnaldo Carvalho de Melo Cc: Arnaldo Carvalho de Melo Cc: Borislav Petkov Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Cc: vince@deater.net Link: http://lkml.kernel.org/r/1462886313-13660-2-git-send-email-alexander.shishkin@linux.intel.com Signed-off-by: Ingo Molnar arch/x86/events/intel/pt.c | 2 ++ 1 file changed, 2 insertions(+) commit 9a7a076e8e4ffcfec05e3cafe4c4e31d41ddbaa0 Author: Dmitry V. Levin Date: Wed May 11 11:48:17 2016 +0300 x86: Use compat version for preadv2 and pwritev2 Similar to preadv and pwritev, preadv2 and pwritev2 need compat entries in the 32-bit syscall table. This bug was found by strace test suite. Fixes: 4babf2c5efb7 ("x86: wire up preadv2 and pwritev2") Signed-off-by: Dmitry V. Levin Acked-by: Christoph Hellwig Link: http://lkml.kernel.org/r/20160511084817.GA29823@altlinux.org Signed-off-by: Thomas Gleixner arch/x86/entry/syscalls/syscall_32.tbl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 23c8a812dc3c621009e4f0e5342aa4e2ede1ceaa Author: David Howells Date: Tue Feb 23 11:03:12 2016 +0000 KEYS: Fix ASN.1 indefinite length object parsing This fixes CVE-2016-0758. In the ASN.1 decoder, when the length field of an ASN.1 value is extracted, it isn't validated against the remaining amount of data before being added to the cursor. With a sufficiently large size indicated, the check: datalen - dp < 2 may then fail due to integer overflow. Fix this by checking the length indicated against the amount of remaining data in both places a definite length is determined. Whilst we're at it, make the following changes: (1) Check the maximum size of extended length does not exceed the capacity of the variable it's being stored in (len) rather than the type that variable is assumed to be (size_t). (2) Compare the EOC tag to the symbolic constant ASN1_EOC rather than the integer 0. (3) To reduce confusion, move the initialisation of len outside of: for (len = 0; n > 0; n--) { since it doesn't have anything to do with the loop counter n. Signed-off-by: David Howells Reviewed-by: Mimi Zohar Acked-by: David Woodhouse Acked-by: Peter Jones lib/asn1_decoder.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) commit 6d6f2833bfbf296101f9f085e10488aef2601ba5 Author: Andrey Ryabinin Date: Wed May 11 16:51:51 2016 +0300 perf/x86: Fix undefined shift on 32-bit kernels Jim reported: UBSAN: Undefined behaviour in arch/x86/events/intel/core.c:3708:12 shift exponent 35 is too large for 32-bit type 'long unsigned int' The use of 'unsigned long' type obviously is not correct here, make it 'unsigned long long' instead. Reported-by: Jim Cromie Signed-off-by: Andrey Ryabinin Signed-off-by: Peter Zijlstra (Intel) Cc: Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: H. Peter Anvin Cc: Imre Palik Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Fixes: 2c33645d366d ("perf/x86: Honor the architectural performance monitoring version") Link: http://lkml.kernel.org/r/1462974711-10037-1-git-send-email-aryabinin@virtuozzo.com Signed-off-by: Ingo Molnar arch/x86/events/intel/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3c3116b745c08dc76ccbed7223c4edddcfd9a186 Author: Peter Zijlstra Date: Tue May 10 14:16:54 2016 +0200 perf/x86/msr: Fix SMI overflow We compute 'delta' and properly sign extend it and then ignore it and recompute the raw value, loosing the sign extention. Signed-off-by: Peter Zijlstra (Intel) Cc: Alexander Shishkin Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Cc: kan.liang@intel.com Cc: linux-kernel@vger.kernel.org Cc: luto@kernel.org Cc: ray.huang@amd.com Signed-off-by: Ingo Molnar arch/x86/events/msr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ec336c879c3b422d2876085be1cbb110e44dc0de Author: hchrzani Date: Mon May 9 09:36:59 2016 +0200 perf/x86/intel/uncore: Fix CHA registers configuration procedure for Knights Landing platform CHA events in Knights Landing platform require programming filter registers properly. Remote node, local node and NonNearMemCachable bits should be set to 1 at all times. Signed-off-by: Hubert Chrzaniuk Signed-off-by: Lawrence F Meadows Signed-off-by: Peter Zijlstra (Intel) Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Cc: bp@suse.de Cc: harish.chegondi@intel.com Cc: hpa@zytor.com Cc: izumi.taku@jp.fujitsu.com Cc: kan.liang@intel.com Cc: lukasz.anaczkowski@intel.com Cc: vthakkar1994@gmail.com Fixes: 77af0037de0a ('perf/x86/intel/uncore: Add Knights Landing uncore PMU support') Link: http://lkml.kernel.org/r/1462779419-17115-2-git-send-email-hubert.chrzaniuk@intel.com Signed-off-by: Ingo Molnar arch/x86/events/intel/uncore_snbep.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 1b7cc307a88377b0c948f9cbc36d026b272fe6e3 Merge: 5f46fea fa7e281 Author: David S. Miller Date: Wed May 11 23:46:09 2016 -0400 Merge branch 'bnxt_en-fixes' Michael Chan says: ==================== bnxt_en: Add workaround to detect bad opaque in rx completion. 2-part workaround for this hardware bug. ==================== Signed-off-by: David S. Miller commit fa7e28127a5ad9fd55ac9c7707d8c8b835113a7c Author: Michael Chan Date: Tue May 10 19:18:00 2016 -0400 bnxt_en: Add workaround to detect bad opaque in rx completion (part 2) Add detection and recovery code when the hardware returned opaque value does not match the expected consumer index. Once the issue is detected, we skip the processing of all RX and LRO/GRO packets. These completion entries are discarded without sending the SKB to the stack and without producing new buffers. The function will be reset from a workqueue. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 60 +++++++++++++++++++++++++++++++ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + 2 files changed, 61 insertions(+) commit 376a5b8647d6c56cb8f104d7ad0390b4f4057e70 Author: Michael Chan Date: Tue May 10 19:17:59 2016 -0400 bnxt_en: Add workaround to detect bad opaque in rx completion (part 1) There is a rare hardware bug that can cause a bad opaque value in the RX or TPA completion. When this happens, the hardware may have used the same buffer twice for 2 rx packets. In addition, the driver will also crash later using the bad opaque as the index into the ring. The rx opaque value is predictable and is always monotonically increasing. The workaround is to keep track of the expected next opaque value and compare it with the one returned by hardware during RX and TPA start completions. If they miscompare, we will not process any more RX and TPA completions and exit NAPI. We will then schedule a workqueue to reset the function. This patch adds the logic to keep track of the next rx consumer index. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +++ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + 2 files changed, 4 insertions(+) commit 5f46feab87bb105d6a217d966b327fdc56696802 Author: Dan Carpenter Date: Tue May 10 22:20:04 2016 +0300 qlcnic: potential NULL dereference in qlcnic_83xx_get_minidump_template() If qlcnic_fw_cmd_get_minidump_temp() fails then "fw_dump->tmpl_hdr" is NULL or possibly freed. It can lead to an oops later. Fixes: d01a6d3c8ae1 ('qlcnic: Add support to enable capability to extend minidump for iSCSI') Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 58a6e2e5794d2aeacf6a84afeaed46e3a5e0fbb0 Merge: a81a360 e3c00d8 Author: Dave Airlie Date: Thu May 12 10:05:36 2016 +1000 Merge branch 'drm-fixes-4.6' of git://people.freedesktop.org/~agd5f/linux into drm-fixes Two some radeon display fixes. * 'drm-fixes-4.6' of git://people.freedesktop.org/~agd5f/linux: drm/radeon: fix PLL sharing on DCE6.1 (v2) drm/radeon: fix DP link training issue with second 4K monitor commit a81a36065b5895f2467eb89cb089ba640e160321 Merge: 44549e8 2700818 Author: Dave Airlie Date: Thu May 12 10:05:06 2016 +1000 Merge tag 'drm-intel-fixes-2016-05-11' of git://anongit.freedesktop.org/drm-intel into drm-fixes Misc intel fixes, reverting MST audio which was causing oops for now. * tag 'drm-intel-fixes-2016-05-11' of git://anongit.freedesktop.org/drm-intel: drm/i915: Bail out of pipe config compute loop on LPT Revert "drm/i915: start adding dp mst audio" drm/i915/bdw: Add missing delay during L3 SQC credit programming drm/i915/lvds: separate border enable readout from panel fitter drm/i915: Update CDCLK_FREQ register on BDW after changing cdclk frequency commit 93f0750dcdaed083d6209b01e952e98ca730db66 Author: Mauro Carvalho Chehab Date: Wed May 11 13:09:34 2016 -0300 Revert "[media] videobuf2-v4l2: Verify planes array in buffer dequeueing" This patch causes a Kernel panic when called on a DVB driver. This was also reported by David R : May 7 14:47:35 server kernel: [ 501.247123] BUG: unable to handle kernel NULL pointer dereference at 0000000000000004 May 7 14:47:35 server kernel: [ 501.247239] IP: [] __verify_planes_array.isra.3+0x1/0x80 [videobuf2_v4l2] May 7 14:47:35 server kernel: [ 501.247354] PGD cae6f067 PUD ca99c067 PMD 0 May 7 14:47:35 server kernel: [ 501.247426] Oops: 0000 [#1] SMP May 7 14:47:35 server kernel: [ 501.247482] Modules linked in: xfs tun xt_connmark xt_TCPMSS xt_tcpmss xt_owner xt_REDIRECT nf_nat_redirect xt_nat ipt_MASQUERADE nf_nat_masquerade_ipv4 ts_kmp ts_bm xt_string ipt_REJECT nf_reject_ipv4 xt_recent xt_conntrack xt_multiport xt_pkttype xt_tcpudp xt_mark nf_log_ipv4 nf_log_common xt_LOG xt_limit iptable_mangle iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_filter ip_tables ip6table_filter ip6_tables x_tables pppoe pppox dm_crypt ts2020 regmap_i2c ds3000 cx88_dvb dvb_pll cx88_vp3054_i2c mt352 videobuf2_dvb cx8800 cx8802 cx88xx pl2303 tveeprom videobuf2_dma_sg ppdev videobuf2_memops videobuf2_v4l2 videobuf2_core dvb_usb_digitv snd_hda_codec_via snd_hda_codec_hdmi snd_hda_codec_generic radeon dvb_usb snd_hda_intel amd64_edac_mod serio_raw snd_hda_codec edac_core fbcon k10temp bitblit softcursor snd_hda_core font snd_pcm_oss i2c_piix4 snd_mixer_oss tileblit drm_kms_helper syscopyarea snd_pcm snd_seq_dummy sysfillrect snd_seq_oss sysimgblt fb_sys_fops ttm snd_seq_midi r8169 snd_rawmidi drm snd_seq_midi_event e1000e snd_seq snd_seq_device snd_timer snd ptp pps_core i2c_algo_bit soundcore parport_pc ohci_pci shpchp tpm_tis tpm nfsd auth_rpcgss oid_registry hwmon_vid exportfs nfs_acl mii nfs bonding lockd grace lp sunrpc parport May 7 14:47:35 server kernel: [ 501.249564] CPU: 1 PID: 6889 Comm: vb2-cx88[0] Not tainted 4.5.3 #3 May 7 14:47:35 server kernel: [ 501.249644] Hardware name: System manufacturer System Product Name/M4A785TD-V EVO, BIOS 0211 07/08/2009 May 7 14:47:35 server kernel: [ 501.249767] task: ffff8800aebf3600 ti: ffff8801e07a0000 task.ti: ffff8801e07a0000 May 7 14:47:35 server kernel: [ 501.249861] RIP: 0010:[] [] __verify_planes_array.isra.3+0x1/0x80 [videobuf2_v4l2] May 7 14:47:35 server kernel: [ 501.250002] RSP: 0018:ffff8801e07a3de8 EFLAGS: 00010086 May 7 14:47:35 server kernel: [ 501.250071] RAX: 0000000000000283 RBX: ffff880210dc5000 RCX: 0000000000000283 May 7 14:47:35 server kernel: [ 501.250161] RDX: ffffffffa0222cf0 RSI: 0000000000000000 RDI: ffff880210dc5014 May 7 14:47:35 server kernel: [ 501.250251] RBP: ffff8801e07a3df8 R08: ffff8801e07a0000 R09: 0000000000000000 May 7 14:47:35 server kernel: [ 501.250348] R10: 0000000000000000 R11: 0000000000000001 R12: ffff8800cda2a9d8 May 7 14:47:35 server kernel: [ 501.250438] R13: ffff880210dc51b8 R14: 0000000000000000 R15: ffff8800cda2a828 May 7 14:47:35 server kernel: [ 501.250528] FS: 00007f5b77fff700(0000) GS:ffff88021fc40000(0000) knlGS:00000000adaffb40 May 7 14:47:35 server kernel: [ 501.250631] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b May 7 14:47:35 server kernel: [ 501.250704] CR2: 0000000000000004 CR3: 00000000ca19d000 CR4: 00000000000006e0 May 7 14:47:35 server kernel: [ 501.250794] Stack: May 7 14:47:35 server kernel: [ 501.250822] ffff8801e07a3df8 ffffffffa0222cfd ffff8801e07a3e70 ffffffffa0236beb May 7 14:47:35 server kernel: [ 501.250937] 0000000000000283 ffff8801e07a3e94 0000000000000000 0000000000000000 May 7 14:47:35 server kernel: [ 501.251051] ffff8800aebf3600 ffffffff8108d8e0 ffff8801e07a3e38 ffff8801e07a3e38 May 7 14:47:35 server kernel: [ 501.251165] Call Trace: May 7 14:47:35 server kernel: [ 501.251200] [] ? __verify_planes_array_core+0xd/0x10 [videobuf2_v4l2] May 7 14:47:35 server kernel: [ 501.251306] [] vb2_core_dqbuf+0x2eb/0x4c0 [videobuf2_core] May 7 14:47:35 server kernel: [ 501.251398] [] ? prepare_to_wait_event+0x100/0x100 May 7 14:47:35 server kernel: [ 501.251482] [] vb2_thread+0x1cb/0x220 [videobuf2_core] May 7 14:47:35 server kernel: [ 501.251569] [] ? vb2_core_qbuf+0x230/0x230 [videobuf2_core] May 7 14:47:35 server kernel: [ 501.251662] [] ? vb2_core_qbuf+0x230/0x230 [videobuf2_core] May 7 14:47:35 server kernel: [ 501.255982] [] kthread+0xc4/0xe0 May 7 14:47:35 server kernel: [ 501.260292] [] ? kthread_park+0x50/0x50 May 7 14:47:35 server kernel: [ 501.264615] [] ret_from_fork+0x3f/0x70 May 7 14:47:35 server kernel: [ 501.268962] [] ? kthread_park+0x50/0x50 May 7 14:47:35 server kernel: [ 501.273216] Code: 0d 01 74 16 48 8b 46 28 48 8b 56 30 48 89 87 d0 01 00 00 48 89 97 d8 01 00 00 5d c3 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 55 <8b> 46 04 48 89 e5 8d 50 f7 31 c0 83 fa 01 76 02 5d c3 48 83 7e May 7 14:47:35 server kernel: [ 501.282146] RIP [] __verify_planes_array.isra.3+0x1/0x80 [videobuf2_v4l2] May 7 14:47:35 server kernel: [ 501.286391] RSP May 7 14:47:35 server kernel: [ 501.290619] CR2: 0000000000000004 May 7 14:47:35 server kernel: [ 501.294786] ---[ end trace b2b354153ccad110 ]--- This reverts commit 2c1f6951a8a82e6de0d82b1158b5e493fc6c54ab. Cc: Sakari Ailus Cc: Hans Verkuil Cc: stable@vger.kernel.org Fixes: 2c1f6951a8a8 ("[media] videobuf2-v4l2: Verify planes array in buffer dequeueing") Signed-off-by: Mauro Carvalho Chehab drivers/media/v4l2-core/videobuf2-v4l2.c | 6 ------ 1 file changed, 6 deletions(-) commit 685764b108a7e5fe9f5ee213d6a627c1166d7c88 Merge: 4d8bbbf 2bcbc81 Author: Linus Torvalds Date: Wed May 11 13:17:12 2016 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "This is a couple of small fixes: one is a potential uninitialised error variable in the alua code, potentially causing spurious failures and the other is a problem caused by the conversion of SCSI to hostwide tags which resulted in the qla1280 driver always failing in host initialisation" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: qla1280: Don't allocate 512kb of host tags scsi_dh_alua: uninitialized variable in alua_rtpg() commit 4d8bbbff1227bbb27fdb02b6db17f080c06eedad Merge: 50c7389 e271c7b Author: Linus Torvalds Date: Wed May 11 12:52:05 2016 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: "Hopefully the last round of fixes this release, fingers crossed :) 1) Initialize static nf_conntrack_locks_all_lock properly, from Florian Westphal. 2) Need to cancel pending work when destroying IDLETIMER entries, from Liping Zhang. 3) Fix TX param usage when sending TSO over iwlwifi devices, from Emmanuel Grumbach. 4) NFACCT quota params not validated properly, from Phil Turnbull. 5) Resolve more glibc vs. kernel header conflicts, from Mikko Tapeli. 6) Missing IRQ free in ravb_close(), from Geert Uytterhoeven. 7) Fix infoleak in x25, from Kangjie Lu. 8) Similarly in thunderx driver, from Heinrich Schuchardt. 9) tc_ife.h uapi header not exported properly, from Jamal Hadi Salim. 10) Don't reenable PHY interreupts if device is in polling mode, from Shaohui Xie. 11) Packet scheduler actions late binding was not being handled properly at all, from Jamal Hadi Salim. 12) Fix binding of conntrack entries to helpers in openvswitch, from Joe Stringer" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (21 commits) gre: do not keep the GRE header around in collect medata mode openvswitch: Fix cached ct with helper. net sched: ife action fix late binding net sched: skbedit action fix late binding net sched: simple action fix late binding net sched: mirred action fix late binding net sched: ipt action fix late binding net sched: vlan action fix late binding net: phylib: fix interrupts re-enablement in phy_start tcp: refresh skb timestamp at retransmit time net: nps_enet: bug fix - handle lost tx interrupts net: nps_enet: Tx handler synchronization export tc ife uapi header net: thunderx: avoid exposing kernel stack net: fix a kernel infoleak in x25 module ravb: Add missing free_irq() call to ravb_close() uapi glibc compat: fix compile errors when glibc net/if.h included before linux/if.h netfilter: nfnetlink_acct: validate NFACCT_QUOTA parameter iwlwifi: mvm: don't override the rate with the AMSDU len netfilter: IDLETIMER: fix race condition when destroy the target ... commit e271c7b4420ddbb9fae82a2b31a5ab3edafcf4fe Author: Jiri Benc Date: Wed May 11 15:53:57 2016 +0200 gre: do not keep the GRE header around in collect medata mode For ipgre interface in collect metadata mode, it doesn't make sense for the interface to be of ARPHRD_IPGRE type. The outer header of received packets is not needed, as all the information from it is present in metadata_dst. We already don't set ipgre_header_ops for collect metadata interfaces, which is the only consumer of mac_header pointing to the outer IP header. Just set the interface type to ARPHRD_NONE in collect metadata mode for ipgre (not gretap, that still correctly stays ARPHRD_ETHER) and reset mac_header. Fixes: a64b04d86d14 ("gre: do not assign header_ops in collect metadata mode") Fixes: 2e15ea390e6f4 ("ip_gre: Add support to collect tunnel metadata.") Signed-off-by: Jiri Benc Signed-off-by: David S. Miller net/ipv4/ip_gre.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 16ec3d4fbb967bd0e1c8d9dce9ef70e915a86615 Author: Joe Stringer Date: Wed May 11 10:29:26 2016 -0700 openvswitch: Fix cached ct with helper. When using conntrack helpers from OVS, a common configuration is to perform a lookup without specifying a helper, then go through a firewalling policy, only to decide to attach a helper afterwards. In this case, the initial lookup will cause a ct entry to be attached to the skb, then the later commit with helper should attach the helper and confirm the connection. However, the helper attachment has been missing. If the user has enabled automatic helper attachment, then this issue will be masked as it will be applied in init_conntrack(). It is also masked if the action is executed from ovs_packet_cmd_execute() as that will construct a fresh skb. This patch fixes the issue by making an explicit call to try to assign the helper if there is a discrepancy between the action's helper and the current skb->nfct. Fixes: cae3a2627520 ("openvswitch: Allow attaching helpers to ct action") Signed-off-by: Joe Stringer Signed-off-by: David S. Miller net/openvswitch/conntrack.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit 50c73890d314921e2097d47e98c2ca59b3876ec7 Author: Mathias Krause Date: Tue May 10 23:07:02 2016 +0200 x86/extable: ensure entries are swapped completely when sorting The x86 exception table sorting was changed in commit 29934b0fb8ff ("x86/extable: use generic search and sort routines") to use the arch independent code in lib/extable.c. However, the patch was mangled somehow on its way into the kernel from the last version posted at [1]. The committed version kind of attempted to incorporate the changes of commit 548acf19234d ("x86/mm: Expand the exception table logic to allow new handling options") as in _completely_ _ignoring_ the x86 specific 'handler' member of struct exception_table_entry. This effectively broke the sorting as entries will only partly be swapped now. Fortunately, the x86 Kconfig selects BUILDTIME_EXTABLE_SORT, so the exception table doesn't need to be sorted at runtime. However, in case that ever changes, we better not break the exception table sorting just because of that. [ Ard Biesheuvel points out that BUILDTIME_EXTABLE_SORT applies to the core image only, but we still rely on the sorting routines for modules in that case - Linus ] Fix this by providing a swap_ex_entry_fixup() macro that takes care of the 'handler' member. [1] https://lkml.org/lkml/2016/1/27/232 Signed-off-by: Mathias Krause Fixes: 29934b0fb8f ("x86/extable: use generic search and sort routines") Reviewed-by: Ard Biesheuvel Cc: Andrew Morton Cc: Andy Lutomirski Cc: Borislav Petkov Cc: H. Peter Anvin Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Tony Luck Signed-off-by: Linus Torvalds arch/x86/include/asm/uaccess.h | 8 ++++++++ 1 file changed, 8 insertions(+) commit e0d09e32c9d34edafd790020222050d7701f986f Merge: d32917e 9b1f189 Author: Linus Torvalds Date: Wed May 11 10:21:16 2016 -0700 Merge tag 'spi-fix-v4.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A bunch of small driver specific fixes that have come up, none of them remarkable in themselves. One fixes a regression introduced in the merge window and another two are targetted at stable" * tag 'spi-fix-v4.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: pxa2xx: Do not detect number of enabled chip selects on Intel SPT spi: spi-ti-qspi: Handle truncated frames properly spi: spi-ti-qspi: Fix FLEN and WLEN settings if bits_per_word is overridden spi: omap2-mcspi: Undo broken fix for dma transfer of vmalloced buffer spi: spi-fsl-dspi: Fix cs_change handling in message transfer commit d32917eedc3b8a21f40206c8dd655beae5be8795 Merge: c511462 44ca941 Author: Linus Torvalds Date: Wed May 11 10:11:44 2016 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fixes from Paolo Bonzini: "Two small x86 patches, improving "make kvmconfig" and fixing an objtool warning for CONFIG_PROFILE_ALL_BRANCHES" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: kvmconfig: add more virtio drivers x86/kvm: Add stack frame dependency to fastop() inline asm commit 84add303ef950b8d85f54bc2248c2bc73467c329 Author: Takashi Iwai Date: Wed May 11 17:48:00 2016 +0200 ALSA: usb-audio: Yet another Phoneix Audio device quirk Phoenix Audio has yet another device with another id (even a different vendor id, 0556:0014) that requires the same quirk for the sample rate. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=110221 Cc: Signed-off-by: Takashi Iwai sound/usb/quirks.c | 1 + 1 file changed, 1 insertion(+) commit e9d848cb65d5f6f7731d12bd1b6d994bfdbcc94f Author: Namhyung Kim Date: Tue May 10 11:26:24 2016 -0300 perf diff: Fix duplicated output column The commit b97511c5bc94 ("perf tools: Add overhead/overhead_children keys defaults via string") moved initialization of column headers but it missed to check the sort__mode. As 'perf diff' doesn't call perf_hpp__init(), the setup_overhead() also should not be called. Before: # Baseline Delta Children Overhead Shared Object Symbol # ........ ....... ........ ........ ................... ....................... # 28.48% -28.47% 28.48% 28.48% [kernel.vmlinux ] [k] intel_idle 11.51% -11.47% 11.51% 11.51% libxul.so [.] 0x0000000001a360f7 3.49% -3.49% 3.49% 3.49% [kernel.vmlinux] [k] generic_exec_single 2.91% -2.89% 2.91% 2.91% libdbus-1.so.3.8.11 [.] 0x000000000000cdc2 2.86% -2.85% 2.86% 2.86% libxcb.so.1.1.0 [.] 0x000000000000c890 2.44% -2.39% 2.44% 2.44% [kernel.vmlinux] [k] perf_event_aux_ctx After: # Baseline Delta Shared Object Symbol # ........ ....... ................... ....................... # 28.48% -28.47% [kernel.vmlinux] [k] intel_idle 11.51% -11.47% libxul.so [.] 0x0000000001a360f7 3.49% -3.49% [kernel.vmlinux] [k] generic_exec_single 2.91% -2.89% libdbus-1.so.3.8.11 [.] 0x000000000000cdc2 2.86% -2.85% libxcb.so.1.1.0 [.] 0x000000000000c890 2.44% -2.39% [kernel.vmlinux] [k] perf_event_aux_ctx Signed-off-by: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo Acked-by: Jiri Olsa Cc: # 4.5+ Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Fixes: b97511c5bc94 ("perf tools: Add overhead/overhead_children keys defaults via string") Link: http://lkml.kernel.org/r/1462890384-12486-2-git-send-email-acme@kernel.org Signed-off-by: Ingo Molnar tools/perf/util/sort.c | 3 +++ 1 file changed, 3 insertions(+) commit aab0a4c83ceb344d2327194bf354820e50607af6 Author: Boris Brezillon Date: Wed May 11 11:00:02 2016 +0200 ARM: dts: at91: sam9x5: Fix the memory range assigned to the PMC The memory range assigned to the PMC (Power Management Controller) was not including the PMC_PCR register which are used to control peripheral clocks. This was working fine thanks to the page granularity of ioremap(), but started to fail when we switched to syscon/regmap, because regmap is making sure that all accesses are falling into the reserved range. Signed-off-by: Boris Brezillon Reported-by: Richard Genoud Tested-by: Richard Genoud Fixes: 863a81c3be1d ("clk: at91: make use of syscon to share PMC registers in several drivers") Cc: Signed-off-by: Nicolas Ferre arch/arm/boot/dts/at91sam9x5.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3966922548f0ea297a219c5a1c548058d2bd59f6 Author: Takashi Iwai Date: Wed May 11 14:56:12 2016 +0200 ALSA: hda - Fix regression on ATI HDMI audio The HDMI/DP audio output on ATI/AMD chips got broken due to the recent restructuring of chmap. Fortunately, Daniel Exner could bisect, and pointed the culprit commit [739ffee97ed5: ALSA: hda - Add hdmi chmap verb programming ops to chmap object]. This commit moved some ops from hdmi_ops to chmap_ops, and reassigned the ops in the embedded chmap object in hdmi_spec instead. Unfortunately, the reassignment of these ops in patch_atihdmi() were moved into an if block that is performed only for old chips. Thus, on newer chips, the generic ops is still used, which doesn't work for such ATI/AMD chips. This patch addresses the regression, simply by moving the assignment of chmap ops to the right place. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=114981 Fixes: 739ffee97ed5 ('ALSA: hda - Add hdmi chmap verb programming ops to chmap object') Reported-and-tested-by: Daniel Exner Signed-off-by: Takashi Iwai sound/pci/hda/patch_hdmi.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit 53d3bc773eaa7ab1cf63585e76af7ee869d5e709 Author: Ingo Molnar Date: Wed May 11 08:25:53 2016 +0200 Revert "sched/fair: Fix fairness issue on migration" Mike reported that this recent commit: 3a47d5124a95 ("sched/fair: Fix fairness issue on migration") ... broke interactivity and the signal starvation test. We have a proper fix series in the works but ran out of time for v4.6, so revert the commit. Reported-by: Mike Galbraith Acked-by: Peter Zijlstra Cc: Thomas Gleixner Cc: Linus Torvalds Cc: Peter Zijlstra Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar kernel/sched/fair.c | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-) commit e4d35be584be88a3db3fa5635a97c62a2ec5aafe Merge: 99d8258 38b78a5 Author: Al Viro Date: Wed May 11 00:00:29 2016 -0400 Merge branch 'ovl-fixes' into for-linus commit 38b78a5f18584db6fa7441e0f4531b283b0e6725 Author: Miklos Szeredi Date: Wed May 11 01:16:37 2016 +0200 ovl: ignore permissions on underlying lookup Generally permission checking is not necessary when overlayfs looks up a dentry on one of the underlying layers, since search permission on base directory was already checked in ovl_permission(). More specifically using lookup_one_len() causes a problem when the lower directory lacks search permission for a specific user while the upper directory does have search permission. Since lookups are cached, this causes inconsistency in behavior: success depends on who did the first lookup. So instead use lookup_hash() which doesn't do the permission check. Reported-by: Ignacy Gawędzki Signed-off-by: Miklos Szeredi fs/overlayfs/super.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 3c9fe8cdff1b889a059a30d22f130372f2b3885f Author: Miklos Szeredi Date: Wed May 11 01:16:37 2016 +0200 vfs: add lookup_hash() helper Overlayfs needs lookup without inode_permission() and already has the name hash (in form of dentry->d_name on overlayfs dentry). It also doesn't support filesystems with d_op->d_hash() so basically it only needs the actual hashed lookup from lookup_one_len_unlocked() So add a new helper that does unlocked lookup of a hashed name. Signed-off-by: Miklos Szeredi fs/namei.c | 33 ++++++++++++++++++++++++++++----- include/linux/namei.h | 2 ++ 2 files changed, 30 insertions(+), 5 deletions(-) commit 9409e22acdfc9153f88d9b1ed2bd2a5b34d2d3ca Author: Miklos Szeredi Date: Wed May 11 01:16:37 2016 +0200 vfs: rename: check backing inode being equal If a file is renamed to a hardlink of itself POSIX specifies that rename(2) should do nothing and return success. This condition is checked in vfs_rename(). However it won't detect hard links on overlayfs where these are given separate inodes on the overlayfs layer. Overlayfs itself detects this condition and returns success without doing anything, but then vfs_rename() will proceed as if this was a successful rename (detach_mounts(), d_move()). The correct thing to do is to detect this condition before even calling into overlayfs. This patch does this by calling vfs_select_inode() to get the underlying inodes. Signed-off-by: Miklos Szeredi Cc: # v4.2+ fs/namei.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 54d5ca871e72f2bb172ec9323497f01cd5091ec7 Author: Miklos Szeredi Date: Wed May 11 01:16:37 2016 +0200 vfs: add vfs_select_inode() helper Signed-off-by: Miklos Szeredi Cc: # v4.2+ fs/open.c | 12 ++++-------- include/linux/dcache.h | 12 ++++++++++++ 2 files changed, 16 insertions(+), 8 deletions(-) commit 6e14313f01f02f324d5dd68a49d34ec1e4bb569e Merge: 84a527a 4e8c861 Author: David S. Miller Date: Tue May 10 23:50:16 2016 -0400 Merge branch 'net-sched-fixes' Jamal Hadi Salim says: ==================== Some actions were broken in allowing for late binding of actions. Late binding workflow is as follows: a) create an action and provide all necessary parameters for it Optionally provide an index or let the kernel give you one. Example: sudo tc actions add action police rate 1kbit burst 90k drop index 1 b) later on bind to the pre-created action from a filter definition by merely specifying the index. Example: sudo tc filter add dev lo parent ffff: protocol ip prio 8 \ u32 match ip src 127.0.0.8/32 flowid 1:8 action police index 1 ==================== Signed-off-by: David S. Miller commit 4e8c861550105f7aaa85a19b2571151cb8eceaa2 Author: Jamal Hadi Salim Date: Tue May 10 16:49:31 2016 -0400 net sched: ife action fix late binding The process below was broken and is fixed with this patch. //add an ife action and give it an instance id of 1 sudo tc actions add action ife encode \ type 0xDEAD allow mark dst 02:15:15:15:15:15 index 1 //create a filter which binds to ife action id 1 sudo tc filter add dev $DEV parent ffff: protocol ip prio 1 u32\ match ip dst 17.0.0.1/32 flowid 1:11 action ife index 1 Message before fix was: RTNETLINK answers: Invalid argument We have an error talking to the kernel Signed-off-by: Jamal Hadi Salim Reviewed-by: Cong Wang Signed-off-by: David S. Miller net/sched/act_ife.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) commit 5e1567aeb7fe0ca478bfad5d17791cce3ddd45c9 Author: Jamal Hadi Salim Date: Tue May 10 16:49:30 2016 -0400 net sched: skbedit action fix late binding The process below was broken and is fixed with this patch. //add a skbedit action and give it an instance id of 1 sudo tc actions add action skbedit mark 10 index 1 //create a filter which binds to skbedit action id 1 sudo tc filter add dev $DEV parent ffff: protocol ip prio 1 u32\ match ip dst 17.0.0.1/32 flowid 1:10 action skbedit index 1 Message before fix was: RTNETLINK answers: Invalid argument We have an error talking to the kernel Signed-off-by: Jamal Hadi Salim Reviewed-by: Cong Wang Signed-off-by: David S. Miller net/sched/act_skbedit.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) commit 0e5538ab2b59ec205411949d839de6dbab663730 Author: Jamal Hadi Salim Date: Tue May 10 16:49:29 2016 -0400 net sched: simple action fix late binding The process below was broken and is fixed with this patch. //add a simple action and give it an instance id of 1 sudo tc actions add action simple sdata "foobar" index 1 //create a filter which binds to simple action id 1 sudo tc filter add dev $DEV parent ffff: protocol ip prio 1 u32\ match ip dst 17.0.0.1/32 flowid 1:10 action simple index 1 Message before fix was: RTNETLINK answers: Invalid argument We have an error talking to the kernel Signed-off-by: Jamal Hadi Salim Reviewed-by: Cong Wang Signed-off-by: David S. Miller net/sched/act_simple.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) commit 87dfbdc6c7478018c5489897d4495a27a626cda1 Author: Jamal Hadi Salim Date: Tue May 10 16:49:28 2016 -0400 net sched: mirred action fix late binding The process below was broken and is fixed with this patch. //add an mirred action and give it an instance id of 1 sudo tc actions add action mirred egress mirror dev $MDEV index 1 //create a filter which binds to mirred action id 1 sudo tc filter add dev $DEV parent ffff: protocol ip prio 1 u32\ match ip dst 17.0.0.1/32 flowid 1:10 action mirred index 1 Message before bug fix was: RTNETLINK answers: Invalid argument We have an error talking to the kernel Signed-off-by: Jamal Hadi Salim Reviewed-by: Cong Wang Signed-off-by: David S. Miller net/sched/act_mirred.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) commit a57f19d30b2d5fb632b73729b39d05bae188eaed Author: Jamal Hadi Salim Date: Tue May 10 16:49:27 2016 -0400 net sched: ipt action fix late binding This was broken and is fixed with this patch. //add an ipt action and give it an instance id of 1 sudo tc actions add action ipt -j mark --set-mark 2 index 1 //create a filter which binds to ipt action id 1 sudo tc filter add dev $DEV parent ffff: protocol ip prio 1 u32\ match ip dst 17.0.0.1/32 flowid 1:10 action ipt index 1 Message before bug fix was: RTNETLINK answers: Invalid argument We have an error talking to the kernel Signed-off-by: Jamal Hadi Salim Reviewed-by: Cong Wang Signed-off-by: David S. Miller net/sched/act_ipt.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) commit 5026c9b1bafcb309bf467b60494b3bcd6364b99c Author: Jamal Hadi Salim Date: Tue May 10 16:49:26 2016 -0400 net sched: vlan action fix late binding Late vlan action binding was broken and is fixed with this patch. //add a vlan action to pop and give it an instance id of 1 sudo tc actions add action vlan pop index 1 //create filter which binds to vlan action id 1 sudo tc filter add dev $DEV parent ffff: protocol ip prio 1 u32 \ match ip dst 17.0.0.1/32 flowid 1:1 action vlan index 1 current message(before bug fix) was: RTNETLINK answers: Invalid argument We have an error talking to the kernel Signed-off-by: Jamal Hadi Salim Reviewed-by: Cong Wang Signed-off-by: David S. Miller net/sched/act_vlan.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) commit 84a527a41f38a80353f185d05e41b021e1ff672b Author: Shaohui Xie Date: Tue May 10 17:42:26 2016 +0800 net: phylib: fix interrupts re-enablement in phy_start If phy was suspended and is starting, current driver always enable phy's interrupts, if phy works in polling, phy can raise unexpected interrupt which will not be handled, the interrupt will block system enter suspend again. So interrupts should only be re-enabled if phy works in interrupt. Signed-off-by: Shaohui Xie Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/phy/phy.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit 10a81980fc47e64ffac26a073139813d3f697b64 Author: Eric Dumazet Date: Mon May 9 20:55:16 2016 -0700 tcp: refresh skb timestamp at retransmit time In the very unlikely case __tcp_retransmit_skb() can not use the cloning done in tcp_transmit_skb(), we need to refresh skb_mstamp before doing the copy and transmit, otherwise TCP TS val will be an exact copy of original transmit. Fixes: 7faee5c0d514 ("tcp: remove TCP_SKB_CB(skb)->when") Signed-off-by: Eric Dumazet Cc: Yuchung Cheng Acked-by: Yuchung Cheng Signed-off-by: David S. Miller net/ipv4/tcp_output.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 2348548282d9a2450cc667c2f75ec1d2f0778a40 Author: Suzuki K Poulose Date: Mon May 9 23:37:35 2016 +0100 arm64/sunxi: 4.6-rc1: Add dependency on generic irq chip Commit ce3dd55b99b1 ("arm64: Introduce Allwinner SoC config option"), added support for ARCH_SUNXI on arm64, but failed to select GENERIC_IRQ_CHIP, which is required for drivers/irqchip/irq-sunxi-nmi.c and causes build failures like : UPD include/generated/compile.h CC init/version.o LD init/built-in.o drivers/built-in.o: In function `sunxi_sc_nmi_set_type': drivers/irqchip/irq-sunxi-nmi.c:114: undefined reference to `irq_setup_alt_chip' drivers/built-in.o: In function `irq_domain_add_linear': include/linux/irqdomain.h:253: undefined reference to `irq_generic_chip_ops' include/linux/irqdomain.h:253: undefined reference to `irq_generic_chip_ops' drivers/built-in.o: In function `sunxi_sc_nmi_irq_init': drivers/irqchip/irq-sunxi-nmi.c:146: undefined reference to `irq_alloc_domain_generic_chips' drivers/irqchip/irq-sunxi-nmi.c:161: undefined reference to `irq_get_domain_generic_chip' drivers/irqchip/irq-sunxi-nmi.c:170: undefined reference to `irq_gc_mask_clr_bit' drivers/irqchip/irq-sunxi-nmi.c:171: undefined reference to `irq_gc_mask_set_bit' drivers/irqchip/irq-sunxi-nmi.c:172: undefined reference to `irq_gc_ack_set_bit' drivers/irqchip/irq-sunxi-nmi.c:170: undefined reference to `irq_gc_mask_clr_bit' Fixes: commit ce3dd55b99b1 ("arm64: Introduce Allwinner SoC config option") Signed-off-by: Suzuki K Poulose Signed-off-by: Andre Przywara Acked-by: Maxime Ripard Signed-off-by: Arnd Bergmann arch/arm64/Kconfig.platforms | 1 + 1 file changed, 1 insertion(+) commit 3b0d190aeb21cf5aabf7157161468970296bb88c Merge: d99079e 05c00d8 Author: David S. Miller Date: Tue May 10 15:04:57 2016 -0400 Merge branch 'nps_enet-fixes' Elad Kanfi says: ==================== nps_enet: Net driver bugs fix v3: tx_packet_sent flag is not necessary, use socket buffer pointer instead. Use wmb() instead of smp_wmb(). v2: Remove code style commit for now. Code style commit will be added after the bugs fix will be approved. Summary: 1. Bug description: TX done interrupts that arrives while interrupts are masked, during NAPI poll, will not trigger an interrupt handling. Since TX interrupt is of level edge we will lose the TX done interrupt. As a result all pending tx frames will get no service. Solution: Check if there is a pending tx request after unmasking the interrupt and if answer is yes then re-add ourselves to the NAPI poll list. 2. Bug description: CPU-A before sending a frame will set a variable to true. CPU-B that executes the tx done interrupt service routine might read a non valid value of that variable. Solution: Use the socket buffer pointer instead of the variable, and add a write memory barrier at the tx sending function after the pointer is set. ==================== Signed-off-by: David S. Miller commit 05c00d82f4d170987ac29607e7f3c27223b52d1e Author: Elad Kanfi Date: Mon May 9 20:13:20 2016 +0300 net: nps_enet: bug fix - handle lost tx interrupts The tx interrupt is of edge type, and in case such interrupt is triggered while it is masked it will not be handled even after tx interrupts are re-enabled in the end of NAPI poll. This will cause tx network to stop in the following scenario: * Rx is being handled, hence interrupts are masked. * Tx interrupt is triggered after checking if there is some tx to handle and before re-enabling the interrupts. In this situation only rx transaction will release tx requests. In order to handle the tx that was missed( if there was one ), a NAPI reschdule was added after enabling the interrupts. Signed-off-by: Elad Kanfi Acked-by: Noam Camus Acked-by: Gilad Ben-Yossef Signed-off-by: David S. Miller drivers/net/ethernet/ezchip/nps_enet.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) commit e5df49d564fe993c68f5cff6d96972a6358b4958 Author: Elad Kanfi Date: Mon May 9 20:13:19 2016 +0300 net: nps_enet: Tx handler synchronization Below is a description of a possible problematic sequence. CPU-A is sending a frame and CPU-B handles the interrupt that indicates the frame was sent. CPU-B reads an invalid value of tx_packet_sent. CPU-A CPU-B ----- ----- nps_enet_send_frame . . tx_skb = skb tx_packet_sent = true order HW to start tx . . HW complete tx ------> get tx complete interrupt . . if(tx_packet_sent == true) handle tx_skb end memory transaction (tx_packet_sent actually written) Furthermore there is a dependency between tx_skb and tx_packet_sent. There is no assurance that tx_skb contains a valid pointer at CPU B when it sees tx_packet_sent == true. Solution: Initialize tx_skb to NULL and use it to indicate that packet was sent, in this way tx_packet_sent can be removed. Add a write memory barrier after setting tx_skb in order to make sure that it is valid before HW is informed and IRQ is fired. Fixed sequence will be: CPU-A CPU-B ----- ----- tx_skb = skb wmb() . . order HW to start tx . . HW complete tx ------> get tx complete interrupt . . if(tx_skb != NULL) handle tx_skb tx_skb = NULL Signed-off-by: Elad Kanfi Acked-by: Noam Camus Acked-by: Gilad Ben-Yossef Signed-off-by: David S. Miller drivers/net/ethernet/ezchip/nps_enet.c | 15 +++++++++------ drivers/net/ethernet/ezchip/nps_enet.h | 2 -- 2 files changed, 9 insertions(+), 8 deletions(-) commit c5114626f33b62fa7595e57d87f33d9d1f8298a2 Merge: 7ec02e3 9a2a5a6 Author: Linus Torvalds Date: Tue May 10 12:04:40 2016 -0700 Merge tag 'pci-v4.6-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fixes from Bjorn Helgaas: "Since v4.5, we've WARNed during resume if a PCI device, including a Thunderbolt device, was added while we were suspended. A change we merged for v4.6-rc1 turned that warning into a system hang. These enumeration patches from Lukas Wunner fix this issue: - Fix BUG on device attach failure - Do not treat EPROBE_DEFER as device attach failure" * tag 'pci-v4.6-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: PCI: Do not treat EPROBE_DEFER as device attach failure PCI: Fix BUG on device attach failure commit ac40b441742b7af76fc04ecfd77c9e86c27d9e36 Author: Geert Uytterhoeven Date: Tue May 10 20:57:57 2016 +0200 regulator: da9063: Correct module alias prefix to fix module autoloading s/paltform/platform/ Signed-off-by: Geert Uytterhoeven Signed-off-by: Mark Brown drivers/regulator/da9063-regulator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7ec02e3bf45e0e7502db7f8d50c19abc1ebbab00 Merge: ac24406 8d415ee Author: Linus Torvalds Date: Tue May 10 11:41:05 2016 -0700 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "Two topology corner case fixes, and a MAINTAINERS file update for mmiotrace maintenance" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/topology: Set x86_max_cores to 1 for CONFIG_SMP=n MAINTAINERS: Add mmiotrace entry x86/topology: Handle CPUID bogosity gracefully commit ac2440654df6ac7314e2f8819fe05e7c863a2392 Merge: 2d0bd95 13b5ab0 Author: Linus Torvalds Date: Tue May 10 11:32:01 2016 -0700 Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Ingo Molnar: "A UP kernel cpufreq fix and a rt/dl scheduler corner case fix" * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/rt, sched/dl: Don't push if task's scheduling class was changed sched/fair: Fix !CONFIG_SMP kernel cpufreq governor breakage commit 44ca941a677323b28366835428ec289a55f764d8 Author: Andrey Utkin Date: Mon May 9 18:04:19 2016 +0300 kvmconfig: add more virtio drivers "make defconfig kvmconfig" is supposed to end up with usable kernel for KVM guest. In practice, it won't work for e.g. Hetzner VPS (KVM-based) unless you add these options. Signed-off-by: Andrey Utkin Signed-off-by: Paolo Bonzini arch/x86/configs/kvm_guest.config | 3 +++ 1 file changed, 3 insertions(+) commit 4548f63e65116458da5245d89aa213b4f8b2ab16 Author: Josh Poimboeuf Date: Wed Mar 9 12:59:50 2016 -0600 x86/kvm: Add stack frame dependency to fastop() inline asm The kbuild test robot reported this objtool warning [1]: arch/x86/kvm/emulate.o: warning: objtool: fastop()+0x69: call without frame pointer save/setup The issue seems to be caused by CONFIG_PROFILE_ALL_BRANCHES. With that option, for some reason gcc decides not to create a stack frame in fastop() before doing the inline asm call, which can result in a bad stack trace. Force a stack frame to be created if CONFIG_FRAME_POINTER is enabled by listing the stack pointer as an output operand for the inline asm statement. This change has no effect for !CONFIG_PROFILE_ALL_BRANCHES. [1] https://lists.01.org/pipermail/kbuild-all/2016-March/018249.html Reported-by: kbuild test robot Signed-off-by: Josh Poimboeuf Acked-by: Ingo Molnar Signed-off-by: Paolo Bonzini arch/x86/kvm/emulate.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 3231e2053eaeee70bdfb216a78a30f11e88e2243 Author: Yura Pakhuchiy Date: Sat May 7 23:53:36 2016 +0700 ALSA: hda - Fix subwoofer pin on ASUS N751 and N551 Subwoofer does not work out of the box on ASUS N751/N551 laptops. This patch fixes it. Patch tested on N751 laptop. N551 part is not tested, but according to [1] and [2] this laptop requires similar changes, so I included them in the patch. 1. https://github.com/honsiorovskyi/asus-n551-hda-fix 2. https://bugs.launchpad.net/ubuntu/+source/alsa-tools/+bug/1405691 Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=117781 Signed-off-by: Yura Pakhuchiy Cc: Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit e061b5695ad52c987d4ee9033a6d09163da6607a Merge: 44549e8 b8453d4 Author: Arnd Bergmann Date: Tue May 10 11:27:45 2016 +0200 Merge tag 'at91-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nferre/linux-at91 into fixes Merge "at91: fixes for 4.6 #1" from Nicolas Ferre: Here is a late fix for AT91. Sorry to have figure it out so late in the development cycle but we had to confirm it was an error with the documentation of two products. So, as the compatibility string is in since 4.6-rc1 and that the previous one works okay, it's a good opportunity to switch back to the one that works without introducing a intermediary bug. The revert on driver code and the removal of the useless additional compatibility string will be queued for 4.7 through NAND/MTD. * tag 'at91-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nferre/linux-at91: ARM: dts: at91: sama5d2: use "atmel,sama5d3-nfc" compatible for nfc commit addacd801e1638f41d659cb53b9b73fc14322cb1 Author: Takashi Iwai Date: Tue May 10 10:24:02 2016 +0200 ALSA: hda - Fix broken reconfig The HD-audio reconfig function got broken in the recent kernels, typically resulting in a failure like: snd_hda_intel 0000:00:1b.0: control 3:0:0:Playback Channel Map:0 is already present This is because of the code restructuring to move the PCM and control instantiation into the codec drive probe, by the commit [bcd96557bd0a: ALSA: hda - Build PCMs and controls at codec driver probe]. Although the commit above removed the calls of snd_hda_codec_build_pcms() and *_build_controls() at the controller driver probe, the similar calls in the reconfig were still left forgotten. This caused the conflicting and duplicated PCMs and controls. The fix is trivial: just remove these superfluous calls from reconfig_codec(). Fixes: bcd96557bd0a ('ALSA: hda - Build PCMs and controls at codec driver probe') Reported-by: Jochen Henneberg Cc: # v4.1+ Signed-off-by: Takashi Iwai sound/pci/hda/hda_sysfs.c | 8 -------- 1 file changed, 8 deletions(-) commit 13b5ab02ae118fc8dfdc2b8597688ec4a11d5b53 Author: Xunlei Pang Date: Mon May 9 12:11:31 2016 +0800 sched/rt, sched/dl: Don't push if task's scheduling class was changed We got this warning: WARNING: CPU: 1 PID: 2468 at kernel/sched/core.c:1161 set_task_cpu+0x1af/0x1c0 [...] Call Trace: dump_stack+0x63/0x87 __warn+0xd1/0xf0 warn_slowpath_null+0x1d/0x20 set_task_cpu+0x1af/0x1c0 push_dl_task.part.34+0xea/0x180 push_dl_tasks+0x17/0x30 __balance_callback+0x45/0x5c __sched_setscheduler+0x906/0xb90 SyS_sched_setattr+0x150/0x190 do_syscall_64+0x62/0x110 entry_SYSCALL64_slow_path+0x25/0x25 This corresponds to: WARN_ON_ONCE(p->state == TASK_RUNNING && p->sched_class == &fair_sched_class && (p->on_rq && !task_on_rq_migrating(p))) It happens because in find_lock_later_rq(), the task whose scheduling class was changed to fair class is still pushed away as if it were a deadline task ... So, check in find_lock_later_rq() after double_lock_balance(), if the scheduling class of the deadline task was changed, break and retry. Apply the same logic to RT tasks. Signed-off-by: Xunlei Pang Reviewed-by: Steven Rostedt Acked-by: Peter Zijlstra Cc: Peter Zijlstra Cc: Steven Rostedt Cc: Juri Lelli Link: http://lkml.kernel.org/r/1462767091-1215-1-git-send-email-xlpang@redhat.com Signed-off-by: Ingo Molnar kernel/sched/deadline.c | 1 + kernel/sched/rt.c | 1 + 2 files changed, 2 insertions(+) commit 2700818ac9f935d8590715eecd7e8cadbca552b6 Author: Daniel Vetter Date: Tue May 3 10:33:01 2016 +0200 drm/i915: Bail out of pipe config compute loop on LPT LPT is pch, so might run into the fdi bandwidth constraint (especially since it has only 2 lanes). But right now we just force pipe_bpp back to 24, resulting in a nice loop (which we bail out with a loud WARN_ON). Fix this. Cc: Chris Wilson Cc: Maarten Lankhorst References: https://bugs.freedesktop.org/show_bug.cgi?id=93477 Signed-off-by: Daniel Vetter Tested-by: Chris Wilson Signed-off-by: Maarten Lankhorst Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/1462264381-7573-1-git-send-email-daniel.vetter@ffwll.ch (cherry picked from commit f58a1acc7e4a1f37d26124ce4c875c647fbcc61f) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_crt.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 8d415ee225a3d15d3e3029524350e8237a4de7b8 Author: Thomas Gleixner Date: Tue May 10 09:20:33 2016 +0200 x86/topology: Set x86_max_cores to 1 for CONFIG_SMP=n Josef reported that the uncore driver trips over with CONFIG_SMP=n because x86_max_cores is 16 instead of 12. The reason is, that for SMP=n the extended topology detection is a NOOP and the cache leaf is used to determine the number of cores. That's wrong in two aspects: 1) The cache leaf enumerates the maximum addressable number of cores in the package, which is obviously not correct 2) UP has no business with topology bits at all. Make intel_num_cpu_cores() return 1 for CONFIG_SMP=n Reported-by: Josef Bacik Signed-off-by: Thomas Gleixner Cc: Peter Zijlstra Cc: kernel-team Cc: Kan Liang Link: http://lkml.kernel.org/r/761b4a2a-0332-7954-f030-c6639f949612@fb.com arch/x86/kernel/cpu/intel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b8453d4ee9e24c6590dd0eecbab1c3cc2028317f Author: Wenyou Yang Date: Mon May 9 14:51:19 2016 +0800 ARM: dts: at91: sama5d2: use "atmel,sama5d3-nfc" compatible for nfc An error in documentation of the NAND Flash Controller (NFC) led to choose another compatibility string for sama5d2 with an impact on the NAND flash ready/busy information. It was producing the error message: atmel_nand 80000000.nand: Time out to wait for interrupt: 0x08000000 and had an impact on performance. So, switch back to the classical "atmel,sama5d3-nfc" compatibility string for this SoC which gives the proper ready/busy bit information. The NAND flash driver will be updated to remove the support for this different implementation. Signed-off-by: Wenyou Yang Acked-by: Romain Izard [nicolas.ferre@atmel.com: change commit message] Signed-off-by: Nicolas Ferre arch/arm/boot/dts/sama5d2.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d99079e2fbd5ac38884f498ca99435d525152a88 Author: Jamal Hadi Salim Date: Mon May 9 08:05:06 2016 -0400 export tc ife uapi header Signed-off-by: Jamal Hadi Salim Signed-off-by: David S. Miller include/uapi/linux/tc_act/Kbuild | 1 + 1 file changed, 1 insertion(+) commit 5e769ada93b2111010d3ca96213fc0b37c95afc8 Merge: adc0a8b cbbba30 Author: David S. Miller Date: Tue May 10 01:02:51 2016 -0400 Merge tag 'wireless-drivers-for-davem-2016-05-09' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for 4.6 iwlwifi * fix P2P rates (and possibly other issues) ==================== Signed-off-by: David S. Miller commit adc0a8bfdc52cbbfe76730b166a17cb0d5cbc0f4 Merge: 161de2c eda3fc5 Author: David S. Miller Date: Tue May 10 00:50:20 2016 -0400 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contain Netfilter simple fixes for your net tree, two one-liner and one two-liner: 1) Oneliner to fix missing spinlock definition that triggers 'BUG: spinlock bad magic on CPU#' when spinlock debugging is enabled, from Florian Westphal. 2) Fix missing workqueue cancelation on IDLETIMER removal, from Liping Zhang. 3) Fix insufficient validation of netlink of NFACCT_QUOTA in nfnetlink_acct, from Phil Turnbull. ==================== Signed-off-by: David S. Miller commit 161de2caf68c549c266e571ffba8e2163886fb10 Author: xypron.glpk@gmx.de Date: Mon May 9 00:46:18 2016 +0200 net: thunderx: avoid exposing kernel stack Reserved fields should be set to zero to avoid exposing bits from the kernel stack. Signed-off-by: Heinrich Schuchardt Signed-off-by: David S. Miller drivers/net/ethernet/cavium/thunder/nicvf_queues.c | 4 ++++ 1 file changed, 4 insertions(+) commit 79e48650320e6fba48369fccf13fd045315b19b8 Author: Kangjie Lu Date: Sun May 8 12:10:14 2016 -0400 net: fix a kernel infoleak in x25 module Stack object "dte_facilities" is allocated in x25_rx_call_request(), which is supposed to be initialized in x25_negotiate_facilities. However, 5 fields (8 bytes in total) are not initialized. This object is then copied to userland via copy_to_user, thus infoleak occurs. Signed-off-by: Kangjie Lu Signed-off-by: David S. Miller net/x25/x25_facilities.c | 1 + 1 file changed, 1 insertion(+) commit 7fa816b92c52e2c304f2ff6401e0d51e1d229ca5 Author: Geert Uytterhoeven Date: Sat May 7 13:17:11 2016 +0200 ravb: Add missing free_irq() call to ravb_close() When reopening the network device on ra7795/salvator-x, e.g. after a DHCP timeout: IP-Config: Reopening network devices... genirq: Flags mismatch irq 139. 00000000 (eth0:ch24:emac) vs. 00000000 (eth0:ch24:emac) ravb e6800000.ethernet eth0: cannot request IRQ eth0:ch24:emac IP-Config: Failed to open eth0 IP-Config: No network devices available The "mismatch" is due to requesting an IRQ that is already in use, while IRQF_PROBE_SHARED wasn't set. However, the real cause is that ravb_close() doesn't release the R-Car Gen3-specific secondary IRQ. Add the missing free_irq() call to fix this. Fixes: 22d4df8ff3a3cc72 ("ravb: Add support for r8a7795 SoC") Signed-off-by: Geert Uytterhoeven Acked-by: Sergei Shtylyov Signed-off-by: David S. Miller drivers/net/ethernet/renesas/ravb_main.c | 2 ++ 1 file changed, 2 insertions(+) commit 4a91cb61bb995e5571098188092e296192309c77 Author: Mikko Rapeli Date: Sun Apr 24 17:45:00 2016 +0200 uapi glibc compat: fix compile errors when glibc net/if.h included before linux/if.h glibc's net/if.h contains copies of definitions from linux/if.h and these conflict and cause build failures if both files are included by application source code. Changes in uapi headers, which fixed header file dependencies to include linux/if.h when it was needed, e.g. commit 1ffad83d, made the net/if.h and linux/if.h incompatibilities visible as build failures for userspace applications like iproute2 and xtables-addons. This patch fixes compile errors when glibc net/if.h is included before linux/if.h: ./linux/if.h:99:21: error: redeclaration of enumerator ‘IFF_NOARP’ ./linux/if.h:98:23: error: redeclaration of enumerator ‘IFF_RUNNING’ ./linux/if.h:97:26: error: redeclaration of enumerator ‘IFF_NOTRAILERS’ ./linux/if.h:96:27: error: redeclaration of enumerator ‘IFF_POINTOPOINT’ ./linux/if.h:95:24: error: redeclaration of enumerator ‘IFF_LOOPBACK’ ./linux/if.h:94:21: error: redeclaration of enumerator ‘IFF_DEBUG’ ./linux/if.h:93:25: error: redeclaration of enumerator ‘IFF_BROADCAST’ ./linux/if.h:92:19: error: redeclaration of enumerator ‘IFF_UP’ ./linux/if.h:252:8: error: redefinition of ‘struct ifconf’ ./linux/if.h:203:8: error: redefinition of ‘struct ifreq’ ./linux/if.h:169:8: error: redefinition of ‘struct ifmap’ ./linux/if.h:107:23: error: redeclaration of enumerator ‘IFF_DYNAMIC’ ./linux/if.h:106:25: error: redeclaration of enumerator ‘IFF_AUTOMEDIA’ ./linux/if.h:105:23: error: redeclaration of enumerator ‘IFF_PORTSEL’ ./linux/if.h:104:25: error: redeclaration of enumerator ‘IFF_MULTICAST’ ./linux/if.h:103:21: error: redeclaration of enumerator ‘IFF_SLAVE’ ./linux/if.h:102:22: error: redeclaration of enumerator ‘IFF_MASTER’ ./linux/if.h:101:24: error: redeclaration of enumerator ‘IFF_ALLMULTI’ ./linux/if.h:100:23: error: redeclaration of enumerator ‘IFF_PROMISC’ The cases where linux/if.h is included before net/if.h need a similar fix in the glibc side, or the order of include files can be changed userspace code as a workaround. This change was tested in x86 userspace on Debian unstable with scripts/headers_compile_test.sh: $ make headers_install && \ cd usr/include && ../../scripts/headers_compile_test.sh -l -k ... cc -Wall -c -nostdinc -I /usr/lib/gcc/i586-linux-gnu/5/include -I /usr/lib/gcc/i586-linux-gnu/5/include-fixed -I . -I /home/mcfrisk/src/linux-2.6/usr/headers_compile_test_include.2uX2zH -I /home/mcfrisk/src/linux-2.6/usr/headers_compile_test_include.2uX2zH/i586-linux-gnu -o /dev/null ./linux/if.h_libc_before_kernel.h PASSED libc before kernel test: ./linux/if.h Reported-by: Jan Engelhardt Reported-by: Josh Boyer Reported-by: Stephen Hemminger Reported-by: Waldemar Brodkorb Cc: Gabriel Laskar Signed-off-by: Mikko Rapeli Signed-off-by: David S. Miller include/uapi/linux/if.h | 28 +++++++++++++++++++++++++ include/uapi/linux/libc-compat.h | 44 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 72 insertions(+) commit 2d0bd9534c8ddaebee64e1b4b7d621915f65e994 Merge: 0161028 1b8d2af Author: Linus Torvalds Date: Mon May 9 18:24:04 2016 -0700 Merge branch 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm build fix from Dan Williams: "A build fix for the usage of HPAGE_SIZE in the last libnvdimm pull request. I have taken note that the kbuild robot build success test does not include results for alpha_allmodconfig. Thanks to Guenter for the report. It's tagged for -stable since the original fix will land there and cause build problems" * 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: libnvdimm, pfn: fix ARCH=alpha allmodconfig build failure commit 0161028b7c8aebef64194d3d73e43bc3b53b5c66 Author: Andy Lutomirski Date: Mon May 9 15:48:51 2016 -0700 perf/core: Change the default paranoia level to 2 Allowing unprivileged kernel profiling lets any user dump follow kernel control flow and dump kernel registers. This most likely allows trivial kASLR bypassing, and it may allow other mischief as well. (Off the top of my head, the PERF_SAMPLE_REGS_INTR output during /dev/urandom reads could be quite interesting.) Signed-off-by: Andy Lutomirski Acked-by: Kees Cook Signed-off-by: Linus Torvalds Documentation/sysctl/kernel.txt | 2 +- kernel/events/core.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 5c56b563b4486281bff80658194f0d1da6feba67 Merge: b507146 44f43e9 Author: Linus Torvalds Date: Mon May 9 17:54:59 2016 -0700 Merge branch 'akpm' (patches from Andrew) Merge fixes from Andrew Morton: "2 fixes" * emailed patches from Andrew Morton : zsmalloc: fix zs_can_compact() integer overflow Revert "proc/base: make prompt shell start from new line after executing "cat /proc/$pid/wchan"" commit 44f43e99fe70833058482d183e99fdfd11220996 Author: Sergey Senozhatsky Date: Mon May 9 16:28:49 2016 -0700 zsmalloc: fix zs_can_compact() integer overflow zs_can_compact() has two race conditions in its core calculation: unsigned long obj_wasted = zs_stat_get(class, OBJ_ALLOCATED) - zs_stat_get(class, OBJ_USED); 1) classes are not locked, so the numbers of allocated and used objects can change by the concurrent ops happening on other CPUs 2) shrinker invokes it from preemptible context Depending on the circumstances, thus, OBJ_ALLOCATED can become less than OBJ_USED, which can result in either very high or negative `total_scan' value calculated later in do_shrink_slab(). do_shrink_slab() has some logic to prevent those cases: vmscan: shrink_slab: zs_shrinker_scan+0x0/0x28 [zsmalloc] negative objects to delete nr=-62 vmscan: shrink_slab: zs_shrinker_scan+0x0/0x28 [zsmalloc] negative objects to delete nr=-62 vmscan: shrink_slab: zs_shrinker_scan+0x0/0x28 [zsmalloc] negative objects to delete nr=-64 vmscan: shrink_slab: zs_shrinker_scan+0x0/0x28 [zsmalloc] negative objects to delete nr=-62 vmscan: shrink_slab: zs_shrinker_scan+0x0/0x28 [zsmalloc] negative objects to delete nr=-62 vmscan: shrink_slab: zs_shrinker_scan+0x0/0x28 [zsmalloc] negative objects to delete nr=-62 However, due to the way `total_scan' is calculated, not every shrinker->count_objects() overflow can be spotted and handled. To demonstrate the latter, I added some debugging code to do_shrink_slab() (x86_64) and the results were: vmscan: OVERFLOW: shrinker->count_objects() == -1 [18446744073709551615] vmscan: but total_scan > 0: 92679974445502 vmscan: resulting total_scan: 92679974445502 [..] vmscan: OVERFLOW: shrinker->count_objects() == -1 [18446744073709551615] vmscan: but total_scan > 0: 22634041808232578 vmscan: resulting total_scan: 22634041808232578 Even though shrinker->count_objects() has returned an overflowed value, the resulting `total_scan' is positive, and, what is more worrisome, it is insanely huge. This value is getting used later on in shrinker->scan_objects() loop: while (total_scan >= batch_size || total_scan >= freeable) { unsigned long ret; unsigned long nr_to_scan = min(batch_size, total_scan); shrinkctl->nr_to_scan = nr_to_scan; ret = shrinker->scan_objects(shrinker, shrinkctl); if (ret == SHRINK_STOP) break; freed += ret; count_vm_events(SLABS_SCANNED, nr_to_scan); total_scan -= nr_to_scan; cond_resched(); } `total_scan >= batch_size' is true for a very-very long time and 'total_scan >= freeable' is also true for quite some time, because `freeable < 0' and `total_scan' is large enough, for example, 22634041808232578. The only break condition, in the given scheme of things, is shrinker->scan_objects() == SHRINK_STOP test, which is a bit too weak to rely on, especially in heavy zsmalloc-usage scenarios. To fix the issue, take a pool stat snapshot and use it instead of racy zs_stat_get() calls. Link: http://lkml.kernel.org/r/20160509140052.3389-1-sergey.senozhatsky@gmail.com Signed-off-by: Sergey Senozhatsky Cc: Minchan Kim Cc: [4.3+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/zsmalloc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 1e92a61c4c7ed85c1bec037c046e92d6dc762f32 Author: Robin Humble Date: Mon May 9 16:28:46 2016 -0700 Revert "proc/base: make prompt shell start from new line after executing "cat /proc/$pid/wchan"" This reverts the 4.6-rc1 commit 7e2bc81da333 ("proc/base: make prompt shell start from new line after executing "cat /proc/$pid/wchan") because it breaks /proc/$PID/whcan formatting in ps and top. Revert also because the patch is inconsistent - it adds a newline at the end of only the '0' wchan, and does not add a newline when /proc/$PID/wchan contains a symbol name. eg. $ ps -eo pid,stat,wchan,comm PID STAT WCHAN COMMAND ... 1189 S - dbus-launch 1190 Ssl 0 dbus-daemon 1198 Sl 0 lightdm 1299 Ss ep_pol systemd 1301 S - (sd-pam) 1304 Ss wait sh Signed-off-by: Robin Humble Cc: Minfei Huang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/proc/base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c52c545ead97fcc2f4f8ea38f1ae3c23211e09a8 Author: H. Nikolaus Schaller Date: Mon May 9 17:01:01 2016 -0700 Input: twl6040-vibra - fix DT node memory management commit e7ec014a47e4 ("Input: twl6040-vibra - update for device tree support") made the separate vibra DT node to a subnode of the twl6040. It now calls of_find_node_by_name() to locate the "vibra" subnode. This function has a side effect to call of_node_put on() for the twl6040 parent node passed in as a parameter. This causes trouble later on. Solution: we must call of_node_get() before of_find_node_by_name() Signed-off-by: H. Nikolaus Schaller Signed-off-by: Dmitry Torokhov drivers/input/misc/twl6040-vibra.c | 1 + 1 file changed, 1 insertion(+) commit b507146bb6b9ac0c0197100ba3e299825a21fed3 Merge: 26acc79 58446fe Author: Linus Torvalds Date: Mon May 9 12:24:19 2016 -0700 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: "This fixes the following issues: - bug in ahash SG list walking that may lead to crashes - resource leak in qat - missing RSA dependency that causes it to fail" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: rsa - select crypto mgr dependency crypto: hash - Fix page length clamping in hash walk crypto: qat - fix adf_ctl_drv.c:undefined reference to adf_init_pf_wq crypto: qat - fix invalid pf2vf_resp_wq logic commit 26acc792c90c6fa1066ba128074b20d2e21790ef Merge: 8634de6 8846a12 Author: Linus Torvalds Date: Mon May 9 12:11:37 2016 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Check klogctl failure correctly, from Colin Ian King. 2) Prevent OOM when under memory pressure in flowcache, from Steffen Klassert. 3) Fix info leak in llc and rtnetlink ifmap code, from Kangjie Lu. 4) Memory barrier and multicast handling fixes in bnxt_en, from Michael Chan. 5) Endianness bug in mlx5, from Daniel Jurgens. 6) Fix disconnect handling in VSOCK, from Ian Campbell. 7) Fix locking of netdev list walking in get_bridge_ifindices(), from Nikolay Aleksandrov. 8) Bridge multicast MLD parser can look at wrong packet offsets, fix from Linus Lüssing. 9) Fix chip hang in qede driver, from Sudarsana Reddy Kalluru. 10) Fix missing setting of encapsulation before inner handling completes in udp_offload code, from Jarno Rajahalme. 11) Missing rollbacks during LAG join and flood configuration failures in mlxsw driver, from Ido Schimmel. 12) Fix error code checks in netxen driver, from Dan Carpenter. 13) Fix key size in new macsec driver, from Sabrina Dubroca. 14) Fix mlx5/VXLAN dependencies, from Arnd Bergmann. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (29 commits) net/mlx5e: make VXLAN support conditional Revert "net/mlx5: Kconfig: Fix MLX5_EN/VXLAN build issue" macsec: key identifier is 128 bits, not 64 Documentation/networking: more accurate LCO explanation macvtap: segmented packet is consumed tools: bpf_jit_disasm: check for klogctl failure qede: uninitialized variable in qede_start_xmit() netxen: netxen_rom_fast_read() doesn't return -1 netxen: reversed condition in netxen_nic_set_link_parameters() netxen: fix error handling in netxen_get_flash_block() mlxsw: spectrum: Add missing rollback in flood configuration mlxsw: spectrum: Fix rollback order in LAG join failure udp_offload: Set encapsulation before inner completes. udp_tunnel: Remove redundant udp_tunnel_gro_complete(). qede: prevent chip hang when increasing channels net: ipv6: tcp reset, icmp need to consider L3 domain bridge: fix igmp / mld query parsing net: bridge: fix old ioctl unlocked net device walk VSOCK: do not disconnect socket when peer has shutdown SEND only net/mlx4_en: Fix endianness bug in IPV6 csum calculation ... commit 8634de6d254462e6953b7dac772a1df4f44c8030 Author: Josh Poimboeuf Date: Fri May 6 09:22:25 2016 -0500 compiler-gcc: require gcc 4.8 for powerpc __builtin_bswap16() gcc support for __builtin_bswap16() was supposedly added for powerpc in gcc 4.6, and was then later added for other architectures in gcc 4.8. However, Stephen Rothwell reported that attempting to use it on powerpc in gcc 4.6 fails with: lib/vsprintf.c:160:2: error: initializer element is not constant lib/vsprintf.c:160:2: error: (near initialization for 'decpair[0]') lib/vsprintf.c:160:2: error: initializer element is not constant lib/vsprintf.c:160:2: error: (near initialization for 'decpair[1]') ... I'm not entirely sure what those errors mean, but I don't see them on gcc 4.8. So let's consider gcc 4.8 to be the official starting point for __builtin_bswap16(). Arnd Bergmann adds: "I found the commit in gcc-4.8 that replaced the powerpc-specific implementation of __builtin_bswap16 with an architecture-independent one. Apparently the powerpc version (gcc-4.6 and 4.7) just mapped to the lhbrx/sthbrx instructions, so it ended up not being a constant, though the intent of the patch was mainly to add support for the builtin to x86: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=52624 has the patch that went into gcc-4.8 and more information." Fixes: 7322dd755e7d ("byteswap: try to avoid __builtin_constant_p gcc bug") Reported-by: Stephen Rothwell Tested-by: Stephen Rothwell Acked-by: Arnd Bergmann Signed-off-by: Josh Poimboeuf Signed-off-by: Stephen Rothwell Signed-off-by: Linus Torvalds include/linux/compiler-gcc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6ae645d5fa385f3787bf1723639cd907fe5865e7 Author: Marek Szyprowski Date: Mon May 9 09:31:47 2016 -0700 Input: max8997-haptic - fix NULL pointer dereference NULL pointer derefence happens when booting with DTB because the platform data for haptic device is not set in supplied data from parent MFD device. The MFD device creates only platform data (from Device Tree) for itself, not for haptic child. Unable to handle kernel NULL pointer dereference at virtual address 0000009c pgd = c0004000 [0000009c] *pgd=00000000 Internal error: Oops: 5 [#1] PREEMPT SMP ARM (max8997_haptic_probe) from [] (platform_drv_probe+0x4c/0xb0) (platform_drv_probe) from [] (driver_probe_device+0x214/0x2c0) (driver_probe_device) from [] (__driver_attach+0xac/0xb0) (__driver_attach) from [] (bus_for_each_dev+0x68/0x9c) (bus_for_each_dev) from [] (bus_add_driver+0x1a0/0x218) (bus_add_driver) from [] (driver_register+0x78/0xf8) (driver_register) from [] (do_one_initcall+0x90/0x1d8) (do_one_initcall) from [] (kernel_init_freeable+0x15c/0x1fc) (kernel_init_freeable) from [] (kernel_init+0x8/0x114) (kernel_init) from [] (ret_from_fork+0x14/0x3c) Signed-off-by: Marek Szyprowski Cc: Fixes: 104594b01ce7 ("Input: add driver support for MAX8997-haptic") [k.kozlowski: Write commit message, add CC-stable] Signed-off-by: Krzysztof Kozlowski Signed-off-by: Dmitry Torokhov drivers/input/misc/max8997_haptic.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 82aaa086019ce0e6fcd3a44c0a2e4329afe988b6 Author: Chris Diamand Date: Mon May 9 09:30:39 2016 -0700 Input: byd - update copyright header As pointed out by Richard, the changes to the comment got missed off the absolute mode patch somehow. Signed-off-by: Chris Diamand Signed-off-by: Dmitry Torokhov drivers/input/mouse/byd.c | 4 ++++ 1 file changed, 4 insertions(+) commit 4f41fc59620fcedaa97cbdf3d7d2956d80fcd922 Author: Serge E. Hallyn Date: Mon May 9 09:59:55 2016 -0500 cgroup, kernfs: make mountinfo show properly scoped path for cgroup namespaces Patch summary: When showing a cgroupfs entry in mountinfo, show the path of the mount root dentry relative to the reader's cgroup namespace root. Short explanation (courtesy of mkerrisk): If we create a new cgroup namespace, then we want both /proc/self/cgroup and /proc/self/mountinfo to show cgroup paths that are correctly virtualized with respect to the cgroup mount point. Previous to this patch, /proc/self/cgroup shows the right info, but /proc/self/mountinfo does not. Long version: When a uid 0 task which is in freezer cgroup /a/b, unshares a new cgroup namespace, and then mounts a new instance of the freezer cgroup, the new mount will be rooted at /a/b. The root dentry field of the mountinfo entry will show '/a/b'. cat > /tmp/do1 << EOF mount -t cgroup -o freezer freezer /mnt grep freezer /proc/self/mountinfo EOF unshare -Gm bash /tmp/do1 > 330 160 0:34 / /sys/fs/cgroup/freezer rw,nosuid,nodev,noexec,relatime - cgroup cgroup rw,freezer > 355 133 0:34 /a/b /mnt rw,relatime - cgroup freezer rw,freezer The task's freezer cgroup entry in /proc/self/cgroup will simply show '/': grep freezer /proc/self/cgroup 9:freezer:/ If instead the same task simply bind mounts the /a/b cgroup directory, the resulting mountinfo entry will again show /a/b for the dentry root. However in this case the task will find its own cgroup at /mnt/a/b, not at /mnt: mount --bind /sys/fs/cgroup/freezer/a/b /mnt 130 25 0:34 /a/b /mnt rw,nosuid,nodev,noexec,relatime shared:21 - cgroup cgroup rw,freezer In other words, there is no way for the task to know, based on what is in mountinfo, which cgroup directory is its own. Example (by mkerrisk): First, a little script to save some typing and verbiage: echo -e "\t/proc/self/cgroup:\t$(cat /proc/self/cgroup | grep freezer)" cat /proc/self/mountinfo | grep freezer | awk '{print "\tmountinfo:\t\t" $4 "\t" $5}' Create cgroup, place this shell into the cgroup, and look at the state of the /proc files: 2653 2653 # Our shell 14254 # cat(1) /proc/self/cgroup: 10:freezer:/a/b mountinfo: / /sys/fs/cgroup/freezer Create a shell in new cgroup and mount namespaces. The act of creating a new cgroup namespace causes the process's current cgroups directories to become its cgroup root directories. (Here, I'm using my own version of the "unshare" utility, which takes the same options as the util-linux version): Look at the state of the /proc files: /proc/self/cgroup: 10:freezer:/ mountinfo: / /sys/fs/cgroup/freezer The third entry in /proc/self/cgroup (the pathname of the cgroup inside the hierarchy) is correctly virtualized w.r.t. the cgroup namespace, which is rooted at /a/b in the outer namespace. However, the info in /proc/self/mountinfo is not for this cgroup namespace, since we are seeing a duplicate of the mount from the old mount namespace, and the info there does not correspond to the new cgroup namespace. However, trying to create a new mount still doesn't show us the right information in mountinfo: # propagating to other mountns /proc/self/cgroup: 7:freezer:/ mountinfo: /a/b /mnt/freezer The act of creating a new cgroup namespace caused the process's current freezer directory, "/a/b", to become its cgroup freezer root directory. In other words, the pathname directory of the directory within the newly mounted cgroup filesystem should be "/", but mountinfo wrongly shows us "/a/b". The consequence of this is that the process in the cgroup namespace cannot correctly construct the pathname of its cgroup root directory from the information in /proc/PID/mountinfo. With this patch, the dentry root field in mountinfo is shown relative to the reader's cgroup namespace. So the same steps as above: /proc/self/cgroup: 10:freezer:/a/b mountinfo: / /sys/fs/cgroup/freezer /proc/self/cgroup: 10:freezer:/ mountinfo: /../.. /sys/fs/cgroup/freezer /proc/self/cgroup: 10:freezer:/ mountinfo: / /mnt/freezer cgroup.clone_children freezer.parent_freezing freezer.state tasks cgroup.procs freezer.self_freezing notify_on_release 3164 2653 # First shell that placed in this cgroup 3164 # Shell started by 'unshare' 14197 # cat(1) Signed-off-by: Serge Hallyn Tested-by: Michael Kerrisk Acked-by: Michael Kerrisk Signed-off-by: Tejun Heo fs/kernfs/mount.c | 14 +++++++++++ include/linux/kernfs.h | 2 ++ kernel/cgroup.c | 63 ++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 79 insertions(+) commit df27b26f04ed388ff4cc2b5d8cfdb5d97678816f Author: Herbert Xu Date: Thu May 5 16:42:49 2016 +0800 crypto: testmgr - Use kmalloc memory for RSA input As akcipher uses an SG interface, you must not use vmalloc memory as input for it. This patch fixes testmgr to copy the vmalloc test vectors to kmalloc memory before running the test. This patch also removes a superfluous sg_virt call in do_test_rsa. Cc: Reported-by: Anatoly Pugachev Signed-off-by: Herbert Xu crypto/testmgr.c | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-) commit 2da2dc9ead232f25601404335cca13c0f722d41b Author: Kaho Ng Date: Mon May 9 00:27:49 2016 +0800 ALSA: hda - Fix white noise on Asus UX501VW headset For reducing the noise from the headset output on ASUS UX501VW, call the existing fixup, alc_fixup_headset_mode_alc668(), additionally. Thread: https://bbs.archlinux.org/viewtopic.php?id=209554 Signed-off-by: Kaho Ng Cc: Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit 8846a125de97f96be64ca234906eedfd26ad778e Merge: 8acca6a 7dbb291 Author: David S. Miller Date: Mon May 9 00:21:13 2016 -0400 Merge branch 'mlx5-build-fix' Saeed Mahameed says: ==================== net/mlx5e: Kconfig fixes for VxLAN Reposting to net the build errors fixes posted by Arnd last week. Originally Arnd posted those fixes to net-next, while the issue is also seen in net. For net-next a different approach is required for fixing the issue as VXLAN and Device Drivers are no longer dependent, but there is no harm for those fixes to get into net-next. Optionally, once net is merged into net-next we can Revert "net/mlx5e: make VXLAN support conditional" as the CONFIG_MLX5_CORE_EN_VXLAN will no longer be required. Applied on top: 288928658583 ('mlxsw: spectrum: Add missing rollback in flood configuration') ==================== Signed-off-by: David S. Miller commit 7dbb29172d415ccccad1166700d6be78dee9f2bc Author: Arnd Bergmann Date: Sun May 8 14:55:25 2016 +0300 net/mlx5e: make VXLAN support conditional VXLAN can be disabled at compile-time or it can be a loadable module while mlx5 is built-in, which leads to a link error: drivers/net/built-in.o: In function `mlx5e_create_netdev': ntb_netdev.c:(.text+0x106de4): undefined reference to `vxlan_get_rx_port' This avoids the link error and makes the vxlan code optional, like the other ethernet drivers do as well. Link: https://patchwork.ozlabs.org/patch/589296/ Fixes: b3f63c3d5e2c ("net/mlx5e: Add netdev support for VXLAN tunneling") Signed-off-by: Arnd Bergmann Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/Kconfig | 7 +++++++ drivers/net/ethernet/mellanox/mlx5/core/Makefile | 3 ++- drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 ++ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 ++++ drivers/net/ethernet/mellanox/mlx5/core/vxlan.h | 11 +++++++++-- 5 files changed, 24 insertions(+), 3 deletions(-) commit 7fd7406d9c7e3c6f235aec224a811dc0fd29e049 Author: Arnd Bergmann Date: Sun May 8 14:55:24 2016 +0300 Revert "net/mlx5: Kconfig: Fix MLX5_EN/VXLAN build issue" This reverts commit 69976fb1045850a742deb9790ea49cbc6f497531. We cannot select VXLAN when IPv4 support is disabled, that just gives us additional build errors, including: warning: (MLX5_CORE_EN) selects VXLAN which has unmet direct dependencies (NETDEVICES && NET_CORE && INET) In file included from ../drivers/net/vxlan.c:36:0: include/net/udp_tunnel.h: In function 'udp_tunnel_handle_offloads': include/net/udp_tunnel.h:112:9: error: implicit declaration of function 'iptunnel_handle_offloads' [-Werror=implicit-function-declaration] return iptunnel_handle_offloads(skb, type); ^~~~~~~~~~~~~~~~~~~~~~~~ I'm sending a proper fix for the original bug in a separate patch. Signed-off-by: Arnd Bergmann Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/Kconfig | 1 - 1 file changed, 1 deletion(-) commit 8acca6acebd07b238af2e61e4f7d55e6232c7e3a Author: Sabrina Dubroca Date: Sat May 7 20:19:29 2016 +0200 macsec: key identifier is 128 bits, not 64 The MACsec standard mentions a key identifier for each key, but doesn't specify anything about it, so I arbitrarily chose 64 bits. IEEE 802.1X-2010 specifies MKA (MACsec Key Agreement), and defines the key identifier to be 128 bits (96 bits "member identifier" + 32 bits "key number"). Signed-off-by: Sabrina Dubroca Acked-by: Hannes Frederic Sowa Signed-off-by: David S. Miller drivers/net/macsec.c | 19 +++++++++++++------ include/uapi/linux/if_macsec.h | 4 +++- 2 files changed, 16 insertions(+), 7 deletions(-) commit c81aa7979432aa10f23656ef6fa113764eab5e5c Author: Shmulik Ladkani Date: Fri May 6 20:27:43 2016 +0300 Documentation/networking: more accurate LCO explanation In few places the term "ones-complement sum" was used but the actual meaning is "the complement of the ones-complement sum". Also, avoid enclosing long statements with underscore, to ease readability. Signed-off-by: Shmulik Ladkani Acked-by: Edward Cree Signed-off-by: David S. Miller Documentation/networking/checksum-offloads.txt | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit be0bd3160165e42783d8215f426e41c07179c08a Author: Eric Dumazet Date: Fri May 6 05:58:21 2016 -0700 macvtap: segmented packet is consumed If GSO packet is segmented and its segments are properly queued, we call consume_skb() instead of kfree_skb() to be drop monitor friendly. Fixes: 3e4f8b7873709 ("macvtap: Perform GSO on forwarding path.") Signed-off-by: Eric Dumazet Cc: Vlad Yasevich Reviewed-by: Shmulik Ladkani Signed-off-by: David S. Miller drivers/net/macvtap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 25a54342fde903b6abc2680594cf3e4864686339 Author: Colin Ian King Date: Thu May 5 23:39:33 2016 +0100 tools: bpf_jit_disasm: check for klogctl failure klogctl can fail and return -ve len, so check for this and return NULL to avoid passing a (size_t)-1 to malloc. Signed-off-by: Colin Ian King Acked-by: Daniel Borkmann Signed-off-by: David S. Miller tools/net/bpf_jit_disasm.c | 3 +++ 1 file changed, 3 insertions(+) commit 810810ffb2f6d46365d0790bbe77698a5534393a Author: Dan Carpenter Date: Thu May 5 16:21:30 2016 +0300 qede: uninitialized variable in qede_start_xmit() "data_split" was never set to false. It's just uninitialized. Fixes: 2950219d87b0 ('qede: Add basic network device support') Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qede/qede_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 44549e8f5eea4e0a41b487b63e616cb089922b99 Author: Linus Torvalds Date: Sun May 8 14:38:32 2016 -0700 Linux 4.6-rc7 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4abac0d0bbc628df5f26845fe05ffc6b3a6533dd Author: Ingo Molnar Date: Sun May 8 10:27:33 2016 +0200 MAINTAINERS: Add mmiotrace entry The Nouveau maintainers would like to follow and review mmiotrace changes as well, so create a separate entry for that code. The high level bits are living in the tracing code, the low level bits in the x86 code. Acked-by: Steven Rostedt Acked-by: Pekka Paalanen Acked-by: karol herbst Cc: linux-kernel@vger.kernel.org Cc: Linus Torvalds Cc: Andrew Morton Cc: Thomas Gleixner Cc: Peter Zijlstra Signed-off-by: Ingo Molnar MAINTAINERS | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit 99d825822eade8d827a1817357cbf3f889a552d6 Author: Al Viro Date: Thu May 5 16:25:35 2016 -0400 get_rock_ridge_filename(): handle malformed NM entries Payloads of NM entries are not supposed to contain NUL. When we run into such, only the part prior to the first NUL goes into the concatenation (i.e. the directory entry name being encoded by a bunch of NM entries). We do stop when the amount collected so far + the claimed amount in the current NM entry exceed 254. So far, so good, but what we return as the total length is the sum of *claimed* sizes, not the actual amount collected. And that can grow pretty large - not unlimited, since you'd need to put CE entries in between to be able to get more than the maximum that could be contained in one isofs directory entry / continuation chunk and we are stop once we'd encountered 32 CEs, but you can get about 8Kb easily. And that's what will be passed to readdir callback as the name length. 8Kb __copy_to_user() from a buffer allocated by __get_free_page() Cc: stable@vger.kernel.org # 0.98pl6+ (yes, really) Signed-off-by: Al Viro fs/isofs/rock.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) commit 8c1f454625743d60763a23c58fa65681d3c98b6f Author: Dan Carpenter Date: Thu May 5 16:20:20 2016 +0300 netxen: netxen_rom_fast_read() doesn't return -1 The error handling is broken here. netxen_rom_fast_read() returns zero on success and -EIO on error. It never returns -1. Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 1c755ffa4fa3e2d4112cadd30142344789ad2fd2 Author: Dan Carpenter Date: Thu May 5 16:19:44 2016 +0300 netxen: reversed condition in netxen_nic_set_link_parameters() My static checker complains that we are using "autoneg" without initializing it. The problem is the ->phy_read() condition is reversed so we only set this on error instead of success. Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/netxen/netxen_nic_hw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 545fea54916af5e88f02346d85301ba0ecc143f3 Author: Dan Carpenter Date: Thu May 5 16:18:46 2016 +0300 netxen: fix error handling in netxen_get_flash_block() My static checker complained that "v" can be used unintialized if netxen_rom_fast_read() returns -EIO. That function never actually returns -1. Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/netxen/netxen_nic_hw.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit 32cf95db22d49cf4a3b421ba9fd156bb5f920ebb Merge: 630aac5 d1306eb Author: Linus Torvalds Date: Sat May 7 10:53:32 2016 -0700 Merge tag 'char-misc-4.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull misc driver fixes from Gfreg KH: "Here are three small fixes for some driver problems that were reported. Full details in the shortlog below. All of these have been in linux-next with no reported issues" * tag 'char-misc-4.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: nvmem: mxs-ocotp: fix buffer overflow in read Drivers: hv: vmbus: Fix signaling logic in hv_need_to_signal_on_read() misc: mic: Fix for double fetch security bug in VOP driver commit 630aac5ab6d6708c2cf715ddb5a77928e0aacb04 Merge: 3f8f0cf 2b86c4a Author: Linus Torvalds Date: Sat May 7 10:50:48 2016 -0700 Merge tag 'staging-4.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull IIO driver fixes from Grek KH: "It's really just IIO drivers here, some small fixes that resolve some 'crash on boot' errors that have shown up in the -rc series, and other bugfixes that are required. All have been in linux-next with no reported problems" * tag 'staging-4.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: iio: imu: mpu6050: Fix name/chip_id when using ACPI iio: imu: mpu6050: fix possible NULL dereferences iio:adc:at91-sama5d2: Repair crash on module removal iio: ak8975: fix maybe-uninitialized warning iio: ak8975: Fix NULL pointer exception on early interrupt commit 3f8f0cf2eddb558e5ccf9b155e758f4b950d8697 Merge: 9125aeb 9be427e Author: Linus Torvalds Date: Sat May 7 10:47:03 2016 -0700 Merge tag 'usb-4.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some last-remaining fixes for USB drivers to resolve issues that have shown up in testing. And two new device ids as well. All of these have been in linux-next with no reported issues" * tag 'usb-4.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: Revert "USB / PM: Allow USB devices to remain runtime-suspended when sleeping" usb: musb: jz4740: fix error check of usb_get_phy() Revert "usb: musb: musb_host: Enable HCD_BH flag to handle urb return in bottom half" usb: musb: gadget: nuke endpoint before setting its descriptor to NULL USB: serial: cp210x: add Straizona Focusers device ids USB: serial: cp210x: add ID for Link ECU commit 9125aeb3e2fe278ac70fda039a3c0cd7f05eb800 Merge: 67601c3b ec953b7 Author: Linus Torvalds Date: Sat May 7 08:27:35 2016 -0700 Merge branch 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM fixes from Russell King: "These are a number of updates to fix a few problems found in the ARM nommu code over the last couple of years, caused mostly by changes on the mmu side" * 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 8573/1: domain: move {set,get}_domain under config guard ARM: 8572/1: nommu: change memory reserve for the vectors ARM: 8571/1: nommu: fix PMSAv7 setup commit 67601c3b64616c3bdb98c966e8f7cd5bb895e996 Merge: 35cd3f4 b34ecd5 Author: Linus Torvalds Date: Sat May 7 08:17:45 2016 -0700 Merge tag 'media/v4.6-5' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: - deadlock fixes on driver probe at exynos4-is and s43-camif drivers - a build breakage if media controller is enabled and USB or PCI is built as module. * tag 'media/v4.6-5' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: [media] media-device: fix builds when USB or PCI is compiled as module [media] media: s3c-camif: fix deadlock on driver probe() [media] media: exynos4-is: fix deadlock on driver probe commit 35cd3f4563c4a0fc99be300afc7b82a822e634c7 Merge: b4184cb 535dac4 Author: Linus Torvalds Date: Sat May 7 08:13:42 2016 -0700 Merge branch 'for-4.6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata Pull libata fixes from Tejun Heo: "An ahci driver addition and updates to ahci port enable handling for some platform devices" * 'for-4.6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata: ata: add AMD Seattle platform driver ARM: dts: apq8064: add ahci ports-implemented mask ata: ahci-platform: Add ports-implemented DT bindings. libahci: save port map for forced port map commit b4184cbff393d9ede2d80efd7088126706c1ce08 Merge: 0783783 9c674815 Author: Linus Torvalds Date: Sat May 7 08:10:08 2016 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma Pull rdma fix from Doug Ledford: "Fix for max sector calculation in iSER" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma: IB/iser: Fix max_sectors calculation commit 56402d63eefe22179f7311a51ff2094731420406 Author: Thomas Gleixner Date: Fri May 6 20:48:16 2016 +0200 x86/topology: Handle CPUID bogosity gracefully Joseph reported that a XEN guest dies with a division by 0 in the package topology setup code. This happens if cpu_info.x86_max_cores is zero. Handle that case and emit a warning. This does not fix the underlying XEN bug, but makes the code more robust. Reported-and-tested-by: Joseph Salisbury Cc: Peter Zijlstra Cc: Boris Ostrovsky Cc: David Vrabel Link: http://lkml.kernel.org/r/alpine.DEB.2.11.1605062046270.3540@nanos Signed-off-by: Thomas Gleixner arch/x86/kernel/smpboot.c | 5 +++++ 1 file changed, 5 insertions(+) commit 536bd00cdbb7b908573e5a93bae67b64cbae60d8 Author: Rafael J. Wysocki Date: Fri May 6 14:58:43 2016 +0200 sched/fair: Fix !CONFIG_SMP kernel cpufreq governor breakage The following commit: 34e2c555f3e1 ("cpufreq: Add mechanism for registering utilization update callbacks") overlooked the fact that update_load_avg(), where CFS invokes cpufreq utilization update callbacks, becomes an empty stub on UP kernels. In consequence, if !CONFIG_SMP, cpufreq governors are never invoked from CFS and they do not have a chance to evaluate CPU performace levels and update them often enough. Needless to say, things don't work as expected then. Fix the problem by making the !CONFIG_SMP stub of update_load_avg() invoke cpufreq update callbacks too. Reported-by: Steve Muckle Tested-by: Steve Muckle Signed-off-by: Rafael J. Wysocki Acked-by: Steve Muckle Cc: Linus Torvalds Cc: Linux PM list Cc: Peter Zijlstra Cc: Srinivas Pandruvada Cc: Thomas Gleixner Cc: Viresh Kumar Fixes: 34e2c555f3e1 (cpufreq: Add mechanism for registering utilization update callbacks) Link: http://lkml.kernel.org/r/6282396.VVEdgVYxO3@vostro.rjw.lan Signed-off-by: Ingo Molnar kernel/sched/fair.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 288928658583a27256c6c295aeccd95a3ddcefce Author: Ido Schimmel Date: Fri May 6 22:18:40 2016 +0200 mlxsw: spectrum: Add missing rollback in flood configuration When we fail to set the flooding configuration for the broadcast and unregistered multicast traffic, we should revert the flooding configuration of the unknown unicast traffic. Fixes: 0293038e0c36 ("mlxsw: spectrum: Add support for flood control") Signed-off-by: Ido Schimmel Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 51554db2d23f71989e040df838613bbae554d4e0 Author: Ido Schimmel Date: Fri May 6 22:18:39 2016 +0200 mlxsw: spectrum: Fix rollback order in LAG join failure Make the leave procedure in the error path symmetric to the join procedure and first remove the port from the collector before potentially destroying the LAG. Fixes: 0d65fc13042f ("mlxsw: spectrum: Implement LAG port join/leave") Signed-off-by: Ido Schimmel Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 229740c63169462a838a8b8e16391ed000934631 Author: Jarno Rajahalme Date: Tue May 3 16:10:21 2016 -0700 udp_offload: Set encapsulation before inner completes. UDP tunnel segmentation code relies on the inner offsets being set for an UDP tunnel GSO packet, but the inner *_complete() functions will set the inner offsets only if 'encapsulation' is set before calling them. Currently, udp_gro_complete() sets 'encapsulation' only after the inner *_complete() functions are done. This causes the inner offsets having invalid values after udp_gro_complete() returns, which in turn will make it impossible to properly segment the packet in case it needs to be forwarded, which would be visible to the user either as invalid packets being sent or as packet loss. This patch fixes this by setting skb's 'encapsulation' in udp_gro_complete() before calling into the inner complete functions, and by making each possible UDP tunnel gro_complete() callback set the inner_mac_header to the beginning of the tunnel payload. Signed-off-by: Jarno Rajahalme Reviewed-by: Alexander Duyck Signed-off-by: David S. Miller drivers/net/geneve.c | 3 +++ drivers/net/vxlan.c | 3 +++ include/linux/netdevice.h | 3 +++ net/ipv4/fou.c | 4 ++++ net/ipv4/udp_offload.c | 8 +++++--- 5 files changed, 18 insertions(+), 3 deletions(-) commit 43b8448cd7b42a4c39476c9a12c960c1408f1946 Author: Jarno Rajahalme Date: Tue May 3 16:10:20 2016 -0700 udp_tunnel: Remove redundant udp_tunnel_gro_complete(). The setting of the UDP tunnel GSO type is already performed by udp[46]_gro_complete(). Signed-off-by: Jarno Rajahalme Signed-off-by: David S. Miller drivers/net/geneve.c | 2 -- drivers/net/vxlan.c | 2 -- include/net/udp_tunnel.h | 9 --------- net/ipv4/fou.c | 2 -- 4 files changed, 15 deletions(-) commit 07837831047fb72856d1f61a726a4094397facd8 Merge: 3f86ba5 74d3694 Author: Linus Torvalds Date: Fri May 6 13:08:35 2016 -0700 Merge branch 'for-linus' of git://git.kernel.dk/linux-block Pull writeback fix from Jens Axboe: "Just a single fix for domain aware writeback, fixing a regression that can cause balance_dirty_pages() to keep looping while not getting any work done" * 'for-linus' of git://git.kernel.dk/linux-block: writeback: Fix performance regression in wb_over_bg_thresh() commit 3f86ba5d0c1c34a4469da1f62d3707e32a20d6ba Merge: 01ec716 886123f Author: Linus Torvalds Date: Fri May 6 12:59:27 2016 -0700 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "This contains two fixes: a boot fix for older SGI/UV systems, and an APIC calibration fix" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/tsc: Read all ratio bits from MSR_PLATFORM_INFO x86/platform/UV: Bring back the call to map_low_mmrs in uv_system_init commit 8e0ddc040a87a3b700bdf67394d24fe30a0f1eb9 Author: Sudarsana Reddy Kalluru Date: Thu May 5 00:35:16 2016 -0400 qede: prevent chip hang when increasing channels qede requires qed to provide enough resources to accommodate 16 combined channels, but that upper-bound isn't actually being enforced by it. Instead, qed inform back to qede how many channels can be opened based on available resources - but that calculation doesn't really take into account the resources requested by qede; Instead it considers other FW/HW available resources. As a result, if a user would increase the number of channels to more than 16 [e.g., using ethtool] the chip would hang. This change increments the resources requested by qede to 64 combined channels instead of 16; This value is an upper bound on the possible available channels [due to other FW/HW resources]. Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qede/qede_main.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 1d2f7b2d956e242179aaf4a08f3545f99c81f9a3 Author: David Ahern Date: Wed May 4 21:26:08 2016 -0700 net: ipv6: tcp reset, icmp need to consider L3 domain Responses for packets to unused ports are getting lost with L3 domains. IPv4 has ip_send_unicast_reply for sending TCP responses which accounts for L3 domains; update the IPv6 counterpart tcp_v6_send_response. For icmp the L3 master check needs to be moved up in icmp6_send to properly respond to UDP packets to a port with no listener. Fixes: ca254490c8df ("net: Add VRF support to IPv6 stack") Signed-off-by: David Ahern Signed-off-by: David S. Miller net/ipv6/icmp.c | 5 ++--- net/ipv6/tcp_ipv6.c | 7 ++++++- 2 files changed, 8 insertions(+), 4 deletions(-) commit 01ec7167615417dd8f6f4d3a0baeadbb4a686091 Merge: 17d25a3 5f2f88e Author: Linus Torvalds Date: Fri May 6 11:58:45 2016 -0700 Merge tag 'pm+acpi-4.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management and ACPI fixes from Rafael Wysocki: "Fixes for problems introduced or discovered recently (intel_pstate, sti-cpufreq, ARM64 cpuidle, Operating Performance Points framework, generic device properties framework) and one fix for a hotplug-related deadlock in ACPICA that's been there forever, but is nasty enough. Specifics: - Fix for a recent regression in the intel_pstate driver causing it to fail to restore the HWP (HW-managed P-states) configuration of the boot CPU after suspend-to-RAM (Rafael Wysocki). - Fix for two recent regressions in the intel_pstate driver, one that can trigger a divide by zero if the driver is accessed via sysfs before it manages to take the first sample and one causing it to fail to update a structure field used in a trace point, so the information coming from it is less useful (Rafael Wysocki). - Fix for a problem in the sti-cpufreq driver introduced during the 4.5 cycle that causes it to break CPU PM in multi-platform kernels by registering cpufreq-dt (which subsequently doesn't work) unconditionally and preventing the driver that would actually work from registering (Sudeep Holla). - Stable-candidate fix for an ARM64 cpuidle issue causing idle state usage counters to be incorrectly updated for idle states that were not entered due to errors (James Morse). - Fix for a recently introduced issue in the OPP (Operating Performance Points) framework causing it to print bogus error messages for missing optional regulators (Viresh Kumar). - Fix for a recently introduced issue in the generic device properties framework that may cause it to attempt to dereferece and invalid pointer in some cases (Heikki Krogerus). - Fix for a deadlock in the ACPICA core that may be triggered by device (eg Thunderbolt) hotplug (Prarit Bhargava)" * tag 'pm+acpi-4.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM / OPP: Remove useless check ACPICA: Dispatcher: Update thread ID for recursive method calls intel_pstate: Fix intel_pstate_get() cpufreq: intel_pstate: Fix HWP on boot CPU after system resume cpufreq: st: enable selective initialization based on the platform ARM: cpuidle: Pass on arm_cpuidle_suspend()'s return value device property: Avoid potential dereferences of invalid pointers commit 17d25a337b75d656a34bdd52a477596c303b7f59 Merge: 18fb92c 2548d54 Author: Linus Torvalds Date: Fri May 6 11:53:27 2016 -0700 Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Ingo Molnar: "This contains a single fix that fixes a nohz tick stopping bug when mixed-poliocy SCHED_FIFO and SCHED_RR tasks are present on a runqueue" * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: nohz/full, sched/rt: Fix missed tick-reenabling bug in sched_can_stop_tick() commit 18fb92c30c766a5fb4593ecd0d9155b33d139e8e Merge: cade818 8482716 Author: Linus Torvalds Date: Fri May 6 11:40:24 2016 -0700 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: "This tree contains two fixes: new Intel CPU model numbers and an AMD/iommu uncore PMU driver fix" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/amd/iommu: Do not register a task ctx for uncore like PMUs perf/x86: Add model numbers for Kabylake CPUs commit cade818463f8ae47e19466c2fe321fe30c3fe57e Merge: 83a395d c10fcb1 Author: Linus Torvalds Date: Fri May 6 11:33:02 2016 -0700 Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull EFI fixes from Ingo Molnar: "This tree contains three fixes: a console spam fix, a file pattern fix and a sysfb_efi fix for a bug that triggered on older ThinkPads" * 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/sysfb_efi: Fix valid BAR address range check x86/efi-bgrt: Switch all pr_err() to pr_notice() for invalid BGRT MAINTAINERS: Remove asterisk from EFI directory names commit 83a395d332ec43ded7bb36d2065f3a4d2e473038 Merge: dd28769 f0b22d1 Author: Linus Torvalds Date: Fri May 6 11:27:05 2016 -0700 Merge branch 'parisc-4.6-5' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc fix from Helge Deller: "Patch from Dmitry V Levin to fix a kernel crash when a straced process calls the (invalid) syscall which is equal to value of __NR_Linux_syscalls" * 'parisc-4.6-5' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: fix a bug when syscall number of tracee is __NR_Linux_syscalls commit dd287690b0aa4b0d22e8dd7dd2cb3055f5141a27 Merge: 4883d11 26f9d5f Author: Linus Torvalds Date: Fri May 6 11:14:38 2016 -0700 Merge tag 'arc-4.6-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC fixes from Vineet Gupta: "Late in the cycle, but this has fixes for couple of issues: a PAE40 boot crash and Arnd spotting lack of barriers in BE io-accessors. The 3rd patch for enabling highmem in low physical mem ;-) honestly is more than a "fix" but its been in works for some time, seems to be stable in testing and enables 2 of our customers to go forward with 4.6 kernel. - Fix for PTE truncation in PAE40 builds - Fix for big endian IO accessors lacking IO barrier - Allow HIGHMEM to work with low physical addresses" * tag 'arc-4.6-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: ARC: support HIGHMEM even without PAE40 ARC: Fix PAE40 boot failures due to PTE truncation ARC: Add missing io barriers to io{read,write}{16,32}be() commit 4883d11e06b5a02a73ee3a554168ec92ab44c0f5 Merge: 659a182 b4c1121 Author: Linus Torvalds Date: Fri May 6 11:05:07 2016 -0700 Merge tag 'powerpc-4.6-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fix from Michael Ellerman: "Fix bad inline asm constraint in create_zero_mask() from Anton Blanchard" * tag 'powerpc-4.6-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc: Fix bad inline asm constraint in create_zero_mask() commit 659a1823273873027a19e190012a7b0c5d7b541c Merge: 9caa7e7 fca0971 Author: Linus Torvalds Date: Fri May 6 10:59:53 2016 -0700 Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux Pull drm fixes from Dave Airlie: "Fixes for i915, amdgpu/radeon and imx. The IMX fix is for an autoloading regression found in Fedora. The radeon fixes, are the same fix to amdgpu/radeon to avoid a hardware lockup in some circumstances with a bad mode, and a double free bug I took a few hours chasing down the other morning. The i915 fixes are across the board, all stable material, and fixing some hangs and suspend/resume issues, along with a live status regressions" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: gpu: ipu-v3: Fix imx-ipuv3-crtc module autoloading drm/amdgpu: make sure vertical front porch is at least 1 drm/radeon: make sure vertical front porch is at least 1 drm/amdgpu: set metadata pointer to NULL after freeing. drm/i915: Make RPS EI/thresholds multiple of 25 on SNB-BDW drm/i915: Fake HDMI live status drm/i915: Fix eDP low vswing for Broadwell drm/i915/ddi: Fix eDP VDD handling during booting and suspend/resume drm/i915: Fix system resume if PCI device remained enabled drm/i915: Avoid stalling on pending flips for legacy cursor updates commit 9b1f189e6dfb0483b715e19364c782d2ddee96a0 Merge: 04974df 92dc20d 8070954 66ec246 1ff7760 Author: Mark Brown Date: Fri May 6 18:20:37 2016 +0100 Merge remote-tracking branches 'spi/fix/fsl-dspi', 'spi/fix/omap2-mcspi', 'spi/fix/pxa2xx' and 'spi/fix/ti-qspi' into spi-linus commit 1b8d2afde54fade94339f573c4e05644f9ae9866 Author: Dan Williams Date: Fri May 6 10:20:10 2016 -0700 libnvdimm, pfn: fix ARCH=alpha allmodconfig build failure I had relied on the kbuild robot for cross build coverage, however it only builds alpha_defconfig. Switch from HPAGE_SIZE to PMD_SIZE, which is more widely defined. Fixes: 658922e57b84 ("libnvdimm, pfn: fix memmap reservation sizing") Cc: Reported-by: Guenter Roeck Tested-by: Guenter Roeck Signed-off-by: Dan Williams drivers/nvdimm/pmem.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 856ce5d083e14571d051301fe3c65b32b8cbe321 Author: Linus Lüssing Date: Wed May 4 17:25:02 2016 +0200 bridge: fix igmp / mld query parsing With the newly introduced helper functions the skb pulling is hidden in the checksumming function - and undone before returning to the caller. The IGMP and MLD query parsing functions in the bridge still assumed that the skb is pointing to the beginning of the IGMP/MLD message while it is now kept at the beginning of the IPv4/6 header. If there is a querier somewhere else, then this either causes the multicast snooping to stay disabled even though it could be enabled. Or, if we have the querier enabled too, then this can create unnecessary IGMP / MLD query messages on the link. Fixing this by taking the offset between IP and IGMP/MLD header into account, too. Fixes: 9afd85c9e455 ("net: Export IGMP/MLD message validation code") Reported-by: Simon Wunderlich Signed-off-by: Linus Lüssing Signed-off-by: David S. Miller net/bridge/br_multicast.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit f0b22d1bb2a37a665a969e95785c75a4f49d1499 Author: Dmitry V. Levin Date: Wed Apr 27 04:56:11 2016 +0300 parisc: fix a bug when syscall number of tracee is __NR_Linux_syscalls Do not load one entry beyond the end of the syscall table when the syscall number of a traced process equals to __NR_Linux_syscalls. Similar bug with regular processes was fixed by commit 3bb457af4fa8 ("[PARISC] Fix bug when syscall nr is __NR_Linux_syscalls"). This bug was found by strace test suite. Cc: stable@vger.kernel.org Signed-off-by: Dmitry V. Levin Acked-by: Helge Deller Signed-off-by: Helge Deller arch/parisc/kernel/syscall.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cbbba30f1ac95a04aae9c61a55aebe5e6fdf29f0 Merge: e2841ea 5c08b0f Author: Kalle Valo Date: Fri May 6 14:27:48 2016 +0300 Merge tag 'iwlwifi-for-kalle-2016-05-04' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes * fix P2P rates (and possibly other issues) commit 5f2f88e330e7ee2d2d7c5e0984b86108b00ac800 Merge: 7c21b38 21f8a99 6d45b71 625fe4f Author: Rafael J. Wysocki Date: Fri May 6 13:16:22 2016 +0200 Merge branches 'pm-opp-fixes', 'pm-cpufreq-fixes' and 'pm-cpuidle-fixes' * pm-opp-fixes: PM / OPP: Remove useless check * pm-cpufreq-fixes: intel_pstate: Fix intel_pstate_get() cpufreq: intel_pstate: Fix HWP on boot CPU after system resume cpufreq: st: enable selective initialization based on the platform * pm-cpuidle-fixes: ARM: cpuidle: Pass on arm_cpuidle_suspend()'s return value commit 7c21b38ca937603741d1ec00a944eeb578cb653f Merge: 93d6884 0224a4a Author: Rafael J. Wysocki Date: Fri May 6 13:15:52 2016 +0200 Merge branches 'acpica-fixes' and 'device-properties-fixes' * acpica-fixes: ACPICA: Dispatcher: Update thread ID for recursive method calls * device-properties-fixes: device property: Avoid potential dereferences of invalid pointers commit 886123fb3a8656699dff40afa0573df359abeb18 Author: Chen Yu Date: Fri May 6 11:33:39 2016 +0800 x86/tsc: Read all ratio bits from MSR_PLATFORM_INFO Currently we read the tsc radio: ratio = (MSR_PLATFORM_INFO >> 8) & 0x1f; Thus we get bit 8-12 of MSR_PLATFORM_INFO, however according to the SDM (35.5), the ratio bits are bit 8-15. Ignoring the upper bits can result in an incorrect tsc ratio, which causes the TSC calibration and the Local APIC timer frequency to be incorrect. Fix this problem by masking 0xff instead. [ tglx: Massaged changelog ] Fixes: 7da7c1561366 "x86, tsc: Add static (MSR) TSC calibration on Intel Atom SoCs" Signed-off-by: Chen Yu Cc: "Rafael J. Wysocki" Cc: stable@vger.kernel.org Cc: Bin Gao Cc: Len Brown Link: http://lkml.kernel.org/r/1462505619-5516-1-git-send-email-yu.c.chen@intel.com Signed-off-by: Thomas Gleixner arch/x86/kernel/tsc_msr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9caa7e78481f17fb6ff77dfaca774998e7440430 Merge: 43a3e83 7322dd7 Author: Linus Torvalds Date: Thu May 5 20:48:35 2016 -0700 Merge branch 'akpm' (patches from Andrew) Merge fixes from Andrew Morton: "14 fixes" * emailed patches from Andrew Morton : byteswap: try to avoid __builtin_constant_p gcc bug lib/stackdepot: avoid to return 0 handle mm: fix kcompactd hang during memory offlining modpost: fix module autoloading for OF devices with generic compatible property proc: prevent accessing /proc//environ until it's ready mm/zswap: provide unique zpool name mm: thp: kvm: fix memory corruption in KVM with THP enabled MAINTAINERS: fix Rajendra Nayak's address mm, cma: prevent nr_isolated_* counters from going negative mm: update min_free_kbytes from khugepaged after core initialization huge pagecache: mmap_sem is unlocked when truncation splits pmd rapidio/mport_cdev: fix uapi type definitions mm: memcontrol: let v2 cgroups follow changes in system swappiness mm: thp: correct split_huge_pages file permission commit 31ca0458a61a502adb7ed192bf9716c6d05791a5 Author: Nikolay Aleksandrov Date: Wed May 4 16:18:45 2016 +0200 net: bridge: fix old ioctl unlocked net device walk get_bridge_ifindices() is used from the old "deviceless" bridge ioctl calls which aren't called with rtnl held. The comment above says that it is called with rtnl but that is not really the case. Here's a sample output from a test ASSERT_RTNL() which I put in get_bridge_ifindices and executed "brctl show": [ 957.422726] RTNL: assertion failed at net/bridge//br_ioctl.c (30) [ 957.422925] CPU: 0 PID: 1862 Comm: brctl Tainted: G W O 4.6.0-rc4+ #157 [ 957.423009] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014 [ 957.423009] 0000000000000000 ffff880058adfdf0 ffffffff8138dec5 0000000000000400 [ 957.423009] ffffffff81ce8380 ffff880058adfe58 ffffffffa05ead32 0000000000000001 [ 957.423009] 00007ffec1a444b0 0000000000000400 ffff880053c19130 0000000000008940 [ 957.423009] Call Trace: [ 957.423009] [] dump_stack+0x85/0xc0 [ 957.423009] [] br_ioctl_deviceless_stub+0x212/0x2e0 [bridge] [ 957.423009] [] sock_ioctl+0x22b/0x290 [ 957.423009] [] do_vfs_ioctl+0x95/0x700 [ 957.423009] [] SyS_ioctl+0x79/0x90 [ 957.423009] [] entry_SYSCALL_64_fastpath+0x23/0xc1 Since it only reads bridge ifindices, we can use rcu to safely walk the net device list. Also remove the wrong rtnl comment above. Signed-off-by: Nikolay Aleksandrov Signed-off-by: David S. Miller net/bridge/br_ioctl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit dedc58e067d8c379a15a8a183c5db318201295bb Author: Ian Campbell Date: Wed May 4 14:21:53 2016 +0100 VSOCK: do not disconnect socket when peer has shutdown SEND only The peer may be expecting a reply having sent a request and then done a shutdown(SHUT_WR), so tearing down the whole socket at this point seems wrong and breaks for me with a client which does a SHUT_WR. Looking at other socket family's stream_recvmsg callbacks doing a shutdown here does not seem to be the norm and removing it does not seem to have had any adverse effects that I can see. I'm using Stefan's RFC virtio transport patches, I'm unsure of the impact on the vmci transport. Signed-off-by: Ian Campbell Cc: "David S. Miller" Cc: Stefan Hajnoczi Cc: Claudio Imbrenda Cc: Andy King Cc: Dmitry Torokhov Cc: Jorgen Hansen Cc: Adit Ranadive Cc: netdev@vger.kernel.org Signed-off-by: David S. Miller net/vmw_vsock/af_vsock.c | 21 +-------------------- 1 file changed, 1 insertion(+), 20 deletions(-) commit 82d69203df634b4dfa765c94f60ce9482bcc44d6 Author: Daniel Jurgens Date: Wed May 4 15:00:33 2016 +0300 net/mlx4_en: Fix endianness bug in IPV6 csum calculation Use htons instead of unconditionally byte swapping nexthdr. On a little endian systems shifting the byte is correct behavior, but it results in incorrect csums on big endian architectures. Fixes: f8c6455bb04b ('net/mlx4_en: Extend checksum offloading by CHECKSUM COMPLETE') Signed-off-by: Daniel Jurgens Reviewed-by: Carol Soto Tested-by: Carol Soto Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/en_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 43a3e837e22818c2c79dad95745a6b54d4e232f7 Author: Linus Torvalds Date: Thu May 5 20:07:14 2016 -0700 mailmap: add John Paul Adrian Glaubitz Apparently patchwork ended up truncating the full name. Signed-off-by: Linus Torvalds .mailmap | 1 + 1 file changed, 1 insertion(+) commit 7270a3f761a2eb8ca38e093608f31879b368249b Merge: 85f397a 2eea658 Author: Linus Torvalds Date: Thu May 5 18:10:01 2016 -0700 Merge branch 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm fixes from Dan Williams: - a fix for the persistent memory 'struct page' driver. The implementation overlooked the fact that pages are allocated in 2MB units leading to -ENOMEM when establishing some configurations. It's tagged for -stable as the problem was introduced with the initial implementation in 4.5. - The new "error status translation" routine, introduced with the 4.6 updates to the nfit driver, missed a necessary path in acpi_nfit_ctl(). The end result is that we are falsely assuming commands complete successfully when the embedded status says otherwise. * 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: nfit: fix translation of command status results libnvdimm, pfn: fix memmap reservation sizing commit 7322dd755e7dd34bc5359aa27abeed1687e0f628 Author: Arnd Bergmann Date: Thu May 5 16:22:39 2016 -0700 byteswap: try to avoid __builtin_constant_p gcc bug This is another attempt to avoid a regression in wwn_to_u64() after that started using get_unaligned_be64(), which in turn ran into a bug on gcc-4.9 through 6.1. The regression got introduced due to the combination of two separate workarounds (commits e3bde9568d99: "include/linux/unaligned: force inlining of byteswap operations" and ef3fb2422ffe: "scsi: fc: use get/put_unaligned64 for wwn access") that each try to sidestep distinct problems with gcc behavior (code growth and increased stack usage). Unfortunately after both have been applied, a more serious gcc bug has been uncovered, leading to incorrect object code that discards part of a function and causes undefined behavior. As part of this problem is how __builtin_constant_p gets evaluated on an argument passed by reference into an inline function, this avoids the use of __builtin_constant_p() for all architectures that set CONFIG_ARCH_USE_BUILTIN_BSWAP. Most architectures do not set ARCH_SUPPORTS_OPTIMIZED_INLINING, which means they probably do not suffer from the problem in the qla2xxx driver, but they might still run into it elsewhere. Both of the original workarounds were only merged in the 4.6 kernel, and the bug that is fixed by this patch should only appear if both are there, so we probably don't need to backport the fix. On the other hand, it works by simplifying the code path and should not have any negative effects. [arnd@arndb.de: fix older gcc warnings] (http://lkml.kernel.org/r/12243652.bxSxEgjgfk@wuerfel) Link: https://lkml.org/lkml/headers/2016/4/12/1103 Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66122 Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70232 Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70646 Fixes: e3bde9568d99 ("include/linux/unaligned: force inlining of byteswap operations") Fixes: ef3fb2422ffe ("scsi: fc: use get/put_unaligned64 for wwn access") Link: http://lkml.kernel.org/r/1780465.XdtPJpi8Tt@wuerfel Signed-off-by: Arnd Bergmann Reviewed-by: Josh Poimboeuf Tested-by: Josh Poimboeuf # on gcc-5.3 Tested-by: Quinn Tran Cc: Martin Jambor Cc: "Martin K. Petersen" Cc: James Bottomley Cc: Denys Vlasenko Cc: Thomas Graf Cc: Peter Zijlstra Cc: David Rientjes Cc: Ingo Molnar Cc: Himanshu Madhani Cc: Jan Hubicka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/uapi/linux/swab.h | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) commit 7c31190bcfdbff225950902a9f226e4eb79ca94f Author: Joonsoo Kim Date: Thu May 5 16:22:35 2016 -0700 lib/stackdepot: avoid to return 0 handle Recently, we allow to save the stacktrace whose hashed value is 0. It causes the problem that stackdepot could return 0 even if in success. User of stackdepot cannot distinguish whether it is success or not so we need to solve this problem. In this patch, 1 bit are added to handle and make valid handle none 0 by setting this bit. After that, valid handle will not be 0 and 0 handle will represent failure correctly. Fixes: 33334e25769c ("lib/stackdepot.c: allow the stack trace hash to be zero") Link: http://lkml.kernel.org/r/1462252403-1106-1-git-send-email-iamjoonsoo.kim@lge.com Signed-off-by: Joonsoo Kim Cc: Alexander Potapenko Cc: Andrey Ryabinin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds lib/stackdepot.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 172400c69cb0d0d684b7cd75ac75872b3d7c61a1 Author: Vlastimil Babka Date: Thu May 5 16:22:32 2016 -0700 mm: fix kcompactd hang during memory offlining Assume memory47 is the last online block left in node1. This will hang: # echo offline > /sys/devices/system/node/node1/memory47/state After a couple of minutes, the following pops up in dmesg: INFO: task bash:957 blocked for more than 120 seconds. Not tainted 4.6.0-rc6+ #6 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. bash D ffff8800b7adbaf8 0 957 951 0x00000000 Call Trace: schedule+0x35/0x80 schedule_timeout+0x1ac/0x270 wait_for_completion+0xe1/0x120 kthread_stop+0x4f/0x110 kcompactd_stop+0x26/0x40 __offline_pages.constprop.28+0x7e6/0x840 offline_pages+0x11/0x20 memory_block_action+0x73/0x1d0 memory_subsys_offline+0x47/0x60 device_offline+0x86/0xb0 store_mem_state+0xda/0xf0 dev_attr_store+0x18/0x30 sysfs_kf_write+0x37/0x40 kernfs_fop_write+0x11d/0x170 __vfs_write+0x37/0x120 vfs_write+0xa9/0x1a0 SyS_write+0x55/0xc0 entry_SYSCALL_64_fastpath+0x1a/0xa4 kcompactd is waiting for kcompactd_max_order > 0 when it's woken up to actually exit. Check kthread_should_stop() to break out of the wait. Fixes: 698b1b306 ("mm, compaction: introduce kcompactd"). Reported-by: Reza Arbab Tested-by: Reza Arbab Cc: Andrea Arcangeli Cc: "Kirill A. Shutemov" Cc: Rik van Riel Cc: Joonsoo Kim Cc: Mel Gorman Cc: David Rientjes Cc: Michal Hocko Cc: Johannes Weiner Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/compaction.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit acbef7b7662953cec96c243db4009ac561d88989 Author: Philipp Zabel Date: Thu May 5 16:22:29 2016 -0700 modpost: fix module autoloading for OF devices with generic compatible property Since the wildcard at the end of OF module aliases is gone, autoloading of modules that don't match a device's last (most generic) compatible value fails. For example the CODA960 VPU on i.MX6Q has the SoC specific compatible "fsl,imx6q-vpu" and the generic compatible "cnm,coda960". Since the driver currently only works with knowledge about the SoC specific integration, it doesn't list "cnm,cod960" in the module device table. This results in the device compatible "of:NvpuTCfsl,imx6q-vpuCcnm,coda960" not matching the module alias "of:N*T*Cfsl,imx6q-vpu" anymore, whereas before commit 2f632369ab79 ("modpost: don't add a trailing wildcard for OF module aliases") it matched the module alias "of:N*T*Cfsl,imx6q-vpu*". This patch adds two module aliases for each compatible, one without the wildcard and one with "C*" appended. $ modinfo coda | grep imx6q alias: of:N*T*Cfsl,imx6q-vpuC* alias: of:N*T*Cfsl,imx6q-vpu Fixes: 2f632369ab79 ("modpost: don't add a trailing wildcard for OF module aliases") Link: http://lkml.kernel.org/r/1462203339-15340-1-git-send-email-p.zabel@pengutronix.de Signed-off-by: Philipp Zabel Cc: Javier Martinez Canillas Cc: Brian Norris Cc: Sjoerd Simons Cc: Rusty Russell Cc: Greg Kroah-Hartman Cc: [4.5+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds scripts/mod/file2alias.c | 69 +++++++++++++++++++++++++++++++----------------- 1 file changed, 45 insertions(+), 24 deletions(-) commit 8148a73c9901a8794a50f950083c00ccf97d43b3 Author: Mathias Krause Date: Thu May 5 16:22:26 2016 -0700 proc: prevent accessing /proc//environ until it's ready If /proc//environ gets read before the envp[] array is fully set up in create_{aout,elf,elf_fdpic,flat}_tables(), we might end up trying to read more bytes than are actually written, as env_start will already be set but env_end will still be zero, making the range calculation underflow, allowing to read beyond the end of what has been written. Fix this as it is done for /proc//cmdline by testing env_end for zero. It is, apparently, intentionally set last in create_*_tables(). This bug was found by the PaX size_overflow plugin that detected the arithmetic underflow of 'this_len = env_end - (env_start + src)' when env_end is still zero. The expected consequence is that userland trying to access /proc//environ of a not yet fully set up process may get inconsistent data as we're in the middle of copying in the environment variables. Fixes: https://forums.grsecurity.net/viewtopic.php?f=3&t=4363 Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=116461 Signed-off-by: Mathias Krause Cc: Emese Revfy Cc: Pax Team Cc: Al Viro Cc: Mateusz Guzik Cc: Alexey Dobriyan Cc: Cyrill Gorcunov Cc: Jarod Wilson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/proc/base.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 32a4e169039927bfb6ee9f0ccbbe3a8aaf13a4bc Author: Dan Streetman Date: Thu May 5 16:22:23 2016 -0700 mm/zswap: provide unique zpool name Instead of using "zswap" as the name for all zpools created, add an atomic counter and use "zswap%x" with the counter number for each zpool created, to provide a unique name for each new zpool. As zsmalloc, one of the zpool implementations, requires/expects a unique name for each pool created, zswap should provide a unique name. The zsmalloc pool creation does not fail if a new pool with a conflicting name is created, unless CONFIG_ZSMALLOC_STAT is enabled; in that case, zsmalloc pool creation fails with -ENOMEM. Then zswap will be unable to change its compressor parameter if its zpool is zsmalloc; it also will be unable to change its zpool parameter back to zsmalloc, if it has any existing old zpool using zsmalloc with page(s) in it. Attempts to change the parameters will result in failure to create the zpool. This changes zswap to provide a unique name for each zpool creation. Fixes: f1c54846ee45 ("zswap: dynamic pool creation") Signed-off-by: Dan Streetman Reported-by: Sergey Senozhatsky Reviewed-by: Sergey Senozhatsky Cc: Dan Streetman Cc: Minchan Kim Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/zswap.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 127393fbe597dd85863a9bdccaa11007e7d4948f Author: Andrea Arcangeli Date: Thu May 5 16:22:20 2016 -0700 mm: thp: kvm: fix memory corruption in KVM with THP enabled After the THP refcounting change, obtaining a compound pages from get_user_pages() no longer allows us to assume the entire compound page is immediately mappable from a secondary MMU. A secondary MMU doesn't want to call get_user_pages() more than once for each compound page, in order to know if it can map the whole compound page. So a secondary MMU needs to know from a single get_user_pages() invocation when it can map immediately the entire compound page to avoid a flood of unnecessary secondary MMU faults and spurious atomic_inc()/atomic_dec() (pages don't have to be pinned by MMU notifier users). Ideally instead of the page->_mapcount < 1 check, get_user_pages() should return the granularity of the "page" mapping in the "mm" passed to get_user_pages(). However it's non trivial change to pass the "pmd" status belonging to the "mm" walked by get_user_pages up the stack (up to the caller of get_user_pages). So the fix just checks if there is not a single pte mapping on the page returned by get_user_pages, and in turn if the caller can assume that the whole compound page is mapped in the current "mm" (in a pmd_trans_huge()). In such case the entire compound page is safe to map into the secondary MMU without additional get_user_pages() calls on the surrounding tail/head pages. In addition of being faster, not having to run other get_user_pages() calls also reduces the memory footprint of the secondary MMU fault in case the pmd split happened as result of memory pressure. Without this fix after a MADV_DONTNEED (like invoked by QEMU during postcopy live migration or balloning) or after generic swapping (with a failure in split_huge_page() that would only result in pmd splitting and not a physical page split), KVM would map the whole compound page into the shadow pagetables, despite regular faults or userfaults (like UFFDIO_COPY) may map regular pages into the primary MMU as result of the pte faults, leading to the guest mode and userland mode going out of sync and not working on the same memory at all times. Any other secondary MMU notifier manager (KVM is just one of the many MMU notifier users) will need the same information if it doesn't want to run a flood of get_user_pages_fast and it can support multiple granularity in the secondary MMU mappings, so I think it is justified to be exposed not just to KVM. The other option would be to move transparent_hugepage_adjust to mm/huge_memory.c but that currently has all kind of KVM data structures in it, so it's definitely not a cut-and-paste work, so I couldn't do a fix as cleaner as this one for 4.6. Signed-off-by: Andrea Arcangeli Cc: "Dr. David Alan Gilbert" Cc: "Kirill A. Shutemov" Cc: "Li, Liang Z" Cc: Amit Shah Cc: Paolo Bonzini Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/arm/kvm/mmu.c | 2 +- arch/x86/kvm/mmu.c | 4 ++-- include/linux/page-flags.h | 22 ++++++++++++++++++++++ 3 files changed, 25 insertions(+), 3 deletions(-) commit ff2de822c94ca733a3f6177691eb0dca5ee2e658 Author: Eric Engestrom Date: Thu May 5 16:22:17 2016 -0700 MAINTAINERS: fix Rajendra Nayak's address Signed-off-by: Eric Engestrom Cc: Rajendra Nayak Cc: Afzal Mohammed Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 14af4a5e9b26ad251f81c174e8a43f3e179434a5 Author: Hugh Dickins Date: Thu May 5 16:22:15 2016 -0700 mm, cma: prevent nr_isolated_* counters from going negative /proc/sys/vm/stat_refresh warns nr_isolated_anon and nr_isolated_file go increasingly negative under compaction: which would add delay when should be none, or no delay when should delay. The bug in compaction was due to a recent mmotm patch, but much older instance of the bug was also noticed in isolate_migratepages_range() which is used for CMA and gigantic hugepage allocations. The bug is caused by putback_movable_pages() in an error path decrementing the isolated counters without them being previously incremented by acct_isolated(). Fix isolate_migratepages_range() by removing the error-path putback, thus reaching acct_isolated() with migratepages still isolated, and leaving putback to caller like most other places do. Fixes: edc2ca612496 ("mm, compaction: move pageblock checks up from isolate_migratepages_range()") [vbabka@suse.cz: expanded the changelog] Signed-off-by: Hugh Dickins Signed-off-by: Vlastimil Babka Acked-by: Joonsoo Kim Cc: Michal Hocko Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/compaction.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) commit bc22af74f271ef76b2e6f72f3941f91f0da3f5f8 Author: Jason Baron Date: Thu May 5 16:22:12 2016 -0700 mm: update min_free_kbytes from khugepaged after core initialization Khugepaged attempts to raise min_free_kbytes if its set too low. However, on boot khugepaged sets min_free_kbytes first from subsys_initcall(), and then the mm 'core' over-rides min_free_kbytes after from init_per_zone_wmark_min(), via a module_init() call. Khugepaged used to use a late_initcall() to set min_free_kbytes (such that it occurred after the core initialization), however this was removed when the initialization of min_free_kbytes was integrated into the starting of the khugepaged thread. The fix here is simply to invoke the core initialization using a core_initcall() instead of module_init(), such that the previous initialization ordering is restored. I didn't restore the late_initcall() since start_stop_khugepaged() already sets min_free_kbytes via set_recommended_min_free_kbytes(). This was noticed when we had a number of page allocation failures when moving a workload to a kernel with this new initialization ordering. On an 8GB system this restores min_free_kbytes back to 67584 from 11365 when CONFIG_TRANSPARENT_HUGEPAGE=y is set and either CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS=y or CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y. Fixes: 79553da293d3 ("thp: cleanup khugepaged startup") Signed-off-by: Jason Baron Acked-by: Kirill A. Shutemov Acked-by: David Rientjes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/page_alloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 684283988f703811b8a05136d0d54f1c31025ad3 Author: Hugh Dickins Date: Thu May 5 16:22:09 2016 -0700 huge pagecache: mmap_sem is unlocked when truncation splits pmd zap_pmd_range()'s CONFIG_DEBUG_VM !rwsem_is_locked(&mmap_sem) BUG() will be invalid with huge pagecache, in whatever way it is implemented: truncation of a hugely-mapped file to an unhugely-aligned size would easily hit it. (Although anon THP could in principle apply khugepaged to private file mappings, which are not excluded by the MADV_HUGEPAGE restrictions, in practice there's a vm_ops check which excludes them, so it never hits this BUG() - there's no interface to "truncate" an anonymous mapping.) We could complicate the test, to check i_mmap_rwsem also when there's a vm_file; but my inclination was to make zap_pmd_range() more readable by simply deleting this check. A search has shown no report of the issue in the years since commit e0897d75f0b2 ("mm, thp: print useful information when mmap_sem is unlocked in zap_pmd_range") expanded it from VM_BUG_ON() - though I cannot point to what commit I would say then fixed the issue. But there are a couple of other patches now floating around, neither yet in the tree: let's agree to retain the check as a VM_BUG_ON_VMA(), as Matthew Wilcox has done; but subject to a vma_is_anonymous() check, as Kirill Shutemov has done. And let's get this in, without waiting for any particular huge pagecache implementation to reach the tree. Matthew said "We can reproduce this BUG() in the current Linus tree with DAX PMDs". Signed-off-by: Hugh Dickins Tested-by: Matthew Wilcox Cc: "Kirill A. Shutemov" Cc: Andrea Arcangeli Cc: Andres Lagar-Cavilla Cc: Yang Shi Cc: Ning Qu Cc: Mel Gorman Cc: Andres Lagar-Cavilla Cc: Konstantin Khlebnikov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memory.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) commit 4e1016dac1ccce6d8a960775526cdc3a5baa690b Author: Alexandre Bounine Date: Thu May 5 16:22:06 2016 -0700 rapidio/mport_cdev: fix uapi type definitions Fix problems in uapi definitions reported by Gabriel Laskar: (see https://lkml.org/lkml/2016/4/5/205 for details) - move public header file rio_mport_cdev.h to include/uapi/linux directory - change types in data structures passed as IOCTL parameters - improve parameter checking in some IOCTL service routines Signed-off-by: Alexandre Bounine Reported-by: Gabriel Laskar Tested-by: Barry Wood Cc: Gabriel Laskar Cc: Matt Porter Cc: Aurelien Jacquiot Cc: Andre van Herk Cc: Barry Wood Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/rapidio/devices/rio_mport_cdev.c | 115 +++++++------ include/linux/rio_mport_cdev.h | 271 ------------------------------ include/uapi/linux/rio_mport_cdev.h | 277 +++++++++++++++++++++++++++++++ 3 files changed, 341 insertions(+), 322 deletions(-) commit 4550c4e157ca3da929593bb6c64080a59141af35 Author: Johannes Weiner Date: Thu May 5 16:22:03 2016 -0700 mm: memcontrol: let v2 cgroups follow changes in system swappiness Cgroup2 currently doesn't have a per-cgroup swappiness setting. We might want to add one later - that's a different discussion - but until we do, the cgroups should always follow the system setting. Otherwise it will be unchangeably set to whatever the ancestor inherited from the system setting at the time of cgroup creation. Signed-off-by: Johannes Weiner Acked-by: Michal Hocko Acked-by: Vladimir Davydov Cc: [4.5] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/swap.h | 4 ++++ 1 file changed, 4 insertions(+) commit 145bdaa1501bf1c8a6cfa8ea5e347b9a46aad1b7 Author: Yang Shi Date: Thu May 5 16:22:00 2016 -0700 mm: thp: correct split_huge_pages file permission split_huge_pages doesn't support get method at all, so the read permission sounds confusing, change the permission to write only. And, add "\n" to the output of set method to make it more readable. Signed-off-by: Yang Shi Acked-by: Kirill A. Shutemov Cc: Andrea Arcangeli Cc: Mel Gorman Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/huge_memory.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 85f397a97aadbea151a42eea6cdab64e2a544e80 Merge: c4781a8 1f93e9f Author: Linus Torvalds Date: Thu May 5 15:40:38 2016 -0700 Merge tag 'asm-generic-4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull asm-generic syscall fix from Arnd Bergmann: "My last pull request for asm-generic had just one patch that added two new system calls to asm/unistd.h, but unfortunately it turned out to be wrong, pointing arch/tile compat mode at the native handlers rather than the compat ones. This was spotted by Yury Norov, who is working on ILP32 mode for arch/arm64, which would have the same problem when merged. This fixes the table to use the correct compat syscalls, like the other 64-bit architectures do. I'll try to find the time to come up with a solution that prevents this problem from happening again, by allowing all future system calls to just get added in a single file for use by all architectures" * tag 'asm-generic-4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: asm-generic: use compat version for preadv2 and pwritev2 commit 2b86c4a84377b74a6ec0ec9463feb0803bcb1066 Merge: 431adc0 393dbe4 Author: Greg Kroah-Hartman Date: Thu May 5 15:38:07 2016 -0700 Merge tag 'iio-fixes-for-4.6d' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus Jonathan writes: Fourth set of IIO fixes for the 4.6 cycle. This last minute set is concerned with a regression in the mpu6050 driver. The regression causes a null pointer dereference on any ACPI device that has one of these present such as the ASUS T100TA Baytrail/T. The issue was known but thought (i.e. missunderstood by me) to only be a possible with no reports, so was routed via the normal merge window. Turns out this was wrong (thanks to Alan for reporting the crash). The pull is just for the null dereference fix and a followup fix that also stops the reported name of the device being NULL. * mpu6050 - Fix a 'possible' NULL dereference introduced as part of splitting the driver to allow both i2c and spi to be supported. The issue affects ACPI systems with this device. - Fix a follow up issue where the name and chip id both get set to null if the device driver instance is instantiated from ACPI tables. commit c4781a8df9566ca13bf3ac6a65f6aae8d3f6e499 Merge: 54176cc ed19ca7 Author: Linus Torvalds Date: Thu May 5 15:31:35 2016 -0700 Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Arnd Bergmann: "Here are a couple last-minute fixes for ARM SoCs. Most of them are for the OMAP platforms, the rest are all for different platforms. OMAP: All dts fixes, mostly affecting voltages and pinctrl for various device drivers: - Regulator minimum voltage fixes for omap5 - ISP syscon register offset fix for omap3 - Fix regulator initial modes for n900 - Fix omap5 pinctrl wkup instance size Allwinner: Remove incorrect constraints from a dcdc1 regulator Alltera SoCFPGA: Fix compilation in thumb2 mode Samsung exynos: Fix a potential oops in the pm-domain error handling Davinci: Avoid a link error if NVMEM is disabled Renesas: Do not mark an external uart clock as disabled, to allow probing the uarts" * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: ARM: davinci: only use NVMEM when available ARM: SoCFPGA: Fix secondary CPU startup in thumb2 kernel ARM: dts: omap5: fix range of permitted wakeup pinmux registers ARM: dts: omap3-n900: Specify peripherals LDO regulators initial mode ARM: dts: omap3: Fix ISP syscon register offset ARM: dts: omap5-cm-t54: fix ldo1_reg and ldo4_reg ranges ARM: dts: omap5-board-common: fix ldo1_reg and ldo4_reg ranges arm64: dts: r8a7795: Don't disable referenced optional scif clock ARM: EXYNOS: Properly skip unitialized parent clock in power domain on ARM: dts: sun8i-q8-common: Do not set constraints on dc1sw regulator commit 54176cc6803844613b3dca13174c13c47e9686db Author: Russell King Date: Thu May 5 17:12:54 2016 +0100 maintainers: update rmk's email address(es) Update my email and web addresses in the kernel maintainers file. Signed-off-by: Russell King Signed-off-by: Linus Torvalds MAINTAINERS | 48 ++++++++++++++++++++++++------------------------ 1 file changed, 24 insertions(+), 24 deletions(-) commit 74d369443325063a5f0260e63971decb950fd8fa Author: Howard Cochran Date: Thu Mar 10 01:12:39 2016 -0500 writeback: Fix performance regression in wb_over_bg_thresh() Commit 947e9762a8dd ("writeback: update wb_over_bg_thresh() to use wb_domain aware operations") unintentionally changed this function's meaning from "are there more dirty pages than the background writeback threshold" to "are there more dirty pages than the writeback threshold". The background writeback threshold is typically half of the writeback threshold, so this had the effect of raising the number of dirty pages required to cause a writeback worker to perform background writeout. This can cause a very severe performance regression when a BDI uses BDI_CAP_STRICTLIMIT because balance_dirty_pages() and the writeback worker can now disagree on whether writeback should be initiated. For example, in a system having 1GB of RAM, a single spinning disk, and a "pass-through" FUSE filesystem mounted over the disk, application code mmapped a 128MB file on the disk and was randomly dirtying pages in that mapping. Because FUSE uses strictlimit and has a default max_ratio of only 1%, in balance_dirty_pages, thresh is ~200, bg_thresh is ~100, and the dirty_freerun_ceiling is the average of those, ~150. So, it pauses the dirtying processes when we have 151 dirty pages and wakes up a background writeback worker. But the worker tests the wrong threshold (200 instead of 100), so it does not initiate writeback and just returns. Thus, balance_dirty_pages keeps looping, sleeping and then waking up the worker who will do nothing. It remains stuck in this state until the few dirty pages that we have finally expire and we write them back for that reason. Then the whole process repeats, resulting in near-zero throughput through the FUSE BDI. The fix is to call the parameterized variant of wb_calc_thresh, so that the worker will do writeback if the bg_thresh is exceeded which was the behavior before the referenced commit. Fixes: 947e9762a8dd ("writeback: update wb_over_bg_thresh() to use wb_domain aware operations") Signed-off-by: Howard Cochran Acked-by: Tejun Heo Signed-off-by: Miklos Szeredi Cc: # v4.2+ Tested-by Sedat Dilek Signed-off-by: Jens Axboe mm/page-writeback.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit ec953b70f368330e806a94df6fe2dd1d72176b2d Author: Vladimir Murzin Date: Wed May 4 10:39:02 2016 +0100 ARM: 8573/1: domain: move {set,get}_domain under config guard Recursive undefined instrcution falut is seen with R-class taking an exception. The reson for that is __show_regs() tries to get domain information, but domains is not available on !MMU cores, like R/M class. Fix it by puting {set,get}_domain functions under CONFIG_CPU_CP15_MMU guard and providing stubs for the case where domains is not supported. Signed-off-by: Vladimir Murzin Signed-off-by: Russell King arch/arm/include/asm/domain.h | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 5b526bd92511a12807a51b7bedd16af03e99bc33 Author: Jean-Philippe Brucker Date: Wed May 4 10:38:12 2016 +0100 ARM: 8572/1: nommu: change memory reserve for the vectors Commit 19accfd3 (ARM: move vector stubs) moved the vector stubs in an additional page above the base vector one. This change wasn't taken into account by the nommu memreserve. This patch ensures that the kernel won't overwrite any vector stub on nommu. [changed the MPU side too] Signed-off-by: Jean-Philippe Brucker Signed-off-by: Vladimir Murzin Signed-off-by: Russell King arch/arm/kernel/head-nommu.S | 2 +- arch/arm/mm/nommu.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 695665b0c5237bee8a3d0099ea856282d5d8f25b Author: Jean-Philippe Brucker Date: Wed May 4 10:37:22 2016 +0100 ARM: 8571/1: nommu: fix PMSAv7 setup Commit 1c2f87c (ARM: 8025/1: Get rid of meminfo) broke the support for MPU on ARMv7-R. This patch adapts the code inside CONFIG_ARM_MPU to use memblocks appropriately. MPU initialisation only uses the first memory region, and removes all subsequent ones. Because looping over all regions that need removal is inefficient, and memblock_remove already handles memory ranges, we can flatten the 'for_each_memblock' part. Signed-off-by: Jean-Philippe Brucker Signed-off-by: Vladimir Murzin Signed-off-by: Russell King arch/arm/mm/nommu.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) commit 9c674815d346305068b27bf03b5e86b659a1b111 Author: Christoph Hellwig Date: Mon Apr 18 17:06:28 2016 -0400 IB/iser: Fix max_sectors calculation iSER currently has a couple places that set max_sectors in either the host template or SCSI host, and all of them get it wrong. This patch instead uses a single assignment that (hopefully) gets it right: the max_sectors value must be derived from the number of segments in the FR or FMR structure, but actually be one lower than the page size multiplied by the number of sectors, as it has to handle the case of non-aligned I/O. Without this I get trivial to reproduce hangs when running xfstests (on XFS) over iSER to Linux targets. Signed-off-by: Christoph Hellwig Reviewed-by: Max Gurtovoy Acked-by: Sagi Grimberg Signed-off-by: Doug Ledford drivers/infiniband/ulp/iser/iscsi_iser.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) commit c5e0666c5a3ccabdf16bb88451886cdf81849b66 Merge: 3cedbec 5ec0811 Author: Linus Torvalds Date: Thu May 5 08:41:57 2016 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace Pull userns fix from Eric Biederman: "This contains just a single fix for a nasty oops" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: propogate_mnt: Handle the first propogated copy being a slave commit 3cedbec301015d8fb914e7e3af0fc0e034b87d34 Merge: 21a9703 e00f7bd Author: Linus Torvalds Date: Thu May 5 08:26:54 2016 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio/qemu fixes from Michael Tsirkin: "A couple of fixes for virtio and for the new QEMU fw cfg driver" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: virtio: Silence uninitialized variable warning firmware: qemu_fw_cfg.c: potential unintialized variable commit e3c00d87845ab375f90fa6e10a5e72a3a5778cd3 Author: Lucas Stach Date: Thu May 5 10:16:44 2016 -0400 drm/radeon: fix PLL sharing on DCE6.1 (v2) On DCE6.1 PPLL2 is exclusively available to UNIPHYA, so it should not be taken into consideration when looking for an already enabled PLL to be shared with other outputs. This fixes the broken VGA port (TRAVIS DP->VGA bridge) on my Richland based laptop, where the internal display is connected to UNIPHYA through a TRAVIS DP->LVDS bridge. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=78987 v2: agd: add check in radeon_get_shared_nondp_ppll as well, drop extra parameter. Signed-off-by: Lucas Stach Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/radeon/atombios_crtc.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 1a738347df2ee4977459a8776fe2c62196bdcb1b Author: Arindam Nath Date: Wed May 4 23:39:59 2016 +0530 drm/radeon: fix DP link training issue with second 4K monitor There is an issue observed when we hotplug a second DP 4K monitor to the system. Sometimes, the link training fails for the second monitor after HPD interrupt generation. The issue happens when some queued or deferred transactions are already present on the AUX channel when we initiate a new transcation to (say) get DPCD or during link training. We set AUX_IGNORE_HPD_DISCON bit in the AUX_CONTROL register so that we can ignore any such deferred transactions when a new AUX transaction is initiated. Signed-off-by: Arindam Nath Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/radeon/radeon_dp_auxch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5ec0811d30378ae104f250bfc9b3640242d81e3f Author: Eric W. Biederman Date: Thu May 5 09:29:29 2016 -0500 propogate_mnt: Handle the first propogated copy being a slave When the first propgated copy was a slave the following oops would result: > BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 > IP: [] propagate_one+0xbe/0x1c0 > PGD bacd4067 PUD bac66067 PMD 0 > Oops: 0000 [#1] SMP > Modules linked in: > CPU: 1 PID: 824 Comm: mount Not tainted 4.6.0-rc5userns+ #1523 > Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007 > task: ffff8800bb0a8000 ti: ffff8800bac3c000 task.ti: ffff8800bac3c000 > RIP: 0010:[] [] propagate_one+0xbe/0x1c0 > RSP: 0018:ffff8800bac3fd38 EFLAGS: 00010283 > RAX: 0000000000000000 RBX: ffff8800bb77ec00 RCX: 0000000000000010 > RDX: 0000000000000000 RSI: ffff8800bb58c000 RDI: ffff8800bb58c480 > RBP: ffff8800bac3fd48 R08: 0000000000000001 R09: 0000000000000000 > R10: 0000000000001ca1 R11: 0000000000001c9d R12: 0000000000000000 > R13: ffff8800ba713800 R14: ffff8800bac3fda0 R15: ffff8800bb77ec00 > FS: 00007f3c0cd9b7e0(0000) GS:ffff8800bfb00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000000000010 CR3: 00000000bb79d000 CR4: 00000000000006e0 > Stack: > ffff8800bb77ec00 0000000000000000 ffff8800bac3fd88 ffffffff811fbf85 > ffff8800bac3fd98 ffff8800bb77f080 ffff8800ba713800 ffff8800bb262b40 > 0000000000000000 0000000000000000 ffff8800bac3fdd8 ffffffff811f1da0 > Call Trace: > [] propagate_mnt+0x105/0x140 > [] attach_recursive_mnt+0x120/0x1e0 > [] graft_tree+0x63/0x70 > [] do_add_mount+0x9b/0x100 > [] do_mount+0x2aa/0xdf0 > [] ? strndup_user+0x4e/0x70 > [] SyS_mount+0x75/0xc0 > [] do_syscall_64+0x4b/0xa0 > [] entry_SYSCALL64_slow_path+0x25/0x25 > Code: 00 00 75 ec 48 89 0d 02 22 22 01 8b 89 10 01 00 00 48 89 05 fd 21 22 01 39 8e 10 01 00 00 0f 84 e0 00 00 00 48 8b 80 d8 00 00 00 <48> 8b 50 10 48 89 05 df 21 22 01 48 89 15 d0 21 22 01 8b 53 30 > RIP [] propagate_one+0xbe/0x1c0 > RSP > CR2: 0000000000000010 > ---[ end trace 2725ecd95164f217 ]--- This oops happens with the namespace_sem held and can be triggered by non-root users. An all around not pleasant experience. To avoid this scenario when finding the appropriate source mount to copy stop the walk up the mnt_master chain when the first source mount is encountered. Further rewrite the walk up the last_source mnt_master chain so that it is clear what is going on. The reason why the first source mount is special is that it it's mnt_parent is not a mount in the dest_mnt propagation tree, and as such termination conditions based up on the dest_mnt mount propgation tree do not make sense. To avoid other kinds of confusion last_dest is not changed when computing last_source. last_dest is only used once in propagate_one and that is above the point of the code being modified, so changing the global variable is meaningless and confusing. Cc: stable@vger.kernel.org fixes: f2ebb3a921c1ca1e2ddd9242e95a1989a50c4c68 ("smarter propagate_mnt()") Reported-by: Tycho Andersen Reviewed-by: Seth Forshee Tested-by: Seth Forshee Signed-off-by: "Eric W. Biederman" fs/pnode.c | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) commit eda3fc50daa93b08774a18d51883c5a5d8d85e15 Author: Phil Turnbull Date: Tue May 3 16:39:19 2016 -0400 netfilter: nfnetlink_acct: validate NFACCT_QUOTA parameter If a quota bit is set in NFACCT_FLAGS but the NFACCT_QUOTA parameter is missing then a NULL pointer dereference is triggered. CAP_NET_ADMIN is required to trigger the bug. Signed-off-by: Phil Turnbull Signed-off-by: Pablo Neira Ayuso net/netfilter/nfnetlink_acct.c | 2 ++ 1 file changed, 2 insertions(+) commit c10fcb14c7afd6688c7b197a814358fecf244222 Author: Wang YanQing Date: Thu May 5 14:14:21 2016 +0100 x86/sysfb_efi: Fix valid BAR address range check The code for checking whether a BAR address range is valid will break out of the loop when a start address of 0x0 is encountered. This behaviour is wrong since by breaking out of the loop we may miss the BAR that describes the EFI frame buffer in a later iteration. Because of this bug I can't use video=efifb: boot parameter to get efifb on my new ThinkPad E550 for my old linux system hard disk with 3.10 kernel. In 3.10, efifb is the only choice due to DRM/I915 not supporting the GPU. This patch also add a trivial optimization to break out after we find the frame buffer address range without testing later BARs. Signed-off-by: Wang YanQing [ Rewrote changelog. ] Signed-off-by: Matt Fleming Reviewed-by: Peter Jones Cc: Cc: Ard Biesheuvel Cc: David Herrmann Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Tomi Valkeinen Cc: linux-efi@vger.kernel.org Link: http://lkml.kernel.org/r/1462454061-21561-2-git-send-email-matt@codeblueprint.co.uk Signed-off-by: Ingo Molnar arch/x86/kernel/sysfb_efi.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) commit 26f9d5fd82ca20fe536cb493ec7cf5628f8997e5 Author: Vineet Gupta Date: Mon Apr 18 10:49:56 2016 +0530 ARC: support HIGHMEM even without PAE40 Initial HIGHMEM support on ARC was introduced for PAE40 where the low memory (0x8000_0000 based) and high memory (0x1_0000_0000) were physically contiguous. So CONFIG_FLATMEM sufficed (despite a peipheral hole in the middle, which wasted a bit of struct page memory, but things worked). However w/o PAE, highmem was not possible and we could only reach ~1.75GB of DDR. Now there is a use case to access ~4GB of DDR w/o PAE40 The idea is to have low memory at canonical 0x8000_0000 and highmem at 0 so enire 4GB address space is available for physical addressing This needs additional platform/interconnect mapping to convert the non contiguous physical addresses into linear bus adresses. From Linux point of view, non contiguous divide means FLATMEM no longer works and DISCONTIGMEM is needed to track the pfns in the 2 regions. This scheme would also work for PAE40, only better in that we don't waste struct page memory for the peripheral hole. The DT description will be something like memory { ... reg = <0x80000000 0x200000000 /* 512MB: lowmem */ 0x00000000 0x10000000>; /* 256MB: highmem */ } Signed-off-by: Noam Camus Signed-off-by: Vineet Gupta arch/arc/Kconfig | 13 +++++++++++ arch/arc/include/asm/mmzone.h | 43 ++++++++++++++++++++++++++++++++++ arch/arc/include/asm/page.h | 6 ++--- arch/arc/mm/init.c | 54 +++++++++++++++++++++++++++++++------------ 4 files changed, 98 insertions(+), 18 deletions(-) commit 2519d753676bdf2460fbbcde276d5b6ba8d6b695 Author: Vineet Gupta Date: Thu May 5 14:53:48 2016 +0530 ARC: Fix PAE40 boot failures due to PTE truncation So a benign looking cleanup which macro'ized PAGE_SHIFT shifts turned out to be bad (since it was done non-sensically across the board). It caused boot failures with PAE40 as forced cast to (unsigned long) from newly introduced virt_to_pfn() was causing truncatiion of the (long long) pte/paddr values. It is OK to use this in accessors dealing with kernel virtual address, pointers etc, but not for PTE values themelves. Fixes: cJ2ff5cf2735c ("ARC: mm: Use virt_to_pfn() for addr >> PAGE_SHIFT pattern) Signed-off-by: Vineet Gupta arch/arc/include/asm/page.h | 9 ++++++++- arch/arc/include/asm/pgtable.h | 13 ++++++------- 2 files changed, 14 insertions(+), 8 deletions(-) commit e5bc0478ab6cf565619224536d75ecb2aedca43b Author: Vineet Gupta Date: Thu May 5 13:32:34 2016 +0530 ARC: Add missing io barriers to io{read,write}{16,32}be() While reviewing a different change to asm-generic/io.h Arnd spotted that ARC ioread32 and ioread32be both of which come from asm-generic versions are not symmetrical in terms of calling the io barriers. generic ioread32 -> ARC readl() [ has barriers] generic ioread32be -> __be32_to_cpu(__raw_readl()) [ lacks barriers] While generic ioread32be is being remediated to call readl(), that involves a swab32(), causing double swaps on ioread32be() on Big Endian systems. So provide our versions of big endian IO accessors to ensure io barrier calls while also keeping them optimal Suggested-by: Arnd Bergmann Acked-by: Arnd Bergmann Cc: stable@vger.kernel.org [4.2+] Signed-off-by: Vineet Gupta arch/arc/include/asm/io.h | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) commit b34ecd5aa34800aefa9e2990a805243ec9348437 Author: Mauro Carvalho Chehab Date: Thu May 5 08:01:34 2016 -0300 [media] media-device: fix builds when USB or PCI is compiled as module Just checking ifdef CONFIG_USB is not enough, if the USB is compiled as module. The same applies to PCI. Tested with the following .config alternatives: CONFIG_USB=m CONFIG_MEDIA_CONTROLLER=y CONFIG_MEDIA_SUPPORT=m CONFIG_VIDEO_AU0828=m CONFIG_USB=m CONFIG_MEDIA_CONTROLLER=y CONFIG_MEDIA_SUPPORT=y CONFIG_VIDEO_AU0828=m CONFIG_USB=y CONFIG_MEDIA_CONTROLLER=y CONFIG_MEDIA_SUPPORT=y CONFIG_VIDEO_AU0828=m CONFIG_USB=y CONFIG_MEDIA_CONTROLLER=y CONFIG_MEDIA_SUPPORT=y CONFIG_VIDEO_AU0828=y Signed-off-by: Mauro Carvalho Chehab drivers/media/media-device.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 8482716b9d865db34c55d4bf2fed19498e7195b9 Author: Peter Zijlstra Date: Sun Apr 24 00:42:55 2016 +0200 perf/x86/amd/iommu: Do not register a task ctx for uncore like PMUs The new sanity check introduced by: 26657848502b ("perf/core: Verify we have a single perf_hw_context PMU") ... triggered on the AMD IOMMU driver. IOMMUs are not per logical CPU, they cannot have per-task counters. Fix it. Reported-by: Borislav Petkov Tested-by: Borislav Petkov Signed-off-by: Peter Zijlstra (Intel) Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Cc: jroedel@suse.de Cc: suravee.suthikulpanit@amd.com Link: http://lkml.kernel.org/r/20160423224255.GB3430@twins.programming.kicks-ass.net Signed-off-by: Ingo Molnar arch/x86/events/amd/iommu.c | 1 + 1 file changed, 1 insertion(+) commit 08914f436bdd2ed60923f49cbc402307aba20fe4 Author: Alex Thorlton Date: Wed May 4 17:39:52 2016 -0500 x86/platform/UV: Bring back the call to map_low_mmrs in uv_system_init A while back the following commit: d394f2d9d8e1 ("x86/platform/UV: Remove EFI memmap quirk for UV2+") changed uv_system_init() to only call map_low_mmrs() on older UV1 hardware, which requires EFI_OLD_MEMMAP to be set in order to boot. The recent changes to the EFI memory mapping code in: d2f7cbe7b26a ("x86/efi: Runtime services virtual mapping") exposed some issues with the fact that we were relying on the EFI memory mapping mechanisms to map in our MMRs for us, after commit d394f2d9d8e1. Rather than revert the entire commit and go back to forcing EFI_OLD_MEMMAP on all UVs, we're going to add the call to map_low_mmrs() back into uv_system_init(), and then fix up our EFI runtime calls to use the appropriate page table. For now, UV2+ will still need efi=old_map to boot, but there will be other changes soon that should eliminate the need for this. Signed-off-by: Alex Thorlton Cc: Matt Fleming Cc: Adam Buchbinder Cc: Len Brown Cc: Borislav Petkov Cc: Russ Anderson Cc: Dimitri Sivanich Link: http://lkml.kernel.org/r/1462401592-120735-1-git-send-email-athorlton@sgi.com Signed-off-by: Ingo Molnar arch/x86/kernel/apic/x2apic_uv_x.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit cba1b3798e2c4c094f2079a0d4c1ba4ec2c5a9ac Author: Andi Kleen Date: Fri Apr 29 17:55:48 2016 -0700 perf/x86: Add model numbers for Kabylake CPUs Everything the same as Skylake, just new model numbers. Signed-off-by: Andi Kleen Signed-off-by: Peter Zijlstra (Intel) Link: http://lkml.kernel.org/r/1461977748-17616-1-git-send-email-andi@firstfloor.org Signed-off-by: Ingo Molnar arch/x86/events/intel/core.c | 2 ++ 1 file changed, 2 insertions(+) commit 58446fef579e5214dc6fffd28cc538051efe1f24 Author: Tadeusz Struk Date: Wed May 4 06:38:46 2016 -0700 crypto: rsa - select crypto mgr dependency The pkcs1pad template needs CRYPTO_MANAGER so it needs to be explicitly selected by CRYPTO_RSA. Reported-by: Jamie Heilman Signed-off-by: Tadeusz Struk Signed-off-by: Herbert Xu crypto/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 13f4bb78cf6a312bbdec367ba3da044b09bf0e29 Author: Herbert Xu Date: Wed May 4 17:52:56 2016 +0800 crypto: hash - Fix page length clamping in hash walk The crypto hash walk code is broken when supplied with an offset greater than or equal to PAGE_SIZE. This patch fixes it by adjusting walk->pg and walk->offset when this happens. Cc: Reported-by: Steffen Klassert Signed-off-by: Herbert Xu crypto/ahash.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit fca097169faf8b9cfe92d8926da7a1fa2d3cd452 Merge: 80623de 4ea3959 Author: Dave Airlie Date: Thu May 5 12:12:09 2016 +1000 Merge tag 'drm-intel-fixes-2016-05-02' of git://anongit.freedesktop.org/drm-intel into drm-fixes i915 fixes for 4.6. A bit more than I'd like at this stage, but OTOH they're all stable material. * tag 'drm-intel-fixes-2016-05-02' of git://anongit.freedesktop.org/drm-intel: drm/i915: Make RPS EI/thresholds multiple of 25 on SNB-BDW drm/i915: Fake HDMI live status drm/i915: Fix eDP low vswing for Broadwell drm/i915/ddi: Fix eDP VDD handling during booting and suspend/resume drm/i915: Fix system resume if PCI device remained enabled drm/i915: Avoid stalling on pending flips for legacy cursor updates commit 80623de03b97efef8df4c8067ab606585663e042 Merge: 503fe87 0126d4b Author: Dave Airlie Date: Thu May 5 10:37:25 2016 +1000 Merge branch 'drm-fixes-4.6' of git://people.freedesktop.org/~agd5f/linux into drm-fixes two fixes for hw lockups and one for a double free * 'drm-fixes-4.6' of git://people.freedesktop.org/~agd5f/linux: drm/amdgpu: make sure vertical front porch is at least 1 drm/radeon: make sure vertical front porch is at least 1 drm/amdgpu: set metadata pointer to NULL after freeing. commit 503fe87bd0a8346ba9d8b7f49115dcd0a4185226 Author: Philipp Zabel Date: Wed Apr 27 10:17:51 2016 +0200 gpu: ipu-v3: Fix imx-ipuv3-crtc module autoloading If of_node is set before calling platform_device_add, the driver core will try to use of: modalias matching, which fails because the device tree nodes don't have a compatible property set. This patch fixes imx-ipuv3-crtc module autoloading by setting the of_node property only after the platform modalias is set. Fixes: 304e6be652e2 ("gpu: ipu-v3: Assign of_node of child platform devices to corresponding ports") Reported-by: Dennis Gilmore Signed-off-by: Philipp Zabel Tested-By: Dennis Gilmore Cc: stable@vger.kernel.org # 4.4+ Signed-off-by: Dave Airlie drivers/gpu/ipu-v3/ipu-common.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 21f8a99ce61b2d4b74bd425a5bf7e9efbe162788 Author: Viresh Kumar Date: Wed May 4 18:49:55 2016 +0530 PM / OPP: Remove useless check Regulators are optional for devices using OPPs and the OPP core shouldn't be printing any errors for such missing regulators. It was fine before the commit 0c717d0f9cb4, but that failed to update this part of the code to remove an 'always true' check and an extra unwanted print message. Fix that now. Fixes: 0c717d0f9cb4 (PM / OPP: Initialize regulator pointer to an error value) Reported-by: Marc Gonzalez Signed-off-by: Viresh Kumar Reviewed-by: Stephen Boyd Signed-off-by: Rafael J. Wysocki drivers/base/power/opp/core.c | 3 --- 1 file changed, 3 deletions(-) commit 21a9703de3045cda0b3aaa5bc193d2e1062908d2 Merge: 4810d96 eb43335 Author: Linus Torvalds Date: Wed May 4 16:07:50 2016 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: atmel_mxt_ts - use mxt_acquire_irq in mxt_soft_reset Input: zforce_ts - fix dual touch recognition Input: twl6040-vibra - fix atomic schedule panic commit 1f93e9f2318b598e6775a1fc9701604993c512b1 Author: Yury Norov Date: Mon May 2 19:12:47 2016 +0300 asm-generic: use compat version for preadv2 and pwritev2 Compat architectures that does not use generic unistd (mips, s390), declare compat version in their syscall tables for preadv2 and pwritev2. Generic unistd syscall table should do it as well. [arnd: this initially slipped through the review and an incorrect patch got merged. arch/tile/ is the only architecture that could be affected for their 32-bit compat mode, every other architecture we support today is fine.] Signed-off-by: Yury Norov Signed-off-by: Arnd Bergmann include/uapi/asm-generic/unistd.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit c2cf530d42437fa2a1fce7b56ea4b478ec35b42a Merge: 32b583a 7d2837d Author: David S. Miller Date: Wed May 4 17:11:39 2016 -0400 Merge branch 'bnxt_en-fixes' Michael Chan says: ==================== bnxt_en: 2 bug fixes. Fix crash on ppc64 due to missing memory barrier and restore multicast after reset. ==================== Signed-off-by: David S. Miller commit 7d2837dd7a3239e8201d9bef75c1a708e451e123 Author: Michael Chan Date: Wed May 4 16:56:44 2016 -0400 bnxt_en: Setup multicast properly after resetting device. The multicast/all-multicast internal flags are not properly restored after device reset. This could lead to unreliable multicast operations after an ethtool configuration change for example. Call bnxt_mc_list_updated() and setup the vnic->mask in bnxt_init_chip() to fix the issue. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) commit 67a95e2022c7f0405408fb1f910283785ece354a Author: Michael Chan Date: Wed May 4 16:56:43 2016 -0400 bnxt_en: Need memory barrier when processing the completion ring. The code determines if the next ring entry is valid before proceeding further to read the rest of the entry. The CPU can re-order and read the rest of the entry first, possibly reading a stale entry, if DMA of a new entry happens right after reading it. This issue can be readily seen on a ppc64 system, causing it to crash. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 ++++ 1 file changed, 4 insertions(+) commit 93d68841a23a5779cef6fb9aa0ef32e7c5bd00da Author: Prarit Bhargava Date: Wed May 4 13:48:56 2016 +0800 ACPICA: Dispatcher: Update thread ID for recursive method calls ACPICA commit 7a3bd2d962f221809f25ddb826c9e551b916eb25 Set the mutex owner thread ID. Original patch from: Prarit Bhargava Link: https://bugzilla.kernel.org/show_bug.cgi?id=115121 Link: https://github.com/acpica/acpica/commit/7a3bd2d9 Signed-off-by: Prarit Bhargava Tested-by: Andy Lutomirski # On a Dell XPS 13 9350 Signed-off-by: Bob Moore Signed-off-by: Lv Zheng Cc: All applicable Signed-off-by: Rafael J. Wysocki drivers/acpi/acpica/dsmethod.c | 3 +++ 1 file changed, 3 insertions(+) commit 32b583a0cb9b757d68c44f2819fa6ccf95dbb953 Merge: 5f8e447 d6af1a3 Author: David S. Miller Date: Wed May 4 16:35:31 2016 -0400 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2016-05-04 1) The flowcache can hit an OOM condition if too many entries are in the gc_list. Fix this by counting the entries in the gc_list and refuse new allocations if the value is too high. 2) The inner headers are invalid after a xfrm transformation, so reset the skb encapsulation field to ensure nobody tries access the inner headers. Otherwise tunnel devices stacked on top of xfrm may build the outer headers based on wrong informations. 3) Add pmtu handling to vti, we need it to report pmtu informations for local generated packets. Please pull or let me know if there are problems. ==================== Signed-off-by: David S. Miller commit 5f8e44741f9f216e33736ea4ec65ca9ac03036e6 Author: Kangjie Lu Date: Tue May 3 16:46:24 2016 -0400 net: fix infoleak in rtnetlink The stack object “map” has a total size of 32 bytes. Its last 4 bytes are padding generated by compiler. These padding bytes are not initialized and sent out via “nla_put”. Signed-off-by: Kangjie Lu Signed-off-by: David S. Miller net/core/rtnetlink.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) commit b8670c09f37bdf2847cc44f36511a53afc6161fd Author: Kangjie Lu Date: Tue May 3 16:35:05 2016 -0400 net: fix infoleak in llc The stack object “info” has a total size of 12 bytes. Its last byte is padding which is not initialized and leaked via “put_cmsg”. Signed-off-by: Kangjie Lu Signed-off-by: David S. Miller net/llc/af_llc.c | 1 + 1 file changed, 1 insertion(+) commit 4810d9682971e8eee659f96e4f9d9154e3c6c0b4 Merge: 41143b7 cf90ea9 Author: Linus Torvalds Date: Wed May 4 11:14:00 2016 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull IMA fix from James Morris. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: ima: fix the string representation of the LSM/IMA hook enumeration ordering commit 1c021bb717a70aaeaa4b25c91f43c2aeddd922de Author: Uwe Kleine-König Date: Tue May 3 16:38:53 2016 +0200 net: fec: only clear a queue's work bit if the queue was emptied In the receive path a queue's work bit was cleared unconditionally even if fec_enet_rx_queue only read out a part of the available packets from the hardware. This resulted in not reading any packets in the next napi turn and so packets were delayed or lost. The obvious fix is to only clear a queue's bit when the queue was emptied. Fixes: 4d494cdc92b3 ("net: fec: change data structure to support multiqueue") Signed-off-by: Uwe Kleine-König Reviewed-by: Lucas Stach Tested-by: Fugang Duan Acked-by: Fugang Duan Signed-off-by: David S. Miller drivers/net/ethernet/freescale/fec_main.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit 6a480a7842545ec520a91730209ec0bae41694c1 Author: Al Viro Date: Wed May 4 14:04:13 2016 -0400 ecryptfs: fix handling of directory opening First of all, trying to open them r/w is idiocy; it's guaranteed to fail. Moreover, assigning ->f_pos and assuming that everything will work is blatantly broken - try that with e.g. tmpfs as underlying layer and watch the fireworks. There may be a non-trivial amount of state associated with current IO position, well beyond the numeric offset. Using the single struct file associated with underlying inode is really not a good idea; we ought to open one for each ecryptfs directory struct file. Additionally, file_operations both for directories and non-directories are full of pointless methods; non-directories should *not* have ->iterate(), directories should not have ->flush(), ->fasync() and ->splice_read(). Signed-off-by: Al Viro fs/ecryptfs/file.c | 71 ++++++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 55 insertions(+), 16 deletions(-) commit 20decb7e486d7eefff3931f58d092d2d7c024a1c Author: Matthias Brugger Date: Tue May 3 16:05:07 2016 +0200 drivers: net: xgene: Fix error handling When probe bails out with an error, we try to unregister the netdev before we have even registered it. Fix the goto statements for that. Signed-off-by: Matthias Brugger Signed-off-by: David S. Miller drivers/net/ethernet/apm/xgene/xgene_enet_main.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 41143b774af2b37c24026521e6eae4c914bd731d Merge: 83858a7 27e0e63 Author: Linus Torvalds Date: Wed May 4 11:00:05 2016 -0700 Merge tag 'for-linus-4.6-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen regression fixes from David Vrabel: - Fix two regressions causing crashes in 32-bit PV guests - Fix a regression in the evtchn driver * tag 'for-linus-4.6-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/evtchn: fix ring resize when binding new events xen/balloon: Fix crash when ballooning on x86 32 bit PAE xen: Fix page <-> pfn conversion on 32 bit systems commit 5c08b0f5026fcc13efb947c4d1f2ca3558145f68 Author: Emmanuel Grumbach Date: Tue May 3 12:08:43 2016 +0300 iwlwifi: mvm: don't override the rate with the AMSDU len The TSO code creates A-MSDUs from a single large send. Each A-MSDU is an skb and skb->len doesn't include the number of bytes which need to be added for the headers being added (subframe header, TCP header, IP header, SNAP, padding). To be able to set the right value in the Tx command, we put the number of bytes added by those headers in driver_data in iwl_mvm_tx_tso and use this value in iwl_mvm_set_tx_cmd. The problem by setting this value in driver_data is that it overrides the ieee80211_tx_info. The bug manifested itself when we send P2P related frames in CCK since the rate in ieee80211_tx_info is zero-ed. This of course is a violation of the P2P specification. To fix this, copy the original ieee80211_tx_info to the stack and pass it to the functions which need it. Assign the number of bytes added by the headers to the driver_data inside the skb itself. Fixes: a6d5e32f247c ("iwlwifi: mvm: send large SKBs to the transport") Signed-off-by: Emmanuel Grumbach drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 83 +++++++++++++++++------------ 1 file changed, 48 insertions(+), 35 deletions(-) commit 27e0e6385377c4dc68a4ddaf1a35a2dfa951f3c5 Author: Jan Beulich Date: Wed May 4 07:02:36 2016 -0600 xen/evtchn: fix ring resize when binding new events The copying of ring data was wrong for two cases: For a full ring nothing got copied at all (as in that case the canonicalized producer and consumer indexes are identical). And in case one or both of the canonicalized (after the resize) indexes would point into the second half of the buffer, the copied data ended up in the wrong (free) part of the new buffer. In both cases uninitialized data would get passed back to the caller. Fix this by simply copying the old ring contents twice: Once to the low half of the new buffer, and a second time to the high half. This addresses the inability to boot a HVM guest with 64 or more vCPUs. This regression was caused by 8620015499101090 (xen/evtchn: dynamically grow pending event channel ring). Reported-by: Konrad Rzeszutek Wilk Signed-off-by: Jan Beulich Cc: # 4.4+ Signed-off-by: David Vrabel drivers/xen/evtchn.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) commit 6d45b719cbd51f014bb1b5dd8ed99068d78d36af Author: Rafael J. Wysocki Date: Wed May 4 14:01:10 2016 +0200 intel_pstate: Fix intel_pstate_get() After commit 8fa520af5081 "intel_pstate: Remove freq calculation from intel_pstate_calc_busy()" intel_pstate_get() calls get_avg_frequency() to compute the average frequency, which is problematic for two reasons. First, intel_pstate_get() may be invoked before the driver reads the CPU feedback registers for the first time and if that happens, get_avg_frequency() will attempt to divide by zero. Second, the get_avg_frequency() call in intel_pstate_get() is racy with respect to intel_pstate_sample() and it may end up returning completely meaningless values for this reason. Moreover, after commit 7349ec0470b6 "intel_pstate: Move intel_pstate_calc_busy() into get_target_pstate_use_performance()" sample.core_pct_busy is never computed on Atom, but it is used in intel_pstate_adjust_busy_pstate() in that case too. To address those problems notice that if sample.core_pct_busy was used in the average frequency computation carried out by get_avg_frequency(), both the divide by zero problem and the race with respect to intel_pstate_sample() would be avoided. Accordingly, move the invocation of intel_pstate_calc_busy() from get_target_pstate_use_performance() to intel_pstate_update_util(), which also will take care of the uninitialized sample.core_pct_busy on Atom, and modify get_avg_frequency() to use sample.core_pct_busy as per the above. Reported-by: kernel test robot Link: http://marc.info/?l=linux-kernel&m=146226437623173&w=4 Fixes: 8fa520af5081 "intel_pstate: Remove freq calculation from intel_pstate_calc_busy()" Fixes: 7349ec0470b6 "intel_pstate: Move intel_pstate_calc_busy() into get_target_pstate_use_performance()" Signed-off-by: Rafael J. Wysocki drivers/cpufreq/intel_pstate.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) commit cf90ea934028375805e2d39c796eb276001574d7 Author: Mimi Zohar Date: Tue Apr 19 17:42:43 2016 -0400 ima: fix the string representation of the LSM/IMA hook enumeration ordering This patch fixes the string representation of the LSM/IMA hook enumeration ordering used for displaying the IMA policy. Fixes: d9ddf077bb85 ("ima: support for kexec image and initramfs") Signed-off-by: Mimi Zohar Tested-by: Eric Richter Signed-off-by: James Morris security/integrity/ima/ima_policy.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 393dbe4e18dd5b17b3952c7d36ac88f61ec40924 Author: Daniel Baluta Date: Thu Mar 17 18:32:44 2016 +0200 iio: imu: mpu6050: Fix name/chip_id when using ACPI When using ACPI, id is NULL and the current code automatically defaults name to NULL and chip id to 0. We should instead use the data provided in the ACPI device table. Fixes: c816d9e7a57b ("iio: imu: mpu6050: fix possible NULL dereferences") Signed-off-by: Daniel Baluta Reviewed-By: Matt Ranostay Signed-off-by: Jonathan Cameron drivers/iio/imu/inv_mpu6050/inv_mpu_i2c.c | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) commit 140afdd9626cdaaf54223e82931213de785c7c94 Author: Matt Ranostay Date: Wed Mar 2 19:18:12 2016 -0800 iio: imu: mpu6050: fix possible NULL dereferences Fix possible null dereferencing of i2c and spi driver data. Signed-off-by: Matt Ranostay Signed-off-by: Jonathan Cameron drivers/iio/imu/inv_mpu6050/inv_mpu_i2c.c | 3 ++- drivers/iio/imu/inv_mpu6050/inv_mpu_spi.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) commit 26792526cc3e29e3ccbc15c996beb61fa64be5af Author: Lyude Date: Tue May 3 11:01:32 2016 -0400 Revert "drm/i915: start adding dp mst audio" Right now MST audio is causing too many kernel panics to really keep around in the kernel. On top of that, even after fixing said panics it's still basically non-functional (at least on all the setups I've tested it on). Revert until we have a proper solution for this. This reverts commit 3d52ccf52f2c51f613e42e65be0f06e4e6788093. Signed-off-by: Lyude Fixes: 3d52ccf52f2c ("drm/i915: start adding dp mst audio") Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/1462287692-28570-1-git-send-email-cpaul@redhat.com (cherry picked from commit 5a8f97ea04c98201deeb973c3f711c3c156115e9) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_debugfs.c | 16 ---------------- drivers/gpu/drm/i915/intel_audio.c | 9 +++------ drivers/gpu/drm/i915/intel_ddi.c | 24 +++++------------------- drivers/gpu/drm/i915/intel_dp_mst.c | 22 ---------------------- drivers/gpu/drm/i915/intel_drv.h | 2 -- 5 files changed, 8 insertions(+), 65 deletions(-) commit d6a862fe8c48229ba342648bcd535b2404724603 Author: Imre Deak Date: Tue May 3 15:54:19 2016 +0300 drm/i915/bdw: Add missing delay during L3 SQC credit programming BSpec requires us to wait ~100 clocks before re-enabling clock gating, so make sure we do this. CC: stable@vger.kernel.org CC: Ville Syrjälä Signed-off-by: Imre Deak Reviewed-by: Ville Syrjälä Link: http://patchwork.freedesktop.org/patch/msgid/1462280061-1457-2-git-send-email-imre.deak@intel.com (cherry picked from commit 48e5d68d28f00c0cadac5a830980ff3222781abb) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_pm.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 8bea61f0585f9851d3fd69315861248d72960833 Author: Jani Nikula Date: Fri Apr 29 15:34:02 2016 +0300 drm/i915/lvds: separate border enable readout from panel fitter The LVDS border enable is independent from the panel fitter. Move the readout of the "border bits" from i9xx_get_pfit_config() to intel_lvds_get_config(), where it will be read if LVDS is enabled even if the panel fitter is not. This fixes the state checker warning: [drm:intel_pipe_config_compare [i915]] *ERROR* mismatch in gmch_pfit.lvds_border_bits (expected 0x00008000, found 0x00000000) Cc: Ville Syrjälä Cc: drm-intel-fixes@lists.freedesktop.org Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=87632 Reviewed-by: Ville Syrjälä Tested-by: Sitsofe Wheeler Signed-off-by: Jani Nikula Link: http://patchwork.freedesktop.org/patch/msgid/1461933243-2140-1-git-send-email-jani.nikula@intel.com (cherry picked from commit a0cbe6a3f1c0e86342965430b4a775b5d35b416b) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_display.c | 3 --- drivers/gpu/drm/i915/intel_lvds.c | 4 ++++ 2 files changed, 4 insertions(+), 3 deletions(-) commit a04e23d42a1ce5d5f421692bb1c7e9352832819d Author: Ville Syrjälä Date: Tue Apr 26 19:46:32 2016 +0300 drm/i915: Update CDCLK_FREQ register on BDW after changing cdclk frequency Update CDCLK_FREQ on BDW after changing the cdclk frequency. Not sure if this is a late addition to the spec, or if I simply overlooked this step when writing the original code. This is what Bspec has to say about CDCLK_FREQ: "Program this field to the CD clock frequency minus one. This is used to generate a divided down clock for miscellaneous timers in display." And the "Broadwell Sequences for Changing CD Clock Frequency" section clarifies this further: "For CD clock 337.5 MHz, program 337 decimal. For CD clock 450 MHz, program 449 decimal. For CD clock 540 MHz, program 539 decimal. For CD clock 675 MHz, program 674 decimal." Cc: stable@vger.kernel.org Cc: Mika Kahola Fixes: b432e5cfd5e9 ("drm/i915: BDW clock change support") Signed-off-by: Ville Syrjälä Link: http://patchwork.freedesktop.org/patch/msgid/1461689194-6079-2-git-send-email-ville.syrjala@linux.intel.com Reviewed-by: Mika Kahola (cherry picked from commit 7f1052a8fa38df635ab0dc0e6025b64ab9834824) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_reg.h | 2 ++ drivers/gpu/drm/i915/intel_display.c | 2 ++ 2 files changed, 4 insertions(+) commit 7f9b474c92713067237c8188f32791cc4007b5da Author: Josh Boyer Date: Tue May 3 20:29:41 2016 +0100 x86/efi-bgrt: Switch all pr_err() to pr_notice() for invalid BGRT The promise of pretty boot splashes from firmware via BGRT was at best only that; a promise. The kernel diligently checks to make sure the BGRT data firmware gives it is valid, and dutifully warns the user when it isn't. However, it does so via the pr_err log level which seems unnecessary. The user cannot do anything about this and there really isn't an error on the part of Linux to correct. This lowers the log level by using pr_notice instead. Users will no longer have their boot process uglified by the kernel reminding us that firmware can and often is broken when the 'quiet' kernel parameter is specified. Ironic, considering BGRT is supposed to make boot pretty to begin with. Signed-off-by: Josh Boyer Signed-off-by: Matt Fleming Reviewed-by: Josh Triplett Cc: Andy Lutomirski Cc: Ard Biesheuvel Cc: Borislav Petkov Cc: Brian Gerst Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Linus Torvalds Cc: Môshe van der Sterre Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Link: http://lkml.kernel.org/r/1462303781-8686-4-git-send-email-matt@codeblueprint.co.uk Signed-off-by: Ingo Molnar arch/x86/platform/efi/efi-bgrt.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) commit e8dfe6d8f6762d515fcd4f30577f7bfcf7659887 Author: Matt Fleming Date: Tue May 3 20:29:39 2016 +0100 MAINTAINERS: Remove asterisk from EFI directory names Mark reported that having asterisks on the end of directory names confuses get_maintainer.pl when it encounters subdirectories, and that my name does not appear when run on drivers/firmware/efi/libstub. Reported-by: Mark Rutland Signed-off-by: Matt Fleming Cc: Cc: Ard Biesheuvel Cc: Catalin Marinas Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Link: http://lkml.kernel.org/r/1462303781-8686-2-git-send-email-matt@codeblueprint.co.uk Signed-off-by: Ingo Molnar MAINTAINERS | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 83858a701cf3271f81dd321c2a81e5666c6ca8f4 Merge: 7391daf 854145e Author: Linus Torvalds Date: Tue May 3 18:02:38 2016 -0700 Merge tag 'trace-fixes-v4.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fix from Steven Rostedt: "Chunyu Hu noticed that if one writes into the trigger files within the ftrace subsystem of events that it can cause an oops. This file is only writable by root, but still is a bug that needs to be fixed" * tag 'trace-fixes-v4.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing: Don't display trigger file for events that can't be enabled commit 7391daf2ffc780679d6ab3fad1db2619e5dd2c2a Merge: 610603a 79e8dc8 Author: Linus Torvalds Date: Tue May 3 15:07:50 2016 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: "Some straggler bug fixes: 1) Batman-adv DAT must consider VLAN IDs when choosing candidate nodes, from Antonio Quartulli. 2) Fix botched reference counting of vlan objects and neigh nodes in batman-adv, from Sven Eckelmann. 3) netem can crash when it sees GSO packets, the fix is to segment then upon ->enqueue. Fix from Neil Horman with help from Eric Dumazet. 4) Fix VXLAN dependencies in mlx5 driver Kconfig, from Matthew Finlay. 5) Handle VXLAN ops outside of rcu lock, via a workqueue, in mlx5, since it can sleep. Fix also from Matthew Finlay. 6) Check mdiobus_scan() return values properly in pxa168_eth and macb drivers. From Sergei Shtylyov. 7) If the netdevice doesn't support checksumming, disable segmentation. From Alexandery Duyck. 8) Fix races between RDS tcp accept and sending, from Sowmini Varadhan. 9) In macb driver, probe MDIO bus before we register the netdev, otherwise we can try to open the device before it is really ready for that. Fix from Florian Fainelli. 10) Netlink attribute size for ILA "tunnels" not calculated properly, fix from Nicolas Dichtel" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: ipv6/ila: fix nlsize calculation for lwtunnel net: macb: Probe MDIO bus before registering netdev RDS: TCP: Synchronize accept() and connect() paths on t_conn_lock. RDS:TCP: Synchronize rds_tcp_accept_one with rds_send_xmit when resetting t_sock vxlan: Add checksum check to the features check function net: Disable segmentation if checksumming is not supported net: mvneta: Remove superfluous SMP function call macb: fix mdiobus_scan() error check pxa168_eth: fix mdiobus_scan() error check net/mlx5e: Use workqueue for vxlan ops net/mlx5e: Implement a mlx5e workqueue net/mlx5: Kconfig: Fix MLX5_EN/VXLAN build issue net/mlx5: Unmap only the relevant IO memory mapping netem: Segment GSO packets on enqueue batman-adv: Fix reference counting of hardif_neigh_node object for neigh_node batman-adv: Fix reference counting of vlan object for tt_local_entry batman-adv: B.A.T.M.A.N V - make sure iface is reactivated upon NETDEV_UP event batman-adv: fix DAT candidate selection (must use vid) commit 610603a520bdeb35bd838835f36cfd6b4a563995 Merge: 1248ded 4441f63 Author: Linus Torvalds Date: Tue May 3 14:23:58 2016 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse Pull fuse fixes from Miklos Szeredi: "Fix a regression and update the MAINTAINERS entry for fuse" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: fuse: update mailing list in MAINTAINERS fuse: Fix return value from fuse_get_user_pages() commit 79e8dc8b80bff0bc5bbb90ca5e73044bf207c8ac Author: Nicolas Dichtel Date: Tue May 3 09:58:27 2016 +0200 ipv6/ila: fix nlsize calculation for lwtunnel The handler 'ila_fill_encap_info' adds one attribute: ILA_ATTR_LOCATOR. Fixes: 65d7ab8de582 ("net: Identifier Locator Addressing module") CC: Tom Herbert Signed-off-by: Nicolas Dichtel Signed-off-by: David S. Miller net/ipv6/ila/ila_lwt.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit cf6696608a069aaac10a253207deeb63dcd6a653 Author: Florian Fainelli Date: Mon May 2 18:38:45 2016 -0700 net: macb: Probe MDIO bus before registering netdev The current sequence makes us register for a network device prior to registering and probing the MDIO bus which could lead to some unwanted consequences, like a thread of execution calling into ndo_open before register_netdev() returns, while the MDIO bus is not ready yet. Rework the sequence to register for the MDIO bus, and therefore attach to a PHY prior to calling register_netdev(), which implies reworking the error path a bit. Signed-off-by: Florian Fainelli Acked-by: Nicolas Ferre Signed-off-by: David S. Miller drivers/net/ethernet/cadence/macb.c | 31 +++++++++++++++++++------------ 1 file changed, 19 insertions(+), 12 deletions(-) commit b365d955f3f8dad71845fee8092330039f67c428 Merge: 42c8819 bd7c5f9 Author: David S. Miller Date: Tue May 3 16:03:45 2016 -0400 Merge branch 'rds-fixes' Sowmini Varadhan says: ==================== RDS: TCP: sychronization during connection startup This patch series ensures that the passive (accept) side of the TCP connection used for RDS-TCP is correctly synchronized with any concurrent active (connect) attempts for a given pair of peers. Patch 1 in the series makes sure that the t_sock in struct rds_tcp_connection is only reset after any threads in rds_tcp_xmit have completed (otherwise a null-ptr deref may be encountered). Patch 2 synchronizes rds_tcp_accept_one() with the rds_tcp*connect() path. v2: review comments from Santosh Shilimkar, other spelling corrections ==================== Signed-off-by: David S. Miller commit bd7c5f983f3185b75cc23bdd5dbc3a676aef3d1e Author: Sowmini Varadhan Date: Mon May 2 11:24:52 2016 -0700 RDS: TCP: Synchronize accept() and connect() paths on t_conn_lock. An arbitration scheme for duelling SYNs is implemented as part of commit 241b271952eb ("RDS-TCP: Reset tcp callbacks if re-using an outgoing socket in rds_tcp_accept_one()") which ensures that both nodes involved will arrive at the same arbitration decision. However, this needs to be synchronized with an outgoing SYN to be generated by rds_tcp_conn_connect(). This commit achieves the synchronization through the t_conn_lock mutex in struct rds_tcp_connection. The rds_conn_state is checked in rds_tcp_conn_connect() after acquiring the t_conn_lock mutex. A SYN is sent out only if the RDS connection is not already UP (an UP would indicate that rds_tcp_accept_one() has completed 3WH, so no SYN needs to be generated). Similarly, the rds_conn_state is checked in rds_tcp_accept_one() after acquiring the t_conn_lock mutex. The only acceptable states (to allow continuation of the arbitration logic) are UP (i.e., outgoing SYN was SYN-ACKed by peer after it sent us the SYN) or CONNECTING (we sent outgoing SYN before we saw incoming SYN). Signed-off-by: Sowmini Varadhan Acked-by: Santosh Shilimkar Signed-off-by: David S. Miller net/rds/tcp.c | 1 + net/rds/tcp.h | 4 ++++ net/rds/tcp_connect.c | 8 ++++++++ net/rds/tcp_listen.c | 30 ++++++++++++++++++++---------- 4 files changed, 33 insertions(+), 10 deletions(-) commit eb192840266fab3e3da644018121eed30153355d Author: Sowmini Varadhan Date: Mon May 2 11:24:51 2016 -0700 RDS:TCP: Synchronize rds_tcp_accept_one with rds_send_xmit when resetting t_sock There is a race condition between rds_send_xmit -> rds_tcp_xmit and the code that deals with resolution of duelling syns added by commit 241b271952eb ("RDS-TCP: Reset tcp callbacks if re-using an outgoing socket in rds_tcp_accept_one()"). Specifically, we may end up derefencing a null pointer in rds_send_xmit if we have the interleaving sequence: rds_tcp_accept_one rds_send_xmit conn is RDS_CONN_UP, so invoke rds_tcp_xmit tc = conn->c_transport_data rds_tcp_restore_callbacks /* reset t_sock */ null ptr deref from tc->t_sock The race condition can be avoided without adding the overhead of additional locking in the xmit path: have rds_tcp_accept_one wait for rds_tcp_xmit threads to complete before resetting callbacks. The synchronization can be done in the same manner as rds_conn_shutdown(). First set the rds_conn_state to something other than RDS_CONN_UP (so that new threads cannot get into rds_tcp_xmit()), then wait for RDS_IN_XMIT to be cleared in the conn->c_flags indicating that any threads in rds_tcp_xmit are done. Fixes: 241b271952eb ("RDS-TCP: Reset tcp callbacks if re-using an outgoing socket in rds_tcp_accept_one()") Signed-off-by: Sowmini Varadhan Acked-by: Santosh Shilimkar Signed-off-by: David S. Miller net/rds/tcp.c | 2 +- net/rds/tcp_listen.c | 40 ++++++++++++++++++++++++---------------- 2 files changed, 25 insertions(+), 17 deletions(-) commit 42c8819b8d7245f54d5cfa6c2ec5a436818aeda9 Merge: 0e28bf9 af67eb9 Author: David S. Miller Date: Tue May 3 16:00:55 2016 -0400 Merge branch 'tunnel-csum-and-sg-offloads' Alexander Duyck says: ==================== Fixes for tunnel checksum and segmentation offloads This patch series is a subset of patches I had submitted for net-next. I plan to drop these two patches from the v3 of "Fix Tunnel features and enable GSO partial for several drivers" and I am instead submitting them for net since these are truly fixes and likely will need to be backported to stable branches. This series addresses 2 specific issues. The first is that we could request TSO on a v4 inner header while not supporting checksum offload of the outer IPv6 header. The second is that we could request an IPv6 inner checksum offload without validating that we could actually support an inner IPv6 checksum offload. ==================== Signed-off-by: David S. Miller commit af67eb9e7e1ab37880459f83153d34b3c42b0075 Author: Alexander Duyck Date: Mon May 2 09:25:16 2016 -0700 vxlan: Add checksum check to the features check function We need to perform an additional check on the inner headers to determine if we can offload the checksum for them. Previously this check didn't occur so we would generate an invalid frame in the case of an IPv6 header encapsulated inside of an IPv4 tunnel. To fix this I added a secondary check to vxlan_features_check so that we can verify that we can offload the inner checksum. Signed-off-by: Alexander Duyck Signed-off-by: David S. Miller include/linux/if_ether.h | 5 +++++ include/net/vxlan.h | 4 +++- 2 files changed, 8 insertions(+), 1 deletion(-) commit 996e802187889f1cd412e6929c9344b92ccb78c4 Author: Alexander Duyck Date: Mon May 2 09:25:10 2016 -0700 net: Disable segmentation if checksumming is not supported In the case of the mlx4 and mlx5 driver they do not support IPv6 checksum offload for tunnels. With this being the case we should disable GSO in addition to the checksum offload features when we find that a device cannot perform a checksum on a given packet type. Signed-off-by: Alexander Duyck Signed-off-by: David S. Miller net/core/dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0e28bf93a273cce0db67a17428697abb722c36b8 Author: Anna-Maria Gleixner Date: Mon May 2 11:02:51 2016 +0200 net: mvneta: Remove superfluous SMP function call Since commit 3b9d6da67e11 ("cpu/hotplug: Fix rollback during error-out in __cpu_disable()") it is ensured that callbacks of CPU_ONLINE and CPU_DOWN_PREPARE are processed on the hotplugged CPU. Due to this SMP function calls are no longer required. Replace smp_call_function_single() with a direct call to mvneta_percpu_enable() or mvneta_percpu_disable(). The functions do not require to be called with interrupts disabled, therefore the smp_call_function_single() calling convention is not preserved. Cc: Thomas Petazzoni Cc: netdev@vger.kernel.org Signed-off-by: Anna-Maria Gleixner Signed-off-by: David S. Miller drivers/net/ethernet/marvell/mvneta.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit ce24c2b8a904753701fe4df313b4cbc2b0649e3e Author: Sergei Shtylyov Date: Sun May 1 01:47:36 2016 +0300 macb: fix mdiobus_scan() error check Now mdiobus_scan() returns ERR_PTR(-ENODEV) instead of NULL if the PHY device ID was read as all ones. As this was not an error before, this value should be filtered out now in this driver. Fixes: b74766a0a0fe ("phylib: don't return NULL from get_phy_device()") Signed-off-by: Sergei Shtylyov Reviewed-by: Florian Fainelli Acked-by: Nicolas Ferre Signed-off-by: David S. Miller drivers/net/ethernet/cadence/macb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 6dd745425807dc977bbea810ef703b935002fcc3 Author: Sergei Shtylyov Date: Sat Apr 30 23:35:11 2016 +0300 pxa168_eth: fix mdiobus_scan() error check Since mdiobus_scan() returns either an error code or NULL on error, the driver should check for both, not only for NULL, otherwise a crash is imminent... Reported-by: Arnd Bergmann Signed-off-by: Sergei Shtylyov Signed-off-by: David S. Miller drivers/net/ethernet/marvell/pxa168_eth.c | 2 ++ 1 file changed, 2 insertions(+) commit 0126d4b9a516256f2432ca0dc78ab293a8255378 Author: Alex Deucher Date: Mon May 2 18:54:39 2016 -0400 drm/amdgpu: make sure vertical front porch is at least 1 hw doesn't like a 0 value. Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/atombios_encoders.c | 4 ++++ 1 file changed, 4 insertions(+) commit 3104b8128d4d646a574ed9d5b17c7d10752cd70b Author: Alex Deucher Date: Mon May 2 18:53:27 2016 -0400 drm/radeon: make sure vertical front porch is at least 1 hw doesn't like a 0 value. Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/radeon/atombios_encoders.c | 4 ++++ 1 file changed, 4 insertions(+) commit 1248ded656d8afb64be01b2985b7b3e562eac914 Merge: 1f6211a eff6ca9 Author: Linus Torvalds Date: Tue May 3 11:06:01 2016 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid Pull HID fixes from Jiri Kosina: "Fixes for the HID subsystem: - regression fix for Wacom driver; commit introduced in 4.6-rc1 mistakenly removed line that should be kept. Fix by Ping Cheng - two device-specific quirks, by Ping Cheng and Nazar Mokrynskyi" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: HID: wacom: add missed stylus_in_proximity line back HID: Fix boot delay for Creative SB Omni Surround 5.1 with quirk HID: wacom: Add support for DTK-1651 commit 1f6211a4ea0c38c4e162c7e8518e09ce43538905 Merge: 689de1d 2c49477 Author: Linus Torvalds Date: Tue May 3 10:58:29 2016 -0700 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fix from Stephen Boyd: "One small bug fix for the imx6qp CAN clk definition that was causing failures and division by zeros in the kernel on those devices" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: imx6q: fix typo in CAN clock definition commit 3df8f4c6e928685e6fdf72b8d0d25e0c3a61cf7a Merge: 6071bd1 d8cf2dd Author: David S. Miller Date: Tue May 3 13:37:27 2016 -0400 Merge branch 'mlx5-fixes' Saeed Mahameed says: ==================== Mellanox 100G mlx5 fixes for 4.6-rc This small series provides some bug fixes for mlx5 driver. A small bug fix for iounmap of a null pointer, which dumps a warning on some archs. One patch to fix the VXLAN/MLX5_EN dependency issue reported by Arnd. Two patches to fix the scheduling while atomic issue for ndo_add/del_vxlan_port NDOs. The first will add an internal mlx5e workqueue and the second will delegate vxlan ports add/del requests to that workqueue. Note: ('net/mlx5: Kconfig: Fix MLX5_EN/VXLAN build issue') is only needed for net and not net-next as the issue was globally fixed for all device drivers by: b7aade15485a ('vxlan: break dependency with netdev drivers') in net-next. Applied on top: f27337e16f2d ('ip_tunnel: fix preempt warning in ip tunnel creation/updating') ==================== Signed-off-by: David S. Miller commit d8cf2dda3de6e6293fb01539fb4e180a7ab42afd Author: Matthew Finlay Date: Sun May 1 22:59:57 2016 +0300 net/mlx5e: Use workqueue for vxlan ops The vxlan add/delete port NDOs are called under rcu lock. The current mlx5e implementation can potentially block in these calls, which is not allowed. Move to using the mlx5e workqueue to handle these NDOs. Fixes: b3f63c3d5e2c ('net/mlx5e: Add netdev support for VXLAN tunneling') Signed-off-by: Matthew Finlay Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/vxlan.c | 50 +++++++++++++++++------ drivers/net/ethernet/mellanox/mlx5/core/vxlan.h | 11 ++++- 3 files changed, 49 insertions(+), 16 deletions(-) commit 7bb2975599210097115021e542b6137781a09588 Author: Matthew Finlay Date: Sun May 1 22:59:56 2016 +0300 net/mlx5e: Implement a mlx5e workqueue Implement a mlx5e workqueue to handle all mlx5e specific tasks. Move all tasks currently using the system workqueue to the new workqueue. This is in preparation for vxlan using the mlx5e workqueue in order to schedule port add/remove operations. Signed-off-by: Matthew Finlay Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 30 ++++++++++++++--------- 2 files changed, 20 insertions(+), 11 deletions(-) commit 69976fb1045850a742deb9790ea49cbc6f497531 Author: Matthew Finlay Date: Sun May 1 22:59:55 2016 +0300 net/mlx5: Kconfig: Fix MLX5_EN/VXLAN build issue When MLX5_EN=y MLX5_CORE=y and VXLAN=m there is a linker error for vxlan_get_rx_port() due to the fact that VXLAN is a module. Change Kconfig to select VXLAN when MLX5_CORE=y. When MLX5_CORE=m there is no dependency on the value of VXLAN. Fixes: b3f63c3d5e2c ('net/mlx5e: Add netdev support for VXLAN tunneling') Signed-off-by: Matthew Finlay Reported-by: Arnd Bergmann Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 5f8a02a441b861fd3b1b5135a1a6e1c13ee4bb33 Author: Gal Pressman Date: Sun May 1 22:59:54 2016 +0300 net/mlx5: Unmap only the relevant IO memory mapping When freeing UAR the driver tries to unmap uar->map and uar->bf_map which are mutually exclusive thus always unmapping a NULL pointer. Make sure we only call iounmap() once, for the actual mapping. Fixes: 0ba422410bbf ('net/mlx5: Fix global UAR mapping') Signed-off-by: Gal Pressman Reported-by: Doron Tsur Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/uar.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 854145e0a8e9a05f7366d240e2f99d9c1ca6d6dd Author: Chunyu Hu Date: Tue May 3 19:34:34 2016 +0800 tracing: Don't display trigger file for events that can't be enabled Currently register functions for events will be called through the 'reg' field of event class directly without any check when seting up triggers. Triggers for events that don't support register through debug fs (events under events/ftrace are for trace-cmd to read event format, and most of them don't have a register function except events/ftrace/functionx) can't be enabled at all, and an oops will be hit when setting up trigger for those events, so just not creating them is an easy way to avoid the oops. Link: http://lkml.kernel.org/r/1462275274-3911-1-git-send-email-chuhu@redhat.com Cc: stable@vger.kernel.org # 3.14+ Fixes: 85f2b08268c01 ("tracing: Add basic event trigger framework") Signed-off-by: Chunyu Hu Signed-off-by: Steven Rostedt kernel/trace/trace_events.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit 0092d3edcb23fcdb8cbe4159ba94a534290ff982 Author: Dave Airlie Date: Tue May 3 12:44:29 2016 +1000 drm/amdgpu: set metadata pointer to NULL after freeing. Without this there was a double free of the metadata, which ended up freeing the fd table for me here, and taking out the machine more often than not. I reproduced with X.org + modesetting DDX + latest llvm/mesa, also required using dri3. Cc: stable@vger.kernel.org Reviewed-by: Christian König Signed-off-by: Dave Airlie Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 1 + 1 file changed, 1 insertion(+) commit eff6ca97998386447b795362cc20213114af2870 Author: Ping Cheng Date: Mon May 2 21:17:34 2016 -0700 HID: wacom: add missed stylus_in_proximity line back Commit 7e12978 ("HID: wacom: break out wacom_intuos_get_tool_type") by accident removed stylus_in_proximity flag for Intuos series while shuffling the code around. Fix that by reintroducing that flag setting in wacom_intuos_inout(), where it originally was. Fixes: 7e12978 ("HID: wacom: break out wacom_intuos_get_tool_type") Signed-off-by: Ping Cheng Signed-off-by: Jiri Kosina drivers/hid/wacom_wac.c | 1 + 1 file changed, 1 insertion(+) commit 4441f63ab7e581ae460c9f7e06fba8a2be192e81 Author: Miklos Szeredi Date: Tue May 3 11:19:33 2016 +0200 fuse: update mailing list in MAINTAINERS The fuse mailing list seems not to be open anymore. The discussion on fuse-devel@... is mostly userspace related anyway. Reported-by: Andreas Gruenbacher Signed-off-by: Miklos Szeredi MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6dc5df71ee5c8b44607928bfe27be50314dcf848 Author: Tadeusz Struk Date: Fri Apr 29 10:43:40 2016 -0700 crypto: qat - fix adf_ctl_drv.c:undefined reference to adf_init_pf_wq Fix undefined reference issue reported by kbuild test robot. Cc: Reported-by: kbuild test robot Signed-off-by: Tadeusz Struk Signed-off-by: Herbert Xu drivers/crypto/qat/qat_common/adf_common_drv.h | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) commit 6071bd1aa13ed9e41824bafad845b7b7f4df5cfd Author: Neil Horman Date: Mon May 2 12:20:15 2016 -0400 netem: Segment GSO packets on enqueue This was recently reported to me, and reproduced on the latest net kernel, when attempting to run netperf from a host that had a netem qdisc attached to the egress interface: [ 788.073771] ---------------------[ cut here ]--------------------------- [ 788.096716] WARNING: at net/core/dev.c:2253 skb_warn_bad_offload+0xcd/0xda() [ 788.129521] bnx2: caps=(0x00000001801949b3, 0x0000000000000000) len=2962 data_len=0 gso_size=1448 gso_type=1 ip_summed=3 [ 788.182150] Modules linked in: sch_netem kvm_amd kvm crc32_pclmul ipmi_ssif ghash_clmulni_intel sp5100_tco amd64_edac_mod aesni_intel lrw gf128mul glue_helper ablk_helper edac_mce_amd cryptd pcspkr sg edac_core hpilo ipmi_si i2c_piix4 k10temp fam15h_power hpwdt ipmi_msghandler shpchp acpi_power_meter pcc_cpufreq nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sd_mod crc_t10dif crct10dif_generic mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit drm_kms_helper ahci ata_generic pata_acpi ttm libahci crct10dif_pclmul pata_atiixp tg3 libata crct10dif_common drm crc32c_intel ptp serio_raw bnx2 r8169 hpsa pps_core i2c_core mii dm_mirror dm_region_hash dm_log dm_mod [ 788.465294] CPU: 16 PID: 0 Comm: swapper/16 Tainted: G W ------------ 3.10.0-327.el7.x86_64 #1 [ 788.511521] Hardware name: HP ProLiant DL385p Gen8, BIOS A28 12/17/2012 [ 788.542260] ffff880437c036b8 f7afc56532a53db9 ffff880437c03670 ffffffff816351f1 [ 788.576332] ffff880437c036a8 ffffffff8107b200 ffff880633e74200 ffff880231674000 [ 788.611943] 0000000000000001 0000000000000003 0000000000000000 ffff880437c03710 [ 788.647241] Call Trace: [ 788.658817] [] dump_stack+0x19/0x1b [ 788.686193] [] warn_slowpath_common+0x70/0xb0 [ 788.713803] [] warn_slowpath_fmt+0x5c/0x80 [ 788.741314] [] ? ___ratelimit+0x93/0x100 [ 788.767018] [] skb_warn_bad_offload+0xcd/0xda [ 788.796117] [] skb_checksum_help+0x17c/0x190 [ 788.823392] [] netem_enqueue+0x741/0x7c0 [sch_netem] [ 788.854487] [] dev_queue_xmit+0x2a8/0x570 [ 788.880870] [] ip_finish_output+0x53d/0x7d0 ... The problem occurs because netem is not prepared to handle GSO packets (as it uses skb_checksum_help in its enqueue path, which cannot manipulate these frames). The solution I think is to simply segment the skb in a simmilar fashion to the way we do in __dev_queue_xmit (via validate_xmit_skb), with some minor changes. When we decide to corrupt an skb, if the frame is GSO, we segment it, corrupt the first segment, and enqueue the remaining ones. tested successfully by myself on the latest net kernel, to which this applies Signed-off-by: Neil Horman CC: Jamal Hadi Salim CC: "David S. Miller" CC: netem@lists.linux-foundation.org CC: eric.dumazet@gmail.com CC: stephen@networkplumber.org Acked-by: Eric Dumazet Signed-off-by: David S. Miller net/sched/sch_netem.c | 61 +++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 59 insertions(+), 2 deletions(-) commit 9b40d5aaef542f5b2bcba41fb1e24cfcba793774 Merge: 33656a1 abe59c6 Author: David S. Miller Date: Tue May 3 00:17:38 2016 -0400 Merge tag 'batman-adv-fix-for-davem' of git://git.open-mesh.org/linux-merge Antonio Quartulli says: ==================== In this small batch of patches you have: - a fix for our Distributed ARP Table that makes sure that the input provided to the hash function during a query is the same as the one provided during an insert (so to prevent false negatives), by Antonio Quartulli - a fix for our new protocol implementation B.A.T.M.A.N. V that ensures that a hard interface is properly re-activated when it is brought down and then up again, by Antonio Quartulli - two fixes respectively to the reference counting of the tt_local_entry and neigh_node objects, by Sven Eckelmann. Such bug is rather severe as it would prevent the netdev objects references by batman-adv from being released after shutdown. ==================== Signed-off-by: David S. Miller commit 689de1d6ca95b3b5bd8ee446863bf81a4883ea25 Author: Linus Torvalds Date: Mon May 2 12:46:42 2016 -0700 Minimal fix-up of bad hashing behavior of hash_64() This is a fairly minimal fixup to the horribly bad behavior of hash_64() with certain input patterns. In particular, because the multiplicative value used for the 64-bit hash was intentionally bit-sparse (so that the multiply could be done with shifts and adds on architectures without hardware multipliers), some bits did not get spread out very much. In particular, certain fairly common bit ranges in the input (roughly bits 12-20: commonly with the most information in them when you hash things like byte offsets in files or memory that have block factors that mean that the low bits are often zero) would not necessarily show up much in the result. There's a bigger patch-series brewing to fix up things more completely, but this is the fairly minimal fix for the 64-bit hashing problem. It simply picks a much better constant multiplier, spreading the bits out a lot better. NOTE! For 32-bit architectures, the bad old hash_64() remains the same for now, since 64-bit multiplies are expensive. The bigger hashing cleanup will replace the 32-bit case with something better. The new constants were picked by George Spelvin who wrote that bigger cleanup series. I just picked out the constants and part of the comment from that series. Cc: stable@vger.kernel.org Cc: George Spelvin Cc: Thomas Gleixner Signed-off-by: Linus Torvalds include/linux/hash.h | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) commit 98bcf28636ac2397489e230b107a051524b1233b Merge: 33656a1 b8a0b8e Author: Linus Torvalds Date: Mon May 2 12:22:51 2016 -0700 Merge tag 'md/4.6-rc6-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md Pull MD fixes from Shaohua Li: "This update includes several trival fixes. The only important one is to fix MD bio merge, which has big performance impact" * tag 'md/4.6-rc6-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md: raid5: delete unnecessary warnning MD: make bio mergeable md/raid0: remove empty line printk from dump_zones md/raid0: fix uninitialized variable bug commit 9a2a5a638f8eb9c612a7a9af0afab93f506f6ba4 Author: Lukas Wunner Date: Mon May 2 13:48:31 2016 -0500 PCI: Do not treat EPROBE_DEFER as device attach failure Linux 4.5 introduced a behavioral change in device probing during the suspend process with commit 013c074f8642 ("PM / sleep: prohibit devices probing during suspend/hibernation"): It defers device probing during the entire suspend process, starting from the prepare phase and ending with the complete phase. A rule existed before that "we rely on subsystems not to do any probing once a device is suspended" but it is enforced only now (Alan Stern, https://lkml.org/lkml/2015/9/15/908). This resulted in a WARN splat if a PCI device (e.g., Thunderbolt) is plugged in while the system is asleep: Upon waking up, pciehp_resume() discovers new devices in the resume phase and immediately tries to bind them to a driver. Since probing is now deferred, device_attach() returns -EPROBE_DEFER, which provoked a WARN in pci_bus_add_device(). Linux 4.6-rc1 aggravates the situation with commit ab1a187bba5c ("PCI: Check device_attach() return value always"): If device_attach() returns a negative value, pci_bus_add_device() now removes the sysfs and procfs entries for the device and pci_bus_add_devices() subsequently locks up with a BUG. Even with the BUG fixed we're still in trouble because the device remains on the deferred probing list even though its sysfs and procfs entries are gone and its children won't be added. Fix by not interpreting -EPROBE_DEFER as failure. The device will be probed eventually (through device_unblock_probing() in dpm_complete()) and there is proper locking in place to avoid races (e.g., if devices are unplugged again und thus deleted from the system before deferred probing happens, I have tested this). Also, those functions which dereference dev->driver (e.g. pci_pm_*()) do contain proper NULL pointer checks. So it seems safe to ignore -EPROBE_DEFER. Fixes: ab1a187bba5c ("PCI: Check device_attach() return value always") Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Acked-by: Rafael J. Wysocki Cc: Grygorii Strashko Cc: Alan Stern drivers/pci/bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1e398eae8407abdc02cde8a449b14d17ed193d56 Author: Lukas Wunner Date: Mon May 2 13:48:25 2016 -0500 PCI: Fix BUG on device attach failure Previously when pci_bus_add_device() called device_attach() and it returned a negative value, we emitted a WARN but carried on. Commit ab1a187bba5c ("PCI: Check device_attach() return value always"), introduced in Linux 4.6-rc1, changed this to unwind all steps preceding device_attach() and to not set dev->is_added = 1. The latter leads to a BUG if pci_bus_add_device() was called from pci_bus_add_devices(). Fix by not recursing to a child bus if device_attach() failed for the bridge leading to it. This can be triggered by plugging in a PCI device (e.g. Thunderbolt) while the system is asleep. The system locks up when woken because device_attach() returns -EPROBE_DEFER. Fixes: ab1a187bba5c ("PCI: Check device_attach() return value always") Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Acked-by: Rafael J. Wysocki drivers/pci/bus.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 33656a1f2ee5346c742d63ddd0e0970c95a56b70 Merge: 5f40adb c26f6c6 Author: Linus Torvalds Date: Mon May 2 09:59:57 2016 -0700 Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull UDF fix from Jan Kara: "A fix of a regression in UDF that got introduced in 4.6-rc1 by one of the charset encoding fixes" * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: udf: Fix conversion of 'dstring' fields to UTF8 commit 5f40adbc3eebd7e1c55ec87315e762924a36fe76 Merge: 9c5d1bc 7df89e9 Author: Linus Torvalds Date: Mon May 2 09:54:22 2016 -0700 Merge tag 'gpio-v4.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO fixes from Linus Walleij: "Here are some late but important fixes for the v4.6 kernel series. ACPI and RCAR, so two driver fixes (PM related) and a self-evident string lookup fix for ACPI GPIOs: - A serious ACPI fix targeted for stable: lookup strings were being free'd. - Revert two patches from the RCAR driver" * tag 'gpio-v4.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpiolib-acpi: Duplicate con_id string when adding it to the crs lookup list Revert "gpio: rcar: Fine-grained Runtime PM support" Revert "gpio: rcar: Add Runtime PM handling for interrupts" commit 9c5d1bc2b73609ada2eaba75e9c8f4963e95b977 Merge: ba22906 b7f8fe2 Author: Linus Torvalds Date: Mon May 2 09:40:42 2016 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) MODULE_FIRMWARE firmware string not correct for iwlwifi 8000 chips, from Sara Sharon. 2) Fix SKB size checks in batman-adv stack on receive, from Sven Eckelmann. 3) Leak fix on mac80211 interface add error paths, from Johannes Berg. 4) Cannot invoke napi_disable() with BH disabled in myri10ge driver, fix from Stanislaw Gruszka. 5) Fix sign extension problem when computing feature masks in net_gso_ok(), from Marcelo Ricardo Leitner. 6) lan78xx driver doesn't count packets and packet lengths in its statistics properly, fix from Woojung Huh. 7) Fix the buffer allocation sizes in pegasus USB driver, from Petko Manolov. 8) Fix refcount overflows in bpf, from Alexei Starovoitov. 9) Unified dst cache handling introduced a preempt warning in ip_tunnel, fix by resetting rather then setting the cached route. From Paolo Abeni. 10) Listener hash collision test fix in soreuseport, from Craig Gallak * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (47 commits) gre: do not pull header in ICMP error processing net: Implement net_dbg_ratelimited() for CONFIG_DYNAMIC_DEBUG case tipc: only process unicast on intended node cxgb3: fix out of bounds read net/smscx5xx: use the device tree for mac address soreuseport: Fix TCP listener hash collision net: l2tp: fix reversed udp6 checksum flags ip_tunnel: fix preempt warning in ip tunnel creation/updating samples/bpf: fix trace_output example bpf: fix check_map_func_compatibility logic bpf: fix refcnt overflow drivers: net: cpsw: use of_phy_connect() in fixed-link case dt: cpsw: phy-handle, phy_id, and fixed-link are mutually exclusive drivers: net: cpsw: don't ignore phy-mode if phy-handle is used drivers: net: cpsw: fix segfault in case of bad phy-handle drivers: net: cpsw: fix parsing of phy-handle DT property in dual_emac config MAINTAINERS: net: Change maintainer for GRETH 10/100/1G Ethernet MAC device driver gre: reject GUE and FOU in collect metadata mode pegasus: fixes reported packet length pegasus: fixes URB buffer allocation size; ... commit e99ed4de1731f79868b00a7ff9f479a55a4799a7 Author: Serge Hallyn Date: Sun Apr 17 15:04:31 2016 -0500 kernfs_path_from_node_locked: don't overwrite nlen We've calculated @len to be the bytes we need for '/..' entries from @kn_from to the common ancestor, and calculated @nlen to be the extra bytes we need to get from the common ancestor to @kn_to. We use them as such at the end. But in the loop copying the actual entries, we overwrite @nlen. Use a temporary variable for that instead. Without this, the return length, when the buffer is large enough, is wrong. (When the buffer is NULL or too small, the returned value is correct. The buffer contents are also correct.) Interestingly, no callers of this function are affected by this as of yet. However the upcoming cgroup_show_path() will be. Signed-off-by: Serge Hallyn fs/kernfs/dir.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit ba22906a9fdb197b10e3e062dc8c438efb7ea6f6 Merge: 04974df 49fa523 Author: Linus Torvalds Date: Mon May 2 09:32:50 2016 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc Pull sparc fixes from David Miller: 1) Fix panics with SR-IOV, from Babu Moger. 2) Wire up preadv2/pwritev2. 3) Allow proper auto-loading of VIO devices, from John Paul Adrian Glaubitz. 4) Recognize Sonoma cpus, from Khalid Aziz. 5) Fix bootup regressions caused by syscall trace fixes made recently. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc: sparc64: Fix bootup regressions on some Kconfig combinations. sparc64: recognize and support Sonoma CPU type sparc: Implement and wire up vio_hotplug for vio. sparc: Implement and wire up modalias_show for vio. sparc/pci: Refactor dev_archdata initialization into pci_init_dev_archdata sparc/defconfigs: Remove CONFIG_IPV6_PRIVACY sparc: Write up preadv2/pwritev2 syscalls. sparc/PCI: Fix for panic while enabling SR-IOV commit 2eea65829dc6c20dccbe79726fd0f3fe7f8aa43b Author: Dan Williams Date: Mon May 2 09:11:53 2016 -0700 nfit: fix translation of command status results When transportation of the command completes successfully, it indicates that the 'status' result is valid. Fix the missed checking and translation of the status field at the end of acpi_nfit_ctl(). Otherwise, we fail to handle reported errors and assume commands complete successfully. Reported-by: Linda Knippers Reviewed-by: Johannes Thumshirn Signed-off-by: Dan Williams drivers/acpi/nfit.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 9be427efc764464fbcbc1ca3f0d34f575cb0f037 Author: Johan Hovold Date: Mon May 2 15:35:57 2016 +0200 Revert "USB / PM: Allow USB devices to remain runtime-suspended when sleeping" This reverts commit e3345db85068ddb937fc0ba40dfc39c293dad977, which broke system resume for a large class of devices. Devices that after having been reset during resume need to be rebound due to a missing reset_resume callback, are now left in a suspended state. This specifically broke resume of common USB-serial devices, which are now unusable after system suspend (until disconnected and reconnected) when USB persist is enabled. During resume, usb_resume_interface will set the needs_binding flag for such interfaces, but unlike system resume, run-time resume does not honour it. Cc: stable # 4.5 Signed-off-by: Johan Hovold Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman drivers/usb/core/port.c | 6 ------ drivers/usb/core/usb.c | 8 +------- 2 files changed, 1 insertion(+), 13 deletions(-) commit d1306eb675ad7a9a760b6b8e8e189824b8db89e7 Author: Stanislav Meduna Date: Mon May 2 16:05:11 2016 +0100 nvmem: mxs-ocotp: fix buffer overflow in read This patch fixes the issue where the mxs_ocotp_read is reading the ocotp in reg_size steps but decrements the remaining size by 1. The number of iterations is thus four times higher, overwriting the area behind the output buffer. Fixes: c01e9a11ab6f ("nvmem: add driver for ocotp in i.MX23 and i.MX28") Tested-by: Stefan Wahren Signed-off-by: Stanislav Meduna Signed-off-by: Srinivas Kandagatla Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/nvmem/mxs-ocotp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 9b15dfe0542fd6f7455c6aeca1cf711192343bf9 Author: Marek Szyprowski Date: Thu Apr 28 07:25:04 2016 -0300 [media] media: s3c-camif: fix deadlock on driver probe() Commit 0c426c472b5585ed6e59160359c979506d45ae49 ("[media] media: Always keep a graph walk large enough around") changed media_device_register_entity() function to take mdev->graph_mutex. This causes deadlock in driver probe, which calls (indirectly) this function with ->graph_mutex taken. This patch removes taking ->graph_mutex in driver probe to avoid deadlock. Other drivers don't take ->graph_mutex for entity registration, so this change should be safe. Signed-off-by: Marek Szyprowski Signed-off-by: Mauro Carvalho Chehab drivers/media/platform/s3c-camif/camif-core.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) commit 243d4c0270a184e91ae589138652e19394edb1e7 Author: Marek Szyprowski Date: Thu Apr 28 07:25:03 2016 -0300 [media] media: exynos4-is: fix deadlock on driver probe Commit 0c426c472b5585ed6e59160359c979506d45ae49 ("[media] media: Always keep a graph walk large enough around") changed media_device_register_entity() function to take mdev->graph_mutex. This causes deadlock in driver probe, which calls (indirectly) this function with ->graph_mutex taken. This patch removes taking ->graph_mutex in driver probe to avoid deadlock. Other drivers don't take ->graph_mutex for entity registration, so this change should be safe. Signed-off-by: Marek Szyprowski Acked-by: Sakari Ailus Tested-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab drivers/media/platform/exynos4-is/media-dev.c | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-) commit ba41e1bc28bd862089b0fc00e8136aa258a62b21 Author: Rafael J. Wysocki Date: Mon May 2 02:27:19 2016 +0200 cpufreq: intel_pstate: Fix HWP on boot CPU after system resume Commit 41cfd64cf49fc "Update frequencies of policy->cpus only from ->set_policy()" changed the way the intel_pstate driver's ->set_policy callback updates the HWP (hardware-managed P-states) settings. A side effect of it is that if those settings are modified on the boot CPU during system suspend and wakeup, they will never be restored during subsequent system resume. To address this problem, allow cpufreq drivers that don't provide ->target or ->target_index callbacks to use ->suspend and ->resume callbacks and add a ->resume callback to intel_pstate to restore the HWP settings on the CPUs that belong to the given policy. Fixes: 41cfd64cf49fc "Update frequencies of policy->cpus only from ->set_policy()" Tested-by: Srinivas Pandruvada Signed-off-by: Rafael J. Wysocki Acked-by: Viresh Kumar drivers/cpufreq/cpufreq.c | 26 +++++++++++++++----------- drivers/cpufreq/intel_pstate.c | 12 ++++++++++-- 2 files changed, 25 insertions(+), 13 deletions(-) commit b7f8fe251e4609e2a437bd2c2dea01e61db6849c Author: Jiri Benc Date: Fri Apr 29 23:31:32 2016 +0200 gre: do not pull header in ICMP error processing iptunnel_pull_header expects that IP header was already pulled; with this expectation, it pulls the tunnel header. This is not true in gre_err. Furthermore, ipv4_update_pmtu and ipv4_redirect expect that skb->data points to the IP header. We cannot pull the tunnel header in this path. It's just a matter of not calling iptunnel_pull_header - we don't need any of its effects. Fixes: bda7bb463436 ("gre: Allow multiple protocol listener for gre protocol.") Signed-off-by: Jiri Benc Signed-off-by: David S. Miller net/ipv4/ip_gre.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit 2c94b53738549d81dc7464a32117d1f5112c64d3 Author: Tim Bingham Date: Fri Apr 29 13:30:23 2016 -0400 net: Implement net_dbg_ratelimited() for CONFIG_DYNAMIC_DEBUG case Prior to commit d92cff89a0c8 ("net_dbg_ratelimited: turn into no-op when !DEBUG") the implementation of net_dbg_ratelimited() was buggy for both the DEBUG and CONFIG_DYNAMIC_DEBUG cases. The bug was that net_ratelimit() was being called and, despite returning true, nothing was being printed to the console. This resulted in messages like the following - "net_ratelimit: %d callbacks suppressed" with no other output nearby. After commit d92cff89a0c8 ("net_dbg_ratelimited: turn into no-op when !DEBUG") the bug is fixed for the DEBUG case. However, there's no output at all for CONFIG_DYNAMIC_DEBUG case. This patch restores debug output (if enabled) for the CONFIG_DYNAMIC_DEBUG case. Add a definition of net_dbg_ratelimited() for the CONFIG_DYNAMIC_DEBUG case. The implementation takes care to check that dynamic debugging is enabled before calling net_ratelimit(). Fixes: d92cff89a0c8 ("net_dbg_ratelimited: turn into no-op when !DEBUG") Signed-off-by: Tim Bingham Signed-off-by: David S. Miller include/linux/net.h | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit b4c112114aab9aff5ed4568ca5e662bb02cdfe74 Author: Anton Blanchard Date: Sat Apr 30 08:29:27 2016 +1000 powerpc: Fix bad inline asm constraint in create_zero_mask() In create_zero_mask() we have: addi %1,%2,-1 andc %1,%1,%2 popcntd %0,%1 using the "r" constraint for %2. r0 is a valid register in the "r" set, but addi X,r0,X turns it into an li: li r7,-1 andc r7,r7,r0 popcntd r4,r7 Fix this by using the "b" constraint, for which r0 is not a valid register. This was found with a kernel build using gcc trunk, narrowed down to when -frename-registers was enabled at -O2. It is just luck however that we aren't seeing this on older toolchains. Thanks to Segher for working with me to find this issue. Cc: stable@vger.kernel.org Fixes: d0cebfa650a0 ("powerpc: word-at-a-time optimization for 64-bit Little Endian") Signed-off-by: Anton Blanchard Signed-off-by: Michael Ellerman arch/powerpc/include/asm/word-at-a-time.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit efe790502be85c60daa65c8aa51f05c333186e12 Author: Hamish Martin Date: Fri Apr 29 10:40:24 2016 -0400 tipc: only process unicast on intended node We have observed complete lock up of broadcast-link transmission due to unacknowledged packets never being removed from the 'transmq' queue. This is traced to nodes having their ack field set beyond the sequence number of packets that have actually been transmitted to them. Consider an example where node 1 has sent 10 packets to node 2 on a link and node 3 has sent 20 packets to node 2 on another link. We see examples of an ack from node 2 destined for node 3 being treated as an ack from node 2 at node 1. This leads to the ack on the node 1 to node 2 link being increased to 20 even though we have only sent 10 packets. When node 1 does get around to sending further packets, none of the packets with sequence numbers less than 21 are actually removed from the transmq. To resolve this we reinstate some code lost in commit d999297c3dbb ("tipc: reduce locking scope during packet reception") which ensures that only messages destined for the receiving node are processed by that node. This prevents the sequence numbers from getting out of sync and resolves the packet leakage, thereby resolving the broadcast-link transmission lock-ups we observed. While we are aware that this change only patches over a root problem that we still haven't identified, this is a sanity test that it is always legitimate to do. It will remain in the code even after we identify and fix the real problem. Reviewed-by: Chris Packham Reviewed-by: John Thompson Signed-off-by: Hamish Martin Signed-off-by: Jon Maloy Signed-off-by: David S. Miller net/tipc/node.c | 5 +++++ 1 file changed, 5 insertions(+) commit 0b86a2a1e5807326f8eb44e9919d0baadeda3a69 Author: Michal Schmidt Date: Fri Apr 29 11:06:50 2016 +0200 cxgb3: fix out of bounds read An out of bounds read of 2 bytes was discovered in cxgb3 with KASAN. t3_config_rss() expects both arrays it gets as parameters to have terminators. setup_rss(), the caller, forgets to add a terminator to one of the arrays. Thankfully the iteration in t3_config_rss() stops anyway, but in the last iteration the check for the terminator is an out of bounds read. Add the missing terminator to rspq_map[]. Reported-by: Jan Stancek Signed-off-by: Michal Schmidt Signed-off-by: David S. Miller drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit c489565b536ff5382460273fd9513f0adebec024 Author: Arnd Bergmann Date: Fri Apr 29 09:05:59 2016 +0200 net/smscx5xx: use the device tree for mac address This takes the MAC address for smsc75xx/smsc95xx USB network devices from a the device tree. This is required to get a usable persistent address on the popular beagleboard, whose hardware designers accidentally forgot that an ethernet device really requires an a MAC address to be functional. The Raspberry Pi also ships smsc9514 without a serial EEPROM, stores the MAC address in ROM accessible via VC4 firmware. The smsc75xx and smsc95xx drivers are just two copies of the same code, so better fix both. [lkundrak@v3.sk: updated to use of_get_property() as per suggestion from Arnd, reworded the message and comments a bit] Tested-by: Lubomir Rintel Signed-off-by: Arnd Bergmann Signed-off-by: Lubomir Rintel Signed-off-by: David S. Miller drivers/net/usb/smsc75xx.c | 12 +++++++++++- drivers/net/usb/smsc95xx.c | 12 +++++++++++- 2 files changed, 22 insertions(+), 2 deletions(-) commit 90e5d0db2b221f0cbbb91e9e61fdb7dbb9e1afc2 Author: Craig Gallek Date: Thu Apr 28 19:24:32 2016 -0400 soreuseport: Fix TCP listener hash collision I forgot to include a check for listener port equality when deciding if two sockets should belong to the same reuseport group. This was not caught previously because it's only necessary when two listening sockets for the same user happen to hash to the same listener bucket. The same error does not exist in the UDP path. Fixes: c125e80b8868("soreuseport: fast reuseport TCP socket selection") Signed-off-by: Craig Gallek Acked-by: Eric Dumazet Signed-off-by: David S. Miller net/ipv4/inet_hashtables.c | 2 ++ 1 file changed, 2 insertions(+) commit 018f8258582381bcce484312f0e9ec2970d0383e Author: Wang Shanker Date: Fri Apr 29 01:29:43 2016 +0800 net: l2tp: fix reversed udp6 checksum flags This patch fixes a bug which causes the behavior of whether to ignore udp6 checksum of udp6 encapsulated l2tp tunnel contrary to what userspace program requests. When the flag `L2TP_ATTR_UDP_ZERO_CSUM6_RX` is set by userspace, it is expected that udp6 checksums of received packets of the l2tp tunnel to create should be ignored. In `l2tp_netlink.c`: `l2tp_nl_cmd_tunnel_create()`, `cfg.udp6_zero_rx_checksums` is set according to the flag, and then passed to `l2tp_core.c`: `l2tp_tunnel_create()` and then `l2tp_tunnel_sock_create()`. In `l2tp_tunnel_sock_create()`, `udp_conf.use_udp6_rx_checksums` is set the same to `cfg.udp6_zero_rx_checksums`. However, if we want the checksum to be ignored, `udp_conf.use_udp6_rx_checksums` should be set to `false`, i.e. be set to the contrary. Similarly, the same should be done to `udp_conf.use_udp6_tx_checksums`. Signed-off-by: Miao Wang Acked-by: James Chapman Signed-off-by: David S. Miller net/l2tp/l2tp_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 04974df8049fc4240d22759a91e035082ccd18b4 Author: Linus Torvalds Date: Sun May 1 15:52:31 2016 -0700 Linux 4.6-rc6 Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e00f7bd221292b318d4d09c3f0c2c8af9b1e5edf Author: Dan Carpenter Date: Fri Apr 15 17:45:10 2016 +0300 virtio: Silence uninitialized variable warning Smatch complains that we might not initialize "queue". The issue is callers like setup_vq() from virtio_pci_modern.c where "num" could be something like 2 and "vring_align" is 64. In that case, vring_size() is less than PAGE_SIZE. It won't happen in real life, but we're getting the value of "num" from a register so it's not really possible to tell what value it holds with static analysis. Let's just silence the warning. Signed-off-by: Dan Carpenter Signed-off-by: Michael S. Tsirkin drivers/virtio/virtio_ring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit da9373d67c8a7adf7d820f24fe672c5540f231ac Merge: 1b46bac 15333e3 Author: Linus Torvalds Date: Sat Apr 30 18:57:42 2016 -0700 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal Pull thermal fixes from Eduardo Valentin: "A couple of minor fixes for the thermal subsystem. Specifics in this pull request: - Fixes in hisilicon thermal driver - More fixes of unsigned to int type change in thermal_core.c" * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal: thermal: use %d to print S32 parameters thermal: hisilicon: increase temperature resolution commit 1db488d12894f1936360779d6ab2aede3dd7f06a Author: K. Y. Srinivasan Date: Sat Apr 2 16:17:38 2016 -0700 Drivers: hv: vmbus: Fix signaling logic in hv_need_to_signal_on_read() On the consumer side, we have interrupt driven flow management of the producer. It is sufficient to base the signaling decision on the amount of space that is available to write after the read is complete. The current code samples the previous available space and uses this in making the signaling decision. This state can be stale and is unnecessary. Since the state can be stale, we end up not signaling the host (when we should) and this can result in a hang. Fix this problem by removing the unnecessary check. I would like to thank Arseney Romanenko for pointing out this issue. Also, issue a full memory barrier before making the signaling descision to correctly deal with potential reordering of the write (read index) followed by the read of pending_sz. Signed-off-by: K. Y. Srinivasan Tested-by: Dexuan Cui Cc: Signed-off-by: Greg Kroah-Hartman drivers/hv/ring_buffer.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) commit 10c64cea04d3c75c306b3f990586ffb343b63287 Author: Al Viro Date: Wed Apr 27 01:11:55 2016 -0400 atomic_open(): fix the handling of create_error * if we have a hashed negative dentry and either CREAT|EXCL on r/o filesystem, or CREAT|TRUNC on r/o filesystem, or CREAT|EXCL with failing may_o_create(), we should fail with EROFS or the error may_o_create() has returned, but not ENOENT. Which is what the current code ends up returning. * if we have CREAT|TRUNC hitting a regular file on a read-only filesystem, we can't fail with EROFS here. At the very least, not until we'd done follow_managed() - we might have a writable file (or a device, for that matter) bound on top of that one. Moreover, the code downstream will see that O_TRUNC and attempt to grab the write access (*after* following possible mount), so if we really should fail with EROFS, it will happen. No need to do that inside atomic_open(). The real logics is much simpler than what the current code is trying to do - if we decided to go for simple lookup, ended up with a negative dentry *and* had create_error set, fail with create_error. No matter whether we'd got that negative dentry from lookup_real() or had found it in dcache. Cc: stable@vger.kernel.org # v3.6+ Acked-by: Miklos Szeredi Signed-off-by: Al Viro fs/namei.c | 20 ++++---------------- 1 file changed, 4 insertions(+), 16 deletions(-) commit 658922e57b847bb7112aa67f6441b6bbc6554412 Author: Dan Williams Date: Sat Apr 30 13:07:06 2016 -0700 libnvdimm, pfn: fix memmap reservation sizing When configuring a pfn-device instance to allocate the memmap array it needs to account for the fact that vmemmap_populate_hugepages() allocates struct page blocks in HPAGE_SIZE chunks. We need to align the reserved area size to 2MB otherwise arch_add_memory() runs out of memory while establishing the memmap: WARNING: CPU: 0 PID: 496 at arch/x86/mm/init_64.c:704 arch_add_memory+0xe7/0xf0 [..] Call Trace: [] dump_stack+0x85/0xc2 [] __warn+0xcb/0xf0 [] warn_slowpath_null+0x1d/0x20 [] arch_add_memory+0xe7/0xf0 [] devm_memremap_pages+0x287/0x450 [] ? devm_memremap_pages+0x1ea/0x450 [] __wrap_devm_memremap_pages+0x58/0x70 [nfit_test_iomap] [] pmem_attach_disk+0x318/0x420 [nd_pmem] [] nd_pmem_probe+0x6f/0x90 [nd_pmem] [] nvdimm_bus_probe+0x69/0x110 [libnvdimm] [..] ndbus0: nd_pmem.probe(pfn3.0) = -12 nd_pmem: probe of pfn3.0 failed with error -12 libndctl: ndctl_pfn_enable: pfn3.0: failed to enable Reported-by: Namratha Kothapalli Cc: Signed-off-by: Dan Williams drivers/nvdimm/pmem.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) commit 2bcbc81421c511ef117cadcf0bee9c4340e68db0 Author: Johannes Thumshirn Date: Wed Apr 27 10:48:52 2016 +0200 qla1280: Don't allocate 512kb of host tags The qla1280 driver sets the scsi_host_template's can_queue field to 0xfffff which results in an allocation failure when allocating the block layer tags for the driver's queues. This was introduced with the change for host wide tags in commit 64d513ac31b - "scsi: use host wide tags by default". Reduce can_queue to MAX_OUTSTANDING_COMMANDS (512) to solve the allocation error. Signed-off-by: Johannes Thumshirn Fixes: 64d513ac31b - "scsi: use host wide tags by default" Cc: stable@vger.kernel.org # v4.4 Cc: Laura Abbott Cc: Michael Reed Reviewed-by: Laurence Oberman Reviewed-by: Lee Duncan Signed-off-by: Martin K. Petersen Signed-off-by: James Bottomley drivers/scsi/qla1280.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a4bd85203190990ad808abbd4a5dc848a950002c Author: Dan Carpenter Date: Thu Apr 14 21:20:34 2016 +0300 scsi_dh_alua: uninitialized variable in alua_rtpg() It's possible to use "err" without initializing it. If it happens to be a 2 which is SCSI_DH_RETRY then that could cause a bug. Bart Van Assche pointed out that we should probably re-initialize it for every iteration through the retry loop. Signed-off-by: Dan Carpenter Reviewed-by: Hannes Reinicke Signed-off-by: Martin K. Petersen Signed-off-by: James Bottomley drivers/scsi/device_handler/scsi_dh_alua.c | 1 + 1 file changed, 1 insertion(+) commit 7df89e92a56a3d2c8f84aa76c61471e4a7bc24f9 Author: Ville Syrjälä Date: Mon Apr 25 16:01:19 2016 +0300 gpiolib-acpi: Duplicate con_id string when adding it to the crs lookup list Calling gpiod_get() from a module and then unloading the module leads to an oops due to acpi_can_fallback_to_crs() storing the pointer to the passed 'con_id' string onto acpi_crs_lookup_list. The next guy to come along will then try to access the string but the memory may now be gone with the module. Make a copy of the passed string instead, and store the copy on the list. BUG: unable to handle kernel paging request at ffffffffa03e7855 IP: [] strcmp+0x12/0x30 PGD 2a07067 PUD 2a08063 PMD 74720067 PTE 0 Oops: 0000 [#1] PREEMPT SMP Modules linked in: i915(+) drm_kms_helper drm intel_gtt snd_hda_codec snd_hda_core i2c_algo_bit syscopya rea sysfillrect sysimgblt fb_sys_fops agpgart snd_soc_sst_bytcr_rt5640 coretemp hwmon intel_rapl intel_soc_dts_thermal punit_atom_debug snd_soc_rt5640 snd_soc_rl6231 serio snd_intel_sst_acpi snd_intel_sst_core video snd_soc_sst_mfld_platf orm snd_soc_sst_match backlight int3402_thermal processor_thermal_device int3403_thermal int3400_thermal acpi_thermal_r el snd_soc_core intel_soc_dts_iosf int340x_thermal_zone snd_compress i2c_hid hid snd_pcm snd_timer snd soundcore evdev sch_fq_codel efivarfs ipv6 autofs4 [last unloaded: drm] CPU: 2 PID: 3064 Comm: modprobe Tainted: G U W 4.6.0-rc3-ffrd-ipvr+ #302 Hardware name: Intel Corp. VALLEYVIEW C0 PLATFORM/BYT-T FFD8, BIOS BLAKFF81.X64.0088.R10.1403240443 FFD8 _X64_R_2014_13_1_00 03/24/2014 task: ffff8800701cd200 ti: ffff880070034000 task.ti: ffff880070034000 RIP: 0010:[] [] strcmp+0x12/0x30 RSP: 0000:ffff880070037748 EFLAGS: 00010286 RAX: 0000000080000000 RBX: ffff88007a342800 RCX: 0000000000000006 RDX: 0000000000000006 RSI: ffffffffa054f856 RDI: ffffffffa03e7856 RBP: ffff880070037748 R08: 0000000000000000 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffa054f855 R13: ffff88007281cae0 R14: 0000000000000010 R15: ffffffffffffffea FS: 00007faa51447700(0000) GS:ffff880079300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffa03e7855 CR3: 0000000041eba000 CR4: 00000000001006e0 Stack: ffff880070037770 ffffffff8136ad28 ffffffffa054f855 0000000000000000 ffff88007a0a2098 ffff8800700377e8 ffffffff8136852e ffff88007a342800 00000007700377a0 ffff8800700377a0 ffffffff81412442 70672d6c656e6170 Call Trace: [] acpi_can_fallback_to_crs+0x88/0x100 [] gpiod_get_index+0x25e/0x310 [] ? mipi_dsi_attach+0x22/0x30 [] gpiod_get+0x12/0x20 [] intel_dsi_init+0x421/0x480 [i915] [] intel_modeset_init+0x853/0x16b0 [i915] [] ? intel_setup_gmbus+0x214/0x260 [i915] [] i915_driver_load+0xdc8/0x19b0 [i915] [] ? _raw_spin_unlock_irqrestore+0x43/0x70 [] drm_dev_register+0xab/0xc0 [drm] [] drm_get_pci_dev+0x93/0x1f0 [drm] [] ? _raw_spin_unlock_irqrestore+0x43/0x70 [] i915_pci_probe+0x34/0x50 [i915] [] pci_device_probe+0x91/0x100 [] driver_probe_device+0x20a/0x2d0 [] __driver_attach+0x9e/0xb0 [] ? driver_probe_device+0x2d0/0x2d0 [] bus_for_each_dev+0x69/0xa0 [] driver_attach+0x1e/0x20 [] bus_add_driver+0x1c0/0x240 [] driver_register+0x60/0xe0 [] __pci_register_driver+0x60/0x70 [] drm_pci_init+0xe4/0x110 [drm] [] ? trace_hardirqs_on+0xe/0x10 [] ? 0xffffffffa02f1000 [] i915_init+0x94/0x9b [i915] [] do_one_initcall+0x8b/0x1c0 [] ? rcu_read_lock_sched_held+0x86/0x90 [] ? kmem_cache_alloc_trace+0x1f6/0x270 [] do_init_module+0x60/0x1dc [] load_module+0x1d0d/0x2390 [] ? __symbol_put+0x70/0x70 [] ? kernel_read_file+0x92/0x120 [] SYSC_finit_module+0xa4/0xb0 [] SyS_finit_module+0xe/0x10 [] do_syscall_64+0x63/0x350 [] entry_SYSCALL64_slow_path+0x25/0x25 Code: f7 48 8d 76 01 48 8d 52 01 0f b6 4e ff 84 c9 88 4a ff 75 ed 5d c3 0f 1f 00 55 48 89 e5 eb 04 84 c0 74 18 48 8d 7f 01 48 8d 76 01 <0f> b6 47 ff 3a 46 ff 74 eb 19 c0 83 c8 01 5d c3 31 c0 5d c3 66 RIP [] strcmp+0x12/0x30 RSP CR2: ffffffffa03e7855 v2: Make the copied con_id const Cc: Dmitry Torokhov Cc: Mika Westerberg Cc: Alexandre Courbot Cc: stable@vger.kernel.org Fixes: 10cf4899f8af ("gpiolib: tighten up ACPI legacy gpio lookups") Signed-off-by: Ville Syrjälä Acked-by: Mika Westerberg Reviewed-by: Dmitry Torokhov Signed-off-by: Linus Walleij drivers/gpio/gpiolib-acpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1b46bac6275506db73592aa8b9bd1d67c79b95dc Merge: 65c4cbe d701cca Author: Linus Torvalds Date: Fri Apr 29 18:50:08 2016 -0700 Merge tag 'powerpc-4.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "A few more powerpc fixes for 4.6: - cxl: Keep IRQ mappings on context teardown from Michael Neuling - cxl: Poll for outstanding IRQs when detaching a context from Michael Neuling - Wire up preadv2 and pwritev2 syscalls from Rui Salvaterra" * tag 'powerpc-4.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc: wire up preadv2 and pwritev2 syscalls cxl: Poll for outstanding IRQs when detaching a context cxl: Keep IRQ mappings on context teardown commit 65c4cbeba797e3fce68aba899e066f50e638e08d Merge: b49a519 c4fc195 Author: Linus Torvalds Date: Fri Apr 29 17:59:26 2016 -0700 Merge tag 'edac_fix_for_4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp Pull EDAC fix from Borislav Petkov: "Make sure sb_edac and i7core_edac do not terminate MCE processing on the decoding callchain prematurely" * tag 'edac_fix_for_4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp: EDAC: i7core, sb_edac: Don't return NOTIFY_BAD from mce_decoder callback commit b49a5195e2e737d06144e024ae092ad915722250 Merge: a8feb78 81be193 Author: Linus Torvalds Date: Fri Apr 29 17:39:51 2016 -0700 Merge tag 'pm+acpi-4.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "One revert of a recent cpufreq commit that introduced a regression and a fix for intel_pstate's Turbo Activation Ratio handling code. Specifics: - Revert cpufreq commit that attempted to fix a problem in the ondemand/conservative governor code, but did that incorrectly and introduced another problem instead (Rafael Wysocki). - Fix incorrect decoding of MSR contents related to the Turbo Activation Ratio (TAR) handling in the intel_pstate driver (Srinivas Pandruvada)" * tag 'pm+acpi-4.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: intel_pstate: Fix processing for turbo activation ratio Revert "cpufreq: governor: Fix negative idle_time when configured with CONFIG_HZ_PERIODIC" commit a8feb782092f01370c7999c3c0823f6120f29241 Merge: b9cc335 2963070 Author: Linus Torvalds Date: Fri Apr 29 17:32:19 2016 -0700 Merge tag 'mmc-v4.6-rc4' of git://git.linaro.org/people/ulf.hansson/mmc Pull MMC fixes from Ulf Hansson: "Here are a two MMC host fixes: - sdhci-acpi: Reduce Baytrail eMMC/SD/SDIO hangs - sunxi: Disable eMMC HS-DDR for Allwinner A80" * tag 'mmc-v4.6-rc4' of git://git.linaro.org/people/ulf.hansson/mmc: mmc: sunxi: Disable eMMC HS-DDR (MMC_CAP_1_8V_DDR) for Allwinner A80 mmc: sdhci-acpi: Reduce Baytrail eMMC/SD/SDIO hangs commit b9cc335ffae82255404507fcd0680a77cc215c5b Merge: 925d96a ea99697 Author: Linus Torvalds Date: Fri Apr 29 17:18:55 2016 -0700 Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux Pull drm fixes from Dave Airlie: "A few fixes all over the place: radeon is probably the biggest standout, it's a fix for screen corruption or hung black outputs so I thought it was worth pulling in. Otherwise some amdgpu power control fixes, some misc vmwgfx fixes, one etnaviv fix, one virtio-gpu fix, two DP MST fixes, and a single TTM fix" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/vmwgfx: Fix order of operation drm/vmwgfx: use vmw_cmd_dx_cid_check for query commands. drm/vmwgfx: Enable SVGA_3D_CMD_DX_SET_PREDICATION drm/amdgpu: disable vm interrupts with vm_fault_stop=2 drm/amdgpu: print a message if ATPX dGPU power control is missing Revert "drm/amdgpu: disable runtime pm on PX laptops without dGPU power control" drm/radeon: fix vertical bars appear on monitor (v2) drm/ttm: fix kref count mess in ttm_bo_move_to_lru_tail drm/virtio: send vblank event after crtc updates drm/dp/mst: Restore primary hub guid on resume drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1() drm/etnaviv: don't move linear memory window on 3D cores without MC2.0 commit 925d96a0c9af72e419dbca1db325e09d78f31502 Merge: 1d003af 4c8bb95 Author: Linus Torvalds Date: Fri Apr 29 17:07:54 2016 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma Pull rdma fixes from Doug Ledford: "Final set of -rc fixes for 4.6. I've collected up a number of patches that are all pretty small with the exception of only a couple. The hfi1 driver has a number of important patches, and it is what really drives the line count of this pull request up. These are all small and I've got this kernel built and running in the test lab (I have most of the hardware, I think nes is the only thing in this patch set that I can't say I've personally tested and have up and running). Summary: - A number of collected fixes for oopses, memory corruptions, deadlocks, etc. All of these fixes are small (many only 5-10 lines), obvious, and tested. - Fix for the security issue related to the use of write for bi-directional communications" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma: RDMA/nes: don't leak skb if carrier down IB/security: Restrict use of the write() interface IB/hfi1: Use kernel default llseek for ui device IB/hfi1: Don't attempt to free resources if initialization failed IB/hfi1: Fix missing lock/unlock in verbs drain callback IB/rdmavt: Fix send scheduling IB/hfi1: Prevent unpinning of wrong pages IB/hfi1: Fix deadlock caused by locking with wrong scope IB/hfi1: Prevent NULL pointer deferences in caching code MAINTAINERS: Update iser/isert maintainer contact info IB/mlx5: Expose correct max_sge_rd limit RDMA/iw_cxgb4: Fix bar2 virt addr calculation for T4 chips iw_cxgb4: handle draining an idle qp iw_cxgb3: initialize ibdev.iwcm->ifname for port mapping iw_cxgb4: initialize ibdev.iwcm->ifname for port mapping IB/core: Don't drain non-existent rq queue-pair IB/core: Fix oops in ib_cache_gid_set_default_gid commit 550af790882f82ed24bb6d75557c2b117a7a0c9d Merge: 97b9b7d 613ac23 Author: Greg Kroah-Hartman Date: Fri Apr 29 15:20:21 2016 -0700 Merge tag 'usb-serial-4.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial fixes for v4.6-rc6 Here are some new device ids. Signed-off-by: Johan Hovold commit b8a0b8e94648179b92191e5cf4fd3c4379b31cc4 Author: Shaohua Li Date: Fri Apr 29 14:18:03 2016 -0700 raid5: delete unnecessary warnning If device has R5_LOCKED set, it's legit device has R5_SkipCopy set and page != orig_page. After R5_LOCKED is clear, handle_stripe_clean_event will clear the SkipCopy flag and set page to orig_page. So the warning is unnecessary. Reported-by: Joey Liao Signed-off-by: Shaohua Li drivers/md/raid5.c | 2 -- 1 file changed, 2 deletions(-) commit ed19ca7fa8bd44936aa3d5284bf38f5d96a28b35 Merge: 04b9665 dcf5341 Author: Kevin Hilman Date: Fri Apr 29 12:04:02 2016 -0700 Merge tag 'sunxi-fixes-for-4.6' of https://git.kernel.org/pub/scm/linux/kernel/git/mripard/linux into fixes Allwinner fixes for 4.6 A single regulator fix * tag 'sunxi-fixes-for-4.6' of https://git.kernel.org/pub/scm/linux/kernel/git/mripard/linux: ARM: dts: sun8i-q8-common: Do not set constraints on dc1sw regulator commit 04b9665b54f7cdc184ea03b0687aaa6d9711646e Author: Arnd Bergmann Date: Tue Mar 15 22:34:45 2016 +0100 ARM: davinci: only use NVMEM when available The davinci platform contains code that calls into the nvmem subsystem, but that might be a loadable module, causing a link error: arch/arm/mach-davinci/built-in.o: In function `davinci_get_mac_addr': :(.text+0x1088): undefined reference to `nvmem_device_read' arch/arm/mach-davinci/built-in.o: In function `read_factory_config': :(.text+0x214c): undefined reference to `nvmem_device_read' Also, when NVMEM is completely disabled, the functions fail with nonobvious error messages. This ensures we only call the API functions when the code is actually reachable from the board file, and otherwise prints a unique log message. Signed-off-by: Arnd Bergmann Fixes: bec3c11bad0e ("misc: at24: replace memory_accessor with nvmem_device_read") Signed-off-by: Sekhar Nori Signed-off-by: Kevin Hilman arch/arm/mach-davinci/board-mityomapl138.c | 5 +++++ arch/arm/mach-davinci/common.c | 5 +++++ 2 files changed, 10 insertions(+) commit 1d003af2effbf10ef7b08736606dd306a29b3396 Merge: 92c19ea 7c88a29 Author: Linus Torvalds Date: Fri Apr 29 11:21:22 2016 -0700 Merge branch 'akpm' (patches from Andrew) Merge fixes from Andrew Morton: "20 fixes" * emailed patches from Andrew Morton : Documentation/sysctl/vm.txt: update numa_zonelist_order description lib/stackdepot.c: allow the stack trace hash to be zero rapidio: fix potential NULL pointer dereference mm/memory-failure: fix race with compound page split/merge ocfs2/dlm: return zero if deref_done message is successfully handled Ananth has moved kcov: don't profile branches in kcov kcov: don't trace the code coverage code mm: wake kcompactd before kswapd's short sleep .mailmap: add Frank Rowand mm/hwpoison: fix wrong num_poisoned_pages accounting mm: call swap_slot_free_notify() with page lock held mm: vmscan: reclaim highmem zone if buffer_heads is over limit numa: fix /proc//numa_maps for THP mm/huge_memory: replace VM_NO_THP VM_BUG_ON with actual VMA check mailmap: fix Krzysztof Kozlowski's misspelled name thp: keep huge zero page pinned until tlb flush mm: exclude HugeTLB pages from THP page_mapped() logic kexec: export OFFSET(page.compound_head) to find out compound tail page kexec: update VMCOREINFO for compound_order/dtor commit f27337e16f2d0e52a8d05ea599ed13cd266ac291 Author: Paolo Abeni Date: Thu Apr 28 11:04:51 2016 +0200 ip_tunnel: fix preempt warning in ip tunnel creation/updating After the commit e09acddf873b ("ip_tunnel: replace dst_cache with generic implementation"), a preemption debug warning is triggered on ip4 tunnels updating; the dst cache helper needs to be invoked in unpreemptible context. We don't need to load the cache on tunnel update, so this commit fixes the warning replacing the load with a dst cache reset, which is preempt safe. Fixes: e09acddf873b ("ip_tunnel: replace dst_cache with generic implementation") Reported-by: Eric Dumazet Signed-off-by: Paolo Abeni Acked-by: Eric Dumazet Signed-off-by: David S. Miller net/ipv4/ip_tunnel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit c4fc1956fa31003bfbe4f597e359d751568e2954 Author: Tony Luck Date: Fri Apr 29 15:42:25 2016 +0200 EDAC: i7core, sb_edac: Don't return NOTIFY_BAD from mce_decoder callback Both of these drivers can return NOTIFY_BAD, but this terminates processing other callbacks that were registered later on the chain. Since the driver did nothing to log the error it seems wrong to prevent other interested parties from seeing it. E.g. neither of them had even bothered to check the type of the error to see if it was a memory error before the return NOTIFY_BAD. Signed-off-by: Tony Luck Acked-by: Aristeu Rozanski Acked-by: Mauro Carvalho Chehab Cc: linux-edac Cc: Link: http://lkml.kernel.org/r/72937355dd92318d2630979666063f8a2853495b.1461864507.git.tony.luck@intel.com Signed-off-by: Borislav Petkov drivers/edac/i7core_edac.c | 2 +- drivers/edac/sb_edac.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit cec5913c1515e5619907016658838af4eff78dd3 Author: Liping Zhang Date: Thu Apr 21 00:47:08 2016 -0700 netfilter: IDLETIMER: fix race condition when destroy the target Workqueue maybe still in running while we destroy the IDLETIMER target, thus cause a use after free error, add cancel_work_sync() to avoid such situation. Signed-off-by: Liping Zhang Signed-off-by: Pablo Neira Ayuso net/netfilter/xt_IDLETIMER.c | 1 + 1 file changed, 1 insertion(+) commit 81be193b7e2089dc34a4e3939f1b057f53995f56 Merge: 02da2d7 1becf03 Author: Rafael J. Wysocki Date: Fri Apr 29 14:22:25 2016 +0200 Merge branch 'pm-cpufreq-fixes' * pm-cpufreq-fixes: cpufreq: intel_pstate: Fix processing for turbo activation ratio Revert "cpufreq: governor: Fix negative idle_time when configured with CONFIG_HZ_PERIODIC" commit abe59c65225ccd63a5964e2f2a73dd2995b948e7 Author: Sven Eckelmann Date: Fri Mar 11 16:44:06 2016 +0100 batman-adv: Fix reference counting of hardif_neigh_node object for neigh_node The batadv_neigh_node was specific to a batadv_hardif_neigh_node and held an implicit reference to it. But this reference was never stored in form of a pointer in the batadv_neigh_node itself. Instead batadv_neigh_node_release depends on a consistent state of hard_iface->neigh_list and that batadv_hardif_neigh_get always returns the batadv_hardif_neigh_node object which it has a reference for. But batadv_hardif_neigh_get cannot guarantee that because it is working only with rcu_read_lock on this list. It can therefore happen that a neigh_addr is in this list twice or that batadv_hardif_neigh_get cannot find the batadv_hardif_neigh_node for an neigh_addr due to some other list operations taking place at the same time. Instead add a batadv_hardif_neigh_node pointer directly in batadv_neigh_node which will be used for the reference counter decremented on release of batadv_neigh_node. Fixes: cef63419f7db ("batman-adv: add list of unique single hop neighbors per hard-interface") Signed-off-by: Sven Eckelmann Signed-off-by: Marek Lindner Signed-off-by: Antonio Quartulli net/batman-adv/originator.c | 16 +++++----------- net/batman-adv/types.h | 2 ++ 2 files changed, 7 insertions(+), 11 deletions(-) commit a33d970d0b54b09746d5540af8271fad4eb10229 Author: Sven Eckelmann Date: Fri Mar 11 16:44:05 2016 +0100 batman-adv: Fix reference counting of vlan object for tt_local_entry The batadv_tt_local_entry was specific to a batadv_softif_vlan and held an implicit reference to it. But this reference was never stored in form of a pointer in the tt_local_entry itself. Instead batadv_tt_local_remove, batadv_tt_local_table_free and batadv_tt_local_purge_pending_clients depend on a consistent state of bat_priv->softif_vlan_list and that batadv_softif_vlan_get always returns the batadv_softif_vlan object which it has a reference for. But batadv_softif_vlan_get cannot guarantee that because it is working only with rcu_read_lock on this list. It can therefore happen that an vid is in this list twice or that batadv_softif_vlan_get cannot find the batadv_softif_vlan for an vid due to some other list operations taking place at the same time. Instead add a batadv_softif_vlan pointer directly in batadv_tt_local_entry which will be used for the reference counter decremented on release of batadv_tt_local_entry. Fixes: 35df3b298fc8 ("batman-adv: fix TT VLAN inconsistency on VLAN re-add") Signed-off-by: Sven Eckelmann Acked-by: Antonio Quartulli Signed-off-by: Marek Lindner Signed-off-by: Antonio Quartulli net/batman-adv/translation-table.c | 42 ++++---------------------------------- net/batman-adv/types.h | 2 ++ 2 files changed, 6 insertions(+), 38 deletions(-) commit b6cf5d499fddbfcffe751e81fb9f1a07d6348026 Author: Antonio Quartulli Date: Thu Apr 14 09:37:05 2016 +0800 batman-adv: B.A.T.M.A.N V - make sure iface is reactivated upon NETDEV_UP event At the moment there is no explicit reactivation of an hard-interface upon NETDEV_UP event. In case of B.A.T.M.A.N. IV the interface is reactivated as soon as the next OGM is scheduled for sending, but this mechanism does not work with B.A.T.M.A.N. V. The latter does not rely on the same scheduling mechanism as its predecessor and for this reason the hard-interface remains deactivated forever after being brought down once. This patch fixes the reactivation mechanism by adding a new routing API which explicitly allows each algorithm to perform any needed operation upon interface re-activation. Such API is optional and is implemented by B.A.T.M.A.N. V only and it just takes care of setting the iface status to ACTIVE Signed-off-by: Antonio Quartulli Signed-off-by: Marek Lindner net/batman-adv/bat_v.c | 12 ++++++++++++ net/batman-adv/hard-interface.c | 3 +++ net/batman-adv/types.h | 3 +++ 3 files changed, 18 insertions(+) commit 2871734e85e920503d49b3a8bc0afbe0773b6036 Author: Antonio Quartulli Date: Sat Mar 12 11:12:59 2016 +0100 batman-adv: fix DAT candidate selection (must use vid) Now that DAT is VLAN aware, it must use the VID when computing the DHT address of the candidate nodes where an entry is going to be stored/retrieved. Fixes: be1db4f6615b ("batman-adv: make the Distributed ARP Table vlan aware") Signed-off-by: Antonio Quartulli [sven@narfation.org: fix conflicts with current version] Signed-off-by: Sven Eckelmann Signed-off-by: Marek Lindner net/batman-adv/distributed-arp-table.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) commit 2d2c038a9999f423e820d89db2b5d7774b67ba49 Author: Takashi Iwai Date: Fri Apr 29 11:20:15 2016 +0200 ALSA: usb-audio: Quirk for yet another Phoenix Audio devices (v2) Phoenix Audio MT202pcs (1de7:0114) and MT202exe (1de7:0013) need the same workaround as TMX320 for avoiding the firmware bug. It fixes the frequent error about the sample rate inquiries and the slow device probe as consequence. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=117321 Cc: Signed-off-by: Takashi Iwai sound/usb/quirks.c | 2 ++ 1 file changed, 2 insertions(+) commit f40d4896bf3284573f1e70e8840c1bcfe1c6bf2d Author: Hans de Goede Date: Wed Apr 27 20:38:44 2016 +0200 regulator: axp20x: Fix axp22x ldo_io registration error on cold boot The maximum supported voltage for ldo_io# is 3.3V, but on cold boot the selector comes up at 0x1f, which maps to 3.8V. This causes _regulator_get_voltage() to fail with -EINVAL which causes regulator registration to fail when constrains are used: [ 1.467788] vcc-touchscreen: failed to get the current voltage(-22) [ 1.474209] axp20x-regulator axp20x-regulator: Failed to register ldo_io1 [ 1.483363] axp20x-regulator: probe of axp20x-regulator failed with error -22 This commits makes the axp20x regulator driver accept the 0x1f register value, fixing this. The datasheet does not guarantee reliable operation above 3.3V, so on boards where this regulator is used the regulator-max-microvolt setting must be 3.3V or less. Signed-off-by: Hans de Goede Signed-off-by: Mark Brown drivers/regulator/axp20x-regulator.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 70d72b7e060e0a16b9ded9d0fbd3dff109743de3 Author: Florian Westphal Date: Sun Apr 24 01:17:14 2016 +0200 netfilter: conntrack: init all_locks to avoid debug warning Else we get 'BUG: spinlock bad magic on CPU#' on resize when spin lock debugging is enabled. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_conntrack_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5305a7b7e860bb40ab226bc7d58019416073948a Author: Ludovic Desroches Date: Tue Apr 19 16:03:45 2016 +0200 pinctrl: at91-pio4: fix pull-up/down logic The default configuration of a pin is often with a value in the pull-up/down field at chip reset. So, even if the internal logic of the controller prevents writing a configuration with pull-up and pull-down at the same time, we must ensure explicitly this condition before writing the register. This was leading to a pull-down condition not taken into account for instance. Signed-off-by: Ludovic Desroches Fixes: 776180848b57 ("pinctrl: introduce driver for Atmel PIO4 controller") Cc: stable@vger.kernel.org #v4.4 and later Acked-by: Alexandre Belloni Acked-by: Nicolas Ferre Signed-off-by: Linus Walleij drivers/pinctrl/pinctrl-at91-pio4.c | 2 ++ 1 file changed, 2 insertions(+) commit ea99697814d6e64927e228675a6eb7fa76014648 Merge: d8ba5d6 afc4542 Author: Dave Airlie Date: Fri Apr 29 14:31:44 2016 +1000 Merge branch 'drm-fixes-4.6' of git://people.freedesktop.org/~agd5f/linux into drm-fixes A few fixes for 4.6. - revert amdgpu PX commit that was previously reverted on the radeon side - cleaned up version of the NI+ MC update display fix for radeon - TTM kref fix * 'drm-fixes-4.6' of git://people.freedesktop.org/~agd5f/linux: drm/amdgpu: disable vm interrupts with vm_fault_stop=2 drm/amdgpu: print a message if ATPX dGPU power control is missing Revert "drm/amdgpu: disable runtime pm on PX laptops without dGPU power control" drm/radeon: fix vertical bars appear on monitor (v2) drm/ttm: fix kref count mess in ttm_bo_move_to_lru_tail commit d8ba5d60d59fd1db5b53c8a110c2f8321591a9d8 Merge: 9a11d2e 7851496 Author: Dave Airlie Date: Fri Apr 29 14:27:50 2016 +1000 Merge branch 'drm-vmwgfx-fixes' of git://people.freedesktop.org/~syeh/repos_linux into drm-fixes three misc vmwgfx fixes * 'drm-vmwgfx-fixes' of git://people.freedesktop.org/~syeh/repos_linux: drm/vmwgfx: Fix order of operation drm/vmwgfx: use vmw_cmd_dx_cid_check for query commands. drm/vmwgfx: Enable SVGA_3D_CMD_DX_SET_PREDICATION commit 92c19ea9535707701861b7533253a516c7d115c9 Merge: 814dd94 1bdb897 Author: Linus Torvalds Date: Thu Apr 28 20:24:27 2016 -0700 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "Two boot crash fixes and an IRQ handling crash fix" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/apic: Handle zero vector gracefully in clear_vector_irq() Revert "x86/mm/32: Set NX in __supported_pte_mask before enabling paging" xen/qspinlock: Don't kick CPU if IRQ is not initialized commit 814dd9481d2045cc99a10a45d267a6167c5cd8ff Merge: 2113caed cf3beb7 Author: Linus Torvalds Date: Thu Apr 28 20:19:04 2016 -0700 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: "x86 PMU driver fixes plus a core code race fix" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel: Fix incorrect lbr_sel_mask value perf/x86/intel/pt: Don't die on VMXON perf/core: Fix perf_event_open() vs. execve() race perf/x86/amd: Set the size of event map array to PERF_COUNT_HW_MAX perf/core: Make sysctl_perf_cpu_time_max_percent conform to documentation perf/x86/intel/rapl: Add missing Haswell model perf/x86/intel: Add model number for Skylake Server to perf commit 2113caed87dd372e5ca2d9b3cba415f4da38936b Merge: 8f3603a 75dd602 Author: Linus Torvalds Date: Thu Apr 28 19:59:17 2016 -0700 Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fixes from Ingo Molnar: "Two lockdep fixes" * 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: lockdep: Fix lock_chain::base size locking/lockdep: Fix ->irq_context calculation commit 8f3603a210970d665e7cecf6623331ce6b24f713 Merge: ba14e96 ede85e9 Author: Linus Torvalds Date: Thu Apr 28 19:54:50 2016 -0700 Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull EFI fix from Ingo Molnar: "This fixes a bug in the efivars code" * 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: efi: Fix out-of-bounds read in variable_matches() commit ba14e961b4fc0b0efcb1b2af7aab605bfce55fb8 Merge: e1f14a5 89a09566 Author: Linus Torvalds Date: Thu Apr 28 19:44:47 2016 -0700 Merge tag 'media/v4.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: "Some regression fixes: - videobuf2 core: avoid the risk of going past buffer on multi-planes and fix rw mode - fix support for 4K formats at V4L2 core - fix a trouble at davinci_fpe, caused by a bad patch - usbvision: revert a patch with a partial fixup. The fixup patch was merged already, and this one has some issues" * tag 'media/v4.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: [media] vb2-memops: Fix over allocation of frame vectors [media] media: vb2: Fix regression on poll() for RW mode [media] v4l2-dv-timings.h: fix polarity for 4k formats [media] davinci_vpfe: Revert "staging: media: davinci_vpfe: remove,unnecessary ret variable" [media] usbvision: revert commit 588afcc1 [media] videobuf2-v4l2: Verify planes array in buffer dequeueing [media] videobuf2-core: Check user space planes array in dqbuf commit e1f14a54694faa5cdc91d4933cd3412809ef5d67 Merge: 6fa9bff af9cc93 Author: Linus Torvalds Date: Thu Apr 28 19:38:45 2016 -0700 Merge tag 'sound-4.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Usually we get a big collection of fixes for ASoC once during rc. And this is it. At this time, most of fixes are about Intel Skylake ASoC driver, which is a new and still on-going development. Along with it, a slight large LOC is seen in legacy HD-audio driver, but it's merely a code move to the upper layer. Other than that, the rest are small or trivial fixes to various drivers, in addition to an ASoC dapm debugfs code fix" * tag 'sound-4.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (24 commits) ALSA: hda - Update BCLK also at hotplug for i915 HSW/BDW ALSA: hda - Add dock support for ThinkPad X260 ASoC: wm5102: Free compressed IRQ in CODEC remove ASoC: arizona: Free speaker thermal IRQs in CODEC remove ASoC: Intel: Skylake: Fix ibs/obs calc for non-integral sampling rates ASoC: Intel: sst: fix a loop timeout in sst_hsw_stream_reset() ASoC: Intel: Skylake: Fix to turn OFF codec power when entering S3 ASoC: hdac_hdmi: Fix codec power state in S3 during playback ASoC: hdac_hdmi: Fix to use dev_pm ops instead soc pm ASoC: wm8962: Correct typo when setting DSPCLK rate ASoC: nau8825: Fix jack detection across suspend ASoC: Intel: Skylake: Fix DSP resource de-allocation ASoC: Intel: Skylake: Fix for unloading module only when it is loaded ASoC: Intel: Skylake: Fix kbuild dependency ASoC: dapm: Make sure we have a card when displaying component widgets ASoC: rt5640: Correct the digital interface data select ASoC: Intel: Skylake: remove call to pci_dev_put ASoC: Intel: Skylake: Call i915 exit last ASoC: Intel: Skylake: Unmap the address last ASoC: Intel: Skylake: Freeup properly on skl_dsp_free ... commit 7c88a292dfcd6979e839493ef18d04770eb3bad0 Author: Xishi Qiu Date: Thu Apr 28 16:19:11 2016 -0700 Documentation/sysctl/vm.txt: update numa_zonelist_order description Commit 3193913ce62c ("mm: page_alloc: default node-ordering on 64-bit NUMA, zone-ordering on 32-bit") changes the default value of numa_zonelist_order. Update the document. Signed-off-by: Xishi Qiu Cc: Mel Gorman Cc: Johannes Weiner Cc: Rik van Riel Cc: David Rientjes Cc: Kamezawa Hiroyuki Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Documentation/sysctl/vm.txt | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) commit 33334e25769c6ad69b983379578f42581d99a2f9 Author: Alexander Potapenko Date: Thu Apr 28 16:19:09 2016 -0700 lib/stackdepot.c: allow the stack trace hash to be zero Do not bail out from depot_save_stack() if the stack trace has zero hash. Initially depot_save_stack() silently dropped stack traces with zero hashes, however there's actually no point in reserving this zero value. Reported-by: Joonsoo Kim Signed-off-by: Alexander Potapenko Acked-by: Andrey Ryabinin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds lib/stackdepot.c | 4 ---- 1 file changed, 4 deletions(-) commit 99f23c2cded85a377325aa9fd374ffa3d55d1088 Author: Vladimir Zapolskiy Date: Thu Apr 28 16:19:06 2016 -0700 rapidio: fix potential NULL pointer dereference The change fixes improper check for a returned error value by class_create() function, which on error returns ERR_PTR() value, thus the original check always results in a dead code on error path. Signed-off-by: Vladimir Zapolskiy Signed-off-by: Alexandre Bounine Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/rapidio/devices/rio_mport_cdev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit c2e7e00b715d3c65f301bec8559d6af4ef8098ab Author: Konstantin Khlebnikov Date: Thu Apr 28 16:19:03 2016 -0700 mm/memory-failure: fix race with compound page split/merge get_hwpoison_page() must recheck relation between head and tail pages. n-horiguchi said: without this recheck, the race causes kernel to pin an irrelevant page, and finally makes kernel crash for refcount mismatch. Signed-off-by: Konstantin Khlebnikov Acked-by: Naoya Horiguchi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memory-failure.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit b73413647ee36406561618f68d0661d49dc47489 Author: xuejiufei Date: Thu Apr 28 16:19:01 2016 -0700 ocfs2/dlm: return zero if deref_done message is successfully handled dlm_deref_lockres_done_handler() should return zero if the message is successfully handled. Fixes: 60d663cb5273 ("ocfs2/dlm: add DEREF_DONE message"). Signed-off-by: xuejiufei Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/ocfs2/dlm/dlmmaster.c | 2 ++ 1 file changed, 2 insertions(+) commit a320817c68e3fa1fc3ddaa709a1ad45cf533693b Author: Ananth N Mavinakayanahalli Date: Thu Apr 28 16:18:58 2016 -0700 Ananth has moved The current ID is going away soon... update email address Signed-off-by: Ananth N Mavinakayanahalli Cc: Masami Hiramatsu Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 36f05ae8bce904b4c8105363e6227a79d343bda6 Author: Andrey Ryabinin Date: Thu Apr 28 16:18:55 2016 -0700 kcov: don't profile branches in kcov Profiling 'if' statements in __sanitizer_cov_trace_pc() leads to unbound recursion and crash: __sanitizer_cov_trace_pc() -> ftrace_likely_update -> __sanitizer_cov_trace_pc() ... Define DISABLE_BRANCH_PROFILING to disable this tracer. Signed-off-by: Andrey Ryabinin Cc: Dmitry Vyukov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/kcov.c | 1 + 1 file changed, 1 insertion(+) commit bdab42dfc974d15303afbf259f340f374a453974 Author: James Morse Date: Thu Apr 28 16:18:52 2016 -0700 kcov: don't trace the code coverage code Kcov causes the compiler to add a call to __sanitizer_cov_trace_pc() in every basic block. Ftrace patches in a call to _mcount() to each function it has annotated. Letting these mechanisms annotate each other is a bad thing. Break the loop by adding 'notrace' to __sanitizer_cov_trace_pc() so that ftrace won't try to patch this code. This patch lets arm64 with KCOV and STACK_TRACER boot. Signed-off-by: James Morse Acked-by: Dmitry Vyukov Cc: Alexander Potapenko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/kcov.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fd901c95388b3bd5a6f749ed1d677a672b992298 Author: Vlastimil Babka Date: Thu Apr 28 16:18:49 2016 -0700 mm: wake kcompactd before kswapd's short sleep When kswapd goes to sleep it checks if the node is balanced and at first it sleeps only for HZ/10 time, then rechecks if the node is still balanced and nobody has woken it during the initial sleep. Only then it goes fully sleep until an allocation slowpath wakes it up again. For higher-order allocations, waking up kcompactd is done only before the full sleep. This turns out to be an issue in case another high-order allocation fails during the initial sleep. It will wake kswapd up, however kswapd considers the zone balanced from the order-0 perspective, and will just quickly try to sleep again. So if there's a longer stream of high-order allocations hitting the slowpath and waking up kswapd, it might never actually wake up kcompactd, which may be considered a regression from kswapd-based compaction. In the worst case, it might be that a single allocation that cannot direct reclaim/compact itself is waking kswapd in the retry loop and preventing kcompactd from being woken up and unblocking it. This patch makes sure kcompactd is woken up in such situations by simply moving the wakeup before the short initial sleep. More efficient solution would be to wake kcompactd immediately instead of kswapd if the node is already order-0 balanced, but in that case we should also move reset_isolation_suitable() call to kcompactd so it's not adding to the allocator's latency. Since it's late in the 4.6 cycle, let's go with the simpler change for now. Fixes: accf62422b3a ("mm, kswapd: replace kswapd compaction with waking up kcompactd") Signed-off-by: Vlastimil Babka Cc: Andrea Arcangeli Cc: "Kirill A. Shutemov" Cc: Rik van Riel Cc: Joonsoo Kim Cc: Mel Gorman Cc: David Rientjes Cc: Michal Hocko Cc: Johannes Weiner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/vmscan.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) commit eeb68d1d2d48b5bfe9d79d8eac35df576bb79a99 Author: Frank Rowand Date: Thu Apr 28 16:18:47 2016 -0700 .mailmap: add Frank Rowand Set current email address to replace obsolete email addresses. Signed-off-by: Frank Rowand Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds .mailmap | 3 +++ 1 file changed, 3 insertions(+) commit d7e69488bd04de165667f6bc741c1c0ec6042ab9 Author: Minchan Kim Date: Thu Apr 28 16:18:44 2016 -0700 mm/hwpoison: fix wrong num_poisoned_pages accounting Currently, migration code increses num_poisoned_pages on *failed* migration page as well as successfully migrated one at the trial of memory-failure. It will make the stat wrong. As well, it marks the page as PG_HWPoison even if the migration trial failed. It would mean we cannot recover the corrupted page using memory-failure facility. This patches fixes it. Signed-off-by: Minchan Kim Reported-by: Vlastimil Babka Acked-by: Naoya Horiguchi Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/migrate.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit b06bad17c7435b600a1d7a35b56eff25e1d3dbc0 Author: Minchan Kim Date: Thu Apr 28 16:18:41 2016 -0700 mm: call swap_slot_free_notify() with page lock held Kyeongdon reported below error which is BUG_ON(!PageSwapCache(page)) in page_swap_info. The reason is that page_endio in rw_page unlocks the page if read I/O is completed so we need to hold a PG_lock again to check PageSwapCache. Otherwise, the page can be removed from swapcache. Kernel BUG at c00f9040 [verbose debug info unavailable] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM Modules linked in: CPU: 4 PID: 13446 Comm: RenderThread Tainted: G W 3.10.84-g9f14aec-dirty #73 task: c3b73200 ti: dd192000 task.ti: dd192000 PC is at page_swap_info+0x10/0x2c LR is at swap_slot_free_notify+0x18/0x6c pc : [] lr : [] psr: 400f0113 sp : dd193d78 ip : c2deb1e4 fp : da015180 r10: 00000000 r9 : 000200da r8 : c120fe08 r7 : 00000000 r6 : 00000000 r5 : c249a6c0 r4 : = c249a6c0 r3 : 00000000 r2 : 40080009 r1 : 200f0113 r0 : = c249a6c0 .. .. Call Trace: page_swap_info+0x10/0x2c swap_slot_free_notify+0x18/0x6c swap_readpage+0x90/0x11c read_swap_cache_async+0x134/0x1ac swapin_readahead+0x70/0xb0 handle_pte_fault+0x320/0x6fc handle_mm_fault+0xc0/0xf0 do_page_fault+0x11c/0x36c do_DataAbort+0x34/0x118 Fixes: 3f2b1a04f44933f2 ("zram: revive swap_slot_free_notify") Signed-off-by: Minchan Kim Tested-by: Kyeongdon Kim Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/page_io.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 7bf52fb891b64b8d61caf0b82060adb9db761aec Author: Minchan Kim Date: Thu Apr 28 16:18:38 2016 -0700 mm: vmscan: reclaim highmem zone if buffer_heads is over limit We have been reclaimed highmem zone if buffer_heads is over limit but commit 6b4f7799c6a5 ("mm: vmscan: invoke slab shrinkers from shrink_zone()") changed the behavior so it doesn't reclaim highmem zone although buffer_heads is over the limit. This patch restores the logic. Fixes: 6b4f7799c6a5 ("mm: vmscan: invoke slab shrinkers from shrink_zone()") Signed-off-by: Minchan Kim Cc: Johannes Weiner Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/vmscan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 28093f9f34cedeaea0f481c58446d9dac6dd620f Author: Gerald Schaefer Date: Thu Apr 28 16:18:35 2016 -0700 numa: fix /proc//numa_maps for THP In gather_pte_stats() a THP pmd is cast into a pte, which is wrong because the layouts may differ depending on the architecture. On s390 this will lead to inaccurate numa_maps accounting in /proc because of misguided pte_present() and pte_dirty() checks on the fake pte. On other architectures pte_present() and pte_dirty() may work by chance, but there may be an issue with direct-access (dax) mappings w/o underlying struct pages when HAVE_PTE_SPECIAL is set and THP is available. In vm_normal_page() the fake pte will be checked with pte_special() and because there is no "special" bit in a pmd, this will always return false and the VM_PFNMAP | VM_MIXEDMAP checking will be skipped. On dax mappings w/o struct pages, an invalid struct page pointer would then be returned that can crash the kernel. This patch fixes the numa_maps THP handling by introducing new "_pmd" variants of the can_gather_numa_stats() and vm_normal_page() functions. Signed-off-by: Gerald Schaefer Cc: Naoya Horiguchi Cc: "Kirill A . Shutemov" Cc: Konstantin Khlebnikov Cc: Michal Hocko Cc: Vlastimil Babka Cc: Jerome Marchand Cc: Johannes Weiner Cc: Dave Hansen Cc: Mel Gorman Cc: Dan Williams Cc: Martin Schwidefsky Cc: Heiko Carstens Cc: Michael Holzheu Cc: [4.3+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/proc/task_mmu.c | 33 ++++++++++++++++++++++++++++++--- include/linux/mm.h | 2 ++ mm/memory.c | 40 ++++++++++++++++++++++++++++++++++++++++ 3 files changed, 72 insertions(+), 3 deletions(-) commit 3486b85a29c1741db99d0c522211c82d2b7a56d0 Author: Konstantin Khlebnikov Date: Thu Apr 28 16:18:32 2016 -0700 mm/huge_memory: replace VM_NO_THP VM_BUG_ON with actual VMA check Khugepaged detects own VMAs by checking vm_file and vm_ops but this way it cannot distinguish private /dev/zero mappings from other special mappings like /dev/hpet which has no vm_ops and popultes PTEs in mmap. This fixes false-positive VM_BUG_ON and prevents installing THP where they are not expected. Link: http://lkml.kernel.org/r/CACT4Y+ZmuZMV5CjSFOeXviwQdABAgT7T+StKfTqan9YDtgEi5g@mail.gmail.com Fixes: 78f11a255749 ("mm: thp: fix /dev/zero MAP_PRIVATE and vm_flags cleanups") Signed-off-by: Konstantin Khlebnikov Reported-by: Dmitry Vyukov Acked-by: Vlastimil Babka Acked-by: Kirill A. Shutemov Cc: Dmitry Vyukov Cc: Andrea Arcangeli Cc: stable Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/huge_memory.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 314e9b75b3f673a61ecbf0bba401830bc7dfe121 Author: Krzysztof Kozlowski Date: Thu Apr 28 16:18:30 2016 -0700 mailmap: fix Krzysztof Kozlowski's misspelled name Patchwork introduced a garbled Polish character in commit 1e3012d0fdc5 ("crypto: s5p-sss - Use memcpy_toio for iomem annotated memory") so fix the mail mapping. Additionally prefer to use kernel.org account for personal work, instead of my gmail address. Signed-off-by: Krzysztof Kozlowski Cc: Herbert Xu Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds .mailmap | 1 + 1 file changed, 1 insertion(+) commit aa88b68c3b1dce8bc3fd54c8a7372a777ff265cd Author: Kirill A. Shutemov Date: Thu Apr 28 16:18:27 2016 -0700 thp: keep huge zero page pinned until tlb flush Andrea has found[1] a race condition on MMU-gather based TLB flush vs split_huge_page() or shrinker which frees huge zero under us (patch 1/2 and 2/2 respectively). With new THP refcounting, we don't need patch 1/2: mmu_gather keeps the page pinned until flush is complete and the pin prevents the page from being split under us. We still need patch 2/2. This is simplified version of Andrea's patch. We don't need fancy encoding. [1] http://lkml.kernel.org/r/1447938052-22165-1-git-send-email-aarcange@redhat.com Signed-off-by: Kirill A. Shutemov Reported-by: Andrea Arcangeli Reviewed-by: Andrea Arcangeli Cc: "Aneesh Kumar K.V" Cc: Mel Gorman Cc: Hugh Dickins Cc: Johannes Weiner Cc: Dave Hansen Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/huge_mm.h | 5 +++++ mm/huge_memory.c | 6 +++--- mm/swap.c | 5 +++++ 3 files changed, 13 insertions(+), 3 deletions(-) commit 66ee95d16a7f1b7b4f1dd74a2d81c6e19dc29a14 Author: Steve Capper Date: Thu Apr 28 16:18:24 2016 -0700 mm: exclude HugeTLB pages from THP page_mapped() logic HugeTLB pages cannot be split, so we use the compound_mapcount to track rmaps. Currently page_mapped() will check the compound_mapcount, but will also go through the constituent pages of a THP compound page and query the individual _mapcount's too. Unfortunately, page_mapped() does not distinguish between HugeTLB and THP compound pages and assumes that a compound page always needs to have HPAGE_PMD_NR pages querying. For most cases when dealing with HugeTLB this is just inefficient, but for scenarios where the HugeTLB page size is less than the pmd block size (e.g. when using contiguous bit on ARM) this can lead to crashes. This patch adjusts the page_mapped function such that we skip the unnecessary THP reference checks for HugeTLB pages. Fixes: e1534ae95004 ("mm: differentiate page_mapped() from page_mapcount() for compound pages") Signed-off-by: Steve Capper Acked-by: Kirill A. Shutemov Cc: Will Deacon Cc: Catalin Marinas Cc: Michal Hocko Cc: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/mm.h | 2 ++ 1 file changed, 2 insertions(+) commit d7f53518f713d3d9bf5ed150f943853fb94e7473 Author: Atsushi Kumagai Date: Thu Apr 28 16:18:21 2016 -0700 kexec: export OFFSET(page.compound_head) to find out compound tail page PageAnon() always look at head page to check PAGE_MAPPING_ANON and tail page's page->mapping has just a poisoned data since commit 1c290f642101 ("mm: sanitize page->mapping for tail pages"). If makedumpfile checks page->mapping of a compound tail page to distinguish anonymous page as usual, it must fail in newer kernel. So it's necessary to export OFFSET(page.compound_head) to avoid checking compound tail pages. The problem is that unnecessary hugepages won't be removed from a dump file in kernels 4.5.x and later. This means that extra disk space would be consumed. It's a problem, but not critical. Signed-off-by: Atsushi Kumagai Acked-by: Dave Young Cc: "Eric W. Biederman" Cc: Vivek Goyal Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/kexec_core.c | 1 + 1 file changed, 1 insertion(+) commit 8639a847b0e11f8d2daa3eafe15a9609c91fd357 Author: Atsushi Kumagai Date: Thu Apr 28 16:18:18 2016 -0700 kexec: update VMCOREINFO for compound_order/dtor makedumpfile refers page.lru.next to get the order of compound pages for page filtering. However, now the order is stored in page.compound_order, hence VMCOREINFO should be updated to export the offset of page.compound_order. The fact is, page.compound_order was introduced already in kernel 4.0, but the offset of it was the same as page.lru.next until kernel 4.3, so this was not actual problem. The above can be said also for page.lru.prev and page.compound_dtor, it's necessary to detect hugetlbfs pages. Further, the content was changed from direct address to the ID which means dtor. The problem is that unnecessary hugepages won't be removed from a dump file in kernels 4.4.x and later. This means that extra disk space would be consumed. It's a problem, but not critical. Signed-off-by: Atsushi Kumagai Acked-by: Dave Young Cc: "Eric W. Biederman" Cc: Vivek Goyal Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/kexec_core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 6fa9bffbccb91e07519e1deb05e001d191f0df43 Merge: cf681c2 d3767f0 Author: Linus Torvalds Date: Thu Apr 28 18:59:24 2016 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client Pull Ceph fixes from Sage Weil: "There is a lifecycle fix in the auth code, a fix for a narrow race condition on map, and a helpful message in the log when there is a feature mismatch (which happens frequently now that the default server-side options have changed)" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client: rbd: report unsupported features to syslog rbd: fix rbd map vs notify races libceph: make authorizer destruction independent of ceph_auth_client commit cf681c2ebcb502ced998ca0659b2907b9ad9daf9 Merge: b75a2bf 532c34b5 Author: Linus Torvalds Date: Thu Apr 28 18:52:11 2016 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Martin Schwidefsky: "Three more bug fixes for 4.6 - Due to a race in the dynamic page table code a multi-threaded program can cause a translation specification exception. With panic_on_oops a user space program can crash the system. - An information leak with the /dev/sclp device. - A use after free in the s390 PCI code" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/sclp_ctl: fix potential information leak with /dev/sclp s390/mm: fix asce_bits handling with dynamic pagetable levels s390/pci: fix use after free in dma_init commit 4c8bb95921e9ac01b9dd0c3abbaf6514ce88af92 Author: Florian Westphal Date: Sun Apr 24 22:18:59 2016 +0200 RDMA/nes: don't leak skb if carrier down Alternatively one could free the skb, OTOH I don't think this test is useful so just remove it. Cc: Signed-off-by: Florian Westphal Signed-off-by: Doug Ledford drivers/infiniband/hw/nes/nes_nic.c | 3 --- 1 file changed, 3 deletions(-) commit 1dfcd832b1a9ed45edac15b31d079b805fa0ae2a Merge: bd34cf6 569cc39 Author: David S. Miller Date: Thu Apr 28 17:29:46 2016 -0400 Merge branch 'bpf-fixes' Alexei Starovoitov says: ==================== bpf: fix several bugs First two patches address bugs found by Jann Horn. Last patch is a minor samples fix spotted during the testing. ==================== Signed-off-by: David S. Miller commit 569cc39d39385a74b23145496bca2df5ac8b2fb8 Author: Alexei Starovoitov Date: Wed Apr 27 18:56:22 2016 -0700 samples/bpf: fix trace_output example llvm cannot always recognize memset as builtin function and optimize it away, so just delete it. It was a leftover from testing of bpf_perf_event_output() with large data structures. Fixes: 39111695b1b8 ("samples: bpf: add bpf_perf_event_output example") Signed-off-by: Alexei Starovoitov Signed-off-by: David S. Miller samples/bpf/trace_output_kern.c | 1 - 1 file changed, 1 deletion(-) commit 6aff67c85c9e5a4bc99e5211c1bac547936626ca Author: Alexei Starovoitov Date: Wed Apr 27 18:56:21 2016 -0700 bpf: fix check_map_func_compatibility logic The commit 35578d798400 ("bpf: Implement function bpf_perf_event_read() that get the selected hardware PMU conuter") introduced clever way to check bpf_helper<->map_type compatibility. Later on commit a43eec304259 ("bpf: introduce bpf_perf_event_output() helper") adjusted the logic and inadvertently broke it. Get rid of the clever bool compare and go back to two-way check from map and from helper perspective. Fixes: a43eec304259 ("bpf: introduce bpf_perf_event_output() helper") Reported-by: Jann Horn Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Signed-off-by: David S. Miller kernel/bpf/verifier.c | 65 +++++++++++++++++++++++++++++++-------------------- 1 file changed, 40 insertions(+), 25 deletions(-) commit 92117d8443bc5afacc8d5ba82e541946310f106e Author: Alexei Starovoitov Date: Wed Apr 27 18:56:20 2016 -0700 bpf: fix refcnt overflow On a system with >32Gbyte of phyiscal memory and infinite RLIMIT_MEMLOCK, the malicious application may overflow 32-bit bpf program refcnt. It's also possible to overflow map refcnt on 1Tb system. Impose 32k hard limit which means that the same bpf program or map cannot be shared by more than 32k processes. Fixes: 1be7f75d1668 ("bpf: enable non-root eBPF programs") Reported-by: Jann Horn Signed-off-by: Alexei Starovoitov Acked-by: Daniel Borkmann Signed-off-by: David S. Miller include/linux/bpf.h | 3 ++- kernel/bpf/inode.c | 7 ++++--- kernel/bpf/syscall.c | 24 ++++++++++++++++++++---- kernel/bpf/verifier.c | 11 +++++++---- 4 files changed, 33 insertions(+), 12 deletions(-) commit bd34cf66cc48a5fb17deb7a1494845c45d71ba8e Merge: bbdd09e 06cd6d6 Author: David S. Miller Date: Thu Apr 28 17:27:31 2016 -0400 Merge branch 'cpsw-phy-handle-fixes' David Rivshin says: ==================== drivers: net: cpsw: phy-handle fixes This series fixes a number of related issues around using phy-handle properties in cpsw emac nodes. Patch 1 fixes a bug if more than one slave is used, and either slave uses the phy-handle property in the devicetree. Patch 2 fixes a NULL pointer dereference which can occur if a phy-handle property is used and of_phy_connect() return NULL, such as with a bad devicetree. Patch 3 fixes an issue where the phy-mode property would be ignored if a phy-handle property was used. This also fixes a bogus error message that would be emitted. Patch 4 fixes makes the binding documentation more explicit that exactly one PHY property should be used, and also marks phy_id as deprecated. Patch 5 cleans up the fixed-link case to work like the now-fixed phy-handle case. I have tested on the following hardware configurations: - (EVMSK) dual emac, phy_id property in both slaves - (EVMSK) dual emac, phy-handle property in both slaves - (EVMSK) a bad phy-handle property pointing to &mmc1 - (EVMSK) phy_id property with incorrect PHY address - (BeagleBoneBlack) single emac, phy_id property - (custom) single emac, fixed-link subnode Andrew Goodbody reported testing v2 on a board that doesn't use dual_emac mode, but with 2 PHYs using phy-handle properties [1]. Nicolas Chauvet reported testing v2 on an HP t410 (dm8148). Markus Brunner reported testing v1 on the following [2]: - emac0 with phy_id and emac1 with fixed phy - emac0 with phy-handle and emac1 with fixed phy - emac0 with fixed phy and emac1 with fixed phy [1] https://lkml.org/lkml/2016/4/22/537 [2] http://www.spinics.net/lists/netdev/msg357890.html ==================== Signed-off-by: David S. Miller commit 06cd6d6eda4bedbb826ed36e4c89734ea364ec4b Author: David Rivshin Date: Wed Apr 27 21:45:45 2016 -0400 drivers: net: cpsw: use of_phy_connect() in fixed-link case If a fixed-link DT subnode is used, the phy_device was looked up so that a PHY ID string could be constructed and passed to phy_connect(). This is not necessary, as the device_node can be passed directly to of_phy_connect() instead. This reuses the same codepath as if the phy-handle DT property was used. Signed-off-by: David Rivshin Tested-by: Nicolas Chauvet Tested-by: Andrew Goodbody Reviewed-by: Mugunthan V N Reviewed-by: Grygorii Strashko Signed-off-by: David S. Miller drivers/net/ethernet/ti/cpsw.c | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) commit a5d2cb3b27441fe7432852d4198eadda1d9d19be Author: David Rivshin Date: Wed Apr 27 21:42:47 2016 -0400 dt: cpsw: phy-handle, phy_id, and fixed-link are mutually exclusive The phy-handle, phy_id, and fixed-link properties are mutually exclusive, and only one need be specified. Make this clear in the binding doc. Also mark the phy_id property as deprecated, as phy-handle should be used instead. Signed-off-by: David Rivshin Reviewed-by: Mugunthan V N Signed-off-by: David S. Miller Documentation/devicetree/bindings/net/cpsw.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit ae092b5bded24d5dc7dae0e0aef4669c169ce874 Author: David Rivshin Date: Wed Apr 27 21:38:26 2016 -0400 drivers: net: cpsw: don't ignore phy-mode if phy-handle is used The phy-mode emac property was only being processed in the phy_id or fixed-link cases. However if phy-handle was specified instead, an error message would complain about the lack of phy_id or fixed-link, and then jump past the of_get_phy_mode(). This would result in the PHY mode defaulting to MII, regardless of what the devicetree specified. Fixes: 9e42f715264f ("drivers: net: cpsw: add phy-handle parsing") Signed-off-by: David Rivshin Tested-by: Nicolas Chauvet Tested-by: Andrew Goodbody Reviewed-by: Mugunthan V N Signed-off-by: David S. Miller drivers/net/ethernet/ti/cpsw.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit d733f7542ad47cf73e033c90cf55158587e1d060 Author: David Rivshin Date: Wed Apr 27 21:32:31 2016 -0400 drivers: net: cpsw: fix segfault in case of bad phy-handle If an emac node has a phy-handle property that points to something which is not a phy, then a segmentation fault will occur when the interface is brought up. This is because while phy_connect() will return ERR_PTR() on failure, of_phy_connect() will return NULL. The common error check uses IS_ERR(), and so missed when of_phy_connect() fails. The NULL pointer is then dereferenced. Also, the common error message referenced slave->data->phy_id, which would be empty in the case of phy-handle. Instead, use the name of the device_node as a useful identifier. And in the phy_id case add the error code for completeness. Fixes: 9e42f715264f ("drivers: net: cpsw: add phy-handle parsing") Signed-off-by: David Rivshin Signed-off-by: David S. Miller drivers/net/ethernet/ti/cpsw.c | 35 ++++++++++++++++++++++------------- 1 file changed, 22 insertions(+), 13 deletions(-) commit 552165bcf7060b998b4a9b5b86110b6a5e04dfd9 Author: David Rivshin Date: Wed Apr 27 21:25:25 2016 -0400 drivers: net: cpsw: fix parsing of phy-handle DT property in dual_emac config Commit 9e42f715264ff158478fa30eaed847f6e131366b ("drivers: net: cpsw: add phy-handle parsing") saved the "phy-handle" phandle into a new cpsw_priv field. However, phy connections are per-slave, so the phy_node field should be in cpsw_slave_data rather than cpsw_priv. This would go unnoticed in a single emac configuration. But in dual_emac mode, the last "phy-handle" property parsed for either slave would be used by both of them, causing them both to refer to the same phy_device. Fixes: 9e42f715264f ("drivers: net: cpsw: add phy-handle parsing") Signed-off-by: David Rivshin Tested-by: Nicolas Chauvet Tested-by: Andrew Goodbody Reviewed-by: Mugunthan V N Reviewed-by: Grygorii Strashko Signed-off-by: David S. Miller drivers/net/ethernet/ti/cpsw.c | 13 ++++++------- drivers/net/ethernet/ti/cpsw.h | 1 + 2 files changed, 7 insertions(+), 7 deletions(-) commit bbdd09ebd7ce87d2122fcc7d97f35a4f8931bc55 Author: Andreas Larsson Date: Wed Apr 27 16:46:10 2016 +0200 MAINTAINERS: net: Change maintainer for GRETH 10/100/1G Ethernet MAC device driver Signed-off-by: Andreas Larsson Signed-off-by: David S. Miller MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 946b636f1730c64e05ff7fe8cf7136422fa8ea70 Author: Jiri Benc Date: Wed Apr 27 14:08:01 2016 +0200 gre: reject GUE and FOU in collect metadata mode The collect metadata mode does not support GUE nor FOU. This might be implemented later; until then, we should reject such config. I think this is okay to be changed. It's unlikely anyone has such configuration (as it doesn't work anyway) and we may need a way to distinguish whether it's supported or not by the kernel later. For backwards compatibility with iproute2, it's not possible to just check the attribute presence (iproute2 always includes the attribute), the actual value has to be checked, too. Fixes: 2e15ea390e6f4 ("ip_gre: Add support to collect tunnel metadata.") Signed-off-by: Jiri Benc Signed-off-by: David S. Miller net/ipv4/ip_gre.c | 5 +++++ 1 file changed, 5 insertions(+) commit 47ff58050a7449260d990ab95fafeb84be682e79 Merge: 6c76f3d 1a8deec Author: David S. Miller Date: Thu Apr 28 17:05:25 2016 -0400 Merge branch 'pegasus-sizes' Petko Manolov says: ==================== pegasus: correct buffer & packet sizes As noticed by Lincoln Ramsay some old (usb 1.1) Pegasus based devices may actually return more bytes than the specified in the datasheet amount. That would not be a problem if the allocated space for the SKB was equal to the parameter passed to usb_fill_bulk_urb(). Some poor bugger (i really hope it was not me, but 'git blame' is useless in this case, so anyway) decided to add '+ 8' to the buffer length parameter. Sometimes the usb transfer overflows and corrupts the socket structure, leading to kernel panic. The above doesn't seem to happen for newer (Pegasus2 based) devices which did help this bug to hide for so long. The new default is to not include the CRC at the end of each received package. So far CRC has been ignored which makes no sense to do it in a first place. The patch is against v4.6-rc5 and was tested on ADM8515 device by transferring multiple gigabytes of data over a couple of days without any complaints from the kernel. Please apply it to whatever net tree you deem fit. Changes since v1: - split the patch in two parts; - corrected the subject lines; Changes since v2: - do not append CRC by default (based on a discussion with Johannes Berg); ==================== Signed-off-by: David S. Miller commit 1a8deec09d12c1a2946f131aa171d5e0479333de Author: Petko Manolov Date: Wed Apr 27 14:24:50 2016 +0300 pegasus: fixes reported packet length The default Pegasus setup was to append the status and CRC at the end of each received packet. The status bits are used to update various stats, but CRC has been ignored. The new default is to not append CRC at the end of RX packets. Signed-off-by: Petko Manolov Signed-off-by: David S. Miller drivers/net/usb/pegasus.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit b7302ca05871e50208bc328cbc8199a21f5d876e Author: Petko Manolov Date: Wed Apr 27 14:24:49 2016 +0300 pegasus: fixes URB buffer allocation size; usb_fill_bulk_urb() receives buffer length parameter 8 bytes larger than what's allocated by alloc_skb(); This seems to be a problem with older (pegasus usb-1.1) devices, which may silently return more data than the maximal packet length. Reported-by: Lincoln Ramsay Signed-off-by: Petko Manolov Signed-off-by: David S. Miller drivers/net/usb/pegasus.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 6c76f3d2922115f4e1327a2dcce47e94453e3375 Merge: 12395d0 2090714 Author: David S. Miller Date: Thu Apr 28 17:02:45 2016 -0400 Merge branch 'gre-lwt-fixes' Jiri Benc says: ==================== gre: fix lwtunnel support This patchset fixes a few bugs in ipgre metadata mode implementation. As an example, in this setup: ip a a 192.168.1.1/24 dev eth0 ip l a gre1 type gre external ip l s gre1 up ip a a 192.168.99.1/24 dev gre1 ip r a 192.168.99.2/32 encap ip dst 192.168.1.2 ttl 10 dev gre1 ping 192.168.99.2 the traffic does not go through before this patchset and does as expected with it applied. v3: Back to v1 in order not to break existing users. Dropped patch 3, will be fixed in iproute2 instead. v2: Rejecting invalid configuration, added patch 3, dropped patch for ETH_P_TEB (will target net-next). ==================== Signed-off-by: David S. Miller commit 2090714e1d6e80979dd6926be22b0de9ca432273 Author: Jiri Benc Date: Wed Apr 27 11:29:07 2016 +0200 gre: build header correctly for collect metadata tunnels In ipgre (i.e. not gretap) + collect metadata mode, the skb was assumed to contain Ethernet header and was encapsulated as ETH_P_TEB. This is not the case, the interface is ARPHRD_IPGRE and the protocol to be used for encapsulation is skb->protocol. Fixes: 2e15ea390e6f4 ("ip_gre: Add support to collect tunnel metadata.") Signed-off-by: Jiri Benc Acked-by: Pravin B Shelar Reviewed-by: Simon Horman Signed-off-by: David S. Miller net/ipv4/ip_gre.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit a64b04d86d14c81f50f68e102f79ef301e3d0a0e Author: Jiri Benc Date: Wed Apr 27 11:29:06 2016 +0200 gre: do not assign header_ops in collect metadata mode In ipgre mode (i.e. not gretap) with collect metadata flag set, the tunnel is incorrectly assumed to be mGRE in NBMA mode (see commit 6a5f44d7a048c). This is not the case, we're controlling the encapsulation addresses by lwtunnel metadata. And anyway, assigning dev->header_ops in collect metadata mode does not make sense. Although it would be more user firendly to reject requests that specify both the collect metadata flag and a remote/local IP address, this would break current users of gretap or introduce ugly code and differences in handling ipgre and gretap configuration. Keep the current behavior of remote/local IP address being ignored in such case. v3: Back to v1, added explanation paragraph. v2: Reject configuration specifying both remote/local address and collect metadata flag. Fixes: 2e15ea390e6f4 ("ip_gre: Add support to collect tunnel metadata.") Signed-off-by: Jiri Benc Signed-off-by: David S. Miller net/ipv4/ip_gre.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 12395d0647dd0e4a594e091925fc4f2705b986a1 Merge: a05d7df e6436be Author: David S. Miller Date: Thu Apr 28 16:55:26 2016 -0400 Merge tag 'mac80211-for-davem-2016-04-27' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== Just a single fix, for a per-CPU memory leak in a (root user triggerable) error case. ==================== Signed-off-by: David S. Miller commit a05d7dfc51417f6437ff35e4682fe547fb665286 Author: Timur Tabi Date: Tue Apr 26 12:44:18 2016 -0500 net: phy: at803x: only the AT8030 needs a hardware reset on link change Commit 13a56b44 ("at803x: Add support for hardware reset") added a work-around for a hardware bug on the AT8030. However, the work-around was being called for all 803x PHYs, even those that don't need it. Function at803x_link_change_notify() checks to make sure that it only resets the PHY on the 8030, but it makes more sense to not call that function at all if it isn't needed. Signed-off-by: Timur Tabi Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/phy/at803x.c | 40 ++++++++++++++++++---------------------- 1 file changed, 18 insertions(+), 22 deletions(-) commit 956a7ffe00b4e8b75d98881ae4d0bd1b580648cb Merge: eb63efb c4fdb6cf Author: David S. Miller Date: Thu Apr 28 16:42:40 2016 -0400 Merge tag 'batman-adv-fix-for-davem' of git://git.open-mesh.org/linux-merge Antonio Quartulli says: ==================== In this patchset you can find the following fixes: 1) check skb size to avoid reading beyond its border when delivering payloads, by Sven Eckelmann 2) initialize last_seen time in neigh_node object to prevent cleanup routine from accidentally purge it, by Marek Lindner 3) release "recently added" slave interfaces upon virtual/batman interface shutdown, by Sven Eckelmann 4) properly decrease router object reference counter upon routing table update, by Sven Eckelmann 5) release queue slots when purging OGM packets of deactivating slave interface, by Linus Lüssing Patch 2 and 3 have no "Fixes:" tag because the offending commits date back to when batman-adv was not yet officially in the net tree. ==================== Signed-off-by: David S. Miller commit eb63efb4f263f1f4c2375731d3a9e2040030bc6a Author: Christophe Jaillet Date: Tue Apr 26 04:33:43 2016 +0200 ps3_gelic: fix memcpy parameter The size allocated for target->hwinfo and the number of bytes copied in it should be consistent. Signed-off-by: Christophe JAILLET Signed-off-by: David S. Miller drivers/net/ethernet/toshiba/ps3_gelic_wireless.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 14437e3fa284f465dbbc8611fd4331ca8d60e986 Author: Woojung Huh Date: Mon Apr 25 22:22:36 2016 +0000 lan78xx: workaround of forced 100 Full/Half duplex mode error At forced 100 Full & Half duplex mode, chip may fail to set mode correctly when cable is switched between long(~50+m) and short one. As workaround, set to 10 before setting to 100 at forced 100 F/H mode. Signed-off-by: Woojung Huh Signed-off-by: David S. Miller drivers/net/usb/lan78xx.c | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) commit 74d79a2e30c476ccc7d45ecf978f38d815287f81 Author: Woojung Huh Date: Mon Apr 25 22:22:32 2016 +0000 lan78xx: fix statistics counter error Fix rx_bytes, tx_bytes and tx_frames error in netdev.stats. - rx_bytes counted bytes excluding size of struct ethhdr. - tx_packets didn't count multiple packets in a single urb - tx_bytes included 8 bytes of extra commands. Signed-off-by: Woojung Huh Signed-off-by: David S. Miller drivers/net/usb/lan78xx.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) commit 1d9619d5337df6cf56eb66b6c8213d1317583513 Author: Colin Ian King Date: Mon Apr 25 23:11:22 2016 +0100 net: dsa: mv88e6xxx: fix uninitialized error return The error return err is not initialized and there is a possibility that err is not assigned causing mv88e6xxx_port_bridge_join to return a garbage error return status. Fix this by initializing err to 0. Signed-off-by: Colin Ian King Reviewed-by: Vivien Didelot Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7b7483409f09c15f30ac43242ead1ab3061e1f59 Author: Marcelo Ricardo Leitner Date: Mon Apr 25 15:13:17 2016 -0300 net: fix net_gso_ok for new GSO types. Fix casting in net_gso_ok. Otherwise the shift on gso_type << NETIF_F_GSO_SHIFT may hit the 32th bit and make it look like a INT_MIN, which is then promoted from signed to uint64 which is 0xffffffff80000000, resulting in wrong behavior when it is and'ed with the feature itself, as in: This test app: #include #include int main(int argc, char **argv) { uint64_t feature1; uint64_t feature2; int gso_type = 1 << 15; feature1 = gso_type << 16; feature2 = (uint64_t)gso_type << 16; printf("%lx %lx\n", feature1, feature2); return 0; } Gives: ffffffff80000000 80000000 So that this: return (features & feature) == feature; Actually works on more bits than expected and invalid ones. Fix is to promote it earlier. Issue noted while rebasing SCTP GSO patch but posting separetely as someone else may experience this meanwhile. Signed-off-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller include/linux/netdevice.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 62522ef3c399996f6c8120bfd14b94280bc9f490 Author: Neil Armstrong Date: Mon Apr 25 19:41:38 2016 +0200 net: ethernet: davinci_emac: Fix devioctl while in fixed link When configured in fixed link, the DaVinci emac driver sets the priv->phydev to NULL and further ioctl calls to the phy_mii_ioctl() causes the kernel to crash. Cc: Brian Hutchinson Fixes: 1bb6aa56bb38 ("net: davinci_emac: Add support for fixed-link PHY") Signed-off-by: Neil Armstrong Reviewed-by: Mugunthan V N Signed-off-by: David S. Miller drivers/net/ethernet/ti/davinci_emac.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit eee66af857d812304419eb5eed1f04f5f0c72e19 Merge: e00f801 e2841ea Author: David S. Miller Date: Thu Apr 28 14:23:27 2016 -0400 Merge tag 'wireless-drivers-for-davem-2016-04-25' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for 4.6 ath9k * fix a couple release old throughput regression on ar9281 iwlwifi * add new device IDs for 8265 * fix a NULL pointer dereference when paging firmware asserts * remove a WARNING on gscan capabilities * fix MODULE_FIRMWARE for 8260 ==================== Signed-off-by: David S. Miller commit e00f80173bacba88a80ec531f78f04c5ae92d7d1 Author: Bert Kenward Date: Mon Apr 25 17:42:12 2016 +0100 MAINTAINERS: net: update sfc maintainers Add myself and Edward Cree as maintainers. Remove Shradha Shah, who is on extended leave. Cc: David S. Miller Cc: Edward Cree Cc: Shradha Shah Signed-off-by: Bert Kenward Acked-by: Edward Cree Signed-off-by: David S. Miller MAINTAINERS | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit dcb4123cbec0294eee1815cfaa1e9b4a8fddb06a Author: Jon Cooper Date: Mon Apr 25 16:51:00 2016 +0100 sfc: disable RSS when unsupported When certain firmware variants are selected (via the sfboot utility) the SFC7000 and SFC8000 series NICs don't support RSS. The driver still tries (and fails) to insert filters with the RSS flag, and the NIC fails to pass traffic. When the firmware reports RSS_LIMITED suppress allocating a default RSS context. The absence of an RSS context is picked up in filter insertion and RSS flags are discarded. Signed-off-by: Bert Kenward Signed-off-by: David S. Miller drivers/net/ethernet/sfc/ef10.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) commit 4be2b49e2820eeaf6436bf7c6d0099c86b6cd237 Author: Stanislaw Gruszka Date: Mon Apr 25 10:59:19 2016 +0200 myri10ge: fix sleeping with bh disabled napi_disable() can not be called with bh disabled, move locking just around myri10ge_ss_lock_napi() . Patches fixes following bug: [ 114.278378] BUG: sleeping function called from invalid context at net/core/dev.c:4383 [ 114.313712] Call Trace: [ 114.314943] [] dump_stack+0x19/0x1b [ 114.317673] [] __might_sleep+0x173/0x230 [ 114.320566] [] napi_disable+0x27/0x90 [ 114.323254] [] myri10ge_close+0xbf/0x3f0 [myri10ge] Signed-off-by: Stanislaw Gruszka Acked-by: Hyong-Youb Kim Signed-off-by: David S. Miller drivers/net/ethernet/myricom/myri10ge/myri10ge.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit edb9a1b8942b32762b1179039debf2172ad9cc32 Author: Eric Engestrom Date: Mon Apr 25 07:36:56 2016 +0100 Documentation: networking: fix spelling mistakes Signed-off-by: Eric Engestrom Signed-off-by: David S. Miller Documentation/networking/altera_tse.txt | 6 +++--- Documentation/networking/ipvlan.txt | 6 +++--- Documentation/networking/pktgen.txt | 6 +++--- Documentation/networking/vrf.txt | 2 +- Documentation/networking/xfrm_sync.txt | 6 +++--- 5 files changed, 13 insertions(+), 13 deletions(-) commit 7851496a32319237456919575e5f4ba62f74cc7d Author: Sinclair Yeh Date: Thu Apr 21 11:29:31 2016 -0700 drm/vmwgfx: Fix order of operation mode->hdisplay * (var->bits_per_pixel + 7) gets evaluated before the division, potentially making the pitch larger than it should be. Since the original intention is to do a div-round-up, just use the macro instead. Signed-off-by: Sinclair Yeh Reviewed-by: Thomas Hellstrom drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit e02e58843153ce80a9fe7588def89b2638d40e64 Author: Charmaine Lee Date: Tue Apr 12 08:19:08 2016 -0700 drm/vmwgfx: use vmw_cmd_dx_cid_check for query commands. Instead of calling vmw_cmd_ok, call vmw_cmd_dx_cid_check to validate the context id for query commands. Signed-off-by: Charmaine Lee Reviewed-by: Sinclair Yeh drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 1883598d4201361a6d2ce785095695f58071ee11 Author: Charmaine Lee Date: Tue Apr 12 08:14:23 2016 -0700 drm/vmwgfx: Enable SVGA_3D_CMD_DX_SET_PREDICATION Fixes piglit tests nv_conditional_render-* crashes. Signed-off-by: Charmaine Lee Reviewed-by: Brian Paul Reviewed-by: Sinclair Yeh drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e6bd18f57aad1a2d1ef40e646d03ed0f2515c9e3 Author: Jason Gunthorpe Date: Sun Apr 10 19:13:13 2016 -0600 IB/security: Restrict use of the write() interface The drivers/infiniband stack uses write() as a replacement for bi-directional ioctl(). This is not safe. There are ways to trigger write calls that result in the return structure that is normally written to user space being shunted off to user specified kernel memory instead. For the immediate repair, detect and deny suspicious accesses to the write API. For long term, update the user space libraries and the kernel API to something that doesn't present the same security vulnerabilities (likely a structured ioctl() interface). The impacted uAPI interfaces are generally only available if hardware from drivers/infiniband is installed in the system. Reported-by: Jann Horn Signed-off-by: Linus Torvalds Signed-off-by: Jason Gunthorpe [ Expanded check to all known write() entry points ] Cc: stable@vger.kernel.org Signed-off-by: Doug Ledford drivers/infiniband/core/ucm.c | 4 ++++ drivers/infiniband/core/ucma.c | 3 +++ drivers/infiniband/core/uverbs_main.c | 5 +++++ drivers/infiniband/hw/qib/qib_file_ops.c | 5 +++++ drivers/staging/rdma/hfi1/TODO | 2 +- drivers/staging/rdma/hfi1/file_ops.c | 6 ++++++ include/rdma/ib.h | 16 ++++++++++++++++ 7 files changed, 40 insertions(+), 1 deletion(-) commit 7723d8c2445c4dfa91f8df42703b56f8ade59af7 Author: Dean Luick Date: Fri Apr 22 11:17:03 2016 -0700 IB/hfi1: Use kernel default llseek for ui device The ui device llseek had a mistake with SEEK_END and did not fully follow seek semantics. Correct all this by using a kernel supplied function for fixed size devices. Cc: Al Viro Reviewed-by: Dennis Dalessandro Signed-off-by: Dean Luick Signed-off-by: Doug Ledford drivers/staging/rdma/hfi1/file_ops.c | 25 ++----------------------- 1 file changed, 2 insertions(+), 23 deletions(-) commit 94158442eb0c66bbb0b733999e108fa26a7673ef Author: Mitko Haralanov Date: Wed Apr 20 06:05:36 2016 -0700 IB/hfi1: Don't attempt to free resources if initialization failed Attempting to free resources which have not been allocated and initialized properly led to the following kernel backtrace: BUG: unable to handle kernel NULL pointer dereference at (null) IP: [] unlock_exp_tids.isra.8+0x2e/0x120 [hfi1] PGD 852a43067 PUD 85d4a6067 PMD 0 Oops: 0000 [#1] SMP CPU: 0 PID: 2831 Comm: osu_bw Tainted: G IO 3.12.18-wfr+ #1 task: ffff88085b15b540 ti: ffff8808588fe000 task.ti: ffff8808588fe000 RIP: 0010:[] [] unlock_exp_tids.isra.8+0x2e/0x120 [hfi1] RSP: 0018:ffff8808588ffde0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff880858a31800 RCX: 0000000000000000 RDX: ffff88085d971bc0 RSI: ffff880858a318f8 RDI: ffff880858a318c0 RBP: ffff8808588ffe20 R08: 0000000000000000 R09: 0000000000000000 R10: ffff88087ffd6f40 R11: 0000000001100348 R12: ffff880852900000 R13: ffff880858a318c0 R14: 0000000000000000 R15: ffff88085d971be8 FS: 00007f4674e83740(0000) GS:ffff88087f400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000085c377000 CR4: 00000000001407f0 Stack: ffffffffa0941a71 ffff880858a318f8 ffff88085d971bc0 ffff880858a31800 ffff880852900000 ffff880858a31800 00000000003ffff7 ffff88085d971bc0 ffff8808588ffe60 ffffffffa09663fc ffff8808588ffe60 ffff880858a31800 Call Trace: [] ? find_mmu_handler+0x51/0x70 [hfi1] [] hfi1_user_exp_rcv_free+0x6c/0x120 [hfi1] [] hfi1_file_close+0x1a9/0x340 [hfi1] [] __fput+0xe9/0x270 [] ____fput+0xe/0x10 [] task_work_run+0xa7/0xe0 [] do_notify_resume+0x59/0x80 [] int_signal+0x12/0x17 This commit re-arranges the context initialization code in a way that would allow for context event flags to be used to determine whether the context has been successfully initialized. In turn, this can be used to skip the resource de-allocation if they were never allocated in the first place. Fixes: 3abb33ac6521 ("staging/hfi1: Add TID cache receive init and free funcs") Reviewed-by: Dennis Dalessandro Signed-off-by: Mitko Haralanov Reviewed-by: Leon Romanovsky drivers/staging/rdma/hfi1/file_ops.c | 60 ++++++++++++++------------------ drivers/staging/rdma/hfi1/user_exp_rcv.c | 2 ++ 2 files changed, 29 insertions(+), 33 deletions(-) commit b9b06cb6fedab10665a2d527464b45f332d17465 Author: Mike Marciniszyn Date: Wed Apr 20 06:05:30 2016 -0700 IB/hfi1: Fix missing lock/unlock in verbs drain callback The iowait_sdma_drained() callback lacked locking to protect the qp s_flags field. This causes the s_flags to be out of sync on multiple CPUs, potentially corrupting the s_flags. Fixes: a545f5308b6c ("staging/rdma/hfi: fix CQ completion order issue") Reviewed-by: Sebastian Sanchez Signed-off-by: Mike Marciniszyn Reviewed-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/staging/rdma/hfi1/qp.c | 2 ++ 1 file changed, 2 insertions(+) commit e6d2e0176e1f3c1e1534851b66c0b972f03ff069 Author: Jubin John Date: Tue Apr 12 10:47:00 2016 -0700 IB/rdmavt: Fix send scheduling call_send is used to determine whether to send immediately or schedule a send for later. The current logic in rdmavt is inverted and has a negative impact on the latency of the hfi1 and qib drivers. Fix this regression by correctly calling send immediately when call_send is set. Reviewed-by: Dennis Dalessandro Reviewed-by: Mike Marciniszyn Signed-off-by: Jubin John Signed-off-by: Doug Ledford drivers/infiniband/sw/rdmavt/qp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 849e3e9398608c26a7c54bf9fbf3288f7ced6bfb Author: Mitko Haralanov Date: Tue Apr 12 10:46:16 2016 -0700 IB/hfi1: Prevent unpinning of wrong pages The routine used by the SDMA cache to handle already cached nodes can extend an already existing node. In its error handling code, the routine will unpin pages when not all pages of the buffer extension were pinned. There was a bug in that part of the routine, which would mistakenly unpin pages from the original set rather than the newly pinned pages. This commit fixes that bug by offsetting the page array to the proper place pointing at the beginning of the newly pinned pages. Reviewed-by: Dean Luick Signed-off-by: Mitko Haralanov Signed-off-by: Doug Ledford drivers/staging/rdma/hfi1/user_sdma.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit de82bdff62a9078a6e4f1452e2f2604686e51e49 Author: Mitko Haralanov Date: Tue Apr 12 10:46:03 2016 -0700 IB/hfi1: Fix deadlock caused by locking with wrong scope The locking around the interval RB tree is designed to prevent access to the tree while it's being modified. The locking in its current form is too overzealous, which is causing a deadlock in certain cases with the following backtrace: Kernel panic - not syncing: Watchdog detected hard LOCKUP on cpu 0 CPU: 0 PID: 5836 Comm: IMB-MPI1 Tainted: G O 3.12.18-wfr+ #1 0000000000000000 ffff88087f206c50 ffffffff814f1caa ffffffff817b53f0 ffff88087f206cc8 ffffffff814ecd56 0000000000000010 ffff88087f206cd8 ffff88087f206c78 0000000000000000 0000000000000000 0000000000001662 Call Trace: [] dump_stack+0x45/0x56 [] panic+0xc2/0x1cb [] ? restart_watchdog_hrtimer+0x50/0x50 [] watchdog_overflow_callback+0xc2/0xd0 [] __perf_event_overflow+0x8e/0x2b0 [] perf_event_overflow+0x14/0x20 [] intel_pmu_handle_irq+0x1b6/0x390 [] perf_event_nmi_handler+0x2b/0x50 [] nmi_handle.isra.3+0x88/0x180 [] do_nmi+0x169/0x310 [] end_repeat_nmi+0x1e/0x2e [] ? unmap_single+0x30/0x30 [] ? _raw_spin_lock_irqsave+0x2d/0x40 [] ? _raw_spin_lock_irqsave+0x2d/0x40 [] ? _raw_spin_lock_irqsave+0x2d/0x40 <> [] hfi1_mmu_rb_search+0x38/0x70 [hfi1] [] user_sdma_free_request+0xcb/0x120 [hfi1] [] user_sdma_txreq_cb+0x263/0x350 [hfi1] [] ? sdma_txclean+0x27/0x1c0 [hfi1] [] ? user_sdma_send_pkts+0x1710/0x1710 [hfi1] [] sdma_make_progress+0x166/0x480 [hfi1] [] ? ttwu_do_wakeup+0x19/0xd0 [] sdma_engine_interrupt+0x8e/0x100 [hfi1] [] sdma_interrupt+0x5d/0xa0 [hfi1] [] handle_irq_event_percpu+0x47/0x1d0 [] handle_irq_event+0x37/0x60 [] handle_edge_irq+0x6f/0x120 [] handle_irq+0xbf/0x150 [] ? irq_enter+0x17/0x80 [] do_IRQ+0x4d/0xc0 [] common_interrupt+0x6a/0x6a [] ? finish_task_switch+0x54/0xe0 [] __schedule+0x3b6/0x7e0 [] __cond_resched+0x26/0x30 [] _cond_resched+0x3a/0x50 [] down_write+0x12/0x30 [] hfi1_release_user_pages+0x69/0x90 [hfi1] [] sdma_rb_remove+0x9a/0xc0 [hfi1] [] __mmu_rb_remove.isra.5+0x5d/0x70 [hfi1] [] hfi1_mmu_rb_remove+0x56/0x70 [hfi1] [] hfi1_user_sdma_process_request+0x74b/0x1160 [hfi1] [] hfi1_aio_write+0xc3/0x100 [hfi1] [] do_sync_readv_writev+0x4c/0x80 [] do_readv_writev+0xbb/0x230 [] ? fsnotify+0x241/0x320 [] ? finish_task_switch+0x54/0xe0 [] vfs_writev+0x35/0x60 [] SyS_writev+0x49/0xc0 [] ? __audit_syscall_exit+0x1f6/0x2a0 [] system_call_fastpath+0x16/0x1b As evident from the backtrace above, the process was being put to sleep while holding the lock. Limiting the scope of the lock only to the RB tree operation fixes the above error allowing for proper locking and the process being put to sleep when needed. Reviewed-by: Dennis Dalessandro Reviewed-by: Dean Luick Signed-off-by: Mitko Haralanov Signed-off-by: Doug Ledford drivers/staging/rdma/hfi1/mmu_rb.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) commit f19bd643dbded8672bfeffe9e51322464e4a9239 Author: Mitko Haralanov Date: Tue Apr 12 10:45:57 2016 -0700 IB/hfi1: Prevent NULL pointer deferences in caching code There is a potential kernel crash when the MMU notifier calls the invalidation routines in the hfi1 pinned page caching code for sdma. The invalidation routine could call the remove callback for the node, which in turn ends up dereferencing the current task_struct to get a pointer to the mm_struct. However, the mm_struct pointer could be NULL resulting in the following backtrace: BUG: unable to handle kernel NULL pointer dereference at 00000000000000a8 IP: [] sdma_rb_remove+0xaa/0x100 [hfi1] 15 task: ffff88085e66e080 ti: ffff88085c244000 task.ti: ffff88085c244000 RIP: 0010:[] [] sdma_rb_remove+0xaa/0x100 [hfi1] RSP: 0000:ffff88085c245878 EFLAGS: 00010002 RAX: 0000000000000000 RBX: ffff88105b9bbd40 RCX: ffffea003931a830 RDX: 0000000000000004 RSI: ffff88105754a9c0 RDI: ffff88105754a9c0 RBP: ffff88085c245890 R08: ffff88105b9bbd70 R09: 00000000fffffffb R10: ffff88105b9bbd58 R11: 0000000000000013 R12: ffff88105754a9c0 R13: 0000000000000001 R14: 0000000000000001 R15: ffff88105b9bbd40 FS: 0000000000000000(0000) GS:ffff88107ef40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000000a8 CR3: 0000000001a0b000 CR4: 00000000001407e0 Stack: ffff88105b9bbd40 ffff88080ec481a8 ffff88080ec481b8 ffff88085c2458c0 ffffffffa03fa00e ffff88080ec48190 ffff88080ed9cd00 0000000001024000 0000000000000000 ffff88085c245920 ffffffffa03fa0e7 0000000000000282 Call Trace: [] __mmu_rb_remove.isra.5+0x5e/0x70 [hfi1] [] mmu_notifier_mem_invalidate+0xc7/0xf0 [hfi1] [] mmu_notifier_page+0x13/0x20 [hfi1] [] __mmu_notifier_invalidate_page+0x50/0x70 [] try_to_unmap_one+0x20b/0x470 [] try_to_unmap_anon+0xa7/0x120 [] try_to_unmap+0x4d/0x60 [] shrink_page_list+0x2eb/0x9d0 [] shrink_inactive_list+0x243/0x490 [] shrink_lruvec+0x4c1/0x640 [] shrink_zone+0x31/0x100 [] kswapd_shrink_zone.constprop.62+0xef/0x1c0 [] kswapd+0x403/0x7e0 [] ? shrink_all_memory+0xf0/0xf0 [] kthread+0xc0/0xd0 [] ? insert_kthread_work+0x40/0x40 [] ret_from_fork+0x7c/0xb0 [] ? insert_kthread_work+0x40/0x40 To correct this, the mm_struct passed to us by the MMU notifier is used (which is what should have been done to begin with). This avoids the broken derefences and ensures that the correct mm_struct is used. Reviewed-by: Dennis Dalessandro Reviewed-by: Dean Luick Signed-off-by: Mitko Haralanov Signed-off-by: Doug Ledford drivers/staging/rdma/hfi1/mmu_rb.c | 24 ++++++++++++++---------- drivers/staging/rdma/hfi1/mmu_rb.h | 3 ++- drivers/staging/rdma/hfi1/user_exp_rcv.c | 9 +++++---- drivers/staging/rdma/hfi1/user_sdma.c | 24 ++++++++++++++++-------- 4 files changed, 37 insertions(+), 23 deletions(-) commit 6383190203b93ff5915edb378acc76bb6a21a604 Merge: 94379ac f5515f9 Author: Arnd Bergmann Date: Thu Apr 28 17:46:27 2016 +0200 Merge tag 'renesas-fixes2-for-v4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into fixes Merge "Second Round of Renesas ARM Based SoC Fixes for v4.6" from Simon Horman: * Don't disable referenced optional scif clock * tag 'renesas-fixes2-for-v4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas: arm64: dts: r8a7795: Don't disable referenced optional scif clock ARM: shmobile: timer: Fix preset_lpj leading to too short delays Revert "ARM: dts: porter: Enable SCIF_CLK frequency and pins" ARM: dts: r8a7791: Don't disable referenced optional clocks commit 94379acca0394e8b030d805e7ae20d81b22fa77e Merge: 5616f36 7472931 Author: Arnd Bergmann Date: Thu Apr 28 17:43:33 2016 +0200 Merge tag 'omap-for-v4.6/fixes-rc5-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes Fixes for omaps for v4.6-rc cycle. All dts fixes, mostly affecting voltages and pinctrl for various device drivers: - Regulator minimum voltage fixes for omap5 - ISP syscon register offset fix for omap3 - Fix regulator initial modes for n900 - Fix omap5 pinctrl wkup instance size * tag 'omap-for-v4.6/fixes-rc5-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: dts: omap5: fix range of permitted wakeup pinmux registers ARM: dts: omap3-n900: Specify peripherals LDO regulators initial mode ARM: dts: omap3: Fix ISP syscon register offset ARM: dts: omap5-cm-t54: fix ldo1_reg and ldo4_reg ranges ARM: dts: omap5-board-common: fix ldo1_reg and ldo4_reg ranges commit e7d2c25d94bf4bb6f73d185e5514414a15a56f46 Author: Sagi Grimberg Date: Sun Apr 3 15:03:12 2016 +0300 MAINTAINERS: Update iser/isert maintainer contact info Signed-off-by: Sagi Grimberg Acked-by: Nicholas Bellinger Signed-off-by: Doug Ledford MAINTAINERS | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 986ef95ecdd3eb6fa29433e68faa94c7624083be Author: Sagi Grimberg Date: Thu Mar 31 19:03:25 2016 +0300 IB/mlx5: Expose correct max_sge_rd limit mlx5 devices (Connect-IB, ConnectX-4, ConnectX-4-LX) has a limitation where rdma read work queue entries cannot exceed 512 bytes. A rdma_read wqe needs to fit in 512 bytes: - wqe control segment (16 bytes) - rdma segment (16 bytes) - scatter elements (16 bytes each) So max_sge_rd should be: (512 - 16 - 16) / 16 = 30. Cc: linux-stable@vger.kernel.org Reported-by: Christoph Hellwig Tested-by: Christoph Hellwig Signed-off-by: Sagi Grimberg Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/hw/mlx5/main.c | 2 +- include/linux/mlx5/device.h | 11 +++++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) commit 2482bc31ca8096241b8fa97610ef23154ce55f45 Author: Sudeep Holla Date: Wed Apr 27 17:18:59 2016 +0100 cpufreq: st: enable selective initialization based on the platform The sti-cpufreq does unconditional registration of the cpufreq-dt driver which causes issue on an multi-platform build. For example, on Vexpress TC2 platform, we get the following error on boot: cpu cpu0: OPP-v2 not supported cpu cpu0: Not doing voltage scaling cpu: dev_pm_opp_of_cpumask_add_table: couldn't find opp table for cpu:0, -19 cpu cpu0: dev_pm_opp_get_max_volt_latency: Invalid regulator (-6) ... arm_big_little: bL_cpufreq_register: Failed registering platform driver: vexpress-spc, err: -17 The actual driver fails to initialise as cpufreq-dt is probed successfully, which is incorrect. This issue can happen to any platform not using cpufreq-dt in a multi-platform build. This patch adds a check to do selective initialization of the driver. Fixes: ab0ea257fc58 (cpufreq: st: Provide runtime initialised driver for ST's platforms) Signed-off-by: Sudeep Holla Acked-by: Viresh Kumar Acked-by: Lee Jones Cc: 4.5+ # 4.5+ Signed-off-by: Rafael J. Wysocki drivers/cpufreq/sti-cpufreq.c | 4 ++++ 1 file changed, 4 insertions(+) commit 625fe4f8ffc1b915248558481bb94249f6bd411c Author: James Morse Date: Tue Apr 26 12:15:01 2016 +0100 ARM: cpuidle: Pass on arm_cpuidle_suspend()'s return value arm_cpuidle_suspend() may return -EOPNOTSUPP, or any value returned by the cpu_ops/cpuidle_ops suspend call. arm_enter_idle_state() doesn't update 'ret' with this value, meaning we always signal success to cpuidle_enter_state(), causing it to update the usage counters as if we succeeded. Fixes: 191de17aa3c1 ("ARM64: cpuidle: Replace cpu_suspend by the common ARM/ARM64 function") Signed-off-by: James Morse Acked-by: Lorenzo Pieralisi Acked-by: Daniel Lezcano Cc: 4.1+ # 4.1+ Signed-off-by: Rafael J. Wysocki drivers/cpuidle/cpuidle-arm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2963070a0f8184fe40be11927344e3fcc7e18e7c Author: Chen-Yu Tsai Date: Tue Apr 26 23:37:26 2016 +0800 mmc: sunxi: Disable eMMC HS-DDR (MMC_CAP_1_8V_DDR) for Allwinner A80 eMMC HS-DDR no longer works on the A80, despite it working when support for this developed. Disable it for now. Signed-off-by: Chen-Yu Tsai Signed-off-by: Ulf Hansson drivers/mmc/host/sunxi-mmc.c | 5 +++++ 1 file changed, 5 insertions(+) commit cf3beb7c90a8efa16a06b26634cddddc92bb819c Author: Kan Liang Date: Thu Apr 21 02:30:10 2016 -0700 perf/x86/intel: Fix incorrect lbr_sel_mask value This patch fixes a bug which was introduced by: b16a5b52eb90 ("perf/x86: Add option to disable reading branch flags/cycles") In this patch, lbr_sel_mask is used to mask the lbr_select. But LBR_SEL_MASK doesn't include the bit for LBR_CALL_STACK. So LBR call stack will never be set in lbr_select. This patch corrects the LBR_SEL_MASK by including all valid bits in LBR_SELECT. Also, the LBR_CALL_STACK bit is different as other bit in LBR_SELECT. It does not operate in suppress mode, so it needs to be specially handled in intel_pmu_setup_hw_lbr_filter. Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Link: http://lkml.kernel.org/r/1461231010-4399-1-git-send-email-kan.liang@intel.com Signed-off-by: Ingo Molnar arch/x86/events/intel/lbr.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 1c5ac21a0e9bab7fc45d0ba9e11623e9ad99d02e Author: Alexander Shishkin Date: Tue Mar 29 17:43:10 2016 +0300 perf/x86/intel/pt: Don't die on VMXON Some versions of Intel PT do not support tracing across VMXON, more specifically, VMXON will clear TraceEn control bit and any attempt to set it before VMXOFF will throw a #GP, which in the current state of things will crash the kernel. Namely: $ perf record -e intel_pt// kvm -nographic on such a machine will kill it. To avoid this, notify the intel_pt driver before VMXON and after VMXOFF so that it knows when not to enable itself. Signed-off-by: Alexander Shishkin Signed-off-by: Peter Zijlstra (Intel) Cc: Arnaldo Carvalho de Melo Cc: Arnaldo Carvalho de Melo Cc: Borislav Petkov Cc: Gleb Natapov Cc: Jiri Olsa Cc: Paolo Bonzini Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Cc: hpa@zytor.com Link: http://lkml.kernel.org/r/87oa9dwrfk.fsf@ashishki-desk.ger.corp.intel.com Signed-off-by: Ingo Molnar arch/x86/events/intel/pt.c | 75 +++++++++++++++++++++++++++++++++------ arch/x86/events/intel/pt.h | 3 ++ arch/x86/include/asm/perf_event.h | 4 +++ arch/x86/kvm/vmx.c | 4 +++ 4 files changed, 75 insertions(+), 11 deletions(-) commit 79c9ce57eb2d5f1497546a3946b4ae21b6fdc438 Author: Peter Zijlstra Date: Tue Apr 26 11:36:53 2016 +0200 perf/core: Fix perf_event_open() vs. execve() race Jann reported that the ptrace_may_access() check in find_lively_task_by_vpid() is racy against exec(). Specifically: perf_event_open() execve() ptrace_may_access() commit_creds() ... if (get_dumpable() != SUID_DUMP_USER) perf_event_exit_task(); perf_install_in_context() would result in installing a counter across the creds boundary. Fix this by wrapping lots of perf_event_open() in cred_guard_mutex. This should be fine as perf_event_exit_task() is already called with cred_guard_mutex held, so all perf locks already nest inside it. Reported-by: Jann Horn Signed-off-by: Peter Zijlstra (Intel) Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Signed-off-by: Ingo Molnar kernel/events/core.c | 52 ++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 36 insertions(+), 16 deletions(-) commit 2548d546d40c0014efdde88a53bf7896e917dcce Author: Peter Zijlstra Date: Thu Apr 21 18:03:15 2016 +0200 nohz/full, sched/rt: Fix missed tick-reenabling bug in sched_can_stop_tick() Chris Metcalf reported a that sched_can_stop_tick() sometimes fails to re-enable the tick. His observed problem is that rq->cfs.nr_running can be 1 even though there are multiple runnable CFS tasks. This happens in the cgroup case, in which case cfs.nr_running is the number of runnable entities for that level. If there is a single runnable cgroup (which can have an arbitrary number of runnable child entries itself) rq->cfs.nr_running will be 1. However, looking at that function I think there's more problems with it. It seems to assume that if there's FIFO tasks, those will run. This is incorrect. The FIFO task can have a lower prio than an RR task, in which case the RR task will run. So the whole fifo_nr_running test seems misplaced, it should go after the rr_nr_running tests. That is, only if !rr_nr_running, can we use fifo_nr_running like this. Reported-by: Chris Metcalf Tested-by: Chris Metcalf Signed-off-by: Peter Zijlstra (Intel) Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Christoph Lameter Cc: Frederic Weisbecker Cc: Jiri Olsa Cc: Luiz Capitulino Cc: Mike Galbraith Cc: Peter Zijlstra Cc: Rik van Riel Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Cc: Viresh Kumar Cc: Wanpeng Li Fixes: 76d92ac305f2 ("sched: Migrate sched to use new tick dependency mask model") Link: http://lkml.kernel.org/r/20160421160315.GK24771@twins.programming.kicks-ass.net Signed-off-by: Ingo Molnar kernel/sched/core.c | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-) commit 0a25556f84d5f79e68e9502bb1f32a43377ab2bf Author: Adam Borowski Date: Wed Apr 27 11:35:31 2016 +0200 perf/x86/amd: Set the size of event map array to PERF_COUNT_HW_MAX The entry for PERF_COUNT_HW_REF_CPU_CYCLES is not used on AMD, but is referenced by filter_events() which expects undefined events to have a value of 0. Found via KASAN: UBSAN: Undefined behaviour in arch/x86/events/amd/core.c:132:30 index 9 is out of range for type 'u64 [9]' UBSAN: Undefined behaviour in arch/x86/events/amd/core.c:132:9 load of address ffffffff81c021c8 with insufficient space for an object of type 'const u64' Signed-off-by: Adam Borowski Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Borislav Petkov Cc: Jiri Olsa Cc: Mike Galbraith Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Link: http://lkml.kernel.org/r/1461749731-30979-1-git-send-email-kilobyte@angband.pl Signed-off-by: Ingo Molnar arch/x86/events/amd/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d3767f0faeda5abdf205f947ae912d48dc70fa06 Author: Ilya Dryomov Date: Wed Apr 13 14:15:50 2016 +0200 rbd: report unsupported features to syslog ... instead of just returning an error. Signed-off-by: Ilya Dryomov Reviewed-by: Josh Durgin drivers/block/rbd.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 811c6688774613a78bfa020f64b570b73f6974c8 Author: Ilya Dryomov Date: Fri Apr 15 16:22:16 2016 +0200 rbd: fix rbd map vs notify races A while ago, commit 9875201e1049 ("rbd: fix use-after free of rbd_dev->disk") fixed rbd unmap vs notify race by introducing an exported wrapper for flushing notifies and sticking it into do_rbd_remove(). A similar problem exists on the rbd map path, though: the watch is registered in rbd_dev_image_probe(), while the disk is set up quite a few steps later, in rbd_dev_device_setup(). Nothing prevents a notify from coming in and crashing on a NULL rbd_dev->disk: BUG: unable to handle kernel NULL pointer dereference at 0000000000000050 Call Trace: [] rbd_watch_cb+0x34/0x180 [rbd] [] do_event_work+0x40/0xb0 [libceph] [] process_one_work+0x17b/0x470 [] worker_thread+0x11b/0x400 [] ? rescuer_thread+0x400/0x400 [] kthread+0xcf/0xe0 [] ? finish_task_switch+0x53/0x170 [] ? kthread_create_on_node+0x140/0x140 [] ret_from_fork+0x58/0x90 [] ? kthread_create_on_node+0x140/0x140 RIP [] rbd_dev_refresh+0xfa/0x180 [rbd] If an error occurs during rbd map, we have to error out, potentially tearing down a watch. Just like on rbd unmap, notifies have to be flushed, otherwise rbd_watch_cb() may end up trying to read in the image header after rbd_dev_image_release() has run: Assertion failure in rbd_dev_header_info() at line 4722: rbd_assert(rbd_image_format_valid(rbd_dev->image_format)); Call Trace: [] ? rbd_parent_request_create+0x150/0x150 [] rbd_dev_refresh+0x59/0x390 [] rbd_watch_cb+0x69/0x290 [] do_event_work+0x10f/0x1c0 [] process_one_work+0x689/0x1a80 [] ? process_one_work+0x5e7/0x1a80 [] ? finish_task_switch+0x225/0x640 [] ? pwq_dec_nr_in_flight+0x2b0/0x2b0 [] worker_thread+0xd9/0x1320 [] ? process_one_work+0x1a80/0x1a80 [] kthread+0x21d/0x2e0 [] ? kthread_stop+0x550/0x550 [] ret_from_fork+0x22/0x40 [] ? kthread_stop+0x550/0x550 RIP [] rbd_dev_header_info+0xa19/0x1e30 To fix this, a) check if RBD_DEV_FLAG_EXISTS is set before calling revalidate_disk(), b) move ceph_osdc_flush_notifies() call into rbd_dev_header_unwatch_sync() to cover rbd map error paths and c) turn header read-in into a critical section. The latter also happens to take care of rbd map foo@bar vs rbd snap rm foo@bar race. Fixes: http://tracker.ceph.com/issues/15490 Signed-off-by: Ilya Dryomov Reviewed-by: Josh Durgin drivers/block/rbd.c | 43 +++++++++++++++++++------------------------ 1 file changed, 19 insertions(+), 24 deletions(-) commit 1bdb8970392a68489b469c3a330a1adb5ef61beb Author: Keith Busch Date: Wed Apr 27 14:22:32 2016 -0600 x86/apic: Handle zero vector gracefully in clear_vector_irq() If x86_vector_alloc_irq() fails x86_vector_free_irqs() is invoked to cleanup the already allocated vectors. This subsequently calls clear_vector_irq(). The failed irq has no vector assigned, which triggers the BUG_ON(!vector) in clear_vector_irq(). We cannot suppress the call to x86_vector_free_irqs() for the failed interrupt, because the other data related to this irq must be cleaned up as well. So calling clear_vector_irq() with vector == 0 is legitimate. Remove the BUG_ON and return if vector is zero, [ tglx: Massaged changelog ] Fixes: b5dc8e6c21e7 "x86/irq: Use hierarchical irqdomain to manage CPU interrupt vectors" Signed-off-by: Keith Busch Cc: stable@vger.kernel.org Signed-off-by: Thomas Gleixner arch/x86/kernel/apic/vector.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 9e209fcfb804da262e38e5cd2e680c47a41f0f95 Author: Tadeusz Struk Date: Mon Apr 25 07:32:19 2016 -0700 crypto: qat - fix invalid pf2vf_resp_wq logic The pf2vf_resp_wq is a global so it has to be created at init and destroyed at exit, instead of per device. Cc: Tested-by: Suresh Marikkannu Signed-off-by: Tadeusz Struk Signed-off-by: Herbert Xu drivers/crypto/qat/qat_common/adf_common_drv.h | 2 ++ drivers/crypto/qat/qat_common/adf_ctl_drv.c | 6 ++++++ drivers/crypto/qat/qat_common/adf_sriov.c | 26 ++++++++++++++++---------- 3 files changed, 24 insertions(+), 10 deletions(-) commit 15333e3af1de37b1b214b28c85fe9a7b257fb92c Author: Leo Yan Date: Tue Mar 29 19:24:15 2016 +0800 thermal: use %d to print S32 parameters Power allocator's parameters are S32 type, so use %d to print them. Acked-by: Javi Merino Signed-off-by: Leo Yan Signed-off-by: Eduardo Valentin drivers/thermal/thermal_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5fdfc48bb0da2aa8a912024a6ecca06486eb9141 Author: Leo Yan Date: Tue Mar 29 19:23:32 2016 +0800 thermal: hisilicon: increase temperature resolution When calculate temperature, old code firstly do division and then convert to "millicelsius" unit. This will lose resolution and only can read back temperature with "Celsius" unit. So firstly scale step value to "millicelsius" and then do division, so finally we can increase resolution for temperature value. Also refine the calculation from temperature value to step value. Signed-off-by: Leo Yan Signed-off-by: Eduardo Valentin drivers/thermal/hisi_thermal.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 82dc4afd7e65455464f0fc2fe6976efde54fe451 Author: Ashutosh Dixit Date: Wed Apr 27 14:36:05 2016 -0700 misc: mic: Fix for double fetch security bug in VOP driver The MIC VOP driver does two successive reads from user space to read a variable length data structure. Kernel memory corruption can result if the data structure changes between the two reads. This patch disallows the chance of this happening. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=116651 Reported by: Pengfei Wang Reviewed-by: Sudeep Dutt Signed-off-by: Ashutosh Dixit Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/misc/mic/vop/vop_vringh.c | 5 +++++ 1 file changed, 5 insertions(+) commit 5616f36713ea77f57ae908bf2fef641364403c9f Author: Sascha Hauer Date: Wed Apr 20 13:34:31 2016 +0000 ARM: SoCFPGA: Fix secondary CPU startup in thumb2 kernel The secondary CPU starts up in ARM mode. When the kernel is compiled in thumb2 mode we have to explicitly compile the secondary startup trampoline in ARM mode, otherwise the CPU will go to Nirvana. Signed-off-by: Sascha Hauer Reported-by: Steffen Trumtrar Suggested-by: Ard Biesheuvel Cc: stable@vger.kernel.org Signed-off-by: Dinh Nguyen Signed-off-by: Kevin Hilman arch/arm/mach-socfpga/headsmp.S | 1 + 1 file changed, 1 insertion(+) commit 0224a4a30b57385a60065aa598181868881d8fc6 Author: Heikki Krogerus Date: Wed Apr 27 14:04:20 2016 +0300 device property: Avoid potential dereferences of invalid pointers Since fwnode may hold ERR_PTR(-ENODEV) or it may be NULL, the fwnode type checks is_of_node(), is_acpi_node() and is is_pset_node() need to consider it. Using IS_ERR_OR_NULL() to check it. Fixes: 0d67e0fa1664 (device property: fix for a case of use-after-free) Reported-by: Dan Carpenter Signed-off-by: Heikki Krogerus [ rjw: Subject & changelog ] Signed-off-by: Rafael J. Wysocki drivers/base/property.c | 2 +- include/acpi/acpi_bus.h | 4 ++-- include/linux/of.h | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) commit 49fa5230462f9f2c4e97c81356473a6bdf06c422 Author: David S. Miller Date: Wed Apr 27 17:27:37 2016 -0400 sparc64: Fix bootup regressions on some Kconfig combinations. The system call tracing bug fix mentioned in the Fixes tag below increased the amount of assembler code in the sequence of assembler files included by head_64.S This caused to total set of code to exceed 0x4000 bytes in size, which overflows the expression in head_64.S that works to place swapper_tsb at address 0x408000. When this is violated, the TSB is not properly aligned, and also the trap table is not aligned properly either. All of this together results in failed boots. So, do two things: 1) Simplify some code by using ba,a instead of ba/nop to get those bytes back. 2) Add a linker script assertion to make sure that if this happens again the build will fail. Fixes: 1a40b95374f6 ("sparc: Fix system call tracing register handling.") Reported-by: Meelis Roos Reported-by: Joerg Abraham Signed-off-by: David S. Miller arch/sparc/kernel/cherrs.S | 14 +++++--------- arch/sparc/kernel/fpu_traps.S | 11 +++++------ arch/sparc/kernel/head_64.S | 24 ++++++++---------------- arch/sparc/kernel/misctrap.S | 12 ++++-------- arch/sparc/kernel/spiterrs.S | 18 ++++++------------ arch/sparc/kernel/utrap.S | 3 +-- arch/sparc/kernel/vmlinux.lds.S | 4 ++++ arch/sparc/kernel/winfixup.S | 3 +-- 8 files changed, 34 insertions(+), 55 deletions(-) commit 97d601d5de6eff9d9acebefa39150940a55e9f19 Merge: f28f20d 89d0a06 Author: David S. Miller Date: Wed Apr 27 16:18:46 2016 -0400 Merge branch 'bnxt_en-fixes' Michael Chan says: ==================== bnxt_en: Bug fixes for net. Only use MSIX on VF, and fix rx page buffers on architectures with PAGE_SIZE >= 64K. ==================== Signed-off-by: David S. Miller commit 89d0a06c516339c0a2b3d02677f5d6310b3319fb Author: Michael Chan Date: Mon Apr 25 02:30:51 2016 -0400 bnxt_en: Divide a page into 32K buffers for the aggregation ring if necessary. If PAGE_SIZE is bigger than BNXT_RX_PAGE_SIZE, that means the native CPU page is bigger than the maximum length of the RX BD. Divide the page into multiple 32K buffers for the aggregation ring. Add an offset field in the bnxt_sw_rx_agg_bd struct to keep track of the page offset of each buffer. Since each page can be referenced by multiple buffer entries, call get_page() as needed to get the proper reference count. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 35 ++++++++++++++++++++++++++----- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 4 ++++ 2 files changed, 34 insertions(+), 5 deletions(-) commit 2839f28bd5bf8fd2ab4a1ea3a5589c8f94364cbb Author: Michael Chan Date: Mon Apr 25 02:30:50 2016 -0400 bnxt_en: Limit RX BD pages to be no bigger than 32K. The RX BD length field of this device is 16-bit, so the largest buffer size is 65535. For LRO and GRO, we allocate native CPU pages for the aggregation ring buffers. It won't work if the native CPU page size is 64K or bigger. We fix this by defining BNXT_RX_PAGE_SIZE to be native CPU page size up to 32K. Replace PAGE_SIZE with BNXT_RX_PAGE_SIZE in all appropriate places related to the rx aggregation ring logic. The next patch will add additional logic to divide the page into 32K chunks for aggrgation ring buffers if PAGE_SIZE is bigger than BNXT_RX_PAGE_SIZE. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 18 +++++++++--------- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 9 +++++++++ 2 files changed, 18 insertions(+), 9 deletions(-) commit 1fa72e29e14d97fbda15437c648d7cc4eb00bff8 Author: Michael Chan Date: Mon Apr 25 02:30:49 2016 -0400 bnxt_en: Don't fallback to INTA on VF. Only MSI-X can be used on a VF. The driver should fail initialization if it cannot successfully enable MSI-X. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b75a2bf899b668b1d52de8846aafdbcf81349c73 Merge: 763cfc8 346c09f Author: Linus Torvalds Date: Wed Apr 27 12:03:59 2016 -0700 Merge branch 'for-4.6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue fix from Tejun Heo: "So, it turns out we had a silly bug in the most fundamental part of workqueue for a very long time. AFAICS, this dates back to pre-git era and has quite likely been there from the time workqueue was first introduced. A work item uses its PENDING bit to synchronize multiple queuers. Anyone who wins the PENDING bit owns the pending state of the work item. Whether a queuer wins or loses the race, one thing should be guaranteed - there will soon be at least one execution of the work item - where "after" means that the execution instance would be able to see all the changes that the queuer has made prior to the queueing attempt. Unfortunately, we were missing a smp_mb() after clearing PENDING for execution, so nothing guaranteed visibility of the changes that a queueing loser has made, which manifested as a reproducible blk-mq stall. Lots of kudos to Roman for debugging the problem. The patch for -stable is the minimal one. For v3.7, Peter is working on a patch to make the code path slightly more efficient and less fragile" * 'for-4.6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: fix ghost PENDING flag while doing MQ IO commit 763cfc86ee8fd728a7cf2334b8d3a897af7a7ade Merge: 3118e5f 264a0ae Author: Linus Torvalds Date: Wed Apr 27 11:41:14 2016 -0700 Merge branch 'for-4.6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: "Two patches to fix a deadlock which can be easily triggered if memcg charge moving is used. This bug was introduced while converting threadgroup locking to a global percpu_rwsem and is caused by cgroup controller task migration path depending on the ability to create new kthreads. cpuset had a similar issue which was fixed by performing heavy-lifting operations asynchronous to task migration. The two patches fix the same issue in memcg in a similar way. The first patch makes the mechanism generic and the second relocates memcg charge moving outside the migration path. Given that we don't want to perform heavy operations while writelocking threadgroup lock anyway, moving them out of the way is a desirable solution. One thing to note is that the problem was difficult to debug because lockdep couldn't figure out the deadlock condition. Looking into how to improve that" * 'for-4.6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: memcg: relocate charge moving from ->attach to ->post_attach cgroup, cpuset: replace cpuset_post_attach_flush() with cgroup_subsys->post_attach callback commit 3118e5f966298c94efb0aade318e8ae463fab714 Merge: 24131a6 10ff4c5 Author: Linus Torvalds Date: Wed Apr 27 11:34:45 2016 -0700 Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "I2C has one buildfix, one ABBA deadlock fix, and three simple 'add ID' patches" * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: exynos5: Fix possible ABBA deadlock by keeping I2C clock prepared i2c: cpm: Fix build break due to incompatible pointer types i2c: ismt: Add Intel DNV PCI ID i2c: xlp9xx: add support for Broadcom Vulcan i2c: rk3x: add support for rk3228 commit 24131a61ec8c2d83431cb818281d3c9db986ab08 Merge: 508fea7 1b10cb2 Author: Linus Torvalds Date: Wed Apr 27 09:46:21 2016 -0700 Merge tag 'arc-4.6-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC fixes from Vineet Gupta: - lockdep now works for ARCv2 builds - enable DT reserved-memory binding (for forthcoming HDMI driver) * tag 'arc-4.6-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: ARC: add support for reserved memory defined by device tree ARC: support generic per-device coherent dma mem Documentation: dt: arc: fix spelling mistakes ARCv2: Enable LOCKDEP commit 508fea71c6b2108ce81814a58fbc8c8aaf5e430f Merge: 9453203 a8950e4 Author: Linus Torvalds Date: Wed Apr 27 09:33:24 2016 -0700 Merge tag 'nios2-v4.6-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/lftan/nios2 Pull arch/nios2 fix from Ley Foon Tan: "memset: use the right constraint modifier for the %4 output operand" * tag 'nios2-v4.6-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/lftan/nios2: nios2: memset: use the right constraint modifier for the %4 output operand commit afc4542105f2b5a3bc6f0f3530d7ccbc94ca90fb Author: Flora Cui Date: Mon Apr 25 16:06:17 2016 +0800 drm/amdgpu: disable vm interrupts with vm_fault_stop=2 V2: disable all vm interrupts in late_init() Signed-off-by: Flora Cui Reviewed-by: Ken Wang Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c | 5 ++++- drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) commit c8791a13d28161a1fa1138112dfe1f986a1358cf Author: Alex Deucher Date: Mon Apr 25 13:14:47 2016 -0400 drm/amdgpu: print a message if ATPX dGPU power control is missing It will help identify problematic boards. Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit e9bef455af8eb0e837e179aab8988ae2649fd8d3 Author: Alex Deucher Date: Mon Apr 25 13:12:18 2016 -0400 Revert "drm/amdgpu: disable runtime pm on PX laptops without dGPU power control" This reverts commit bedf2a65c1aa8fb29ba8527fd00c0f68ec1f55f1. See the radeon revert for an extended description. Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c | 8 ++++---- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 +------- 2 files changed, 5 insertions(+), 11 deletions(-) commit 5d5b7803c49bbb01bdf4c6e95e8314d0515b9484 Author: Vitaly Prosyak Date: Thu Apr 14 13:34:03 2016 -0400 drm/radeon: fix vertical bars appear on monitor (v2) When crtc/timing is disabled on boot the dig block should be stopped in order ignore timing from crtc, reset the steering fifo otherwise we get display corruption or hung in dp sst mode. v2: agd: fix coding style Signed-off-by: Vitaly Prosyak Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org Signed-off-by: Alex Deucher drivers/gpu/drm/radeon/evergreen.c | 154 ++++++++++++++++++++++++++++++++- drivers/gpu/drm/radeon/evergreen_reg.h | 46 ++++++++++ 2 files changed, 199 insertions(+), 1 deletion(-) commit 56fc350224f16901db709cd8cba86bac751aa2a2 Author: Flora Cui Date: Wed Apr 20 10:23:47 2016 +0800 drm/ttm: fix kref count mess in ttm_bo_move_to_lru_tail Fixes the following scenario: 1. Page table bo allocated in vram and linked to man->lru. tbo->list_kref.refcount=2 2. Page table bo is swapped out and removed from man->lru. tbo->list_kref.refcount=1 3. Command submission from userspace. Page table bo is moved to vram. ttm_bo_move_to_lru_tail() link it to man->lru and don't increase the kref count. Reviewed-by: Thomas Hellstrom Signed-off-by: Flora Cui Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/ttm/ttm_bo.c | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) commit 9453203bf868a9b36227c961c68c8892c7262355 Merge: f28f20d a30b8f8 Author: Linus Torvalds Date: Wed Apr 27 08:57:11 2016 -0700 Merge tag 'platform-drivers-x86-v4.6-3' of git://git.infradead.org/users/dvhart/linux-platform-drivers-x86 Pull x86 platform driver fix from Darren Hart: "Fix regression caused by hotkey enabling value in toshiba_acpi" * tag 'platform-drivers-x86-v4.6-3' of git://git.infradead.org/users/dvhart/linux-platform-drivers-x86: toshiba_acpi: Fix regression caused by hotkey enabling value commit af9cc93c0dee5fc1f9fa32cd9d79a456738a21be Merge: bb03ed2 8c0f551 Author: Takashi Iwai Date: Wed Apr 27 17:30:49 2016 +0200 Merge tag 'asoc-fix-v4.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v4.6 This is a fairly large collection of fixes but almost all driver specific ones, especially to the new Intel drivers which have had a lot of recent development. The one core fix is a change to the debugfs code to avoid crashes in some relatively unusual configurations. commit a2262e5a12e05389ab4c7fc5cf60016b041dd8dc Author: Hans de Goede Date: Wed Apr 27 15:59:27 2016 +0200 regulator: axp20x: Fix axp22x ldo_io voltage ranges The minium voltage of 1800mV is a copy and paste error from the axp20x regulator info. The correct minimum voltage for the ldo_io regulators on the axp22x is 700mV. Fixes: 1b82b4e4f954 ("regulator: axp20x: Add support for AXP22X regulators") Signed-off-by: Hans de Goede Acked-by: Chen-Yu Tsai Signed-off-by: Mark Brown drivers/regulator/axp20x-regulator.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 1b10cb21d888c021bedbe678f7c26aee1bf04ffa Author: Alexey Brodkin Date: Tue Apr 26 19:29:34 2016 +0300 ARC: add support for reserved memory defined by device tree Enable reserved memory initialization from device tree. Signed-off-by: Alexey Brodkin Cc: Grant Likely Cc: Marek Szyprowski Cc: linux-kernel@vger.kernel.org Signed-off-by: Vineet Gupta arch/arc/Kconfig | 1 + arch/arc/mm/init.c | 4 ++++ 2 files changed, 5 insertions(+) commit 32ed9a0e0ddcf58ef343bcb6ae44ee60d1ee31ce Author: Alexey Brodkin Date: Tue Apr 26 19:29:33 2016 +0300 ARC: support generic per-device coherent dma mem Signed-off-by: Alexey Brodkin Cc: linux-kernel@vger.kernel.org Signed-off-by: Vineet Gupta arch/arc/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 258fc497fa8e8d4cf54c5ffcd196e26325d5202d Merge: 02da2d7 a0a966b Author: Arnd Bergmann Date: Wed Apr 27 11:00:00 2016 +0200 Merge tag 'samsung-fixes-4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into fixes Fix for more theoretical than practical OOPS on first turn on of a exynos power domain, if there was no turn off before. Usually all power domains are on, so the first action is to turn off but some older bootloaders might behave differently. * tag 'samsung-fixes-4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: ARM: EXYNOS: Properly skip unitialized parent clock in power domain on commit a8950e49bd241dc9ad90c24e92e23e95dbe9f018 Author: Romain Perier Date: Tue Apr 19 18:17:32 2016 +0800 nios2: memset: use the right constraint modifier for the %4 output operand Depending on the size of the area to be memset'ed, the nios2 memset implementation either uses a naive loop (for buffers smaller or equal than 8 bytes) or a more optimized implementation (for buffers larger than 8 bytes). This implementation does 4-byte stores rather than 1-byte stores to speed up memset. However, we discovered that on our nios2 platform, memset() was not properly setting the buffer to the expected value. A memset of 0xff would not set the entire buffer to 0xff, but to: 0xff 0x00 0xff 0x00 0xff 0x00 0xff 0x00 ... Which is obviously incorrect. Our investigation has revealed that the problem lies in the incorrect constraints used in the inline assembly. The following piece of assembly, from the nios2 memset implementation, is supposed to create a 4-byte value that repeats 4 times the 1-byte pattern passed as memset argument: /* fill8 %3, %5 (c & 0xff) */ " slli %4, %5, 8\n" " or %4, %4, %5\n" " slli %3, %4, 16\n" " or %3, %3, %4\n" However, depending on the compiler and optimization level, this code might be compiled as: 34: 280a923a slli r5,r5,8 38: 294ab03a or r5,r5,r5 3c: 2808943a slli r4,r5,16 40: 2148b03a or r4,r4,r5 This is wrong because r5 gets used both for %5 and %4, which leads to the final pattern stored in r4 to be 0xff00ff00 rather than the expected 0xffffffff. %4 is defined with the "=r" constraint, i.e as an output operand. However, as explained in http://www.ethernut.de/en/documents/arm-inline-asm.html, this does not prevent gcc from using the same register for an output operand (%4) and input operand (%5). By using the constraint modifier '&', we indicate that the register should be used for output only. With this change, we get the following assembly output: 34: 2810923a slli r8,r5,8 38: 4150b03a or r8,r8,r5 3c: 400e943a slli r7,r8,16 40: 3a0eb03a or r7,r7,r8 Which correctly produces the 0xffffffff pattern when 0xff is passed as the memset() pattern. It is worth mentioning the observed consequence of this bug: we were hitting the kernel BUG() in mm/bootmem.c:__free() that verifies when marking a page as free that it was previously marked as occupied (i.e that the bit was set to 1). The entire bootmem bitmap is set to 0xff bit via a memset() during the bootmem initialization. The bootmem_free() call right after the initialization was finding some bits to be set to 0, which didn't make sense since the bitmap has just been memset'ed to 0xff. Except that due to the bug explained above, the bitmap was in fact initialized to 0xff00ff00. Thanks to Marek Vasut for his help and feedback. Signed-off-by: Romain Perier Acked-by: Marek Vasut Acked-by: Ley Foon Tan arch/nios2/lib/memset.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e6436be21e77e3659b4ff7e357ab5a8342d132d2 Author: Johannes Berg Date: Tue Apr 26 13:47:08 2016 +0200 mac80211: fix statistics leak if dev_alloc_name() fails In the case that dev_alloc_name() fails, e.g. because the name was given by the user and already exists, we need to clean up properly and free the per-CPU statistics. Fix that. Cc: stable@vger.kernel.org Fixes: 5a490510ba5f ("mac80211: use per-CPU TX/RX statistics") Signed-off-by: Johannes Berg net/mac80211/iface.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 4ea3959018d09edfa36a9e7b5ccdbd4ec4b99e49 Author: Ville Syrjälä Date: Wed Apr 20 16:43:56 2016 +0300 drm/i915: Make RPS EI/thresholds multiple of 25 on SNB-BDW Somehow my SNB GT1 (Dell XPS 8300) gets very unhappy around GPU hangs if the RPS EI/thresholds aren't suitably aligned. It seems like scheduling/timer interupts stop working somehow and things get stuck eg. in usleep_range(). I bisected the problem down to commit 8a5864377b12 ("drm/i915/skl: Restructured the gen6_set_rps_thresholds function") I observed that before all the values were at least multiples of 25, but afterwards they are not. And rounding things up to the next multiple of 25 does seem to help, so lets' do that. I also tried roundup(..., 5) but that wasn't sufficient. Also I have no idea if we might need this sort of thing on gen9+ as well. These are the original EI/thresholds: LOW_POWER GEN6_RP_UP_EI 12500 GEN6_RP_UP_THRESHOLD 11800 GEN6_RP_DOWN_EI 25000 GEN6_RP_DOWN_THRESHOLD 21250 BETWEEN GEN6_RP_UP_EI 10250 GEN6_RP_UP_THRESHOLD 9225 GEN6_RP_DOWN_EI 25000 GEN6_RP_DOWN_THRESHOLD 18750 HIGH_POWER GEN6_RP_UP_EI 8000 GEN6_RP_UP_THRESHOLD 6800 GEN6_RP_DOWN_EI 25000 GEN6_RP_DOWN_THRESHOLD 15000 These are after 8a5864377b12: LOW_POWER GEN6_RP_UP_EI 12500 GEN6_RP_UP_THRESHOLD 11875 GEN6_RP_DOWN_EI 25000 GEN6_RP_DOWN_THRESHOLD 21250 BETWEEN GEN6_RP_UP_EI 10156 GEN6_RP_UP_THRESHOLD 9140 GEN6_RP_DOWN_EI 25000 GEN6_RP_DOWN_THRESHOLD 18750 HIGH_POWER GEN6_RP_UP_EI 7812 GEN6_RP_UP_THRESHOLD 6640 GEN6_RP_DOWN_EI 25000 GEN6_RP_DOWN_THRESHOLD 15000 And these are what we have after this patch: LOW_POWER GEN6_RP_UP_EI 12500 GEN6_RP_UP_THRESHOLD 11875 GEN6_RP_DOWN_EI 25000 GEN6_RP_DOWN_THRESHOLD 21250 BETWEEN GEN6_RP_UP_EI 10175 GEN6_RP_UP_THRESHOLD 9150 GEN6_RP_DOWN_EI 25000 GEN6_RP_DOWN_THRESHOLD 18750 HIGH_POWER GEN6_RP_UP_EI 7825 GEN6_RP_UP_THRESHOLD 6650 GEN6_RP_DOWN_EI 25000 GEN6_RP_DOWN_THRESHOLD 15000 Cc: stable@vger.kernel.org Cc: Akash Goel Cc: Chris Wilson Testcase: igt/kms_pipe_crc_basic/hang-read-crc-pipe-B Fixes: 8a5864377b12 ("drm/i915/skl: Restructured the gen6_set_rps_thresholds function") Signed-off-by: Ville Syrjälä Link: http://patchwork.freedesktop.org/patch/msgid/1461159836-9108-1-git-send-email-ville.syrjala@linux.intel.com Acked-by: Chris Wilson Reviewed-by: Patrik Jakobsson (cherry picked from commit 8a292d016d1cc4938ff14b4df25328230b08a408) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_reg.h | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 60b3143c7cac7e8d2ca65c0b347466c5776395d1 Author: Shashank Sharma Date: Thu Apr 21 16:48:32 2016 +0530 drm/i915: Fake HDMI live status This patch does the following: - Fakes live status of HDMI as connected (even if that's not). While testing certain (monitor + cable) combinations with various intel platforms, it seems that live status register doesn't work reliably on some older devices. So limit the live_status check for HDMI detection, only for platforms from gen7 onwards. V2: restrict faking live_status to certain platforms V3: (Ville) - keep the debug message for !live_status case - fix indentation of comment - remove "warning" from the debug message (Jani) - Change format of fix details in the commit message Fixes: 237ed86c693d ("drm/i915: Check live status before reading edid") Cc: stable@vger.kernel.org # v4.4 Suggested-by: Ville Syrjala Signed-off-by: Shashank Sharma Link: http://patchwork.freedesktop.org/patch/msgid/1461237606-16491-1-git-send-email-shashank.sharma@intel.com Signed-off-by: Ville Syrjälä (cherry picked from commit 4f4a8185011773f7520d9916c6857db946e7f9d1) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_hdmi.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) commit 992e7a41f9fcc7bcd10e7d346aee5ed7a2c241cb Author: Mika Kahola Date: Wed Apr 20 15:39:02 2016 +0300 drm/i915: Fix eDP low vswing for Broadwell It was noticed on bug #94087 that module parameter i915.edp_vswing=2 that should override the VBT setting to use default voltage swing (400 mV) was not applied for Broadwell. This patch provides a fix for this by checking if default i.e. higher voltage swing is requested to be used and applies the DDI translations table for DP instead of eDP (low vswing) table. v2: Combine two if statements into one (Jani) v3: Change dev_priv->edp_low_vswing to use dev_priv->vbt.edp.low_vswing Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=94087 Signed-off-by: Mika Kahola Link: http://patchwork.freedesktop.org/patch/msgid/1461155942-7749-1-git-send-email-mika.kahola@intel.com Cc: stable@vger.kernel.org Signed-off-by: Ville Syrjälä (cherry picked from commit 00983519214b61c1b9371ec2ed55a4dde773e384) [Jani: s/dev_priv->vbt.edp.low_vswing/dev_priv->edp_low_vswing/ to backport] Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_ddi.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) commit 5eaa60c7109b40f17ac81090bc8b90482da76cd1 Author: Imre Deak Date: Mon Apr 18 10:04:21 2016 +0300 drm/i915/ddi: Fix eDP VDD handling during booting and suspend/resume The driver's VDD on/off logic assumes that whenever the VDD is on we also hold an AUX power domain reference. Since BIOS can leave the VDD on during booting and resuming and on DDI platforms we won't take a corresponding power reference, the above assumption won't hold on those platforms and an eventual delayed VDD off work will do an extraneous AUX power domain put resulting in a refcount underflow. Fix this the same way we did this for non-DDI DP encoders: commit 6d93c0c41760c0 ("drm/i915: fix VDD state tracking after system resume") At the same time call the DP encoder suspend handler the same way as the non-DDI DP encoders do to flush any pending VDD off work. Leaving the work running may cause a HW access where we don't expect this (at a point where power domains are suspended already). While at it remove an unnecessary function call indirection. This fixed for me AUX refcount underflow problems on BXT during suspend/resume. CC: Ville Syrjälä CC: stable@vger.kernel.org Signed-off-by: Imre Deak Reviewed-by: Ville Syrjälä Link: http://patchwork.freedesktop.org/patch/msgid/1460963062-13211-4-git-send-email-imre.deak@intel.com (cherry picked from commit bf93ba67e9c05882f05b7ca2d773cfc8bf462c2a) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_ddi.c | 10 +++------- drivers/gpu/drm/i915/intel_dp.c | 4 ++-- drivers/gpu/drm/i915/intel_drv.h | 2 ++ 3 files changed, 7 insertions(+), 9 deletions(-) commit dab9a2663f4e688106c041f7cd2797a721382f0a Author: Imre Deak Date: Mon Apr 18 14:45:54 2016 +0300 drm/i915: Fix system resume if PCI device remained enabled During system resume we depended on pci_enable_device() also putting the device into PCI D0 state. This won't work if the PCI device was already enabled but still in D3 state. This is because pci_enable_device() is refcounted and will not change the HW state if called with a non-zero refcount. Leaving the device in D3 will make all subsequent device accesses fail. This didn't cause a problem most of the time, since we resumed with an enable refcount of 0. But it fails at least after module reload because after that we also happen to leak a PCI device enable reference: During probing we call drm_get_pci_dev() which will enable the PCI device, but during device removal drm_put_dev() won't disable it. This is a bug of its own in DRM core, but without much harm as it only leaves the PCI device enabled. Fixing it is also a bit more involved, due to DRM mid-layering and because it affects non-i915 drivers too. The fix in this patch is valid regardless of the problem in DRM core. v2: - Add a code comment about the relation of this fix to the freeze/thaw vs. the suspend/resume phases. (Ville) - Add a code comment about the inconsistent ordering of set power state and device enable calls. (Chris) CC: Ville Syrjälä CC: Chris Wilson CC: stable@vger.kernel.org Signed-off-by: Imre Deak Reviewed-by: Ville Syrjälä Link: http://patchwork.freedesktop.org/patch/msgid/1460979954-14503-1-git-send-email-imre.deak@intel.com (cherry picked from commit 44410cd0bfb26bde9288da34c190cc9267d42a20) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_drv.c | 32 +++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) commit 7ac7d19f808697abe6658c64c96868f728273f9c Author: Chris Wilson Date: Sun Apr 17 20:42:46 2016 +0100 drm/i915: Avoid stalling on pending flips for legacy cursor updates The legacy cursor ioctl expects to be asynchronous with respect to other screen updates, in particular page flips. As X updates the cursor from a signal context, if the cursor blocks then it will stall both the input and output chains causing bad stuttering and horrible UX. Reported-and-tested-by: Rafael Ristovski Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=94980 Fixes: 5008e874edd34 ("drm/i915: Make wait_for_flips interruptible.") Suggested-by: Maarten Lankhorst Signed-off-by: Chris Wilson Cc: Maarten Lankhorst Cc: Ville Syrjälä Cc: Daniel Vetter Cc: Jani Nikula Cc: stable@vger.kernel.org Link: http://patchwork.freedesktop.org/patch/msgid/1460922166-20292-1-git-send-email-chris@chris-wilson.co.uk Acked-by: Daniel Vetter Reviewed-by: Maarten Lankhorst (cherry picked from commit acf4e84d6167317ff21be5c03e1ea76ea5783701) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_display.c | 3 +++ 1 file changed, 3 insertions(+) commit 532c34b5fbf1687df63b3fcd5b2846312ac943c6 Author: Martin Schwidefsky Date: Mon Apr 25 17:54:28 2016 +0200 s390/sclp_ctl: fix potential information leak with /dev/sclp The sclp_ctl_ioctl_sccb function uses two copy_from_user calls to retrieve the sclp request from user space. The first copy_from_user fetches the length of the request which is stored in the first two bytes of the request. The second copy_from_user gets the complete sclp request, but this copies the length field a second time. A malicious user may have changed the length in the meantime. Reported-by: Pengfei Wang Reviewed-by: Michael Holzheu Signed-off-by: Martin Schwidefsky drivers/s390/char/sclp_ctl.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit d701cca6744fe0d67c86346dcfc9b128b17b5045 Author: Rui Salvaterra Date: Tue Apr 19 13:23:36 2016 +0100 powerpc: wire up preadv2 and pwritev2 syscalls Wire up preadv2/pwritev2 in the same way as preadv/pwritev. Fixes two build warnings on ppc64. mpe: Lightly tested with fio (slightly hacked to add the syscall wrappers): fio-4217 [009] .... 1304.635300: sys_preadv2(fd: 3, vec: 10025821de0, vlen: 1, pos_l: 6253000, pos_h: 0, flags: 1) fio-4217 [009] .... 1304.635474: sys_preadv2 -> 0x1000 Signed-off-by: Rui Salvaterra Signed-off-by: Michael Ellerman arch/powerpc/include/asm/systbl.h | 2 ++ arch/powerpc/include/asm/unistd.h | 2 +- arch/powerpc/include/uapi/asm/unistd.h | 2 ++ 3 files changed, 5 insertions(+), 1 deletion(-) commit 2bc79ffcbb817873cc43d63118008ab75181b73d Author: Michael Neuling Date: Fri Apr 22 14:57:49 2016 +1000 cxl: Poll for outstanding IRQs when detaching a context When detaching contexts, we may still have interrupts in the system which are yet to be delivered to any CPU and be acked in the PSL. This can result in a subsequent unrelated process getting an spurious IRQ or an interrupt for a non-existent context. This polls the PSL to ensure that the PSL is clear of IRQs for the detached context, before removing the context from the idr. Signed-off-by: Michael Neuling Tested-by: Andrew Donnellan Acked-by: Ian Munsie Tested-by: Vaibhav Jain Signed-off-by: Michael Ellerman drivers/misc/cxl/context.c | 7 +++++++ drivers/misc/cxl/cxl.h | 2 ++ drivers/misc/cxl/native.c | 31 +++++++++++++++++++++++++++++++ 3 files changed, 40 insertions(+) commit d6776bba44d9752f6cdf640046070e71ee4bba7b Author: Michael Neuling Date: Fri Apr 22 14:57:48 2016 +1000 cxl: Keep IRQ mappings on context teardown Keep IRQ mappings on context teardown. This won't leak IRQs as if we allocate the mapping again, the generic code will give the same mapping used last time. Doing this works around a race in the generic code. Masking the interrupt introduces a race which can crash the kernel or result in IRQ that is never EOIed. The lost of EOI results in all subsequent mappings to the same HW IRQ never receiving an interrupt. We've seen this race with cxl test cases which are doing heavy context startup and teardown at the same time as heavy interrupt load. A fix to the generic code is being investigated also. Signed-off-by: Michael Neuling Cc: stable@vger.kernel.org # 3.8 Tested-by: Andrew Donnellan Acked-by: Ian Munsie Tested-by: Vaibhav Jain Signed-off-by: Michael Ellerman drivers/misc/cxl/irq.c | 1 - 1 file changed, 1 deletion(-) commit 9a11d2e7e66b6b8764a2430686b8716637bf812e Author: Gustavo Padovan Date: Thu Apr 14 10:58:54 2016 -0700 drm/virtio: send vblank event after crtc updates virtio_gpu was failing to send vblank events when using the atomic IOCTL with the DRM_MODE_PAGE_FLIP_EVENT flag set. This patch fixes each and enables atomic pageflips updates. Signed-off-by: Gustavo Padovan Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie drivers/gpu/drm/virtio/virtgpu_display.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 9dc0487d96a0396367a1451b31873482080b527f Author: Lyude Date: Wed Apr 13 16:50:18 2016 -0400 drm/dp/mst: Restore primary hub guid on resume Some hubs are forgetful, and end up forgetting whatever GUID we set previously after we do a suspend/resume cycle. This can lead to hotplugging breaking (along with probably other things) since the hub will start sending connection notifications with the wrong GUID. As such, we need to check on resume whether or not the GUID the hub is giving us is valid. Signed-off-by: Lyude Reviewed-by: Harry Wentland Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/1460580618-7421-1-git-send-email-cpaul@redhat.com Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie drivers/gpu/drm/drm_dp_mst_topology.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 263efde31f97c498e1ebad30e4d2906609d7ad6b Author: cpaul@redhat.com Date: Fri Apr 22 16:08:46 2016 -0400 drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1() We can thank KASAN for finding this, otherwise I probably would have spent hours on it. This fixes a somewhat harder to trigger kernel panic, occuring while enabling MST where the port we were currently updating the payload on would have all of it's refs dropped before we finished what we were doing: ================================================================== BUG: KASAN: use-after-free in drm_dp_update_payload_part1+0xb3f/0xdb0 [drm_kms_helper] at addr ffff8800d29de018 Read of size 4 by task Xorg/973 ============================================================================= BUG kmalloc-2048 (Tainted: G B W ): kasan: bad access detected ----------------------------------------------------------------------------- INFO: Allocated in drm_dp_add_port+0x1aa/0x1ed0 [drm_kms_helper] age=16477 cpu=0 pid=2175 ___slab_alloc+0x472/0x490 __slab_alloc+0x20/0x40 kmem_cache_alloc_trace+0x151/0x190 drm_dp_add_port+0x1aa/0x1ed0 [drm_kms_helper] drm_dp_send_link_address+0x526/0x960 [drm_kms_helper] drm_dp_check_and_send_link_address+0x1ac/0x210 [drm_kms_helper] drm_dp_mst_link_probe_work+0x77/0xd0 [drm_kms_helper] process_one_work+0x562/0x1350 worker_thread+0xd9/0x1390 kthread+0x1c5/0x260 ret_from_fork+0x22/0x40 INFO: Freed in drm_dp_free_mst_port+0x50/0x60 [drm_kms_helper] age=7521 cpu=0 pid=2175 __slab_free+0x17f/0x2d0 kfree+0x169/0x180 drm_dp_free_mst_port+0x50/0x60 [drm_kms_helper] drm_dp_destroy_connector_work+0x2b8/0x490 [drm_kms_helper] process_one_work+0x562/0x1350 worker_thread+0xd9/0x1390 kthread+0x1c5/0x260 ret_from_fork+0x22/0x40 which on this T460s, would eventually lead to kernel panics in somewhat random places later in intel_mst_enable_dp() if we got lucky enough. Signed-off-by: Lyude Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie drivers/gpu/drm/drm_dp_mst_topology.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit f28f20da704d399fb1e4d8838ffd697a357d9cc8 Merge: 91ea692 8358b02 Author: Linus Torvalds Date: Tue Apr 26 16:25:51 2016 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Handle v4/v6 mixed sockets properly in soreuseport, from Craig Gallak. 2) Bug fixes for the new macsec facility (missing kmalloc NULL checks, missing locking around netdev list traversal, etc.) from Sabrina Dubroca. 3) Fix handling of host routes on ifdown in ipv6, from David Ahern. 4) Fix double-fdput in bpf verifier. From Jann Horn. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (31 commits) bpf: fix double-fdput in replace_map_fd_with_map_ptr() net: ipv6: Delete host routes on an ifdown Revert "ipv6: Revert optional address flusing on ifdown." net/mlx4_en: fix spurious timestamping callbacks net: dummy: remove note about being Y by default cxgbi: fix uninitialized flowi6 ipv6: Revert optional address flusing on ifdown. ipv4/fib: don't warn when primary address is missing if in_dev is dead net/mlx5: Add pci shutdown callback net/mlx5_core: Remove static from local variable net/mlx5e: Use vport MTU rather than physical port MTU net/mlx5e: Fix minimum MTU net/mlx5e: Device's mtu field is u16 and not int net/mlx5_core: Add ConnectX-5 to list of supported devices net/mlx5e: Fix MLX5E_100BASE_T define net/mlx5_core: Fix soft lockup in steering error flow qlcnic: Update version to 5.3.64 net: stmmac: socfpga: Remove re-registration of reset controller macsec: fix netlink attribute validation macsec: add missing macsec prefix in uapi ... commit bd0b560a75bcebdcb48d82ed81f6b77c12771107 Merge: 02da2d7 2144fff Author: Dave Airlie Date: Wed Apr 27 09:19:06 2016 +1000 Merge branch 'drm-etnaviv-fixes' of git://git.pengutronix.de:/git/lst/linux into drm-fixes just a single fix to not move the GPU linear window on cores where it might lead to inconsistent views of the memory by different engines in the core, thus breaking relocs and possibly causing other fun. * 'drm-etnaviv-fixes' of git://git.pengutronix.de:/git/lst/linux: drm/etnaviv: don't move linear memory window on 3D cores without MC2.0 commit 91ea692f8798a40a3f9ed771fade1bdff08acd58 Merge: 8ead9dd 978fa43 Author: Linus Torvalds Date: Tue Apr 26 16:17:01 2016 -0700 Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Arnd Bergmann: "Here are the latest bug fixes for ARM SoCs, mostly addressing recent regressions. Changes are across several platforms, so I'm listing every change separately here. Regressions since 4.5: - A correction of the psci firmware DT binding, to prevent users from relying on unintended semantics - Actually getting the newly merged clock driver for some OMAP platforms to work - A revert of patches for the Qualcomm BAM, these need to be reworked for 4.7 to avoid breaking boards other than the one they were intended for - A correction for the I2C device nodes on the Socionext Uniphier platform - i.MX SDHCI was broken for non-DT platforms due to a change with the setting of the DMA mask - A revert of a patch that accidentally added a nonexisting clock on the Rensas "Porter" board - A couple of OMAP fixes that are all related to suspend after the power domain changes for dra7 - On Mediatek, revert part of the power domain initialization changes that broke mt8173-evb Fixes for older bugs: - Workaround for an "external abort" in the omap34xx suspend/resume code. - The USB1/eSATA should not be listed as an excon device on am57xx-beagle-x15 (broken since v4.0) - A v4.5 regression in the TI AM33xx and AM43XX DT specifying incorrect DMA request lines for the GPMC - The jiffies calibration on Renesas platforms was incorrect for some modern CPU cores. - A hardware errata woraround for clockdomains on TI DRA7" * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: drivers: firmware: psci: unify enable-method binding on ARM {64,32}-bit systems arm64: dts: uniphier: fix I2C nodes of PH1-LD20 ARM: shmobile: timer: Fix preset_lpj leading to too short delays Revert "ARM: dts: porter: Enable SCIF_CLK frequency and pins" ARM: dts: r8a7791: Don't disable referenced optional clocks Revert "ARM: OMAP: Catch callers of revision information prior to it being populated" ARM: OMAP3: Fix external abort on 36xx waking from off mode idle ARM: dts: am57xx-beagle-x15: remove extcon_usb1 ARM: dts: am437x: Fix GPMC dma properties ARM: dts: am33xx: Fix GPMC dma properties Revert "soc: mediatek: SCPSYS: Fix double enabling of regulators" ARM: mach-imx: sdhci-esdhc-imx: initialize DMA mask ARM: DRA7: clockdomain: Implement timer workaround for errata i874 ARM: OMAP: Catch callers of revision information prior to it being populated ARM: dts: dra7: Correct clock tree for sys_32k_ck ARM: OMAP: DRA7: Provide proper class to omap2_set_globals_tap ARM: OMAP: DRA7: wakeupgen: Skip SAR save for wakeupgen Revert "dts: msm8974: Add dma channels for blsp2_i2c1 node" Revert "dts: msm8974: Add blsp2_bam dma node" ARM: dts: Add clocks for dm814x ADPLL commit 8ead9dd54716d1e05e129959f702fcc1786f82b4 Author: Linus Torvalds Date: Mon Apr 25 20:04:08 2016 -0700 devpts: more pty driver interface cleanups This is more prep-work for the upcoming pty changes. Still just code cleanup with no actual semantic changes. This removes a bunch pointless complexity by just having the slave pty side remember the dentry associated with the devpts slave rather than the inode. That allows us to remove all the "look up the dentry" code for when we want to remove it again. Together with moving the tty pointer from "inode->i_private" to "dentry->d_fsdata" and getting rid of pointless inode locking, this removes about 30 lines of code. Not only is the end result smaller, it's simpler and easier to understand. The old code, for example, depended on the d_find_alias() to not just find the dentry, but also to check that it is still hashed, which in turn validated the tty pointer in the inode. That is a _very_ roundabout way to say "invalidate the cached tty pointer when the dentry is removed". The new code just does dentry->d_fsdata = NULL; in devpts_pty_kill() instead, invalidating the tty pointer rather more directly and obviously. Don't do something complex and subtle when the obvious straightforward approach will do. The rest of the patch (ie apart from code deletion and the above tty pointer clearing) is just switching the calling convention to pass the dentry or file pointer around instead of the inode. Cc: Eric Biederman Cc: Peter Anvin Cc: Andy Lutomirski Cc: Al Viro Cc: Peter Hurley Cc: Serge Hallyn Cc: Willy Tarreau Cc: Aurelien Jarno Cc: Alan Cox Cc: Jann Horn Cc: Greg KH Cc: Jiri Slaby Cc: Florian Weimer Signed-off-by: Linus Torvalds drivers/tty/pty.c | 18 +++++++--------- drivers/tty/tty_io.c | 6 +++--- fs/devpts/inode.c | 53 +++++++++++----------------------------------- include/linux/devpts_fs.h | 6 +++--- include/linux/tty_driver.h | 4 ++-- 5 files changed, 28 insertions(+), 59 deletions(-) commit 431adc0aeca68d257bd705db50f73e4c19e5690d Merge: bf16200 8e6cb47 Author: Greg Kroah-Hartman Date: Tue Apr 26 14:58:46 2016 -0700 Merge tag 'iio-fixes-for-4.6c' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus Jonathan writes: 3rd set of IIO fixes for the 4.6 cycle. * ak8975 - fix a null pointer exception if an interrupt occurs during probe. - fix a maybe-unitialized warning. * at91-sama5d2 - fix a crash on removal of the module. commit 97b9b7dc7722dc78d46046fc7a0dd0264832327f Author: Vladimir Zapolskiy Date: Mon Apr 25 15:53:31 2016 -0500 usb: musb: jz4740: fix error check of usb_get_phy() The usb_get_phy() function returns either a valid pointer to phy or ERR_PTR() error, check for NULL always fails and may lead to oops on error path, fix this issue. Signed-off-by: Vladimir Zapolskiy Signed-off-by: Bin Liu Signed-off-by: Greg Kroah-Hartman drivers/usb/musb/jz4740.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f551e13529833e052f75ec628a8af7b034af20f9 Author: Bin Liu Date: Mon Apr 25 15:53:30 2016 -0500 Revert "usb: musb: musb_host: Enable HCD_BH flag to handle urb return in bottom half" This reverts commit 2035772010db634ec8566b658fb1cd87ec47ac77. Commit 20357720 claims throughput improvement for MSC/UVC, but I don't see much improvement. Following are the MSC measurement using dd on AM335x GP EVM. with BCD_BH: read: 14.9MB/s, write: 20.9MB/s without BCD_BH: read: 15.2MB/s, write: 21.2MB/s However with this commit the following regressions have been observed. 1. ASIX usb-ethernet dongle is completely broken on UDP RX. 2. Unpluging a 3G modem, which uses option driver, behind a hub causes console log flooding with the following message. option_instat_callback: error -71 Signed-off-by: Bin Liu Signed-off-by: Greg Kroah-Hartman drivers/usb/musb/musb_host.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 607fb0f4d90cc9a4463bcb17c1417d8a709dfda1 Author: Tal Shorer Date: Mon Apr 25 15:53:29 2016 -0500 usb: musb: gadget: nuke endpoint before setting its descriptor to NULL Some functions, such as f_sourcesink, rely on an endpoint's desc field during their requests' complete() callback, so clear it only _after_ nuking all requests to avoid NULL pointer dereference. Signed-off-by: Tal Shorer Signed-off-by: Bin Liu Signed-off-by: Greg Kroah-Hartman drivers/usb/musb/musb_gadget.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 8358b02bf67d3a5d8a825070e1aa73f25fb2e4c7 Author: Jann Horn Date: Tue Apr 26 22:26:26 2016 +0200 bpf: fix double-fdput in replace_map_fd_with_map_ptr() When bpf(BPF_PROG_LOAD, ...) was invoked with a BPF program whose bytecode references a non-map file descriptor as a map file descriptor, the error handling code called fdput() twice instead of once (in __bpf_map_get() and in replace_map_fd_with_map_ptr()). If the file descriptor table of the current task is shared, this causes f_count to be decremented too much, allowing the struct file to be freed while it is still in use (use-after-free). This can be exploited to gain root privileges by an unprivileged user. This bug was introduced in commit 0246e64d9a5f ("bpf: handle pseudo BPF_LD_IMM64 insn"), but is only exploitable since commit 1be7f75d1668 ("bpf: enable non-root eBPF programs") because previously, CAP_SYS_ADMIN was required to reach the vulnerable code. (posted publicly according to request by maintainer) Signed-off-by: Jann Horn Signed-off-by: Linus Torvalds Acked-by: Alexei Starovoitov Acked-by: Daniel Borkmann Signed-off-by: David S. Miller kernel/bpf/verifier.c | 1 - 1 file changed, 1 deletion(-) commit 8c0f55100478649e3c0133684aa4aebab77ce10f Merge: 78cfca3 653aa46 33362c6 Author: Mark Brown Date: Tue Apr 26 19:25:18 2016 +0100 Merge remote-tracking branches 'asoc/fix/rt5640' and 'asoc/fix/wm8962' into asoc-linus commit 78cfca32cac26201d362fe9d2bf6f3c11a9f4a3b Merge: e408057 ab9f87c dd5dc00 1b377cc e6cee90 af139d5 Author: Mark Brown Date: Tue Apr 26 19:25:15 2016 +0100 Merge remote-tracking branches 'asoc/fix/arizona', 'asoc/fix/cs35l32', 'asoc/fix/hdac', 'asoc/fix/nau8825' and 'asoc/fix/rt5616' into asoc-linus commit e408057767973e13d72bf52604957925720b7142 Merge: f179f3f8 f0c8e1d Author: Mark Brown Date: Tue Apr 26 19:25:14 2016 +0100 Merge remote-tracking branch 'asoc/fix/intel' into asoc-linus commit f179f3f8a9bc86c43a1016c6d0ef87b7bb5ced86 Merge: 02da2d7 4732507 Author: Mark Brown Date: Tue Apr 26 19:25:13 2016 +0100 Merge remote-tracking branch 'asoc/fix/dapm' into asoc-linus commit e16d8a6cbb499c5c8bfe9330d3351b649bded4af Author: Andy Lutomirski Date: Tue Apr 26 08:52:44 2016 -0700 Revert "x86/mm/32: Set NX in __supported_pte_mask before enabling paging" This reverts commit 320d25b6a05f8b73c23fc21025d2906ecdd2d4fc. This change was problematic for a couple of reasons: 1. It missed a some entry points (Xen things and 64-bit native). 2. The entry it changed can be executed more than once. This isn't really a problem, but it conflated per-cpu state setup and global state setup. 3. It broke 64-bit non-NX. 64-bit non-NX worked the other way around from 32-bit -- __supported_pte_mask had NX set initially and was *cleared* in x86_configure_nx. With the patch applied, it never got cleared. Reported-and-tested-by: Meelis Roos Signed-off-by: Andy Lutomirski Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Brian Gerst Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Linus Torvalds Cc: Mike Galbraith Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/59bd15f7f4b56b633a611b7f70876c6d2ad01a98.1461685884.git.luto@kernel.org Signed-off-by: Ingo Molnar arch/x86/kernel/head_32.S | 6 ------ arch/x86/mm/setup_nx.c | 5 +++-- 2 files changed, 3 insertions(+), 8 deletions(-) commit 7472931f7f1e9d91f761dce30107ae345b61a5c3 Author: H. Nikolaus Schaller Date: Mon Apr 18 20:20:59 2016 +0200 ARM: dts: omap5: fix range of permitted wakeup pinmux registers otherwise we can't define gpio1_wk14 Signed-off-by: H. Nikolaus Schaller Signed-off-by: Tony Lindgren arch/arm/boot/dts/omap5.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0698178c608e5f48ac78cde8c08260c2d7041a39 Author: Ivaylo Dimitrov Date: Sun Apr 17 17:29:23 2016 +0300 ARM: dts: omap3-n900: Specify peripherals LDO regulators initial mode Without that, regulators are left in the mode last set by the bootloader or by the kernel the device was rebooted from. This leads to various problems, like non-working peripherals. Signed-off-by: Ivaylo Dimitrov Reviewed-By: Sebastian Reichel Reviewed-by: Javier Martinez Canillas Reviewed-by: Pavel Machek Signed-off-by: Tony Lindgren arch/arm/boot/dts/omap3-n900.dts | 9 +++++++++ 1 file changed, 9 insertions(+) commit e180feaf79b54d999329b194a3650f390acedf2c Author: Ivaylo Dimitrov Date: Sat Apr 16 09:20:28 2016 +0300 ARM: dts: omap3: Fix ISP syscon register offset According to the TRM, SCM CONTROL_CSIRXFE register is on offset 0x6c Signed-off-by: Ivaylo Dimitrov Reviewed-By: Sebastian Reichel Signed-off-by: Tony Lindgren arch/arm/boot/dts/omap34xx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5607959a4d5b54dcc9a3572bdbf967dfda88ae66 Author: Tomi Valkeinen Date: Mon Apr 18 13:06:07 2016 +0300 ARM: dts: omap5-cm-t54: fix ldo1_reg and ldo4_reg ranges ldo4_reg is connected to DSS, and should always be 1.8V. However the The dts defines a range of 1.5V-1.8V, which requires somethings to set the actual voltage at runtime. Currently we set the voltage in omapdss driver. As the voltage must always be 1.8V, let's just define the range to 1.8V so that the driver doesn't need to deal with the voltage. In fact, the driver should not touch the voltage, except in the cases where the voltage needs to be changed at runtime. I presume the situation is the same for ldo1_reg, used for CSI, although I think it is not currently used in the mainline. Signed-off-by: Tomi Valkeinen Signed-off-by: Tony Lindgren arch/arm/boot/dts/omap5-cm-t54.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 5086e5c79602a4620fbc3ec208f38e445982e301 Author: Tomi Valkeinen Date: Mon Apr 18 13:06:06 2016 +0300 ARM: dts: omap5-board-common: fix ldo1_reg and ldo4_reg ranges ldo4_reg is connected to DSS, and should always be 1.8V. However the The dts defines a range of 1.5V-1.8V, which requires somethings to set the actual voltage at runtime. Currently we set the voltage in omapdss driver. As the voltage must always be 1.8V, let's just define the range to 1.8V so that the driver doesn't need to deal with the voltage. In fact, the driver should not touch the voltage, except in the cases where the voltage needs to be changed at runtime. I presume the situation is the same for ldo1_reg, used for CSI, although I think it is not currently used in the mainline. Signed-off-by: Tomi Valkeinen Signed-off-by: Tony Lindgren arch/arm/boot/dts/omap5-board-common.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 32cc92c7b5e52357a0a24010bae9eb257fa75d3e Author: Hariprasad S Date: Tue Apr 5 10:23:48 2016 +0530 RDMA/iw_cxgb4: Fix bar2 virt addr calculation for T4 chips For T4, kernel mode qps don't use the user doorbell. User mode qps during flow control db ringing are forced into kernel, where user doorbell is treated as kernel doorbell and proper bar2 offset in bar2 virtual space is calculated, which incase of T4 is a bogus address, causing a kernel panic due to illegal write during doorbell ringing. In case of T4, kernel mode qp bar2 virtual address should be 0. Added T4 check during bar2 virtual address calculation to return 0. Fixed Bar2 range checks based on bar2 physical address. The below oops will be fixed <1>BUG: unable to handle kernel paging request at 000000000002aa08 <1>IP: [] c4iw_uld_control+0x4e0/0x880 [iw_cxgb4] <4>PGD 1416a8067 PUD 15bf35067 PMD 0 <4>Oops: 0002 [#1] SMP <4>last sysfs file: /sys/devices/pci0000:00/0000:00:03.0/0000:02:00.4/infiniband/cxgb4_0/node_guid <4>CPU 5 <4>Modules linked in: rdma_ucm rdma_cm ib_cm ib_sa ib_mad ib_uverbs ip6table_filter ip6_tables ebtable_nat ebtables ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack ipt_REJECT xt_CHECKSUM iptable_mangle iptable_filter ip_tables bridge autofs4 target_core_iblock target_core_file target_core_pscsi target_core_mod configfs bnx2fc cnic uio fcoe libfcoe libfc scsi_transport_fc scsi_tgt 8021q garp stp llc cpufreq_ondemand acpi_cpufreq freq_table mperf vhost_net macvtap macvlan tun kvm uinput microcode iTCO_wdt iTCO_vendor_support sg joydev serio_raw i2c_i801 i2c_core lpc_ich mfd_core e1000e ptp pps_core ioatdma dca i7core_edac edac_core shpchp ext3 jbd mbcache sd_mod crc_t10dif pata_acpi ata_generic ata_piix iw_cxgb4 iw_cm ib_core ib_addr cxgb4 ipv6 dm_mirror dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan] <4> Supermicro X8ST3/X8ST3 <4>RIP: 0010:[] [] c4iw_uld_control+0x4e0/0x880 [iw_cxgb4] <4>RSP: 0000:ffff880155a03db0 EFLAGS: 00010006 <4>RAX: 000000000000001d RBX: ffff88013ae5fc00 RCX: ffff880155adb180 <4>RDX: 000000000002aa00 RSI: 0000000000000001 RDI: ffff88013ae5fdf8 <4>RBP: ffff880155a03e10 R08: 0000000000000000 R09: 0000000000000001 <4>R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 <4>R13: 000000000000001d R14: ffff880156414ab0 R15: ffffe8ffffc05b88 <4>FS: 0000000000000000(0000) GS:ffff8800282a0000(0000) knlGS:0000000000000000 <4>CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b <4>CR2: 000000000002aa08 CR3: 000000015bd0e000 CR4: 00000000000007e0 <4>DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 <4>DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 <4>Process cxgb4 (pid: 394, threadinfo ffff880155a00000, task ffff880156414ab0) <4>Stack: <4> ffff880156415068 ffff880155adb180 ffff880155a03df0 ffffffffa00a344b <4> 00000000000003e8 ffff880155920000 0000000000000004 ffff880155920000 <4> ffff88015592d438 ffffffffa00a3860 ffff880155a03fd8 ffffe8ffffc05b88 <4>Call Trace: <4> [] ? enable_txq_db+0x2b/0x80 [cxgb4] <4> [] ? process_db_full+0x0/0xa0 [cxgb4] <4> [] process_db_full+0x46/0xa0 [cxgb4] <4> [] worker_thread+0x170/0x2a0 <4> [] ? autoremove_wake_function+0x0/0x40 <4> [] ? worker_thread+0x0/0x2a0 <4> [] kthread+0x9e/0xc0 <4> [] child_rip+0xa/0x20 <4> [] ? kthread+0x0/0xc0 <4> [] ? child_rip+0x0/0x20 <4>Code: e9 ba 00 00 00 66 0f 1f 44 00 00 44 8b 05 29 07 02 00 45 85 c0 0f 85 71 02 00 00 8b 83 70 01 00 00 45 0f b7 ed c1 e0 0f 44 09 e8 <89> 42 08 0f ae f8 66 c7 83 82 01 00 00 00 00 44 0f b7 ab dc 01 <1>RIP [] c4iw_uld_control+0x4e0/0x880 [iw_cxgb4] <4> RSP <4>CR2: 000000000002aa08` Based on original work by Bharat Potnuri Fixes: 74217d4c6a4fb0d8 ("iw_cxgb4: support for bar2 qid densities exceeding the page size") Signed-off-by: Steve Wise Signed-off-by: Hariprasad Shenai Reviewed-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/hw/cxgb4/cq.c | 2 +- drivers/infiniband/hw/cxgb4/qp.c | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) commit 40edd7fdfc8a2c838c313b982f318cd69e638750 Author: Steve Wise Date: Tue Apr 12 06:55:03 2016 -0700 iw_cxgb4: handle draining an idle qp In c4iw_drain_sq/rq(), if the particular queue is already empty then don't block. Fixes: ce4af14d94aa ('iw_cxgb4: add queue drain functions') Signed-off-by: Steve Wise Signed-off-by: Doug Ledford drivers/infiniband/hw/cxgb4/qp.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) commit ad202348fe3fa8187c43af5ab5b86fe6de057bd3 Author: Steve Wise Date: Tue Apr 12 06:55:01 2016 -0700 iw_cxgb3: initialize ibdev.iwcm->ifname for port mapping The IWCM uses ibdev.iwcm->ifname for registration with the iwarp port map daemon. But iw_cxgb3 did not initialize this field which causes intermittent registration failures based on the contents of the uninitialized memory. Fixes: c1340e8aa628 ("iw_cxgb3: support for iWARP port mapping") Signed-off-by: Steve Wise Signed-off-by: Doug Ledford drivers/infiniband/hw/cxgb3/iwch_provider.c | 2 ++ 1 file changed, 2 insertions(+) commit 851d7b6b8a954b28f85e62a53cbba472907e21e4 Author: Steve Wise Date: Tue Apr 12 06:54:54 2016 -0700 iw_cxgb4: initialize ibdev.iwcm->ifname for port mapping The IWCM uses ibdev.iwcm->ifname for registration with the iwarp port map daemon. But iw_cxgb4 did not initialize this field which causes intermittent registration failures based on the contents of the uninitialized memory. Fixes: 170003c894d9 ("iw_cxgb4: remove port mapper related code") Signed-off-by: Steve Wise Signed-off-by: Doug Ledford drivers/infiniband/hw/cxgb4/provider.c | 2 ++ 1 file changed, 2 insertions(+) commit 42235f80ab205bf5020cf33cb3e94455410abe36 Author: Sagi Grimberg Date: Tue Apr 26 17:55:38 2016 +0300 IB/core: Don't drain non-existent rq queue-pair The drain_rq function expects a normal receive qp to drain. A qp can only have either a normal rq or an srq. If there is an srq, there is no rq to drain. Until the API supports draining SRQs, simply skip draining the rq when the qp has an srq attached. Fixes: 765d67748bcf ("IB: new common API for draining queues") Signed-off-by: Sagi Grimberg Signed-off-by: Doug Ledford drivers/infiniband/core/verbs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 38bd10c447f8e8980753149a8a65108159871df5 Author: David Ahern Date: Thu Apr 21 20:56:12 2016 -0700 net: ipv6: Delete host routes on an ifdown It was a simple idea -- save IPv6 configured addresses on a link down so that IPv6 behaves similar to IPv4. As always the devil is in the details and the IPv6 stack as too many behavioral differences from IPv4 making the simple idea more complicated than it needs to be. The current implementation for keeping IPv6 addresses can panic or spit out a warning in one of many paths: 1. IPv6 route gets an IPv4 route as its 'next' which causes a panic in rt6_fill_node while handling a route dump request. 2. rt->dst.obsolete is set to DST_OBSOLETE_DEAD hitting the WARN_ON in fib6_del 3. Panic in fib6_purge_rt because rt6i_ref count is not 1. The root cause of all these is references related to the host route for an address that is retained. So, this patch deletes the host route every time the ifdown loop runs. Since the host route is deleted and will be re-generated an up there is no longer a need for the l3mdev fix up. On the 'admin up' side move addrconf_permanent_addr into the NETDEV_UP event handling so that it runs only once versus on UP and CHANGE events. All of the current panics and warnings appear to be related to addresses on the loopback device, but given the catastrophic nature when a bug is triggered this patch takes the conservative approach and evicts all host routes rather than trying to determine when it can be re-used and when it can not. That can be a later optimizaton if desired. Signed-off-by: David Ahern Signed-off-by: David S. Miller net/ipv6/addrconf.c | 48 +++++++++++++++--------------------------------- 1 file changed, 15 insertions(+), 33 deletions(-) commit 6a923934c33c750a595868af6bef5f1a1fa90054 Author: David S. Miller Date: Tue Apr 26 11:47:41 2016 -0400 Revert "ipv6: Revert optional address flusing on ifdown." This reverts commit 841645b5f2dfceac69b78fcd0c9050868d41ea61. Ok, this puts the feature back. I've decided to apply David A.'s bug fix and run with that rather than make everyone wait another whole release for this feature. Signed-off-by: David S. Miller Documentation/networking/ip-sysctl.txt | 9 ++ include/linux/ipv6.h | 1 + include/uapi/linux/ipv6.h | 1 + net/ipv6/addrconf.c | 162 ++++++++++++++++++++++++++++++--- 4 files changed, 161 insertions(+), 12 deletions(-) commit 346c09f80459a3ad97df1816d6d606169a51001a Author: Roman Pen Date: Tue Apr 26 13:15:35 2016 +0200 workqueue: fix ghost PENDING flag while doing MQ IO The bug in a workqueue leads to a stalled IO request in MQ ctx->rq_list with the following backtrace: [ 601.347452] INFO: task kworker/u129:5:1636 blocked for more than 120 seconds. [ 601.347574] Tainted: G O 4.4.5-1-storage+ #6 [ 601.347651] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 601.348142] kworker/u129:5 D ffff880803077988 0 1636 2 0x00000000 [ 601.348519] Workqueue: ibnbd_server_fileio_wq ibnbd_dev_file_submit_io_worker [ibnbd_server] [ 601.348999] ffff880803077988 ffff88080466b900 ffff8808033f9c80 ffff880803078000 [ 601.349662] ffff880807c95000 7fffffffffffffff ffffffff815b0920 ffff880803077ad0 [ 601.350333] ffff8808030779a0 ffffffff815b01d5 0000000000000000 ffff880803077a38 [ 601.350965] Call Trace: [ 601.351203] [] ? bit_wait+0x60/0x60 [ 601.351444] [] schedule+0x35/0x80 [ 601.351709] [] schedule_timeout+0x192/0x230 [ 601.351958] [] ? blk_flush_plug_list+0xc7/0x220 [ 601.352208] [] ? ktime_get+0x37/0xa0 [ 601.352446] [] ? bit_wait+0x60/0x60 [ 601.352688] [] io_schedule_timeout+0xa4/0x110 [ 601.352951] [] ? _raw_spin_unlock_irqrestore+0xe/0x10 [ 601.353196] [] bit_wait_io+0x1b/0x70 [ 601.353440] [] __wait_on_bit+0x5d/0x90 [ 601.353689] [] wait_on_page_bit+0xc0/0xd0 [ 601.353958] [] ? autoremove_wake_function+0x40/0x40 [ 601.354200] [] __filemap_fdatawait_range+0xe4/0x140 [ 601.354441] [] filemap_fdatawait_range+0x14/0x30 [ 601.354688] [] filemap_write_and_wait_range+0x3f/0x70 [ 601.354932] [] blkdev_fsync+0x1b/0x50 [ 601.355193] [] vfs_fsync_range+0x49/0xa0 [ 601.355432] [] blkdev_write_iter+0xca/0x100 [ 601.355679] [] __vfs_write+0xaa/0xe0 [ 601.355925] [] vfs_write+0xa9/0x1a0 [ 601.356164] [] kernel_write+0x38/0x50 The underlying device is a null_blk, with default parameters: queue_mode = MQ submit_queues = 1 Verification that nullb0 has something inflight: root@pserver8:~# cat /sys/block/nullb0/inflight 0 1 root@pserver8:~# find /sys/block/nullb0/mq/0/cpu* -name rq_list -print -exec cat {} \; ... /sys/block/nullb0/mq/0/cpu2/rq_list CTX pending: ffff8838038e2400 ... During debug it became clear that stalled request is always inserted in the rq_list from the following path: save_stack_trace_tsk + 34 blk_mq_insert_requests + 231 blk_mq_flush_plug_list + 281 blk_flush_plug_list + 199 wait_on_page_bit + 192 __filemap_fdatawait_range + 228 filemap_fdatawait_range + 20 filemap_write_and_wait_range + 63 blkdev_fsync + 27 vfs_fsync_range + 73 blkdev_write_iter + 202 __vfs_write + 170 vfs_write + 169 kernel_write + 56 So blk_flush_plug_list() was called with from_schedule == true. If from_schedule is true, that means that finally blk_mq_insert_requests() offloads execution of __blk_mq_run_hw_queue() and uses kblockd workqueue, i.e. it calls kblockd_schedule_delayed_work_on(). That means, that we race with another CPU, which is about to execute __blk_mq_run_hw_queue() work. Further debugging shows the following traces from different CPUs: CPU#0 CPU#1 ---------------------------------- ------------------------------- reqeust A inserted STORE hctx->ctx_map[0] bit marked kblockd_schedule...() returns 1 request B inserted STORE hctx->ctx_map[1] bit marked kblockd_schedule...() returns 0 *** WORK PENDING bit is cleared *** flush_busy_ctxs() is executed, but bit 1, set by CPU#1, is not observed As a result request B pended forever. This behaviour can be explained by speculative LOAD of hctx->ctx_map on CPU#0, which is reordered with clear of PENDING bit and executed _before_ actual STORE of bit 1 on CPU#1. The proper fix is an explicit full barrier , which guarantees that clear of PENDING bit is to be executed before all possible speculative LOADS or STORES inside actual work function. Signed-off-by: Roman Pen Cc: Gioh Kim Cc: Michael Wang Cc: Tejun Heo Cc: Jens Axboe Cc: linux-block@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Tejun Heo kernel/workqueue.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) commit 8d4d5c3a7c25e69075e60e5e70c1e05c205aef89 Author: Maxime Ripard Date: Tue Apr 26 16:00:51 2016 +0200 regulator: axp20x: Fix LDO4 linear voltage range The current linear voltage range for the LDO4 regulator found in the APX20X PMICs assumes that the voltage is linear between 2.5 and 3.1V. However, the PMIC can output up to 3.3V on that regulator by skipping the 2.6V and 2.9V steps. Fix the ranges to read and set the proper voltages. Fixes: 13d57e64352a ("regulator: axp20x: Use linear voltage ranges for AXP20X LDO4") Signed-off-by: Maxime Ripard Acked-by: Chen-Yu Tsai Signed-off-by: Mark Brown drivers/regulator/axp20x-regulator.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 978fa436231a834dc686292efc7d944d9013e035 Author: Sudeep Holla Date: Fri Apr 22 16:18:02 2016 +0100 drivers: firmware: psci: unify enable-method binding on ARM {64,32}-bit systems Currently ARM CPUs DT bindings allows different enable-method value for PSCI based systems. On ARM 64-bit this property is required and must be "psci" while on ARM 32-bit systems this property is optional and must be "arm,psci" if present. However, "arm,psci" has always been the compatible string for the PSCI node, and was never intended to be the enable-method. So this is a bug in the binding and not a deliberate attempt at specifying 32-bit differently. This is problematic if 32-bit OS is run on 64-bit system which has "psci" as enable-method rather than the expected "arm,psci". So let's unify the value into "psci" and remove support for "arm,psci" before it finds any users. Reported-by: Soby Mathew Cc: Rob Herring Acked-by: Mark Rutland Acked-by: Lorenzo Pieralisi Signed-off-by: Sudeep Holla Signed-off-by: Arnd Bergmann Documentation/devicetree/bindings/arm/cpus.txt | 1 - drivers/firmware/psci.c | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) commit 66ec246eb9982e7eb8e15e1fc55f543230310dd0 Author: Jarkko Nikula Date: Tue Apr 26 10:08:26 2016 +0300 spi: pxa2xx: Do not detect number of enabled chip selects on Intel SPT Certain Intel Sunrisepoint PCH variants report zero chip selects in SPI capabilities register even they have one per port. Detection in pxa2xx_spi_probe() sets master->num_chipselect to 0 leading to -EINVAL from spi_register_master() where chip select count is validated. Fix this by not using SPI capabilities register on Sunrisepoint. They don't have more than one chip select so use the default value 1 instead of detection. Fixes: 8b136baa5892 ("spi: pxa2xx: Detect number of enabled Intel LPSS SPI chip select signals") Signed-off-by: Jarkko Nikula Signed-off-by: Mark Brown Cc: stable@vger.kernel.org drivers/spi/spi-pxa2xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bb03ed216370cb021f377f923471e56d1de3ff5d Author: Takashi Iwai Date: Thu Apr 21 16:39:17 2016 +0200 ALSA: hda - Update BCLK also at hotplug for i915 HSW/BDW The recent bug report suggests that BCLK setup for i915 HSW/BDW needs to be updated at each HDMI hotplug, not only at initialization and resume. That is, we need to update HSW_EM4 and HSW_EM5 registers at ELD notification, too. Otherwise the HDMI audio may be out of sync and played in a wrong pitch. However, the HDA codec driver has no access to the controller registers, and currently the code managing these registers is in hda_intel.c, i.e. local to the controller driver. For allowing the explicit BCLK update from the codec driver, as in this patch, the former haswell_set_bclk() in hda_intel.c is moved to hdac_i915.c and exposed as snd_hdac_i915_set_bclk(). This is called from both the HDA controller driver and intel_pin_eld_notify() in HDMI codec driver. Along with this change, snd_hdac_get_display_clk() gets dropped as it's no longer used. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91410 Cc: # v4.5+ Signed-off-by: Takashi Iwai include/sound/hda_i915.h | 5 ++-- sound/hda/hdac_i915.c | 62 ++++++++++++++++++++++++++++++++++++++-------- sound/pci/hda/hda_intel.c | 56 +++-------------------------------------- sound/pci/hda/patch_hdmi.c | 1 + 4 files changed, 58 insertions(+), 66 deletions(-) commit 037e119738120c1cdc460c6ae33871c3000531f3 Author: Conrad Kostecki Date: Tue Apr 26 10:08:10 2016 +0200 ALSA: hda - Add dock support for ThinkPad X260 Fixes audio output on a ThinkPad X260, when using Lenovo CES 2013 docking station series (basic, pro, ultra). Signed-off-by: Conrad Kostecki Cc: Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit fc96256c906362e845d848d0f6a6354450059e81 Author: Eric Dumazet Date: Sat Apr 23 11:35:46 2016 -0700 net/mlx4_en: fix spurious timestamping callbacks When multiple skb are TX-completed in a row, we might incorrectly keep a timestamp of a prior skb and cause extra work. Fixes: ec693d47010e8 ("net/mlx4_en: Add HW timestamping (TS) support") Signed-off-by: Eric Dumazet Cc: Willem de Bruijn Reviewed-by: Eran Ben Elisha Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/en_tx.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 9f5db53507b6607dc1b5d59547097966c0e71047 Author: Ivan Babrou Date: Sat Apr 23 12:58:03 2016 +0000 net: dummy: remove note about being Y by default Signed-off-by: Ivan Babrou Signed-off-by: David S. Miller drivers/net/Kconfig | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 9c573de3283af007ea11c17bde1e4568d9417328 Author: Shaohua Li Date: Mon Apr 25 16:52:38 2016 -0700 MD: make bio mergeable blk_queue_split marks bio unmergeable, which makes sense for normal bio. But if dispatching the bio to underlayer disk, the blk_queue_split checks are invalid, hence it's possible the bio becomes mergeable. In the reported bug, this bug causes trim against raid0 performance slash https://bugzilla.kernel.org/show_bug.cgi?id=117051 Reported-and-tested-by: Park Ju Hyung Fixes: 6ac45aeb6bca(block: avoid to merge splitted bio) Cc: stable@vger.kernel.org (v4.3+) Cc: Ming Lei Cc: Neil Brown Reviewed-by: Jens Axboe Signed-off-by: Shaohua Li drivers/md/md.c | 2 ++ 1 file changed, 2 insertions(+) commit f5515f9cdff136dc32517d4b81fe2b9091237b4a Author: Geert Uytterhoeven Date: Mon Apr 25 16:08:30 2016 +0200 arm64: dts: r8a7795: Don't disable referenced optional scif clock clk_get() on a disabled clock node will return -EPROBE_DEFER, which can cause drivers to be deferred forever if such clocks are referenced in their devices' clocks properties. Update the disabled external scif clock node so that it is not disabled to prevent this. Reported-by: Jürg Billeter Signed-off-by: Geert Uytterhoeven [simon: fix for v4.6 extracted from a larger patch targeted at v4.7] Signed-off-by: Simon Horman arch/arm64/boot/dts/renesas/r8a7795.dtsi | 1 - 1 file changed, 1 deletion(-) commit 1becf03545a0859ceaaf9e8c2d9861882a71cb01 Author: Srinivas Pandruvada Date: Fri Apr 22 19:53:59 2016 -0700 cpufreq: intel_pstate: Fix processing for turbo activation ratio When the config TDP level is not nominal (level = 0), the MSR values for reading level 1 and level 2 ratios contain power in low 14 bits and actual ratio bits are at bits [23:16]. The current processing for level 1 and level 2 is wrong as there is no shift done to get actual ratio. Fixes: 6a35fc2d6c22 (cpufreq: intel_pstate: get P1 from TAR when available) Signed-off-by: Srinivas Pandruvada Cc: 4.4+ # 4.4+ Signed-off-by: Rafael J. Wysocki drivers/cpufreq/intel_pstate.c | 5 +++++ 1 file changed, 5 insertions(+) commit eb43335c409543506dd84b59f5c6bdd35cecf2c7 Author: Nick Dyer Date: Mon Apr 25 14:18:52 2016 -0700 Input: atmel_mxt_ts - use mxt_acquire_irq in mxt_soft_reset If using IRQF_TRIGGER_FALLING, then there is a race here: if the reset completes before we enable the IRQ, then CHG is already low and touch will be broken. This has been seen on Chromebook Pixel 2. A workaround is to reconfig T18 COMMSCONFIG to enable the RETRIGEN bit using mxt-app: mxt-app -W -T18 44 mxt-app --backup Tested-by: Tom Rini Signed-off-by: Nick Dyer Signed-off-by: Dmitry Torokhov drivers/input/touchscreen/atmel_mxt_ts.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) commit 6984ab1ab35f422292b7781c65284038bcc0f6a6 Author: Knut Wohlrab Date: Mon Apr 25 14:08:25 2016 -0700 Input: zforce_ts - fix dual touch recognition A wrong decoding of the touch coordinate message causes a wrong touch ID. Touch ID for dual touch must be 0 or 1. According to the actual Neonode nine byte touch coordinate coding, the state is transported in the lower nibble and the touch ID in the higher nibble of payload byte five. Signed-off-by: Knut Wohlrab Signed-off-by: Oleksij Rempel Signed-off-by: Dirk Behme Signed-off-by: Dmitry Torokhov drivers/input/touchscreen/zforce_ts.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 28a994fad95dd8475f04bd036e08a14aa8d125ea Author: H. Nikolaus Schaller Date: Mon Apr 25 14:02:36 2016 -0700 Input: twl6040-vibra - fix atomic schedule panic commit c6f39257c952 ("mfd: twl6040: Use regmap for register cache") did remove the private cache for the vibra control registers and replaced access within twl6040_get_vibralr_status() by calls to regmap. This is OK, as long as twl6040_get_vibralr_status() uses already cached values or is not called from interrupt context. But we call this in vibra_play() for checking that the vibrator is not configured for audio mode. The result is a "BUG: scheduling while atomic" if the first use of the twl6040 is a vibra effect, because the first fetch is by reading the twl6040 registers through (blocking) i2c and not from the cache. As soon as the regmap has cached the status, further calls are fine. The solution is to move the condition to the work() function which runs in context that can block. The original code returns -EBUSY, but the return value of ->play() functions is ignored anyways. Hence, we do not loose functionality by not returning an error but just reporting the issue to INFO loglevel. Tested-on: Pyra (omap5) prototype Signed-off-by: H. Nikolaus Schaller Signed-off-by: Dmitry Torokhov drivers/input/misc/twl6040-vibra.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit 3d6d30d60abb19ba9a20e53ce65b18a9c148fcd1 Author: Jiri Benc Date: Fri Apr 22 13:09:13 2016 +0200 cxgbi: fix uninitialized flowi6 ip6_route_output looks into different fields in the passed flowi6 structure, yet cxgbi passes garbage in nearly all those fields. Zero the structure out first. Fixes: fc8d0590d9142 ("libcxgbi: Add ipv6 api to driver") Signed-off-by: Jiri Benc Signed-off-by: David S. Miller drivers/scsi/cxgbi/libcxgbi.c | 1 + 1 file changed, 1 insertion(+) commit 264a0ae164bc0e9144bebcd25ff030d067b1a878 Author: Tejun Heo Date: Thu Apr 21 19:09:02 2016 -0400 memcg: relocate charge moving from ->attach to ->post_attach Hello, So, this ended up a lot simpler than I originally expected. I tested it lightly and it seems to work fine. Petr, can you please test these two patches w/o the lru drain drop patch and see whether the problem is gone? Thanks. ------ 8< ------ If charge moving is used, memcg performs relabeling of the affected pages from its ->attach callback which is called under both cgroup_threadgroup_rwsem and thus can't create new kthreads. This is fragile as various operations may depend on workqueues making forward progress which relies on the ability to create new kthreads. There's no reason to perform charge moving from ->attach which is deep in the task migration path. Move it to ->post_attach which is called after the actual migration is finished and cgroup_threadgroup_rwsem is dropped. * move_charge_struct->mm is added and ->can_attach is now responsible for pinning and recording the target mm. mem_cgroup_clear_mc() is updated accordingly. This also simplifies mem_cgroup_move_task(). * mem_cgroup_move_task() is now called from ->post_attach instead of ->attach. Signed-off-by: Tejun Heo Cc: Johannes Weiner Acked-by: Michal Hocko Debugged-and-tested-by: Petr Mladek Reported-by: Cyril Hrubis Reported-by: Johannes Weiner Fixes: 1ed1328792ff ("sched, cgroup: replace signal_struct->group_rwsem with a global percpu_rwsem") Cc: # 4.4+ mm/memcontrol.c | 37 +++++++++++++++++++------------------ 1 file changed, 19 insertions(+), 18 deletions(-) commit 5cf1cacb49aee39c3e02ae87068fc3c6430659b0 Author: Tejun Heo Date: Thu Apr 21 19:06:48 2016 -0400 cgroup, cpuset: replace cpuset_post_attach_flush() with cgroup_subsys->post_attach callback Since e93ad19d0564 ("cpuset: make mm migration asynchronous"), cpuset kicks off asynchronous NUMA node migration if necessary during task migration and flushes it from cpuset_post_attach_flush() which is called at the end of __cgroup_procs_write(). This is to avoid performing migration with cgroup_threadgroup_rwsem write-locked which can lead to deadlock through dependency on kworker creation. memcg has a similar issue with charge moving, so let's convert it to an official callback rather than the current one-off cpuset specific function. This patch adds cgroup_subsys->post_attach callback and makes cpuset register cpuset_post_attach_flush() as its ->post_attach. The conversion is mostly one-to-one except that the new callback is called under cgroup_mutex. This is to guarantee that no other migration operations are started before ->post_attach callbacks are finished. cgroup_mutex is one of the outermost mutex in the system and has never been and shouldn't be a problem. We can add specialized synchronization around __cgroup_procs_write() but I don't think there's any noticeable benefit. Signed-off-by: Tejun Heo Cc: Li Zefan Cc: Johannes Weiner Cc: Michal Hocko Cc: # 4.4+ prerequisite for the next patch include/linux/cgroup-defs.h | 1 + include/linux/cpuset.h | 6 ------ kernel/cgroup.c | 7 +++++-- kernel/cpuset.c | 4 ++-- 4 files changed, 8 insertions(+), 10 deletions(-) commit 841645b5f2dfceac69b78fcd0c9050868d41ea61 Author: David S. Miller Date: Mon Apr 25 15:33:55 2016 -0400 ipv6: Revert optional address flusing on ifdown. This reverts the following three commits: 70af921db6f8835f4b11c65731116560adb00c14 799977d9aafbf0ca0b9c39b04cbfb16db71302c9 f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac The feature was ill conceived, has terrible semantics, and has added nothing but regressions to the already fragile ipv6 stack. Fixes: f1705ec197e7 ("net: ipv6: Make address flushing on ifdown optional") Signed-off-by: David S. Miller Documentation/networking/ip-sysctl.txt | 9 -- include/linux/ipv6.h | 1 - include/uapi/linux/ipv6.h | 1 - net/ipv6/addrconf.c | 162 +++------------------------------ 4 files changed, 12 insertions(+), 161 deletions(-) commit 6c1ea260f89709e0021d2c59f8fd2a104b5b1123 Author: Ilya Dryomov Date: Mon Apr 11 19:34:49 2016 +0200 libceph: make authorizer destruction independent of ceph_auth_client Starting the kernel client with cephx disabled and then enabling cephx and restarting userspace daemons can result in a crash: [262671.478162] BUG: unable to handle kernel paging request at ffffebe000000000 [262671.531460] IP: [] kfree+0x5a/0x130 [262671.584334] PGD 0 [262671.635847] Oops: 0000 [#1] SMP [262672.055841] CPU: 22 PID: 2961272 Comm: kworker/22:2 Not tainted 4.2.0-34-generic #39~14.04.1-Ubuntu [262672.162338] Hardware name: Dell Inc. PowerEdge R720/068CDY, BIOS 2.4.3 07/09/2014 [262672.268937] Workqueue: ceph-msgr con_work [libceph] [262672.322290] task: ffff88081c2d0dc0 ti: ffff880149ae8000 task.ti: ffff880149ae8000 [262672.428330] RIP: 0010:[] [] kfree+0x5a/0x130 [262672.535880] RSP: 0018:ffff880149aeba58 EFLAGS: 00010286 [262672.589486] RAX: 000001e000000000 RBX: 0000000000000012 RCX: ffff8807e7461018 [262672.695980] RDX: 000077ff80000000 RSI: ffff88081af2be04 RDI: 0000000000000012 [262672.803668] RBP: ffff880149aeba78 R08: 0000000000000000 R09: 0000000000000000 [262672.912299] R10: ffffebe000000000 R11: ffff880819a60e78 R12: ffff8800aec8df40 [262673.021769] R13: ffffffffc035f70f R14: ffff8807e5b138e0 R15: ffff880da9785840 [262673.131722] FS: 0000000000000000(0000) GS:ffff88081fac0000(0000) knlGS:0000000000000000 [262673.245377] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [262673.303281] CR2: ffffebe000000000 CR3: 0000000001c0d000 CR4: 00000000001406e0 [262673.417556] Stack: [262673.472943] ffff880149aeba88 ffff88081af2be04 ffff8800aec8df40 ffff88081af2be04 [262673.583767] ffff880149aeba98 ffffffffc035f70f ffff880149aebac8 ffff8800aec8df00 [262673.694546] ffff880149aebac8 ffffffffc035c89e ffff8807e5b138e0 ffff8805b047f800 [262673.805230] Call Trace: [262673.859116] [] ceph_x_destroy_authorizer+0x1f/0x50 [libceph] [262673.968705] [] ceph_auth_destroy_authorizer+0x3e/0x60 [libceph] [262674.078852] [] put_osd+0x45/0x80 [libceph] [262674.134249] [] remove_osd+0xae/0x140 [libceph] [262674.189124] [] __reset_osd+0x103/0x150 [libceph] [262674.243749] [] kick_requests+0x223/0x460 [libceph] [262674.297485] [] ceph_osdc_handle_map+0x282/0x5e0 [libceph] [262674.350813] [] dispatch+0x4e/0x720 [libceph] [262674.403312] [] try_read+0x3d1/0x1090 [libceph] [262674.454712] [] ? dequeue_entity+0x152/0x690 [262674.505096] [] con_work+0xcb/0x1300 [libceph] [262674.555104] [] process_one_work+0x14e/0x3d0 [262674.604072] [] worker_thread+0x11a/0x470 [262674.652187] [] ? rescuer_thread+0x310/0x310 [262674.699022] [] kthread+0xd2/0xf0 [262674.744494] [] ? kthread_create_on_node+0x1c0/0x1c0 [262674.789543] [] ret_from_fork+0x3f/0x70 [262674.834094] [] ? kthread_create_on_node+0x1c0/0x1c0 What happens is the following: (1) new MON session is established (2) old "none" ac is destroyed (3) new "cephx" ac is constructed ... (4) old OSD session (w/ "none" authorizer) is put ceph_auth_destroy_authorizer(ac, osd->o_auth.authorizer) osd->o_auth.authorizer in the "none" case is just a bare pointer into ac, which contains a single static copy for all services. By the time we get to (4), "none" ac, freed in (2), is long gone. On top of that, a new vtable installed in (3) points us at ceph_x_destroy_authorizer(), so we end up trying to destroy a "none" authorizer with a "cephx" destructor operating on invalid memory! To fix this, decouple authorizer destruction from ac and do away with a single static "none" authorizer by making a copy for each OSD or MDS session. Authorizers themselves are independent of ac and so there is no reason for destroy_authorizer() to be an ac op. Make it an op on the authorizer itself by turning ceph_authorizer into a real struct. Fixes: http://tracker.ceph.com/issues/15447 Reported-by: Alan Zhang Signed-off-by: Ilya Dryomov Reviewed-by: Sage Weil fs/ceph/mds_client.c | 6 ++-- include/linux/ceph/auth.h | 10 +++--- include/linux/ceph/osd_client.h | 1 - net/ceph/auth.c | 8 ++--- net/ceph/auth_none.c | 71 ++++++++++++++++++++++------------------- net/ceph/auth_none.h | 3 +- net/ceph/auth_x.c | 21 ++++++------ net/ceph/auth_x.h | 1 + net/ceph/osd_client.c | 6 ++-- 9 files changed, 62 insertions(+), 65 deletions(-) commit a30b8f81d9d6fe24eab8a023794548b048f08e3c Author: Azael Avalos Date: Fri Apr 22 09:29:36 2016 -0600 toshiba_acpi: Fix regression caused by hotkey enabling value Commit 52cbae0127ad ("toshiba_acpi: Change default Hotkey enabling value") changed the hotkeys enabling value, as it was the same value Windows uses, however, it turns out that the value tells the EC that the driver will now take care of the hardware events like the physical RFKill switch or the pointing device toggle button. This patch reverts such commit by changing the default hotkey enabling value to 0x09, which enables hotkey events only, making the hardware buttons working again. Fixes bugs 113331 and 114941. Signed-off-by: Azael Avalos Cc: stable@vger.kernel.org Signed-off-by: Darren Hart drivers/platform/x86/toshiba_acpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bcc981e9ed84c678533299d7eff17d2c81e4d5de Merge: 02da2d7 340ff60 Author: Linus Torvalds Date: Mon Apr 25 09:32:45 2016 -0700 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: "This fixes a couple of regressions in the talitos driver that were introduced back in 4.3. The first bug causes a crash when the driver's AEAD functionality is used while the second bug prevents its AEAD feature from working once you get past the first bug" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: talitos - fix AEAD tcrypt tests crypto: talitos - fix crash in talitos_cra_init() commit 004cb62efd5e9e4772efb46b49c16fa2618ecf3e Merge: 92f27f9 5d7e23a Author: Kevin Hilman Date: Mon Apr 25 08:55:17 2016 -0700 Merge tag 'omap-for-v4.6/dt-ti81xx-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes Enable dm814x and dra62x clock driver. This branch has a dependency to the clk-ti branch from the Linux clk tree for the ADPLL clock driver. Otherwise things won't keep booting properly when we flip over to use the clock driver instead of fixed clocks set up by the bootloader. * tag 'omap-for-v4.6/dt-ti81xx-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: dts: Add clocks for dm814x ADPLL commit b297874a2d5c5fcaeb5242a8b4708e54c5477d90 Author: Michał Pecio Date: Sun Apr 24 18:11:45 2016 +0200 md/raid0: remove empty line printk from dump_zones Remove the final printk. All preceding output is already properly newline-terminated and the printk isn't even KERN_CONT to begin with, so it only adds one empty line to the log. Signed-off-by: Michal Pecio Signed-off-by: Shaohua Li drivers/md/raid0.c | 1 - 1 file changed, 1 deletion(-) commit ede85e90be26e5de2a72f76feec01cfc5281d4bd Merge: 02da2d7 630ba0c Author: Ingo Molnar Date: Mon Apr 25 17:28:11 2016 +0200 Merge tag 'efi-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/mfleming/efi into efi/urgent Pull EFI fix from Matt Fleming: * Avoid out-of-bounds access in the efivars code when performing string matching on converted EFI variable names (Laszlo Ersek) Signed-off-by: Ingo Molnar commit 567a44ecb44eb2584ddb93e962cfb133ce77e0bb Author: Nazar Mokrynskyi Date: Mon Apr 25 17:01:56 2016 +0300 HID: Fix boot delay for Creative SB Omni Surround 5.1 with quirk Needed for v2 of the device firmware, otherwise kernel will stuck for few seconds and throw "usb_submit_urb(ctrl) failed: -1" early on system boot. Signed-off-by: Nazar Mokrynskyi Reviewed-by: Benjamin Tissoires Signed-off-by: Jiri Kosina drivers/hid/hid-ids.h | 1 + drivers/hid/usbhid/hid-quirks.c | 1 + 2 files changed, 2 insertions(+) commit 89a095668304e8a02502ffd35edacffdbf49aa8c Author: Ricardo Ribalda Date: Thu Mar 3 16:12:48 2016 -0300 [media] vb2-memops: Fix over allocation of frame vectors On page unaligned frames, create_framevec forces get_vaddr_frames to allocate an extra page at the end of the buffer. Under some circumstances, this leads to -EINVAL on VIDIOC_QBUF. E.g: We have vm_a that vm_area that goes from 0x1000 to 0x3000. And a frame that goes from 0x1800 to 0x2800, i.e. 2 pages. frame_vector_create will be called with the following params: get_vaddr_frames(0x1800, 2, write, 1, vec); get_vaddr will allocate the first page after checking that the memory 0x1800-0x27ff is valid, but it will not allocate the second page because the range 0x2800-0x37ff is out of the vm_a range. This results in create_framevec returning -EFAULT Error Trace: [ 9083.793015] video0: VIDIOC_QBUF: 00:00:00.00000000 index=1, type=vid-cap, flags=0x00002002, field=any, sequence=0, memory=userptr, bytesused=0, offset/userptr=0x7ff2b023ca80, length=5765760 [ 9083.793028] timecode=00:00:00 type=0, flags=0x00000000, frames=0, userbits=0x00000000 [ 9083.793117] video0: VIDIOC_QBUF: error -22: 00:00:00.00000000 index=2, type=vid-cap, flags=0x00000000, field=any, sequence=0, memory=userptr, bytesused=0, offset/userptr=0x7ff2b07bc500, length=5765760 Also use true instead of 1 since that argument is a bool in the get_vaddr_frames() prototype. Fixes: 21fb0cb7ec65 ("[media] vb2: Provide helpers for mapping virtual addresses") Reported-by: Albert Antony Signed-off-by: Ricardo Ribalda Delgado [hans.verkuil@cisco.com: merged the 'bool' change into this patch] Acked-by: Marek Szyprowski Reviewed-by: Jan Kara Cc: # for v4.3 and up Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab drivers/media/v4l2-core/videobuf2-memops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b93876845c5e30a92964eeb088d9d2e024118022 Author: Ricardo Ribalda Date: Mon Apr 25 06:04:45 2016 -0300 [media] media: vb2: Fix regression on poll() for RW mode When using a device is read/write mode, vb2 does not handle properly the first select/poll operation. The reason for this, is that when this code has been refactored, some of the operations have changed their order, and now fileio emulator is not started. The reintroduced check to the core is enabled by a quirk flag, that avoids this check by other subsystems like DVB. Fixes: 49d8ab9feaf2 ("media] media: videobuf2: Separate vb2_poll()") Reported-by: Dimitrios Katsaros Cc: Junghak Sung Cc: # for v4.5 and up Signed-off-by: Ricardo Ribalda Delgado Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab drivers/media/v4l2-core/videobuf2-core.c | 10 ++++++++++ drivers/media/v4l2-core/videobuf2-v4l2.c | 14 ++++++-------- include/media/videobuf2-core.h | 4 ++++ 3 files changed, 20 insertions(+), 8 deletions(-) commit 3020ca711871fdaf0c15c8bab677a6bc302e28fe Author: Hans Verkuil Date: Fri Apr 22 04:00:50 2016 -0300 [media] v4l2-dv-timings.h: fix polarity for 4k formats The VSync polarity was negative instead of positive for the 4k CEA formats. I probably copy-and-pasted these from the DMT 4k format, which does have a negative VSync polarity. Signed-off-by: Hans Verkuil Reported-by: Martin Bugge Cc: # for v4.1 and up Signed-off-by: Mauro Carvalho Chehab include/uapi/linux/v4l2-dv-timings.h | 30 ++++++++++++++++++++---------- 1 file changed, 20 insertions(+), 10 deletions(-) commit c26f6c61578852f679787d555e6d07804e1f5f14 Author: Andrew Gabbasov Date: Mon Apr 25 06:19:38 2016 -0500 udf: Fix conversion of 'dstring' fields to UTF8 Commit 9293fcfbc1812a22ad5ce1b542eb90c1bbe01be1 ("udf: Remove struct ustr as non-needed intermediate storage"), while getting rid of 'struct ustr', does not take any special care of 'dstring' fields and effectively use fixed field length instead of actual string length, encoded in the last byte of the field. Also, commit 484a10f49387e4386bf2708532e75bf78ffea2cb ("udf: Merge linux specific translation into CS0 conversion function") introduced checking of the length of the string being converted, requiring proper alignment to number of bytes constituing each character. The UDF volume identifier is represented as a 32-bytes 'dstring', and needs to be converted from CS0 to UTF8, while mounting UDF filesystem. The changes in mentioned commits can in some cases lead to incorrect handling of volume identifier: - if the actual string in 'dstring' is of maximal length and does not have zero bytes separating it from dstring encoded length in last byte, that last byte may be included in conversion, thus making incorrect resulting string; - if the identifier is encoded with 2-bytes characters (compression code is 16), the length of 31 bytes (32 bytes of field length minus 1 byte of compression code), taken as the string length, is reported as an incorrect (unaligned) length, and the conversion fails, which in its turn leads to volume mounting failure. This patch introduces handling of 'dstring' encoded length field in udf_CS0toUTF8 function, that is used in all and only cases when 'dstring' fields are converted. Currently these cases are processing of Volume Identifier and Volume Set Identifier fields. The function is also renamed to udf_dstrCS0toUTF8 to distinctly indicate that it handles 'dstring' input. Signed-off-by: Andrew Gabbasov Signed-off-by: Jan Kara fs/udf/super.c | 4 ++-- fs/udf/udfdecl.h | 2 +- fs/udf/unicode.c | 16 ++++++++++++++-- 3 files changed, 17 insertions(+), 5 deletions(-) commit 2c932d4c9165ddbe417af612dbe2113df7f2057e Author: Ashish Samant Date: Fri Mar 25 10:53:41 2016 -0700 fuse: Fix return value from fuse_get_user_pages() fuse_get_user_pages() should return error or 0. Otherwise fuse_direct_io read will not return 0 to indicate that read has completed. Fixes: 742f992708df ("fuse: return patrial success from fuse_direct_io()") Signed-off-by: Ashish Samant Signed-off-by: Seth Forshee Signed-off-by: Miklos Szeredi fs/fuse/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a0a966b83873f33778710a4fc59240244b0734a5 Author: Krzysztof Kozlowski Date: Fri Apr 22 09:26:52 2016 +0200 ARM: EXYNOS: Properly skip unitialized parent clock in power domain on We want to skip reparenting a clock on turning on power domain, if we do not have the parent yet. The parent is obtained when turning the domain off. However due to a typo, the loop is continued on IS_ERR() of clock being reparented, not on the IS_ERR() of the parent. Theoretically this could lead to OOPS on first turn on of a power domain, if there was no turn off before. Practically that should never happen because all power domains are turned on by default (reset value, bootloader does not turn off them usually) so the first action will be always turn off. Fixes: 29e5eea06bc1 ("ARM: EXYNOS: Get current parent clock for power domain on/off") Reported-by: Vladimir Zapolskiy Signed-off-by: Krzysztof Kozlowski arch/arm/mach-exynos/pm_domains.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit da67e68c0e4601e87612918496fd8c7d72795e50 Author: Eric Engestrom Date: Mon Apr 25 01:24:04 2016 +0100 Documentation: dt: arc: fix spelling mistakes Signed-off-by: Eric Engestrom Signed-off-by: Vineet Gupta Documentation/devicetree/bindings/arc/archs-pct.txt | 2 +- Documentation/devicetree/bindings/arc/pct.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 391a20333b8393ef2e13014e6e59d192c5594471 Author: Paolo Abeni Date: Thu Apr 21 22:23:31 2016 +0200 ipv4/fib: don't warn when primary address is missing if in_dev is dead After commit fbd40ea0180a ("ipv4: Don't do expensive useless work during inetdev destroy.") when deleting an interface, fib_del_ifaddr() can be executed without any primary address present on the dead interface. The above is safe, but triggers some "bug: prim == NULL" warnings. This commit avoids warning if the in_dev is dead Signed-off-by: Paolo Abeni Signed-off-by: David S. Miller net/ipv4/fib_frontend.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 94862a62dfe3ba1c7601115a2dc80721c5b256f0 Author: Rafael J. Wysocki Date: Thu Apr 21 20:57:47 2016 +0200 Revert "cpufreq: governor: Fix negative idle_time when configured with CONFIG_HZ_PERIODIC" Revert commit 0df35026c6a5 (cpufreq: governor: Fix negative idle_time when configured with CONFIG_HZ_PERIODIC) that introduced a regression by causing the ondemand cpufreq governor to misbehave for CONFIG_TICK_CPU_ACCOUNTING unset (the frequency goes up to the max at one point and stays there indefinitely). The revert takes subsequent modifications of the code in question into account. Fixes: 0df35026c6a5 (cpufreq: governor: Fix negative idle_time when configured with CONFIG_HZ_PERIODIC) Link: https://bugzilla.kernel.org/show_bug.cgi?id=115261 Reported-and-tested-by: Timo Valtoaho Cc: 4.5+ # 4.5+ Signed-off-by: Rafael J. Wysocki Acked-by: Viresh Kumar drivers/cpufreq/cpufreq_governor.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) commit 02da2d72174c61988eb4456b53f405e3ebdebce4 Author: Linus Torvalds Date: Sun Apr 24 16:17:05 2016 -0700 Linux 4.6-rc5 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 91e019de2ff85fdcadacacb7623dac7a7c522258 Merge: 45c78e0 5fc7197 Author: David S. Miller Date: Sun Apr 24 14:51:50 2016 -0400 Merge branch 'mlx5-fixes' Saeed Mahameed says: ==================== mlx5 driver updates and fixes Changes from V0: - Dropped: ("net/mlx5e: Reset link modes upon setting speed to zero") - Fixed compilation issue introduced to mlx5_ib driver. - Rebased to df637193906a ('Revert "Prevent NUll pointer dereference with two PHYs on cpsw"') This series has few bug fixes for mlx5 core and ethernet driver. Eli fixed a wrong static local variable declaration in flow steering API. Majd added the support of ConnectX-5 PF and VF and added the support for kernel shutdown pci callback for more robust reboot procedures. Maor fixed a soft lockup in flow steering. Rana fixed a wrog speed define in mlx5 EN driver. I also had the chance to introduce some bug fixes in mlx5 EN mtu reporting and handling. For -stable: net/mlx5_core: Fix soft lockup in steering error flow net/mlx5e: Device's mtu field is u16 and not int net/mlx5e: Fix minimum MTU net/mlx5e: Use vport MTU rather than physical port MTU ==================== Signed-off-by: David S. Miller commit 5fc7197d3a256d9c5de3134870304b24892a4908 Author: Majd Dibbiny Date: Fri Apr 22 00:33:07 2016 +0300 net/mlx5: Add pci shutdown callback This patch introduces kexec support for mlx5. When switching kernels, kexec() calls shutdown, which unloads the driver and cleans its resources. In addition, remove unregister netdev from shutdown flow. This will allow a clean shutdown, even if some netdev clients did not release their reference from this netdev. Releasing The HW resources only is enough as the kernel is shutting down Signed-off-by: Majd Dibbiny Signed-off-by: Tariq Toukan Signed-off-by: Haggai Abramovsky Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 15 +++++++++++++-- drivers/net/ethernet/mellanox/mlx5/core/main.c | 23 +++++++++++++++++++---- include/linux/mlx5/driver.h | 7 ++++--- 3 files changed, 36 insertions(+), 9 deletions(-) commit 78228cbdeb0aa5c96e2a721e7e0d6953b416b5a3 Author: Eli Cohen Date: Fri Apr 22 00:33:06 2016 +0300 net/mlx5_core: Remove static from local variable The static is not required and breaks re-entrancy if it will be required. Fixes: 2530236303d9 ("net/mlx5_core: Flow steering tree initialization") Signed-off-by: Eli Cohen Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cd255efff9baadd654d6160e52d17ae7c568c9d3 Author: Saeed Mahameed Date: Fri Apr 22 00:33:05 2016 +0300 net/mlx5e: Use vport MTU rather than physical port MTU Set and report vport MTU rather than physical MTU, Driver will set both vport and physical port mtu and will rely on the query of vport mtu. SRIOV VFs have to report their MTU to their vport manager (PF), and this will allow them to work with any MTU they need without failing the request. Also for some cases where the PF is not a port owner, PF can work with MTU less than the physical port mtu if set physical port mtu didn't take effect. Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 44 ++++++++++++++++++----- drivers/net/ethernet/mellanox/mlx5/core/vport.c | 40 +++++++++++++++++++++ include/linux/mlx5/vport.h | 2 ++ 3 files changed, 77 insertions(+), 9 deletions(-) commit d8edd2469ace550db707798180d1c84d81f93bca Author: Saeed Mahameed Date: Fri Apr 22 00:33:04 2016 +0300 net/mlx5e: Fix minimum MTU Minimum MTU that can be set in Connectx4 device is 68. This fixes the case where a user wants to set invalid MTU, the driver will fail to satisfy this request and the interface will stay down. It is better to report an error and continue working with old mtu. Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit 046339eaab26804f52f6604877f5674f70815b26 Author: Saeed Mahameed Date: Fri Apr 22 00:33:03 2016 +0300 net/mlx5e: Device's mtu field is u16 and not int For set/query MTU port firmware commands the MTU field is 16 bits, here I changed all the "int mtu" parameters of the functions wrapping those firmware commands to be u16. Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller drivers/infiniband/hw/mlx5/main.c | 4 ++-- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 ++-- drivers/net/ethernet/mellanox/mlx5/core/port.c | 10 +++++----- include/linux/mlx5/port.h | 6 +++--- 4 files changed, 12 insertions(+), 12 deletions(-) commit 64dbbdfef245f67504ec403a5aebfcc7b92bd8c1 Author: Majd Dibbiny Date: Fri Apr 22 00:33:02 2016 +0300 net/mlx5_core: Add ConnectX-5 to list of supported devices Add the upcoming ConnectX-5 devices (PF and VF) to the list of supported devices by the mlx5 driver. Signed-off-by: Majd Dibbiny Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/main.c | 2 ++ 1 file changed, 2 insertions(+) commit 6e4c21894673baabdbef03c3ac2458a28246128b Author: Rana Shahout Date: Fri Apr 22 00:33:01 2016 +0300 net/mlx5e: Fix MLX5E_100BASE_T define Bit 25 of eth_proto_capability in PTYS register is 1000Base-TT and not 100Base-T. Fixes: f62b8bb8f2d3 ('net/mlx5: Extend mlx5_core to support ConnectX-4 Ethernet functionality') Signed-off-by: Rana Shahout Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) commit c3f9bf628bc7edda298897d952f5e761137229c9 Author: Maor Gottlieb Date: Fri Apr 22 00:33:00 2016 +0300 net/mlx5_core: Fix soft lockup in steering error flow In the error flow of adding flow rule to auto-grouped flow table, we call to tree_remove_node. tree_remove_node locks the node's parent, however the node's parent is already locked by mlx5_add_flow_rule and this causes a deadlock. After this patch, if we failed to add the flow rule, we unlock the flow table before calling to tree_remove_node. fixes: f0d22d187473 ('net/mlx5_core: Introduce flow steering autogrouped flow table') Signed-off-by: Maor Gottlieb Reported-by: Amir Vadai Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 46 +++++++++-------------- 1 file changed, 17 insertions(+), 29 deletions(-) commit 45c78e0219405af1b0f31b06952dfd9bcf7ad1f6 Author: Manish Chopra Date: Thu Apr 21 13:25:20 2016 -0400 qlcnic: Update version to 5.3.64 Just updating the version as many fixes got accumulated over 5.3.63 Signed-off-by: Manish Chopra Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qlcnic/qlcnic.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 3c201b5a84edd6ee2f9a8548efaa813980839b46 Author: Marek Vasut Date: Thu Apr 21 14:11:50 2016 +0200 net: stmmac: socfpga: Remove re-registration of reset controller Both socfpga_dwmac_parse_data() in dwmac-socfpga.c and stmmac_dvr_probe() in stmmac_main.c functions call devm_reset_control_get() to register an reset controller for the stmmac. This results in an attempt to register two reset controllers for the same non-shared reset line. The first attempt to register the reset controller works fine. The second attempt fails with warning from the reset controller core, see below. The warning is produced because the reset line is non-shared and thus it is allowed to have only up-to one reset controller associated with that reset line, not two or more. The solution has multiple parts. First, the original socfpga_dwmac_init() is tweaked to use reset controller pointer from the stmmac_priv (private data of the stmmac core) instead of the local instance, which was used before. The local re-registration of the reset controller is removed. Next, the socfpga_dwmac_init() is moved after stmmac_dvr_probe() in the probe function. This order is legal according to Altera and it makes the code much easier, since there is no need to temporarily register and unregister the reset controller ; the reset controller is already registered by the stmmac_dvr_probe(). Finally, plat_dat->exit and socfpga_dwmac_exit() is no longer necessary, since the functionality is already performed by the stmmac core. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1 at drivers/reset/core.c:187 __of_reset_control_get+0x218/0x270 Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.6.0-rc4-next-20160419-00015-gabb2477-dirty #4 Hardware name: Altera SOCFPGA [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [] (show_stack) from [] (dump_stack+0x94/0xa8) [] (dump_stack) from [] (__warn+0xec/0x104) [] (__warn) from [] (warn_slowpath_null+0x20/0x28) [] (warn_slowpath_null) from [] (__of_reset_control_get+0x218/0x270) [] (__of_reset_control_get) from [] (__devm_reset_control_get+0x54/0x90) [] (__devm_reset_control_get) from [] (stmmac_dvr_probe+0x1b4/0x8e8) [] (stmmac_dvr_probe) from [] (socfpga_dwmac_probe+0x1b8/0x28c) [] (socfpga_dwmac_probe) from [] (platform_drv_probe+0x4c/0xb0) [] (platform_drv_probe) from [] (driver_probe_device+0x224/0x2bc) [] (driver_probe_device) from [] (__driver_attach+0xac/0xb0) [] (__driver_attach) from [] (bus_for_each_dev+0x6c/0xa0) [] (bus_for_each_dev) from [] (bus_add_driver+0x1a4/0x21c) [] (bus_add_driver) from [] (driver_register+0x78/0xf8) [] (driver_register) from [] (do_one_initcall+0x40/0x170) [] (do_one_initcall) from [] (kernel_init_freeable+0x1dc/0x27c) [] (kernel_init_freeable) from [] (kernel_init+0x8/0x114) [] (kernel_init) from [] (ret_from_fork+0x14/0x3c) ---[ end trace 059d2fbe87608fa9 ]--- Signed-off-by: Marek Vasut Cc: Matthew Gerlach Cc: Dinh Nguyen Cc: David S. Miller Tested-by: Dinh Nguyen Signed-off-by: David S. Miller .../net/ethernet/stmicro/stmmac/dwmac-socfpga.c | 50 +++++++--------------- 1 file changed, 16 insertions(+), 34 deletions(-) commit b6742cab0d79708d54774ce615c8c96ad71ce40b Merge: 3d05a06 4b1fb93 Author: David S. Miller Date: Sun Apr 24 14:32:05 2016 -0400 Merge branch 'macsec-fixes' Sabrina Dubroca says: ==================== macsec: a few fixes Some small fixes for the macsec driver: - possible NULL pointer dereferences - netlink dumps fixes: RTNL locking, consistent dumps - a reference counting bug - wrong name for uapi constant - a few memory leaks Patches 1 to 5 are the same as in v1, patches 6 to 9 are new. Patch 6 fixes the memleak that Lance spotted in v1. ==================== Signed-off-by: David S. Miller commit 4b1fb9352f351faa067a914907d58a6fe38ac048 Author: Sabrina Dubroca Date: Fri Apr 22 11:28:09 2016 +0200 macsec: fix netlink attribute validation macsec_validate_attr should check IFLA_MACSEC_REPLAY_PROTECT (not IFLA_MACSEC_PROTECT) to verify that the replay protection and replay window arguments are correct. Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver") Signed-off-by: Sabrina Dubroca Acked-by: Hannes Frederic Sowa Signed-off-by: David S. Miller drivers/net/macsec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 748164802c1bd2c52937d20782b07d8c68dd9a4f Author: Sabrina Dubroca Date: Fri Apr 22 11:28:08 2016 +0200 macsec: add missing macsec prefix in uapi I accidentally forgot some MACSEC_ prefixes in if_macsec.h. Fixes: dece8d2b78d1 ("uapi: add MACsec bits") Signed-off-by: Sabrina Dubroca Acked-by: Hannes Frederic Sowa Signed-off-by: David S. Miller drivers/net/macsec.c | 12 +++++++----- include/uapi/linux/if_macsec.h | 4 ++-- 2 files changed, 9 insertions(+), 7 deletions(-) commit 38787fc209580f9b5918e93e71da7c960dbb5d8d Author: Sabrina Dubroca Date: Fri Apr 22 11:28:07 2016 +0200 macsec: fix SA leak if initialization fails Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver") Reported-by: Lance Richardson Signed-off-by: Sabrina Dubroca Acked-by: Hannes Frederic Sowa Signed-off-by: David S. Miller drivers/net/macsec.c | 2 ++ 1 file changed, 2 insertions(+) commit 960d5848dbf1245cc3a310109897937207411c0c Author: Sabrina Dubroca Date: Fri Apr 22 11:28:06 2016 +0200 macsec: fix memory leaks around rx_handler (un)registration We leak a struct macsec_rxh_data when we unregister the rx_handler in macsec_dellink. We also leak a struct macsec_rxh_data in register_macsec_dev if we fail to register the rx_handler. Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver") Signed-off-by: Sabrina Dubroca Acked-by: Hannes Frederic Sowa Signed-off-by: David S. Miller drivers/net/macsec.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 96cfc5052c5d434563873caa7707b32b9e389b16 Author: Sabrina Dubroca Date: Fri Apr 22 11:28:05 2016 +0200 macsec: add consistency check to netlink dumps Use genl_dump_check_consistent in dump_secy. Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver") Suggested-by: Johannes Berg Signed-off-by: Sabrina Dubroca Acked-by: Hannes Frederic Sowa Signed-off-by: David S. Miller drivers/net/macsec.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit c3b7d0bd7ac2c501d4806db71ddd383c184968e8 Author: Sabrina Dubroca Date: Fri Apr 22 11:28:04 2016 +0200 macsec: fix rx_sa refcounting with decrypt callback The decrypt callback macsec_decrypt_done needs a reference on the rx_sa and releases it before returning, but macsec_handle_frame already put that reference after macsec_decrypt returned NULL. Set rx_sa to NULL when the decrypt callback runs so that macsec_handle_frame knows it must not release the reference. Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver") Signed-off-by: Sabrina Dubroca Acked-by: Hannes Frederic Sowa Signed-off-by: David S. Miller drivers/net/macsec.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) commit 497f358aa4c0d99b75ec204407389920d5e33ec5 Author: Sabrina Dubroca Date: Fri Apr 22 11:28:03 2016 +0200 macsec: don't put a NULL rxsa The "deliver:" path of macsec_handle_frame can be called with rx_sa == NULL. Check rx_sa != NULL before calling macsec_rxsa_put(). Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver") Signed-off-by: Sabrina Dubroca Acked-by: Hannes Frederic Sowa Signed-off-by: David S. Miller drivers/net/macsec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit c10c63ea739bce3b8a6ab85c7bb472d900c9b070 Author: Sabrina Dubroca Date: Fri Apr 22 11:28:02 2016 +0200 macsec: take rtnl lock before for_each_netdev Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver") Reported-by: Johannes Berg Signed-off-by: Sabrina Dubroca Acked-by: Hannes Frederic Sowa Signed-off-by: David S. Miller drivers/net/macsec.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) commit 72f2a05b8f367ee0d75584a6fbec7dbe7c144f27 Author: Sabrina Dubroca Date: Fri Apr 22 11:28:01 2016 +0200 macsec: add missing NULL check after kmalloc Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver") Reported-by: Dan Carpenter Signed-off-by: Sabrina Dubroca Acked-by: Hannes Frederic Sowa Signed-off-by: David S. Miller drivers/net/macsec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 3d05a06d313d602f7cd589d5d8d45bd04902adcb Merge: f75cfba 45ebcce Author: David S. Miller Date: Sun Apr 24 14:23:38 2016 -0400 Merge branch 'bridge-mdb-fixes' Jiri Pirko says: ==================== bridge: mdb: Couple of fixes Elad says: This patchset fixes two problems reported by Nikolay Aleksandrov. The first problem is that the MDB offload flag might be accesed without helding the multicast_lock. The second problem is that the switchdev mdb offload is deferred and the offload bit was marked regardless if the operation succeeded or not. ==================== Signed-off-by: David S. Miller commit 45ebcce56823d14d196dbdecd26783b3d5f464a6 Author: Elad Raz Date: Thu Apr 21 12:52:45 2016 +0200 bridge: mdb: Marking port-group as offloaded There is a race-condition when updating the mdb offload flag without using the mulicast_lock. This reverts commit 9e8430f8d60d98 ("bridge: mdb: Passing the port-group pointer to br_mdb module"). This patch marks offloaded MDB entry as "offload" by changing the port- group flags and marks it as MDB_PG_FLAGS_OFFLOAD. When switchdev PORT_MDB succeeded and adds a multicast group, a completion callback is been invoked "br_mdb_complete". The completion function locks the multicast_lock and finds the right net_bridge_port_group and marks it as offloaded. Fixes: 9e8430f8d60d98 ("bridge: mdb: Passing the port-group pointer to br_mdb module") Reported-by: Nikolay Aleksandrov Signed-off-by: Elad Raz Signed-off-by: Jiri Pirko Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller net/bridge/br_mdb.c | 91 +++++++++++++++++++++++++++++++++-------------- net/bridge/br_multicast.c | 8 +++-- net/bridge/br_private.h | 4 +-- 3 files changed, 71 insertions(+), 32 deletions(-) commit 6dd684c0feb207f30180570bad24264b922d9476 Author: Elad Raz Date: Thu Apr 21 12:52:44 2016 +0200 bridge: mdb: Common function for mdb entry translation There is duplicate code that translates br_mdb_entry to br_ip let's wrap it in a common function. Signed-off-by: Elad Raz Signed-off-by: Jiri Pirko Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller net/bridge/br_mdb.c | 33 +++++++++++++++------------------ 1 file changed, 15 insertions(+), 18 deletions(-) commit 7ceb2afbd6aee4643056b47156baad6841db8e78 Author: Elad Raz Date: Thu Apr 21 12:52:43 2016 +0200 switchdev: Adding complete operation to deferred switchdev ops When using switchdev deferred operation (SWITCHDEV_F_DEFER), the operation is executed in different context and the application doesn't have any way to get the operation real status. Adding a completion callback fixes that. This patch adds fields to switchdev_attr and switchdev_obj "complete_priv" field which is used by the "complete" callback. Application can set a complete function which will be called once the operation executed. Signed-off-by: Elad Raz Signed-off-by: Jiri Pirko Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller include/net/switchdev.h | 4 ++++ net/switchdev/switchdev.c | 6 ++++++ 2 files changed, 10 insertions(+) commit f75cfbaddeef943aed479b80415c3dcc63ff4247 Author: Grygorii Strashko Date: Thu Apr 21 13:13:56 2016 +0300 MAINTAINERS: net: add entry for TI Ethernet Switch drivers Add record for TI Ethernet Switch Driver CPSW/CPDMA/MDIO HW (am33/am43/am57/dr7/davinci) to ensure that related patches will go through dedicated linux-omap list. Also add Mugunthan as maintainer and myself as the reviewer. Cc: "David S. Miller" Cc: Tony Lindgren Cc: Mugunthan V N Cc: Richard Cochran Signed-off-by: Grygorii Strashko Acked-by: Mugunthan V N Acked-by: Tony Lindgren Signed-off-by: David S. Miller MAINTAINERS | 9 +++++++++ 1 file changed, 9 insertions(+) commit 613ac23a46e10d4d4339febdd534fafadd68e059 Author: Jasem Mutlaq Date: Tue Apr 19 10:38:27 2016 +0300 USB: serial: cp210x: add Straizona Focusers device ids Adding VID:PID for Straizona Focusers to cp210x driver. Signed-off-by: Jasem Mutlaq Cc: stable Signed-off-by: Johan Hovold drivers/usb/serial/cp210x.c | 2 ++ 1 file changed, 2 insertions(+) commit 1d377f4d690637a0121eac8701f84a0aa1e69a69 Author: Mike Manning Date: Mon Apr 18 12:13:23 2016 +0000 USB: serial: cp210x: add ID for Link ECU The Link ECU is an aftermarket ECU computer for vehicles that provides full tuning abilities as well as datalogging and displaying capabilities via the USB to Serial adapter built into the device. Signed-off-by: Mike Manning Cc: stable Signed-off-by: Johan Hovold drivers/usb/serial/cp210x.c | 2 ++ 1 file changed, 2 insertions(+) commit c4fdb6cff2aa0ae740c5f19b6f745cbbe786d42f Author: Linus Lüssing Date: Fri Mar 11 14:04:49 2016 +0100 batman-adv: Fix broadcast/ogm queue limit on a removed interface When removing a single interface while a broadcast or ogm packet is still pending then we will free the forward packet without releasing the queue slots again. This patch is supposed to fix this issue. Fixes: 6d5808d4ae1b ("batman-adv: Add missing hardif_free_ref in forw_packet_free") Signed-off-by: Linus Lüssing [sven@narfation.org: fix conflicts with current version] Signed-off-by: Sven Eckelmann Signed-off-by: Marek Lindner Signed-off-by: Antonio Quartulli net/batman-adv/send.c | 6 ++++++ 1 file changed, 6 insertions(+) commit d1a65f1741bfd9c69f9e4e2ad447a89b6810427d Author: Sven Eckelmann Date: Sun Mar 20 12:27:53 2016 +0100 batman-adv: Reduce refcnt of removed router when updating route _batadv_update_route rcu_derefences orig_ifinfo->router outside of a spinlock protected region to print some information messages to the debug log. But this pointer is not checked again when the new pointer is assigned in the spinlock protected region. Thus is can happen that the value of orig_ifinfo->router changed in the meantime and thus the reference counter of the wrong router gets reduced after the spinlock protected region. Just rcu_dereferencing the value of orig_ifinfo->router inside the spinlock protected region (which also set the new pointer) is enough to get the correct old router object. Fixes: e1a5382f978b ("batman-adv: Make orig_node->router an rcu protected pointer") Signed-off-by: Sven Eckelmann Signed-off-by: Marek Lindner Signed-off-by: Antonio Quartulli net/batman-adv/routing.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit f2d23861b818d08bcd15cc1612ae94aa33b3931c Author: Sven Eckelmann Date: Sat Mar 19 13:55:21 2016 +0100 batman-adv: Deactivate TO_BE_ACTIVATED hardif on shutdown The shutdown of an batman-adv interface can happen with one of its slave interfaces still being in the BATADV_IF_TO_BE_ACTIVATED state. A possible reason for it is that the routing algorithm BATMAN_V was selected and batadv_schedule_bat_ogm was not yet called for this interface. This slave interface still has to be set to BATADV_IF_INACTIVE or the batman-adv interface will never reduce its usage counter and thus never gets shutdown. This problem can be simulated via: $ modprobe dummy $ modprobe batman-adv routing_algo=BATMAN_V $ ip link add bat0 type batadv $ ip link set dummy0 master bat0 $ ip link set dummy0 up $ ip link del bat0 unregister_netdevice: waiting for bat0 to become free. Usage count = 3 Reported-by: Matthias Schiffer Signed-off-by: Sven Eckelmann Signed-off-by: Marek Lindner Signed-off-by: Antonio Quartulli net/batman-adv/hard-interface.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit e48474ed8a217b7f80f2a42bc05352406a06cb67 Author: Marek Lindner Date: Fri Mar 11 16:01:09 2016 +0100 batman-adv: init neigh node last seen field Signed-off-by: Marek Lindner [sven@narfation.org: fix conflicts with current version] Signed-off-by: Sven Eckelmann Signed-off-by: Antonio Quartulli net/batman-adv/originator.c | 1 + 1 file changed, 1 insertion(+) commit c78296665c3d81f040117432ab9e1cb125521b0c Author: Sven Eckelmann Date: Fri Feb 26 17:56:13 2016 +0100 batman-adv: Check skb size before using encapsulated ETH+VLAN header The encapsulated ethernet and VLAN header may be outside the received ethernet frame. Thus the skb buffer size has to be checked before it can be parsed to find out if it encapsulates another batman-adv packet. Fixes: 420193573f11 ("batman-adv: softif bridge loop avoidance") Signed-off-by: Sven Eckelmann Signed-off-by: Marek Lindner Signed-off-by: Antonio Quartulli net/batman-adv/soft-interface.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 913f201083c81cf021f050d041352ac854c4b526 Merge: 4dfa573 a6f4850 Author: Linus Torvalds Date: Sat Apr 23 17:15:39 2016 -0700 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal Pull thermal fixes from Eduardo Valentin: "Specifics in this pull request: - Fixes in mediatek and OF thermal drivers - Fixes in power_allocator governor - More fixes of unsigned to int type change in thermal_core.c. These change have been CI tested using KernelCI bot. \o/" * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal: thermal: fix Mediatek thermal controller build thermal: consistently use int for trip temp thermal: fix mtk_thermal build dependency thermal: minor mtk_thermal.c cleanups thermal: power_allocator: req_range multiplication should be a 64 bit type thermal: of: add __init attribute commit 4dfa5739d9e135fa3731f3acfbc618e384c351d2 Merge: 1ad9bf9 987aedb Author: Linus Torvalds Date: Sat Apr 23 14:53:11 2016 -0700 Merge tag 'asm-generic-4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull asm-generic update from Arnd Bergmann: "Here is one patch to wire up the preadv/pwritev system calls in the generic system call table, which is required for all architectures that were merged in the last few years, including arm64. Usually these get merged along with the syscall implementation or one of the architecture trees, but this time that did not happen. Andre and Christoph both sent a version of this patch, I picked the one I got first" * tag 'asm-generic-4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: generic syscalls: wire up preadv2 and pwritev2 syscalls commit 987aedb5d6f6e10c5203c6d0aab9a60ec22c7e93 Author: Andre Przywara Date: Mon Apr 11 10:17:46 2016 +0100 generic syscalls: wire up preadv2 and pwritev2 syscalls These new syscalls are implemented as generic code, so enable them for architectures like arm64 which use the generic syscall table. Signed-off-by: Andre Przywara Signed-off-by: Arnd Bergmann include/uapi/asm-generic/unistd.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 92f27f98ceb2d457c97cb032349bbf2f776420d0 Merge: 56896ef 10c0f0e Author: Arnd Bergmann Date: Sat Apr 23 22:10:48 2016 +0200 Merge tag 'qcom-fixes-for-4.6-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/agross/linux into fixes Merge "Qualcomm Fixes for v4.6-rc2" from Andy Gross: * Revert BAM usage on MSM8974 boards * tag 'qcom-fixes-for-4.6-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/agross/linux: Revert "dts: msm8974: Add dma channels for blsp2_i2c1 node" Revert "dts: msm8974: Add blsp2_bam dma node" commit 56896ef5b990a3822da45f92e548c4c8ac301bb4 Author: Masahiro Yamada Date: Fri Apr 15 19:30:46 2016 +0900 arm64: dts: uniphier: fix I2C nodes of PH1-LD20 The I2C hardware blocks on this SoC are connected as follows: I2C0: external connection I2C1: external connection I2C2: internal connection I2C3: external connection I2C4: external connection I2C5: internal connection I2C6: no connection (not accessible) Delete pinctrl from Ch2, add pinctrl to Ch4, and remove the Ch6 node. Signed-off-by: Masahiro Yamada Signed-off-by: Arnd Bergmann .../boot/dts/socionext/uniphier-ph1-ld20-ref.dts | 1 - arch/arm64/boot/dts/socionext/uniphier-ph1-ld20.dtsi | 20 +++++--------------- 2 files changed, 5 insertions(+), 16 deletions(-) commit 1ad9bf9fdc29d36baa2db1d0f09ec684ff915f2b Merge: 82b23cb ea5dfb5 Author: Linus Torvalds Date: Sat Apr 23 12:07:29 2016 -0700 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "Misc fixes: two EDAC driver fixes, a Xen crash fix, a HyperV log spam fix and a documentation fix" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86 EDAC, sb_edac.c: Take account of channel hashing when needed x86 EDAC, sb_edac.c: Repair damage introduced when "fixing" channel address x86/mm/xen: Suppress hugetlbfs in PV guests x86/doc: Correct limits in Documentation/x86/x86_64/mm.txt x86/hyperv: Avoid reporting bogus NMI status for Gen2 instances commit 82b23cb94b8cee25781c209d9b1df3b144c8bb5f Merge: 0e11d25 a19cad6 3b9d6da 16eeed7 Author: Linus Torvalds Date: Sat Apr 23 11:45:52 2016 -0700 Merge branches 'perf-urgent-for-linus', 'smp-urgent-for-linus' and 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf, cpu hotplug and timer fixes from Ingo Molnar: "perf: - A single tooling fix for a user-triggerable segfault. CPU hotplug: - Fix a CPU hotplug corner case regression, introduced by the recent hotplug rework timers: - Fix a boot hang in the ARM based Tango SoC clocksource driver" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf intel-pt: Fix segfault tracing transactions * 'smp-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: cpu/hotplug: Fix rollback during error-out in __cpu_disable() * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: clocksource/drivers/tango-xtal: Fix boot hang due to incorrect test commit 0e11d256512c5166e03c9e9f221f9371bd42911e Merge: 16ecb41 fba7cd6 Author: Linus Torvalds Date: Sat Apr 23 11:39:48 2016 -0700 Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fixes from Ingo Molnar: "Misc fixes: pvqspinlocks: - an instrumentation fix futexes: - preempt-count vs pagefault_disable decouple corner case fix - futex requeue plist race window fix - futex UNLOCK_PI transaction fix for a corner case" * 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: asm-generic/futex: Re-enable preemption in futex_atomic_cmpxchg_inatomic() futex: Acknowledge a new waiter in counter before plist futex: Handle unlock_pi race gracefully locking/pvqspinlock: Fix division by zero in qstat_read() commit 16ecb414101353fd93773a47d39eac4b93af02e9 Merge: 6527efb 91951f9 Author: Linus Torvalds Date: Sat Apr 23 11:34:39 2016 -0700 Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Ingo Molnar: "A core irq affinity masks related fix and a MIPS irqchip driver fix" * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/mips-gic: Don't overrun pcpu_masks array genirq: Dont allow affinity mask to be updated on IPIs commit 6527efba38a06410f19670adba8a1951f8fe3d3c Merge: 68dc08b c2bb9e3 Author: Linus Torvalds Date: Sat Apr 23 11:25:01 2016 -0700 Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool fixes from Ingo Molnar: "A handful of objtool fixes: two improvements to how warnings are printed plus a false positive warning fix, and build environment fix" * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: objtool: Fix Makefile to properly see if libelf is supported objtool: Detect falling through to the next function objtool: Add workaround for GCC switch jump table bug commit 68dc08b5802f606b5b50dde558533b643b6d9526 Merge: 8e3ae37 d40d334 Author: Linus Torvalds Date: Sat Apr 23 11:20:03 2016 -0700 Merge tag 'usb-4.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / PHY driver fixes from Greg KH: "Here are two small sets of patches, both from subsystem trees, USB gadget and PHY drivers. Full details are in the shortlog, and they have all been in linux-next for a while (before I merged them to the USB tree)" * tag 'usb-4.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: gadget: f_fs: Fix use-after-free usb: dwc3: gadget: Fix suspend/resume during device mode usb: dwc3: fix memory leak of dwc->regset usb: dwc3: core: fix PHY handling during suspend usb: dwc3: omap: fix up error path on probe() usb: gadget: composite: Clear reserved fields of SSP Dev Cap phy: rockchip-emmc: adapt binding to specifiy register offset and length phy: rockchip-emmc: should be a child device of the GRF phy: rockchip-dp: should be a child device of the GRF commit 8e3ae37acca382b3050d6e8e413520d386e0d6ee Merge: f9d1e7f f077b73 Author: Linus Torvalds Date: Sat Apr 23 11:13:46 2016 -0700 Merge tag 'tty-4.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull serial fixes from Greg KH: "Here are 3 serial driver fixes for issues that have been reported. Two are reverts, fixing problems that were in the big TTY/Serial driver merge in 4.6-rc1, and the last one is a simple bugfix for a regression that showed up in 4.6-rc1 as well. All have been in linux-next with no reported issues" * tag 'tty-4.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: Revert "serial: 8250: Add hardware dependency to RT288X option" tty/serial/8250: fix RS485 half-duplex RX Revert "serial-uartlite: Constify uartlite_be/uartlite_le" commit f9d1e7f389b3724ee7d6dde7427b10806bc66577 Merge: 09502d9 dcc7597 Author: Linus Torvalds Date: Sat Apr 23 11:04:26 2016 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input subsystem fixes from Dmitry Torokhov: "Just minor driver fixes" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: twl4030-vibra - do not reparent to grandparent Input: twl6040-vibra - do not reparent to grandparent Input: twl6040-vibra - ignore return value of schedule_work Input: twl6040-vibra - fix NULL pointer dereference by removing workqueue Input: pmic8xxx-pwrkey - fix algorithm for converting trigger delay Input: arizona-haptic - don't assign input_dev parent Input: clarify we want BTN_TOOL_ on proximity Input: xpad - add Mad Catz FightStick TE 2 VID/PID Input: gtco - fix crash on detecting device without endpoints commit 75dd602a5198a6e5f75534db52b6e6fbaabb33d1 Author: Peter Zijlstra Date: Wed Mar 30 11:36:59 2016 +0200 lockdep: Fix lock_chain::base size lock_chain::base is used to store an index into the chain_hlocks[] array, however that array contains more elements than can be indexed using the u16. Change the lock_chain structure to use a bitfield to encode the data it needs and add BUILD_BUG_ON() assertions to check the fields are wide enough. Also, for DEBUG_LOCKDEP, assert that we don't run out of elements of that array; as that would wreck the collision detectoring. Signed-off-by: Peter Zijlstra (Intel) Cc: Alfredo Alvarez Fernandez Cc: Andrew Morton Cc: Linus Torvalds Cc: Paul E. McKenney Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Theodore Ts'o Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/20160330093659.GS3408@twins.programming.kicks-ass.net Signed-off-by: Ingo Molnar include/linux/lockdep.h | 8 +++++--- kernel/locking/lockdep.c | 24 +++++++++++++++++++++++- kernel/locking/lockdep_proc.c | 2 ++ 3 files changed, 30 insertions(+), 4 deletions(-) commit c24697566298df04cac9913e0601501b5ee2b3f5 Author: Boqun Feng Date: Tue Feb 16 13:57:40 2016 +0800 locking/lockdep: Fix ->irq_context calculation task_irq_context() returns the encoded irq_context of the task, the return value is encoded in the same as ->irq_context of held_lock. Always return 0 if !(CONFIG_TRACE_IRQFLAGS && CONFIG_PROVE_LOCKING) Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Cc: Andrew Morton Cc: Josh Triplett Cc: Lai Jiangshan Cc: Linus Torvalds Cc: Mathieu Desnoyers Cc: Paul E. McKenney Cc: Peter Zijlstra Cc: Steven Rostedt Cc: Thomas Gleixner Cc: sasha.levin@oracle.com Link: http://lkml.kernel.org/r/1455602265-16490-2-git-send-email-boqun.feng@gmail.com Signed-off-by: Ingo Molnar kernel/locking/lockdep.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) commit b303e7c15d53cd8ef6b349b702e07eee3f102792 Author: Peter Zijlstra Date: Mon Apr 4 09:57:40 2016 +0200 perf/core: Make sysctl_perf_cpu_time_max_percent conform to documentation Markus reported that 0 should also disable the throttling we per Documentation/sysctl/kernel.txt. Reported-by: Markus Trippelsdorf Signed-off-by: Peter Zijlstra (Intel) Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Fixes: 91a612eea9a3 ("perf/core: Fix dynamic interrupt throttle") Signed-off-by: Ingo Molnar kernel/events/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit e1089602a3bf3efd13d0ffc575f3e22213f009da Author: Srinivas Pandruvada Date: Sun Apr 17 08:43:29 2016 -0700 perf/x86/intel/rapl: Add missing Haswell model Added one missing Haswell model. Signed-off-by: Srinivas Pandruvada Signed-off-by: Peter Zijlstra (Intel) Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Cc: bp@alien8.de Cc: hpa@zytor.com Link: http://lkml.kernel.org/r/1460907809-11897-1-git-send-email-srinivas.pandruvada@linux.intel.com Signed-off-by: Ingo Molnar arch/x86/events/intel/rapl.c | 1 + 1 file changed, 1 insertion(+) commit b89c173788c3a8ed571652c203bf59a0e9d700aa Author: Andi Kleen Date: Fri Apr 15 13:25:33 2016 -0700 perf/x86/intel: Add model number for Skylake Server to perf Everything the same as base Skylake, just a new model number. Signed-off-by: Andi Kleen Signed-off-by: Peter Zijlstra (Intel) Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Link: http://lkml.kernel.org/r/1460751933-2264-1-git-send-email-andi@firstfloor.org Signed-off-by: Ingo Molnar arch/x86/events/intel/core.c | 1 + 1 file changed, 1 insertion(+) commit 707e59ba494372a90d245f18b0c78982caa88e48 Author: Ross Lagerwall Date: Fri Apr 22 13:05:31 2016 +0100 xen/qspinlock: Don't kick CPU if IRQ is not initialized The following commit: 1fb3a8b2cfb2 ("xen/spinlock: Fix locking path engaging too soon under PVHVM.") ... moved the initalization of the kicker interrupt until after native_cpu_up() is called. However, when using qspinlocks, a CPU may try to kick another CPU that is spinning (because it has not yet initialized its kicker interrupt), resulting in the following crash during boot: kernel BUG at /build/linux-Ay7j_C/linux-4.4.0/drivers/xen/events/events_base.c:1210! invalid opcode: 0000 [#1] SMP ... RIP: 0010:[] [] xen_send_IPI_one+0x59/0x60 ... Call Trace: [] xen_qlock_kick+0xe/0x10 [] __pv_queued_spin_unlock+0xb2/0xf0 [] ? __raw_callee_save___pv_queued_spin_unlock+0x11/0x20 [] ? check_tsc_warp+0x76/0x150 [] check_tsc_sync_source+0x96/0x160 [] native_cpu_up+0x3d8/0x9f0 [] xen_hvm_cpu_up+0x35/0x80 [] _cpu_up+0x13c/0x180 [] cpu_up+0x7a/0xa0 [] smp_init+0x7f/0x81 [] kernel_init_freeable+0xef/0x212 [] ? rest_init+0x80/0x80 [] kernel_init+0xe/0xe0 [] ret_from_fork+0x3f/0x70 [] ? rest_init+0x80/0x80 To fix this, only send the kick if the target CPU's interrupt has been initialized. This check isn't racy, because the target is waiting for the spinlock, so it won't have initialized the interrupt in the meantime. Signed-off-by: Ross Lagerwall Reviewed-by: Boris Ostrovsky Cc: David Vrabel Cc: Juergen Gross Cc: Konrad Rzeszutek Wilk Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-kernel@vger.kernel.org Cc: xen-devel@lists.xenproject.org Signed-off-by: Ingo Molnar arch/x86/xen/spinlock.c | 6 ++++++ 1 file changed, 6 insertions(+) commit f4e7de63ab273b6a5e35c82eb4fc6363c855ddd4 Author: Doug Ledford Date: Fri Apr 22 20:14:58 2016 -0400 IB/core: Fix oops in ib_cache_gid_set_default_gid When we fail to find the default gid index, we can't continue processing in this routine or else we will pass a negative index to later routines resulting in invalid memory access attempts and a kernel oops. Fixes: 03db3a2d81e6 (IB/core: Add RoCE GID table management) Signed-off-by: Doug Ledford drivers/infiniband/core/cache.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit e6d939bfd43271d7ab0b411d830ab62d835d8536 Merge: 22c49e5 fc26fe9 Author: Kevin Hilman Date: Fri Apr 22 16:55:05 2016 -0700 Merge tag 'imx-fixes-4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into fixes Merge "ARM: i.MX fixes for 4.6" from Shawn Guo: The i.MX fixes for 4.6: - The sdhci-esdhc-imx DMA support is broken due to commit 7b91369b4655 ("mmc: sdhci: Set DMA mask when adding host"). It requires device's dma_mask be set up properly to get DMA work. The fixing patch initializes the DMA mask to enable the access again. * tag 'imx-fixes-4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: ARM: mach-imx: sdhci-esdhc-imx: initialize DMA mask commit 22c49e5a09ec6af0c2355503b880a4083facdcf2 Merge: c95e2e7 1560d15 Author: Kevin Hilman Date: Fri Apr 22 16:52:55 2016 -0700 Merge tag 'omap-for-v4.6/fixes-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes Merge "omap fixes for v4.6-rc cycle" from Tony Lindgren: Fixes for omaps for v4.6-rc cycle: - Clockdomain fix for dra7 timer interrupts - Two fixes for GPMC EDMA binding, I missed the need for a merge with GPMC changes and EDMA changes - Fix beagle-x15 eSATA by dropping misconfigured extcon_usb1 - Fix occasional external aborts on 36xx with PM that we've been chasing for past few months. It turned out to be duplicate restore of INTC registers that can in some cases cause us to hit erratum 1.106. * tag 'omap-for-v4.6/fixes-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: OMAP3: Fix external abort on 36xx waking from off mode idle ARM: dts: am57xx-beagle-x15: remove extcon_usb1 ARM: dts: am437x: Fix GPMC dma properties ARM: dts: am33xx: Fix GPMC dma properties ARM: DRA7: clockdomain: Implement timer workaround for errata i874 commit 09502d9fffd84d22dd1fba9fd4cf0d880a5da377 Merge: ddce192 56b367c Author: Linus Torvalds Date: Fri Apr 22 11:52:49 2016 -0700 Merge tag 'pinctrl-v4.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: "Some pin control driver fixes came in. One headed for stable and the other two are just ordinary merge window fixes. - Make the i.MX driver select REGMAP as a dependency - Fix up the Mediatek debounce time unit - Fix a real hairy ffs vs __ffs issue in the Single pinctrl driver" * tag 'pinctrl-v4.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: single: Fix pcs_parse_bits_in_pinctrl_entry to use __ffs than ffs pinctrl: mediatek: correct debounce time unit in mtk_gpio_set_debounce pinctrl: imx: Kconfig: PINCTRL_IMX select REGMAP commit 630ba0cc7a6dbafbdee43795617c872b35cde1b4 Author: Laszlo Ersek Date: Thu Apr 21 18:21:11 2016 +0200 efi: Fix out-of-bounds read in variable_matches() The variable_matches() function can currently read "var_name[len]", for example when: - var_name[0] == 'a', - len == 1 - match_name points to the NUL-terminated string "ab". This function is supposed to accept "var_name" inputs that are not NUL-terminated (hence the "len" parameter"). Document the function, and access "var_name[*match]" only if "*match" is smaller than "len". Reported-by: Chris Wilson Signed-off-by: Laszlo Ersek Cc: Peter Jones Cc: Matthew Garrett Cc: Jason Andryuk Cc: Jani Nikula Cc: # v3.10+ Link: http://thread.gmane.org/gmane.comp.freedesktop.xorg.drivers.intel/86906 Signed-off-by: Matt Fleming drivers/firmware/efi/vars.c | 37 ++++++++++++++++++++++++++----------- 1 file changed, 26 insertions(+), 11 deletions(-) commit ddce192106e4f984123884f8e878f66ace94b573 Merge: ff06162 882416c Author: Linus Torvalds Date: Fri Apr 22 11:11:15 2016 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - Cache invalidation fix for early CPU boot status update (incorrect cacheline) - of_put_node() missing in the spin_table code - EL1/El2 early init inconsistency when Virtualisation Host Extensions are present - RCU warning fix in the arm_pmu.c driver * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: Fix EL1/EL2 early init inconsistencies with VHE drivers/perf: arm-pmu: fix RCU usage on pmu resume from low-power arm64: spin-table: add missing of_node_put() arm64: fix invalidation of wrong __early_cpu_boot_status cacheline commit ff061624e1afad3b556fcc8df23898014b47bc7e Merge: 7c5047a 4705e02 Author: Linus Torvalds Date: Fri Apr 22 10:53:12 2016 -0700 Merge tag 'powerpc-4.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "Three powerpc cpu feature fixes from Anton Blanchard: - scan_features() updated incorrect bits for REAL_LE - update cpu_user_features2 in scan_features() - update TM user feature bits in scan_features()" * tag 'powerpc-4.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc: Update TM user feature bits in scan_features() powerpc: Update cpu_user_features2 in scan_features() powerpc: scan_features() updates incorrect bits for REAL_LE commit 7c5047a124cbfd7be0648c1cf41f802cf7e6918d Merge: d61fb48 9800699 Author: Linus Torvalds Date: Fri Apr 22 10:41:31 2016 -0700 Merge tag 'iommu-fixes-v4.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull IOMMU fixes from Joerg Roedel: "The fixes include: - Two patches to revert the use of default domains in the ARM SMMU driver. Enabling this caused regressions which need more thorough fixing. So the regressions are fixed for now by disabling the use of default domains. - A fix for a v4.4 regression in the AMD IOMMU driver which broke devices behind invisible PCIe-to-PCI bridges with IOMMU enabled" * tag 'iommu-fixes-v4.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/arm-smmu: Don't allocate resources for bypass domains iommu/arm-smmu: Fix stream-match conflict with IOMMU_DOMAIN_DMA iommu/amd: Fix checking of pci dma aliases commit d61fb48b2f81979195ed04bc555a4d859995a554 Merge: d4b0528 18cdfe751 Author: Linus Torvalds Date: Fri Apr 22 10:29:52 2016 -0700 Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux Pull drm fixes from Dave Airlie: "i915, nouveau and amdgpu/radeon fixes in this: nouveau: Two fixes, one for a regression with dithering and one for a bug hit by the userspace drivers. i915: A few fixes, mostly things heading for stable, two important skylake GT3/4 hangs. radeon/amdgpu: Some audio, suspend/resume and some runtime PM fixes, along with two patches to harden the userptr ABI a bit" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (24 commits) drm: Loongson-3 doesn't fully support wc memory drm/nouveau/gr/gf100: select a stream master to fixup tfb offset queries amdgpu/uvd: add uvd fw version for amdgpu drm/amdgpu: forbid mapping of userptr bo through radeon device file drm/radeon: forbid mapping of userptr bo through radeon device file drm/amdgpu: bump the afmt limit for CZ, ST, Polaris drm/amdgpu: use defines for CRTCs and AMFT blocks drm/dp/mst: Validate port in drm_dp_payload_send_msg() drm/nouveau/kms: fix setting of default values for dithering properties drm/radeon: print a message if ATPX dGPU power control is missing Revert "drm/radeon: disable runtime pm on PX laptops without dGPU power control" drm/amdgpu/acp: fix resume on CZ systems with AZ audio drm/radeon: add a quirk for a XFX R9 270X drm/radeon: print pci revision as well as pci ids on driver load drm/i915: Use fw_domains_put_with_fifo() on HSW drm/i915: Force ringbuffers to not be at offset 0 drm/i915: Adjust size of PIPE_CONTROL used for gen8 render seqno write drm/i915/skl: Fix spurious gpu hang with gt3/gt4 revs drm/i915/skl: Fix rc6 based gpu/system hang drm/i915/userptr: Hold mmref whilst calling get-user-pages ... commit d4b05288271040217c46440a1dc246357ac301d2 Merge: 5f44abd 3194ed4 Author: Linus Torvalds Date: Fri Apr 22 10:17:18 2016 -0700 Merge tag 'sound-4.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Again a relatively calm week without surprise: most of fixes are about HD-audio, including fixes for Cirrus codec regression and a race over regmap access. Although both change are slightly unintuitive, the risk of further breakage is quite low, I hope. Other than that, all the rest are trivial" * tag 'sound-4.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda - Fix possible race on regmap bypass flip ALSA: pcxhr: Fix missing mutex unlock ALSA: hda - add PCI ID for Intel Broxton-T ALSA: hda - Keep powering up ADCs on Cirrus codecs ALSA: hda/realtek - Add ALC3234 headset mode for Optiplex 9020m ALSA - hda: hdmi check NULL pointer in hdmi_set_chmap ALSA: hda - Don't trust the reported actual power state commit c95e2e7eddfa571dccc8cfe645c790ff7fb7e2e0 Merge: c0e3091 c531fb2 Author: Kevin Hilman Date: Fri Apr 22 09:58:48 2016 -0700 Merge tag 'renesas-fixes-for-v4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into fixes Merge "Renesas ARM Based SoC Fixes for v4.6" from Simon Horman: Renesas ARM Based SoC Fixes for v4.6 * Correct preset_lpj calculation which may lead to too short delays * Correct handling of optional clocks on r8a7791 to restore access to the serial port the porter board * tag 'renesas-fixes-for-v4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas: ARM: shmobile: timer: Fix preset_lpj leading to too short delays Revert "ARM: dts: porter: Enable SCIF_CLK frequency and pins" ARM: dts: r8a7791: Don't disable referenced optional clocks commit c0e309138be2e4ba1551dde76f7fa2479cd9198d Merge: 2193a3f 3d51ae1 Author: Kevin Hilman Date: Fri Apr 22 09:45:53 2016 -0700 Merge tag 'omap-for-v4.6/fixes-rc2-v2-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes Merge "omap fixes against v4.6-rc2" from Tony Lindgren Fixes for omaps against v4.6-rc2, mostly to fix suspend for beagle-x15 that broke when we added runtime based SoC revision detection earlier. It seems suspend worked earlier as things were only partially initialized, while now we initialize things properly for dra7. Note that the "ARM: OMAP: Catch callers of revision information prior to it being populated" had to be reverted as it caused bogus warnings for other SoCs because omap initcalls bail out based on revision being set to 0 for other SoCs. These initcalls will mostly just disappear when we drop support for omap3 legacy booting. Also included is a fix for dra7 sys_32k_ck clock source that is not enabled on boot making system fall back to using emulated clock. * tag 'omap-for-v4.6/fixes-rc2-v2-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: (198 commits) Revert "ARM: OMAP: Catch callers of revision information prior to it being populated" ARM: OMAP: Catch callers of revision information prior to it being populated ARM: dts: dra7: Correct clock tree for sys_32k_ck ARM: OMAP: DRA7: Provide proper class to omap2_set_globals_tap ARM: OMAP: DRA7: wakeupgen: Skip SAR save for wakeupgen Linux 4.6-rc2 v4l2-mc: avoid warning about unused variable Convert straggling drivers to new six-argument get_user_pages() .mailmap: add Christophe Ricard Make CONFIG_FHANDLE default y mm/page_isolation.c: fix the function comments oom, oom_reaper: do not enqueue task if it is on the oom_reaper_list head mm/page_isolation: fix tracepoint to mirror check function behavior mm/rmap: batched invalidations should use existing api x86/mm: TLB_REMOTE_SEND_IPI should count pages mm: fix invalid node in alloc_migrate_target() include/linux/huge_mm.h: return NULL instead of false for pmd_trans_huge_lock() mm, kasan: fix compilation for CONFIG_SLAB MAINTAINERS: orangefs mailing list is subscribers-only net: mvneta: fix changing MTU when using per-cpu processing ... commit 10ff4c5239a137abfc896ec73ef3d15a0f86a16a Author: Javier Martinez Canillas Date: Sat Apr 16 21:14:52 2016 -0400 i2c: exynos5: Fix possible ABBA deadlock by keeping I2C clock prepared The exynos5 I2C controller driver always prepares and enables a clock before using it and then disables unprepares it when the clock is not used anymore. But this can cause a possible ABBA deadlock in some scenarios since a driver that uses regmap to access its I2C registers, will first grab the regmap lock and then the I2C xfer function will grab the prepare lock when preparing the I2C clock. But since the clock driver also uses regmap for I2C accesses, preparing a clock will first grab the prepare lock and then the regmap lock when using the regmap API. An example of this happens on the Exynos5422 Odroid XU4 board where a s2mps11 PMIC is used and both the s2mps11 regulators and clk drivers share the same I2C regmap. The possible deadlock is reported by the kernel lockdep: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(sec_core:428:(regmap)->lock); lock(prepare_lock); lock(sec_core:428:(regmap)->lock); lock(prepare_lock); *** DEADLOCK *** Fix it by leaving the code prepared on probe and use {en,dis}able in the I2C transfer function. This patch is similar to commit 34e81ad5f0b6 ("i2c: s3c2410: fix ABBA deadlock by keeping clock prepared") that fixes the same bug in other driver for an I2C controller found in Samsung SoCs. Reported-by: Anand Moon Signed-off-by: Javier Martinez Canillas Reviewed-by: Anand Moon Reviewed-by: Krzysztof Kozlowski Signed-off-by: Wolfram Sang Cc: stable@kernel.org drivers/i2c/busses/i2c-exynos5.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) commit 609d5a1b2b35bb62b4b3750396e55453160c2a17 Author: Michael Ellerman Date: Wed Apr 13 13:59:14 2016 +1000 i2c: cpm: Fix build break due to incompatible pointer types Since commit ea8daa7b9784 ("kbuild: Add option to turn incompatible pointer check into error"), assignments from an incompatible pointer types have become a hard error, eg: drivers/i2c/busses/i2c-cpm.c:545:91: error: passing argument 3 of 'dma_alloc_coherent' from incompatible pointer type Fix the build break by converting txdma & rxdma to dma_addr_t. Signed-off-by: Michael Ellerman Signed-off-by: Wolfram Sang Cc: stable@kernel.org Fixes: ea8daa7b9784 drivers/i2c/busses/i2c-cpm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d9676fa152c83b82137af950b1d4f629045d90c9 Author: Evgeny Voevodin Date: Wed Mar 23 12:26:52 2016 +0300 ARCv2: Enable LOCKDEP - The asm helpers for calling into irq tracer were missing - Add calls to above helpers in low level assembly entry code for ARCv2 - irq_save() uses CLRI to disable interrupts and returns the prev interrupt state (in STATUS32) in a specific encoding (and not the raw value of STATUS32). This is usable with SETI in irq_restore(). However save_flags() reads the raw value of STATUS32 which doesn't pair with irq_save/restore() and thus needs fixing. Signed-off-by: Evgeny Voevodin [vgupta: updated changelog and also added some comments] Signed-off-by: Vineet Gupta arch/arc/include/asm/irqflags-arcv2.h | 36 ++++++++++++++++++++++++++++++++++- arch/arc/kernel/entry-arcv2.S | 10 +++++++++- arch/arc/kernel/entry-compact.S | 3 +++ 3 files changed, 47 insertions(+), 2 deletions(-) commit d40d334743776937132d3a0c5a203d245407e5a7 Merge: 5813dea 5128de8 Author: Greg Kroah-Hartman Date: Fri Apr 22 17:13:24 2016 +0900 Merge tag 'phy-for-4.6-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/kishon/linux-phy into usb-linus Kishon writes: phy: for 4.6-rc *) make rockchip-dp and rockchip-emmc PHY child device of GRF Signed-off-by: Kishon Vijay Abraham I commit ea5dfb5fae81939f777ca569d8cfb599252da2e8 Author: Tony Luck Date: Thu Apr 14 10:22:02 2016 -0700 x86 EDAC, sb_edac.c: Take account of channel hashing when needed Haswell and Broadwell can be configured to hash the channel interleave function using bits [27:12] of the physical address. On those processor models we must check to see if hashing is enabled (bit21 of the HASWELL_HASYSDEFEATURE2 register) and act accordingly. Based on a patch by patrickg Tested-by: Patrick Geary Signed-off-by: Tony Luck Acked-by: Mauro Carvalho Chehab Cc: Aristeu Rozanski Cc: Borislav Petkov Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-edac@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Ingo Molnar drivers/edac/sb_edac.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) commit ff15e95c82768d589957dbb17d7eb7dba7904659 Author: Tony Luck Date: Thu Apr 14 10:21:52 2016 -0700 x86 EDAC, sb_edac.c: Repair damage introduced when "fixing" channel address In commit: eb1af3b71f9d ("Fix computation of channel address") I switched the "sck_way" variable from holding the log2 value read from the h/w to instead be the actual number. Unfortunately it is needed in log2 form when used to shift the address. Tested-by: Patrick Geary Signed-off-by: Tony Luck Acked-by: Mauro Carvalho Chehab Cc: Aristeu Rozanski Cc: Borislav Petkov Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-edac@vger.kernel.org Cc: stable@vger.kernel.org Fixes: eb1af3b71f9d ("Fix computation of channel address") Signed-off-by: Ingo Molnar drivers/edac/sb_edac.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 5813dea9f33fff0420eab6b5892e5698094f838f Merge: c3b46c7 38740a5 Author: Greg Kroah-Hartman Date: Fri Apr 22 17:09:05 2016 +0900 Merge tag 'fixes-for-v4.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus Felipe writes: usb: fixes for v4.6-rc5 No more major fixes left. Out of the 6 fixes we have here, 4 are on dwc3. The most important is the memory leak fix in dwc3/debugfs.c. We also have a fix for PHY handling in suspend/resume and a fix for dwc3-omap's error handling. Suspend/resume also had the potential to trigger a NULL pointer dereference on dwc3; that's also fixed now. Our good ol' ffs function gets a use-after-free fix while the generic composite.c layer has a robustness fix by making sure reserved fields of a possible SSP device capability descriptor is cleared to 0. commit 103f6112f253017d7062cd74d17f4a514ed4485c Author: Jan Beulich Date: Thu Apr 21 00:27:04 2016 -0600 x86/mm/xen: Suppress hugetlbfs in PV guests Huge pages are not normally available to PV guests. Not suppressing hugetlbfs use results in an endless loop of page faults when user mode code tries to access a hugetlbfs mapped area (since the hypervisor denies such PTEs to be created, but error indications can't be propagated out of xen_set_pte_at(), just like for various of its siblings), and - once killed in an oops like this: kernel BUG at .../fs/hugetlbfs/inode.c:428! invalid opcode: 0000 [#1] SMP ... RIP: e030:[] [] remove_inode_hugepages+0x25b/0x320 ... Call Trace: [] hugetlbfs_evict_inode+0x15/0x40 [] evict+0xbd/0x1b0 [] __dentry_kill+0x19a/0x1f0 [] dput+0x1fe/0x220 [] __fput+0x155/0x200 [] task_work_run+0x60/0xa0 [] do_exit+0x160/0x400 [] do_group_exit+0x3b/0xa0 [] get_signal+0x1ed/0x470 [] do_signal+0x14/0x110 [] prepare_exit_to_usermode+0xe9/0xf0 [] retint_user+0x8/0x13 This is CVE-2016-3961 / XSA-174. Reported-by: Vitaly Kuznetsov Signed-off-by: Jan Beulich Cc: Andrew Morton Cc: Andy Lutomirski Cc: Boris Ostrovsky Cc: Borislav Petkov Cc: Brian Gerst Cc: David Vrabel Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Juergen Gross Cc: Linus Torvalds Cc: Luis R. Rodriguez Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Toshi Kani Cc: stable@vger.kernel.org Cc: xen-devel Link: http://lkml.kernel.org/r/57188ED802000078000E431C@prv-mh.provo.novell.com Signed-off-by: Ingo Molnar arch/x86/include/asm/hugetlb.h | 1 + 1 file changed, 1 insertion(+) commit 78b0634d2851d30ec5d289aefbae23b141de67f0 Author: Juergen Gross Date: Fri Apr 22 09:35:04 2016 +0200 x86/doc: Correct limits in Documentation/x86/x86_64/mm.txt Correct the size of the module mapping space and the maximum available physical memory size of current processors. Signed-off-by: Juergen Gross Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: corbet@lwn.net Cc: linux-doc@vger.kernel.org Link: http://lkml.kernel.org/r/1461310504-15977-1-git-send-email-jgross@suse.com Signed-off-by: Ingo Molnar Documentation/x86/x86_64/mm.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 3b9d6da67e11ca8f78fde887918983523a36b0fa Author: Sebastian Andrzej Siewior Date: Fri Apr 8 14:40:15 2016 +0200 cpu/hotplug: Fix rollback during error-out in __cpu_disable() The recent introduction of the hotplug thread which invokes the callbacks on the plugged cpu, cased the following regression: If takedown_cpu() fails, then we run into several issues: 1) The rollback of the target cpu states is not invoked. That leaves the smp threads and the hotplug thread in disabled state. 2) notify_online() is executed due to a missing skip_onerr flag. That causes that both CPU_DOWN_FAILED and CPU_ONLINE notifications are invoked which confuses quite some notifiers. 3) The CPU_DOWN_FAILED notification is not invoked on the target CPU. That's not an issue per se, but it is inconsistent and in consequence blocks the patches which rely on these states being invoked on the target CPU and not on the controlling cpu. It also does not preserve the strict call order on rollback which is problematic for the ongoing state machine conversion as well. To fix this we add a rollback flag to the remote callback machinery and invoke the rollback including the CPU_DOWN_FAILED notification on the remote cpu. Further mark the notify online state with 'skip_onerr' so we don't get a double invokation. This workaround will go away once we moved the unplug invocation to the target cpu itself. [ tglx: Massaged changelog and moved the CPU_DOWN_FAILED notifiaction to the target cpu ] Fixes: 4cb28ced23c4 ("cpu/hotplug: Create hotplug threads") Reported-by: Heiko Carstens Signed-off-by: Sebastian Andrzej Siewior Cc: linux-s390@vger.kernel.org Cc: rt@linutronix.de Cc: Martin Schwidefsky Cc: Anna-Maria Gleixner Link: http://lkml.kernel.org/r/20160408124015.GA21960@linutronix.de Signed-off-by: Thomas Gleixner kernel/cpu.c | 33 ++++++++++++++++++++++++++------- 1 file changed, 26 insertions(+), 7 deletions(-) commit 16eeed7e5558a3dcf30f75526a896b2632f299f9 Author: Daniel Lezcano Date: Tue Apr 19 15:43:02 2016 +0200 clocksource/drivers/tango-xtal: Fix boot hang due to incorrect test Commit 0881841f7e78 introduced a regression by inverting a test check after calling clocksource_mmio_init(). That results on the system to hang at boot time. Fix it by inverting the test again. Fixes: 0881841f7e78 ("Replace code by clocksource_mmio_init") Reported-by: Marc Gonzalez Signed-off-by: Daniel Lezcano drivers/clocksource/tango_xtal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c2bb9e32e2315971a8535fee77335c04a739d71d Author: Steven Rostedt Date: Wed Apr 20 11:32:35 2016 -0400 objtool: Fix Makefile to properly see if libelf is supported When doing a make allmodconfig, I hit the following compile error: In file included from builtin-check.c:32:0: elf.h:22:18: fatal error: gelf.h: No such file or directory compilation terminated. ... Digging into it, it appears that the $(shell ..) command in the Makefile does not give the proper result when it fails to find -lelf, and continues to compile objtool. Instead, use the "try-run" makefile macro to perform the test. This gives a proper result for both cases. Signed-off-by: Steven Rostedt Acked-by: Josh Poimboeuf Cc: Andrew Morton Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Bernd Petrovitsch Cc: Borislav Petkov Cc: Chris J Arges Cc: Jiri Slaby Cc: Linus Torvalds Cc: Michal Marek Cc: Namhyung Kim Cc: Pedro Alves Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: live-patching@vger.kernel.org Fixes: 442f04c34a1a4 ("objtool: Add tool to perform compile-time stack metadata validation") Link: http://lkml.kernel.org/r/20160420153234.GA24032@home.goodmis.org Signed-off-by: Ingo Molnar Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 18cdfe751f26ffa610f2a7b59775c5cc4c1c9619 Merge: 221004c 562e268 Author: Dave Airlie Date: Fri Apr 22 10:39:26 2016 +1000 Merge branch 'drm-fixes-4.6' of git://people.freedesktop.org/~agd5f/linux into drm-fixes Misc radeon and amdgpu bug fixes for 4.6. * 'drm-fixes-4.6' of git://people.freedesktop.org/~agd5f/linux: amdgpu/uvd: add uvd fw version for amdgpu drm/amdgpu: forbid mapping of userptr bo through radeon device file drm/radeon: forbid mapping of userptr bo through radeon device file drm/amdgpu: bump the afmt limit for CZ, ST, Polaris drm/amdgpu: use defines for CRTCs and AMFT blocks drm/radeon: print a message if ATPX dGPU power control is missing Revert "drm/radeon: disable runtime pm on PX laptops without dGPU power control" drm/amdgpu/acp: fix resume on CZ systems with AZ audio drm/radeon: add a quirk for a XFX R9 270X drm/radeon: print pci revision as well as pci ids on driver load drm/amdgpu: when suspending, if uvd/vce was running. need to cancel delay work. drm/radeon: fix initial connector audio value commit 221004c66a58949a0f25c937a6789c0839feb530 Author: Huacai Chen Date: Tue Apr 19 19:19:11 2016 +0800 drm: Loongson-3 doesn't fully support wc memory Signed-off-by: Huacai Chen Cc: stable@vger.kernel.org Reviewed-by: Alex Deucher Signed-off-by: Dave Airlie include/drm/drm_cache.h | 2 ++ 1 file changed, 2 insertions(+) commit 005e8dad01d2a7b98948927d7e0c4c7c61ec2d69 Merge: deba0a2 28dca90 Author: Dave Airlie Date: Fri Apr 22 10:09:33 2016 +1000 Merge branch 'linux-4.6' of git://github.com/skeggsb/linux into drm-fixes transform feedback fix. * 'linux-4.6' of git://github.com/skeggsb/linux: drm/nouveau/gr/gf100: select a stream master to fixup tfb offset queries commit 28dca90533750c7e31e8641c3df426bad9c12941 Author: Ben Skeggs Date: Fri Apr 22 10:05:21 2016 +1000 drm/nouveau/gr/gf100: select a stream master to fixup tfb offset queries Signed-off-by: Ben Skeggs Cc: stable@vger.kernel.org drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 2 ++ 1 file changed, 2 insertions(+) commit 562e2689baebaa2ac25b7ec934385480ed1cb7d6 Author: Sonny Jiang Date: Mon Apr 18 16:05:04 2016 -0400 amdgpu/uvd: add uvd fw version for amdgpu Was previously always hardcoded to 0. Signed-off-by: Sonny Jiang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 3 +++ 3 files changed, 5 insertions(+), 1 deletion(-) commit 054892ed6a1645e265bc35641c2a96433a051453 Author: Jérôme Glisse Date: Tue Apr 19 09:07:51 2016 -0400 drm/amdgpu: forbid mapping of userptr bo through radeon device file Allowing userptr bo which are basicly a list of page from some vma (so either anonymous page or file backed page) would lead to serious corruption of kernel structures and counters (because we overwrite the page->mapping field when mapping buffer). This will already block if the buffer was populated before anyone does try to mmap it because then TTM_PAGE_FLAG_SG would be set in in the ttm_tt flags. But that flag is check before ttm_tt_populate in the ttm vm fault handler. So to be safe just add a check to verify_access() callback. Reviewed-by: Christian König Signed-off-by: Jérôme Glisse Cc: Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 2 ++ 1 file changed, 2 insertions(+) commit b5dcec693f87cb8475f2291c0075b2422addd3d6 Author: Jérôme Glisse Date: Tue Apr 19 09:07:50 2016 -0400 drm/radeon: forbid mapping of userptr bo through radeon device file Allowing userptr bo which are basicly a list of page from some vma (so either anonymous page or file backed page) would lead to serious corruption of kernel structures and counters (because we overwrite the page->mapping field when mapping buffer). This will already block if the buffer was populated before anyone does try to mmap it because then TTM_PAGE_FLAG_SG would be set in in the ttm_tt flags. But that flag is check before ttm_tt_populate in the ttm vm fault handler. So to be safe just add a check to verify_access() callback. Reviewed-by: Christian König Signed-off-by: Jérôme Glisse Cc: Signed-off-by: Alex Deucher drivers/gpu/drm/radeon/radeon_ttm.c | 2 ++ 1 file changed, 2 insertions(+) commit 83c5cda2ccf40a7a7e4bb674321509b346e23d5a Author: Alex Deucher Date: Mon Apr 18 18:25:34 2016 -0400 drm/amdgpu: bump the afmt limit for CZ, ST, Polaris Fixes array overflow on these chips. Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3ea25f858fd5aeee888059952bbb8e910541eebb Author: Alex Deucher Date: Mon Apr 18 18:09:57 2016 -0400 drm/amdgpu: use defines for CRTCs and AMFT blocks Prerequiste for the next patch which ups the limits. Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit deba0a2af9592b2022a0bce7b085a318b53ce1db Author: cpaul@redhat.com Date: Mon Apr 4 19:58:47 2016 -0400 drm/dp/mst: Validate port in drm_dp_payload_send_msg() With the joys of things running concurrently, there's always a chance that the port we get passed in drm_dp_payload_send_msg() isn't actually valid anymore. Because of this, we need to make sure we validate the reference to the port before we use it otherwise we risk running into various race conditions. For instance, on the Dell MST monitor I have here for testing, hotplugging it enough times causes us to kernel panic: [drm:intel_mst_enable_dp] 1 [drm:drm_dp_update_payload_part2] payload 0 1 [drm:intel_get_hpd_pins] hotplug event received, stat 0x00200000, dig 0x10101011, pins 0x00000020 [drm:intel_hpd_irq_handler] digital hpd port B - short [drm:intel_dp_hpd_pulse] got hpd irq on port B - short [drm:intel_dp_check_mst_status] got esi 00 10 00 [drm:drm_dp_update_payload_part2] payload 1 1 general protection fault: 0000 [#1] SMP … Call Trace: [] drm_dp_update_payload_part2+0xc2/0x130 [drm_kms_helper] [] intel_mst_enable_dp+0xf8/0x180 [i915] [] haswell_crtc_enable+0x3ed/0x8c0 [i915] [] intel_atomic_commit+0x5ad/0x1590 [i915] [] ? drm_atomic_set_crtc_for_connector+0x57/0xe0 [drm] [] drm_atomic_commit+0x37/0x60 [drm] [] drm_atomic_helper_set_config+0x7a/0xb0 [drm_kms_helper] [] drm_mode_set_config_internal+0x62/0x100 [drm] [] drm_mode_setcrtc+0x3cd/0x4e0 [drm] [] drm_ioctl+0x143/0x510 [drm] [] ? drm_mode_setplane+0x1b0/0x1b0 [drm] [] ? hrtimer_start_range_ns+0x1b7/0x3a0 [] do_vfs_ioctl+0x92/0x570 [] ? __sys_recvmsg+0x42/0x80 [] SyS_ioctl+0x79/0x90 [] entry_SYSCALL_64_fastpath+0x1a/0xa4 RIP [] drm_dp_payload_send_msg+0x146/0x1f0 [drm_kms_helper] Which occurs because of the hotplug event shown in the log, which ends up causing DRM's dp helpers to drop the port we're updating the payload on and panic. CC: stable@vger.kernel.org Signed-off-by: Lyude Reviewed-by: David Airlie Signed-off-by: Dave Airlie drivers/gpu/drm/drm_dp_mst_topology.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 3addc4e3a7142fcb9782c1d8ab70c63ebbd6d803 Merge: 762ce44 38bdcfc Author: Dave Airlie Date: Fri Apr 22 09:53:07 2016 +1000 Merge branch 'linux-4.6' of git://github.com/skeggsb/linux into drm-fixes Single nouveau regression fix * 'linux-4.6' of git://github.com/skeggsb/linux: drm/nouveau/kms: fix setting of default values for dithering properties commit 38bdcfc1fc734a91fd982fe32290f3f70612bf33 Author: Ben Skeggs Date: Fri Apr 22 09:09:41 2016 +1000 drm/nouveau/kms: fix setting of default values for dithering properties Signed-off-by: Ben Skeggs drivers/gpu/drm/nouveau/nouveau_connector.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 762ce4458974534a2407cc924db05840c89105df Merge: 5f44abd 31318a9 Author: Dave Airlie Date: Fri Apr 22 09:09:11 2016 +1000 Merge tag 'drm-intel-fixes-2016-04-21' of git://anongit.freedesktop.org/drm-intel into drm-fixes Hi Dave, fixes all around, all but one are cc: stable material, the most important ones are likely the Skylake hang fixes from Mika. * tag 'drm-intel-fixes-2016-04-21' of git://anongit.freedesktop.org/drm-intel: drm/i915: Use fw_domains_put_with_fifo() on HSW drm/i915: Force ringbuffers to not be at offset 0 drm/i915: Adjust size of PIPE_CONTROL used for gen8 render seqno write drm/i915/skl: Fix spurious gpu hang with gt3/gt4 revs drm/i915/skl: Fix rc6 based gpu/system hang drm/i915/userptr: Hold mmref whilst calling get-user-pages drm/i915: Fixup the free space logic in ring_prepare drm/i915/skl+: Use plane size for relative data rate calculation commit 5f44abd041c5f3be76d57579ab254d78e601315b Merge: f78fe08 38a7a73 Author: Linus Torvalds Date: Thu Apr 21 15:41:13 2016 -0700 Merge tag 'rtc-4.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC fixes from Alexandre Belloni: "A few fixes for the RTC subsystem. The documentation fix already missed 4.5 so I think it is worth taking it now: A documentation fix for s3c and two fixes for the ds1307" * tag 'rtc-4.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: rtc: ds1307: Use irq when available for wakeup-source device rtc: ds1307: ds3231 temperature s16 overflow rtc: s3c: Document in binding that only s3c6410 needs a src clk commit f78fe0817a20b09d7830ec88869ed83c3d205a40 Merge: c5edde3 395da12 Author: Linus Torvalds Date: Thu Apr 21 14:29:34 2016 -0700 Merge tag 'pm+acpi-4.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "Two fixes for issues introduced recently, one for an intel_pstate driver problem uncovered by the recent switch over from using timers and the other one for a potential cpufreq core problem related to system suspend/resume. Specifics: - Fix an intel_pstate driver problem causing CPUs to get stuck in the highest P-state when completely idle uncovered by the recent switch over from using timers (Rafael Wysocki). - Avoid attempts to get the current CPU frequency when all devices (like I2C controllers that may be nedded for that purpose) have been suspended during system suspend/resume (Rafael Wysocki)" * tag 'pm+acpi-4.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: Abort cpufreq_update_current_freq() for cpufreq_suspended set intel_pstate: Avoid getting stuck in high P-states when idle commit 38a7a73e8ed0fa9e8cd99bb62463afbdcd23429b Author: Nishanth Menon Date: Tue Apr 19 11:23:54 2016 -0500 rtc: ds1307: Use irq when available for wakeup-source device With commit 8bc2a40730ec ("rtc: ds1307: add support for the DT property 'wakeup-source'") we lost the ability for rtc irq functionality for devices that are actually hooked on a real IRQ line and have capability to wakeup as well. This is not an expected behavior. So, instead of just not requesting IRQ, skip the IRQ requirement only if interrupts are not defined for the device. Fixes: 8bc2a40730ec ("rtc: ds1307: add support for the DT property 'wakeup-source'") Reported-by: Tony Lindgren Cc: Michael Lange Cc: Alexandre Belloni Signed-off-by: Nishanth Menon Signed-off-by: Alexandre Belloni drivers/rtc/rtc-ds1307.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9a3dce62cc5640d7ea17733a2bd1b57665c232b0 Author: Zhuang Yuyao Date: Mon Apr 18 09:21:42 2016 +0900 rtc: ds1307: ds3231 temperature s16 overflow while retrieving temperature from ds3231, the result may be overflow since s16 is too small for a multiplication with 250. ie. if temp_buf[0] == 0x2d, the result (s16 temp) will be negative. Signed-off-by: Akinobu Mita Tested-by: Michael Tatarinov Signed-off-by: Alexandre Belloni drivers/rtc/rtc-ds1307.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit c5b8b5beee1e2aadef0409dba555b7085d57910d Author: Khalid Aziz Date: Tue Apr 19 11:12:54 2016 -0600 sparc64: recognize and support Sonoma CPU type Add code to recognize SPARC-Sonoma cpu correctly and update cpu hardware caps and cpu distribution map. SPARC-Sonoma is based upon SPARC-M7 core along with additional PCI functions added on and is reported by firmware as "SPARC-SN". Signed-off-by: Khalid Aziz Acked-by: Allen Pais Signed-off-by: David S. Miller arch/sparc/include/asm/spitfire.h | 1 + arch/sparc/kernel/cpu.c | 6 ++++++ arch/sparc/kernel/cpumap.c | 1 + arch/sparc/kernel/head_64.S | 8 ++++++++ arch/sparc/kernel/setup_64.c | 7 ++++++- arch/sparc/mm/init_64.c | 3 +++ 6 files changed, 25 insertions(+), 1 deletion(-) commit 5bde2c9be701c4583f0a9243bd46590ec401bfba Author: Adrian Glaubitz Date: Thu Apr 14 20:14:42 2016 +0200 sparc: Implement and wire up vio_hotplug for vio. Signed-off-by: John Paul Adrian Glaubitz Acked-by: Sam Ravnborg Signed-off-by: David S. Miller arch/sparc/kernel/vio.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit 36128d204b81c099b5779771127a5546eac549c9 Author: Adrian Glaubitz Date: Thu Apr 14 20:14:41 2016 +0200 sparc: Implement and wire up modalias_show for vio. Signed-off-by: John Paul Adrian Glaubitz Acked-by: Sam Ravnborg Signed-off-by: David S. Miller arch/sparc/kernel/vio.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit 9a78d4fc28904785ffe4c2d361e25b251b479704 Author: Sowmini Varadhan Date: Mon Apr 11 17:57:05 2016 -0700 sparc/pci: Refactor dev_archdata initialization into pci_init_dev_archdata The function pcibios_add_device() added by commit d0c31e020057 ("sparc/PCI: Fix for panic while enabling SR-IOV") initializes the dev_archdata by doing a memcpy from the PF. This has the problem that it erroneously copies the OF device without explicitly refcounting it. As David Miller pointed out: "Generally speaking we don't really support hot-plug for OF probed devices, but if we did all of the device tree pointers have to be refcounted properly." To fix this error, and also avoid code duplication, this patch creates a new helper function, pci_init_dev_archdata(), that initializes the fields in dev_archdata, and can be invoked by callers after they have taken the needed refcounts Signed-off-by: Sowmini Varadhan Tested-by: Babu Moger Reviewed-by: Khalid Aziz Signed-off-by: David S. Miller arch/sparc/kernel/pci.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) commit a95f94bc98754bad32cb7f36c867d71f3f2be729 Author: Borislav Petkov Date: Wed Mar 30 13:42:47 2016 +0200 sparc/defconfigs: Remove CONFIG_IPV6_PRIVACY Option is long gone, see 5d9efa7ee99e ("ipv6: Remove privacy config option.") Signed-off-by: Borislav Petkov Cc: sparclinux@vger.kernel.org Signed-off-by: David S. Miller arch/sparc/configs/sparc32_defconfig | 1 - arch/sparc/configs/sparc64_defconfig | 1 - 2 files changed, 2 deletions(-) commit c5edde3a81149d29ceae4221f09f4c7bc2f70846 Merge: f862d66 b4f7052 Author: Linus Torvalds Date: Thu Apr 21 12:57:34 2016 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Fix memory leak in iwlwifi, from Matti Gottlieb. 2) Add missing registration of netfilter arp_tables into initial namespace, from Florian Westphal. 3) Fix potential NULL deref in DecNET routing code. 4) Restrict NETLINK_URELEASE to truly bound sockets only, from Dmitry Ivanov. 5) Fix dst ref counting in VRF, from David Ahern. 6) Fix TSO segmenting limits in i40e driver, from Alexander Duyck. 7) Fix heap leak in PACKET_DIAG_MCLIST, from Mathias Krause. 8) Ravalidate IPV6 datagram socket cached routes properly, particularly with UDP, from Martin KaFai Lau. 9) Fix endian bug in RDS dp_ack_seq handling, from Qing Huang. 10) Fix stats typing in bcmgenet driver, from Eric Dumazet. 11) Openvswitch needs to orphan SKBs before ipv6 fragmentation handing, from Joe Stringer. 12) SPI device reference leak in spi_ks8895 PHY driver, from Mark Brown. 13) atl2 doesn't actually support scatter-gather, so don't advertise the feature. From Ben Hucthings. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (72 commits) openvswitch: use flow protocol when recalculating ipv6 checksums Driver: Vmxnet3: set CHECKSUM_UNNECESSARY for IPv6 packets atl2: Disable unimplemented scatter/gather feature net/mlx4_en: Split SW RX dropped counter per RX ring net/mlx4_core: Don't allow to VF change global pause settings net/mlx4_core: Avoid repeated calls to pci enable/disable net/mlx4_core: Implement pci_resume callback net: phy: spi_ks8895: Don't leak references to SPI devices net: ethernet: davinci_emac: Fix platform_data overwrite net: ethernet: davinci_emac: Fix Unbalanced pm_runtime_enable qede: Fix single MTU sized packet from firmware GRO flow qede: Fix setting Skb network header qede: Fix various memory allocation error flows for fastpath tcp: Merge tx_flags and tskey in tcp_shifted_skb tcp: Merge tx_flags and tskey in tcp_collapse_retrans drivers: net: cpsw: fix wrong regs access in cpsw_ndo_open tcp: Fix SOF_TIMESTAMPING_TX_ACK when handling dup acks openvswitch: Orphan skbs before IPv6 defrag Revert "Prevent NUll pointer dereference with two PHYs on cpsw" VSOCK: Only check error on skb_recv_datagram when skb is NULL ... commit b4f70527f052b0c00be4d7cac562baa75b212df5 Author: Simon Horman Date: Thu Apr 21 11:49:15 2016 +1000 openvswitch: use flow protocol when recalculating ipv6 checksums When using masked actions the ipv6_proto field of an action to set IPv6 fields may be zero rather than the prevailing protocol which will result in skipping checksum recalculation. This patch resolves the problem by relying on the protocol in the flow key rather than that in the set field action. Fixes: 83d2b9ba1abc ("net: openvswitch: Support masked set actions.") Cc: Jarno Rajahalme Signed-off-by: Simon Horman Signed-off-by: David S. Miller net/openvswitch/actions.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f0d437809d23999cb25207cfbe80c61e5703fdc1 Author: Shrikrishna Khare Date: Wed Apr 20 18:12:29 2016 -0700 Driver: Vmxnet3: set CHECKSUM_UNNECESSARY for IPv6 packets For IPv6, if the device indicates that the checksum is correct, set CHECKSUM_UNNECESSARY. Reported-by: Subbarao Narahari Signed-off-by: Shrikrishna Khare Signed-off-by: Jin Heo Signed-off-by: David S. Miller drivers/net/vmxnet3/vmxnet3_drv.c | 12 ++++++++---- drivers/net/vmxnet3/vmxnet3_int.h | 4 ++-- 2 files changed, 10 insertions(+), 6 deletions(-) commit f43bfaeddc79effbf3d0fcb53ca477cca66f3db8 Author: Ben Hutchings Date: Wed Apr 20 23:23:08 2016 +0100 atl2: Disable unimplemented scatter/gather feature atl2 includes NETIF_F_SG in hw_features even though it has no support for non-linear skbs. This bug was originally harmless since the driver does not claim to implement checksum offload and that used to be a requirement for SG. Now that SG and checksum offload are independent features, if you explicitly enable SG *and* use one of the rare protocols that can use SG without checkusm offload, this potentially leaks sensitive information (before you notice that it just isn't working). Therefore this obscure bug has been designated CVE-2016-2117. Reported-by: Justin Yackoski Signed-off-by: Ben Hutchings Fixes: ec5f06156423 ("net: Kill link between CSUM and SG features.") Signed-off-by: David S. Miller drivers/net/ethernet/atheros/atlx/atl2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 91951f980e521d8f7e92283735b99fb9f4b05d93 Author: Paul Burton Date: Thu Apr 21 11:31:54 2016 +0100 irqchip/mips-gic: Don't overrun pcpu_masks array Commit 2a0787051182 ("irqchip/mips-gic: Use gic_vpes instead of NR_CPUS") & commit 78930f09b940 ("irqchip/mips-gic: Clear percpu_masks correctly when mapping") both introduce code which accesses gic_vpes entries in the pcpu_masks array. However, this array has length NR_CPUS. If NR_CPUS is less than gic_vpes (ie. the kernel supports use of less CPUs than are present in the system) then we overrun the array, clobber some other data & generally die pretty promptly. Most notably this affects uniprocessor kernels running on any multicore or multithreaded Malta with a GIC (ie. the vast majority of real Malta boards). Fix this by only accessing up to min(gic_vpes, NR_CPUS) entries in the pcpu_masks array, preventing the array overrun. Fixes: 2a0787051182 ("irqchip/mips-gic: Use gic_vpes instead of NR_CPUS") Fixes: 78930f09b940 ("irqchip/mips-gic: Clear percpu_masks correctly when mapping") Signed-off-by: Paul Burton Cc: linux-mips@linux-mips.org Cc: Jason Cooper Cc: Marc Zyngier Cc: Ralf Baechle Link: http://lkml.kernel.org/r/1461234714-9975-1-git-send-email-paul.burton@imgtec.com Signed-off-by: Thomas Gleixner drivers/irqchip/irq-mips-gic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 669c00c009ba0db81e840fd7e11faff7be8c8123 Merge: a1459c1 d21ed3a Author: David S. Miller Date: Thu Apr 21 15:02:41 2016 -0400 Merge branch 'mlx4-fixes' Or Gerlitz says: ==================== Mellaox 40G driver fixes for 4.6-rc With the fix for ARM bug being under the works, these are few other fixes for mlx4 we have ready to go. Eran addressed the problematic/wrong reporting of dropped packets, Daniel fixed some matters related to PPC EEH's and Jenny's patch makes sure VFs can't change the port's pause settings. ==================== Signed-off-by: David S. Miller commit d21ed3a311a1031dddc78e9270d1aa9adc8f8a93 Author: Eran Ben Elisha Date: Wed Apr 20 16:01:18 2016 +0300 net/mlx4_en: Split SW RX dropped counter per RX ring Count SW packet drops per RX ring instead of a global counter. This will allow monitoring the number of rx drops per ring. In addition, SW rx_dropped counter was overwritten by HW rx_dropped counter, sum both of them instead to show the accurate value. Fixes: a3333b35da16 ('net/mlx4_en: Moderate ethtool callback to [...] ') Signed-off-by: Eran Ben Elisha Reported-by: Brenden Blanco Signed-off-by: Saeed Mahameed Signed-off-by: Or Gerlitz Reported-by: Eric Dumazet Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 5 ++++- drivers/net/ethernet/mellanox/mlx4/en_port.c | 5 ++++- drivers/net/ethernet/mellanox/mlx4/en_rx.c | 2 +- drivers/net/ethernet/mellanox/mlx4/mlx4_en.h | 1 + 4 files changed, 10 insertions(+), 3 deletions(-) commit 2a500090a4ea2ccd713f3c782a2fb27681bd6e67 Author: Eugenia Emantayev Date: Wed Apr 20 16:01:17 2016 +0300 net/mlx4_core: Don't allow to VF change global pause settings Currently changing global pause settings is done via SET_PORT command with input modifier GENERAL. This command is allowed for each VF since MTU setting is done via the same command. Change the above to the following scheme: before passing the request to the FW, the PF will check whether it was issued by a slave. If yes, don't change global pause and warn, otherwise change to the requested value and store for further reference. Signed-off-by: Eugenia Emantayev Signed-off-by: Saeed Mahameed Signed-off-by: Or Gerlitz Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/mlx4.h | 2 ++ drivers/net/ethernet/mellanox/mlx4/port.c | 13 +++++++++++++ 2 files changed, 15 insertions(+) commit 4bfd2e6e53435a214888fd35e230157a38ffc6a0 Author: Daniel Jurgens Date: Wed Apr 20 16:01:16 2016 +0300 net/mlx4_core: Avoid repeated calls to pci enable/disable Maintain the PCI status and provide wrappers for enabling and disabling the PCI device. Performing the actions more than once without doing its opposite results in warning logs. This occurred when EEH hotplugged the device causing a warning for disabling an already disabled device. Fixes: 2ba5fbd62b25 ('net/mlx4_core: Handle AER flow properly') Signed-off-by: Daniel Jurgens Signed-off-by: Yishai Hadas Signed-off-by: Or Gerlitz Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/main.c | 39 +++++++++++++++++++++++++++---- include/linux/mlx4/device.h | 7 ++++++ 2 files changed, 41 insertions(+), 5 deletions(-) commit c12833acff62cff83a8b728253e7ebbc1264d75e Author: Daniel Jurgens Date: Wed Apr 20 16:01:15 2016 +0300 net/mlx4_core: Implement pci_resume callback Move resume related activities to a new pci_resume function instead of performing them in mlx4_pci_slot_reset. This change is needed to avoid a hotplug during EEH recovery due to commit f2da4ccf8bd4 ("powerpc/eeh: More relaxed hotplug criterion"). Fixes: 2ba5fbd62b25 ('net/mlx4_core: Handle AER flow properly') Signed-off-by: Daniel Jurgens Signed-off-by: Yishai Hadas Signed-off-by: Or Gerlitz Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/main.c | 39 +++++++++++++++++++------------ 1 file changed, 24 insertions(+), 15 deletions(-) commit a1459c1c9ebcd72f3d488fd10673e64b2bfcbd27 Author: Mark Brown Date: Wed Apr 20 12:54:05 2016 +0100 net: phy: spi_ks8895: Don't leak references to SPI devices The ks8895 driver is using spi_dev_get() apparently just to take a copy of the SPI device used to instantiate it but never calls spi_dev_put() to free it. Since the device is guaranteed to exist between probe() and remove() there should be no need for the driver to take an extra reference to it so fix the leak by just using a straight assignment. Signed-off-by: Mark Brown Signed-off-by: David S. Miller drivers/net/phy/spi_ks8995.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 210990b05a1247886539078e857cd038881bb2d6 Author: Neil Armstrong Date: Wed Apr 20 10:56:45 2016 +0200 net: ethernet: davinci_emac: Fix platform_data overwrite When the DaVinci emac driver is removed and re-probed, the actual pdev->dev.platform_data is populated with an unwanted valid pointer saved by the previous davinci_emac_of_get_pdata() call, causing a kernel crash when calling priv->int_disable() in emac_int_disable(). Unable to handle kernel paging request at virtual address c8622a80 ... [] (emac_int_disable) from [] (emac_dev_open+0x290/0x5f8) [] (emac_dev_open) from [] (__dev_open+0xb8/0x120) [] (__dev_open) from [] (__dev_change_flags+0x88/0x14c) [] (__dev_change_flags) from [] (dev_change_flags+0x18/0x48) [] (dev_change_flags) from [] (devinet_ioctl+0x6b4/0x7ac) [] (devinet_ioctl) from [] (sock_ioctl+0x1d8/0x2c0) [] (sock_ioctl) from [] (do_vfs_ioctl+0x41c/0x600) [] (do_vfs_ioctl) from [] (SyS_ioctl+0x6c/0x7c) [] (SyS_ioctl) from [] (ret_fast_syscall+0x0/0x1c) Fixes: 42f59967a091 ("net: ethernet: davinci_emac: add OF support") Cc: Brian Hutchinson Signed-off-by: Neil Armstrong Signed-off-by: David S. Miller drivers/net/ethernet/ti/davinci_emac.c | 2 -- 1 file changed, 2 deletions(-) commit 99164f9e62a391b5f4b7923b624d182b5d2859e0 Author: Neil Armstrong Date: Wed Apr 20 10:56:13 2016 +0200 net: ethernet: davinci_emac: Fix Unbalanced pm_runtime_enable In order to avoid an Unbalanced pm_runtime_enable in the DaVinci emac driver when the device is removed and re-probed, and a pm_runtime_disable() call in davinci_emac_remove(). Actually, using unbind/bind on a TI DM8168 SoC gives : $ echo 4a120000.ethernet > /sys/bus/platform/drivers/davinci_emac/unbind net eth1: DaVinci EMAC: davinci_emac_remove() $ echo 4a120000.ethernet > /sys/bus/platform/drivers/davinci_emac/bind davinci_emac 4a120000.ethernet: Unbalanced pm_runtime_enable Cc: Brian Hutchinson Fixes: 3ba97381343b ("net: ethernet: davinci_emac: add pm_runtime support") Signed-off-by: Neil Armstrong Signed-off-by: David S. Miller drivers/net/ethernet/ti/davinci_emac.c | 1 + 1 file changed, 1 insertion(+) commit 395da1259ac3e3fdc70636a854c993ddb76c6169 Merge: c3b46c7 c9d9c92 Author: Rafael J. Wysocki Date: Thu Apr 21 20:57:46 2016 +0200 Merge branch 'pm-cpufreq-fixes' * pm-cpufreq-fixes: cpufreq: Abort cpufreq_update_current_freq() for cpufreq_suspended set intel_pstate: Avoid getting stuck in high P-states when idle commit 3ad977992fccce7acf9af2afbd2a555cf1725404 Merge: 5bec11c ee2fa8e Author: David S. Miller Date: Thu Apr 21 14:51:29 2016 -0400 Merge branch 'qed-fixes' Manish Chopra says: ==================== qede: Bug fixes This series fixes - * various memory allocation failure flows for fastpath * issues with respect to driver GRO packets handling V1->V2 * Send series against net instead of net-next. Please consider applying this series to "net" ==================== Signed-off-by: David S. Miller commit ee2fa8e6b317ef756a3dfc2dae35891c025e32c9 Author: Manish Chopra Date: Wed Apr 20 03:03:29 2016 -0400 qede: Fix single MTU sized packet from firmware GRO flow In firmware assisted GRO flow there could be a single MTU sized segment arriving due to firmware aggregation timeout/last segment in an aggregation flow, which is not expected to be an actual gro packet. So If a skb has zero frags from the GRO flow then simply push it in the stack as non gso skb. Signed-off-by: Manish Chopra Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qede/qede_main.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit aad94c0408780c9f2e168f91ded861dd3877f7d9 Author: Manish Chopra Date: Wed Apr 20 03:03:28 2016 -0400 qede: Fix setting Skb network header Skb's network header needs to be set before extracting IPv4/IPv6 headers from it. Signed-off-by: Manish Chopra Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qede/qede_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f86af2dfded628034d05a2548e50001f34549403 Author: Manish Chopra Date: Wed Apr 20 03:03:27 2016 -0400 qede: Fix various memory allocation error flows for fastpath This patch handles memory allocation failures for fastpath gracefully in the driver. Signed-off-by: Manish Chopra Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qede/qede_main.c | 140 ++++++++++++++++----------- 1 file changed, 85 insertions(+), 55 deletions(-) commit 5bec11cf446eafa4851649db2d53e4086119a36f Merge: 3fa88c5 cfea5a6 Author: David S. Miller Date: Thu Apr 21 14:40:56 2016 -0400 Merge branch 'tcp-coalesce-merge-timestamps' Martin KaFai Lau says: ==================== tcp: Merge timestamp info when coalescing skbs This series is separated from the RFC series related to tcp_sendmsg(MSG_EOR) and it is targeting for the net branch. This patchset is focusing on fixing cases where TCP timestamp could be lost after coalescing skbs. A BPF prog is used to kprobe to sock_queue_err_skb() and print out the value of serr->ee.ee_data. The BPF prog (run-able from bcc) is attached here: BPF prog used for testing: ~~~~~ from __future__ import print_function from bcc import BPF bpf_text = """ int trace_err_skb(struct pt_regs *ctx) { struct sk_buff *skb = (struct sk_buff *)ctx->si; struct sock *sk = (struct sock *)ctx->di; struct sock_exterr_skb *serr; u32 ee_data = 0; if (!sk || !skb) return 0; serr = SKB_EXT_ERR(skb); bpf_probe_read(&ee_data, sizeof(ee_data), &serr->ee.ee_data); bpf_trace_printk("ee_data:%u\\n", ee_data); return 0; }; """ b = BPF(text=bpf_text) b.attach_kprobe(event="sock_queue_err_skb", fn_name="trace_err_skb") print("Attached to kprobe") b.trace_print() ==================== Signed-off-by: David S. Miller commit cfea5a688eb37bcd1081255df9f9f777f4e61999 Author: Martin KaFai Lau Date: Tue Apr 19 22:39:29 2016 -0700 tcp: Merge tx_flags and tskey in tcp_shifted_skb After receiving sacks, tcp_shifted_skb() will collapse skbs if possible. tx_flags and tskey also have to be merged. This patch reuses the tcp_skb_collapse_tstamp() to handle them. BPF Output Before: ~~~~~ BPF Output After: ~~~~~ <...>-2024 [007] d.s. 88.644374: : ee_data:14599 Packetdrill Script: ~~~~~ +0 `sysctl -q -w net.ipv4.tcp_min_tso_segs=10` +0 `sysctl -q -w net.ipv4.tcp_no_metrics_save=1` +0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 +0 bind(3, ..., ...) = 0 +0 listen(3, 1) = 0 0.100 < S 0:0(0) win 32792 0.100 > S. 0:0(0) ack 1 0.200 < . 1:1(0) ack 1 win 257 0.200 accept(3, ..., ...) = 4 +0 setsockopt(4, SOL_TCP, TCP_NODELAY, [1], 4) = 0 0.200 write(4, ..., 1460) = 1460 +0 setsockopt(4, SOL_SOCKET, 37, [2688], 4) = 0 0.200 write(4, ..., 13140) = 13140 0.200 > P. 1:1461(1460) ack 1 0.200 > . 1461:8761(7300) ack 1 0.200 > P. 8761:14601(5840) ack 1 0.300 < . 1:1(0) ack 1 win 257 0.300 > P. 1:1461(1460) ack 1 0.400 < . 1:1(0) ack 14601 win 257 0.400 close(4) = 0 0.400 > F. 14601:14601(0) ack 1 0.500 < F. 1:1(0) ack 14602 win 257 0.500 > . 14602:14602(0) ack 2 Signed-off-by: Martin KaFai Lau Cc: Eric Dumazet Cc: Neal Cardwell Cc: Soheil Hassas Yeganeh Cc: Willem de Bruijn Cc: Yuchung Cheng Acked-by: Soheil Hassas Yeganeh Tested-by: Soheil Hassas Yeganeh Signed-off-by: David S. Miller include/net/tcp.h | 2 ++ net/ipv4/tcp_input.c | 1 + net/ipv4/tcp_output.c | 4 ++-- 3 files changed, 5 insertions(+), 2 deletions(-) commit 082ac2d51d9f19ec1c29bdaaaf7fb49889e4fade Author: Martin KaFai Lau Date: Tue Apr 19 22:39:28 2016 -0700 tcp: Merge tx_flags and tskey in tcp_collapse_retrans If two skbs are merged/collapsed during retransmission, the current logic does not merge the tx_flags and tskey. The end result is the SCM_TSTAMP_ACK timestamp could be missing for a packet. The patch: 1. Merge the tx_flags 2. Overwrite the prev_skb's tskey with the next_skb's tskey BPF Output Before: ~~~~~~ BPF Output After: ~~~~~~ packetdrill-2092 [001] d.s. 453.998486: : ee_data:1459 Packetdrill Script: ~~~~~~ +0 `sysctl -q -w net.ipv4.tcp_min_tso_segs=10` +0 `sysctl -q -w net.ipv4.tcp_no_metrics_save=1` +0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 +0 bind(3, ..., ...) = 0 +0 listen(3, 1) = 0 0.100 < S 0:0(0) win 32792 0.100 > S. 0:0(0) ack 1 0.200 < . 1:1(0) ack 1 win 257 0.200 accept(3, ..., ...) = 4 +0 setsockopt(4, SOL_TCP, TCP_NODELAY, [1], 4) = 0 0.200 write(4, ..., 730) = 730 +0 setsockopt(4, SOL_SOCKET, 37, [2688], 4) = 0 0.200 write(4, ..., 730) = 730 +0 setsockopt(4, SOL_SOCKET, 37, [2176], 4) = 0 0.200 write(4, ..., 11680) = 11680 +0 setsockopt(4, SOL_SOCKET, 37, [2688], 4) = 0 0.200 > P. 1:731(730) ack 1 0.200 > P. 731:1461(730) ack 1 0.200 > . 1461:8761(7300) ack 1 0.200 > P. 8761:13141(4380) ack 1 0.300 < . 1:1(0) ack 1 win 257 0.300 < . 1:1(0) ack 1 win 257 0.300 < . 1:1(0) ack 1 win 257 0.300 > P. 1:1461(1460) ack 1 0.400 < . 1:1(0) ack 13141 win 257 0.400 close(4) = 0 0.400 > F. 13141:13141(0) ack 1 0.500 < F. 1:1(0) ack 13142 win 257 0.500 > . 13142:13142(0) ack 2 Signed-off-by: Martin KaFai Lau Cc: Eric Dumazet Cc: Neal Cardwell Cc: Soheil Hassas Yeganeh Cc: Willem de Bruijn Cc: Yuchung Cheng Acked-by: Soheil Hassas Yeganeh Tested-by: Soheil Hassas Yeganeh Signed-off-by: David S. Miller net/ipv4/tcp_output.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit 3fa88c51c73a67e7eeda1fcafd809f9185790b31 Author: Grygorii Strashko Date: Tue Apr 19 21:09:49 2016 +0300 drivers: net: cpsw: fix wrong regs access in cpsw_ndo_open The cpsw_ndo_open() could try to access CPSW registers before calling pm_runtime_get_sync(). This will trigger L3 error: WARNING: CPU: 0 PID: 21 at drivers/bus/omap_l3_noc.c:147 l3_interrupt_handler+0x220/0x34c() 44000000.ocp:L3 Custom Error: MASTER M2 (64-bit) TARGET L4_FAST (Idle): Data Access in Supervisor mode during Functional access and CPSW will stop functioning. Hence, fix it by moving pm_runtime_get_sync() before the first access to CPSW registers in cpsw_ndo_open(). Signed-off-by: Grygorii Strashko Signed-off-by: David S. Miller drivers/net/ethernet/ti/cpsw.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 479f85c36688f5c855ad463b71902ef5992628b7 Author: Martin KaFai Lau Date: Mon Apr 18 15:39:53 2016 -0700 tcp: Fix SOF_TIMESTAMPING_TX_ACK when handling dup acks Assuming SOF_TIMESTAMPING_TX_ACK is on. When dup acks are received, it could incorrectly think that a skb has already been acked and queue a SCM_TSTAMP_ACK cmsg to the sk->sk_error_queue. In tcp_ack_tstamp(), it checks 'between(shinfo->tskey, prior_snd_una, tcp_sk(sk)->snd_una - 1)'. If prior_snd_una == tcp_sk(sk)->snd_una like the following packetdrill script, between() returns true but the tskey is actually not acked. e.g. try between(3, 2, 1). The fix is to replace between() with one before() and one !before(). By doing this, the -1 offset on the tcp_sk(sk)->snd_una can also be removed. A packetdrill script is used to reproduce the dup ack scenario. Due to the lacking cmsg support in packetdrill (may be I cannot find it), a BPF prog is used to kprobe to sock_queue_err_skb() and print out the value of serr->ee.ee_data. Both the packetdrill and the bcc BPF script is attached at the end of this commit message. BPF Output Before Fix: ~~~~~~ <...>-2056 [001] d.s. 433.927987: : ee_data:1459 #incorrect packetdrill-2056 [001] d.s. 433.929563: : ee_data:1459 #incorrect packetdrill-2056 [001] d.s. 433.930765: : ee_data:1459 #incorrect packetdrill-2056 [001] d.s. 434.028177: : ee_data:1459 packetdrill-2056 [001] d.s. 434.029686: : ee_data:14599 BPF Output After Fix: ~~~~~~ <...>-2049 [000] d.s. 113.517039: : ee_data:1459 <...>-2049 [000] d.s. 113.517253: : ee_data:14599 BCC BPF Script: ~~~~~~ #!/usr/bin/env python from __future__ import print_function from bcc import BPF bpf_text = """ #include #include #include #include #ifdef memset #undef memset #endif int trace_err_skb(struct pt_regs *ctx) { struct sk_buff *skb = (struct sk_buff *)ctx->si; struct sock *sk = (struct sock *)ctx->di; struct sock_exterr_skb *serr; u32 ee_data = 0; if (!sk || !skb) return 0; serr = SKB_EXT_ERR(skb); bpf_probe_read(&ee_data, sizeof(ee_data), &serr->ee.ee_data); bpf_trace_printk("ee_data:%u\\n", ee_data); return 0; }; """ b = BPF(text=bpf_text) b.attach_kprobe(event="sock_queue_err_skb", fn_name="trace_err_skb") print("Attached to kprobe") b.trace_print() Packetdrill Script: ~~~~~~ +0 `sysctl -q -w net.ipv4.tcp_min_tso_segs=10` +0 `sysctl -q -w net.ipv4.tcp_no_metrics_save=1` +0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 +0 bind(3, ..., ...) = 0 +0 listen(3, 1) = 0 0.100 < S 0:0(0) win 32792 0.100 > S. 0:0(0) ack 1 0.200 < . 1:1(0) ack 1 win 257 0.200 accept(3, ..., ...) = 4 +0 setsockopt(4, SOL_TCP, TCP_NODELAY, [1], 4) = 0 +0 setsockopt(4, SOL_SOCKET, 37, [2688], 4) = 0 0.200 write(4, ..., 1460) = 1460 0.200 write(4, ..., 13140) = 13140 0.200 > P. 1:1461(1460) ack 1 0.200 > . 1461:8761(7300) ack 1 0.200 > P. 8761:14601(5840) ack 1 0.300 < . 1:1(0) ack 1 win 257 0.300 < . 1:1(0) ack 1 win 257 0.300 < . 1:1(0) ack 1 win 257 0.300 > P. 1:1461(1460) ack 1 0.400 < . 1:1(0) ack 14601 win 257 0.400 close(4) = 0 0.400 > F. 14601:14601(0) ack 1 0.500 < F. 1:1(0) ack 14602 win 257 0.500 > . 14602:14602(0) ack 2 Signed-off-by: Martin KaFai Lau Cc: Eric Dumazet Cc: Neal Cardwell Cc: Soheil Hassas Yeganeh Cc: Willem de Bruijn Cc: Yuchung Cheng Acked-by: Soheil Hassas Yeganeh Tested-by: Soheil Hassas Yeganeh Signed-off-by: David S. Miller net/ipv4/tcp_input.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 49e261a8a21e0960a3f7ff187a453ba1c1149053 Author: Joe Stringer Date: Mon Apr 18 14:51:47 2016 -0700 openvswitch: Orphan skbs before IPv6 defrag This is the IPv6 counterpart to commit 8282f27449bf ("inet: frag: Always orphan skbs inside ip_defrag()"). Prior to commit 029f7f3b8701 ("netfilter: ipv6: nf_defrag: avoid/free clone operations"), ipv6 fragments sent to nf_ct_frag6_gather() would be cloned (implicitly orphaning) prior to queueing for reassembly. As such, when the IPv6 message is eventually reassembled, the skb->sk for all fragments would be NULL. After that commit was introduced, rather than cloning, the original skbs were queued directly without orphaning. The end result is that all frags except for the first and last may have a socket attached. This commit explicitly orphans such skbs during nf_ct_frag6_gather() to prevent BUG_ON(skb->sk) during a later call to ip6_fragment(). kernel BUG at net/ipv6/ip6_output.c:631! [...] Call Trace: [] ? __lock_acquire+0x927/0x20a0 [] ? do_output.isra.28+0x1b0/0x1b0 [openvswitch] [] ? __lock_is_held+0x52/0x70 [] ovs_fragment+0x1f7/0x280 [openvswitch] [] ? mark_held_locks+0x75/0xa0 [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [] ? dst_discard_out+0x20/0x20 [] ? dst_ifdown+0x80/0x80 [] do_output.isra.28+0xf3/0x1b0 [openvswitch] [] do_execute_actions+0x709/0x12c0 [openvswitch] [] ? ovs_flow_stats_update+0x74/0x1e0 [openvswitch] [] ? ovs_flow_stats_update+0xa1/0x1e0 [openvswitch] [] ? _raw_spin_unlock+0x27/0x40 [] ovs_execute_actions+0x45/0x120 [openvswitch] [] ovs_dp_process_packet+0x85/0x150 [openvswitch] [] ? _raw_spin_unlock+0x27/0x40 [] ovs_execute_actions+0xc4/0x120 [openvswitch] [] ovs_dp_process_packet+0x85/0x150 [openvswitch] [] ? key_extract+0x442/0xc10 [openvswitch] [] ovs_vport_receive+0x5d/0xb0 [openvswitch] [] ? __lock_acquire+0x927/0x20a0 [] ? __lock_acquire+0x927/0x20a0 [] ? __lock_acquire+0x927/0x20a0 [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [] internal_dev_xmit+0x6d/0x150 [openvswitch] [] ? internal_dev_xmit+0x5/0x150 [openvswitch] [] dev_hard_start_xmit+0x2df/0x660 [] ? validate_xmit_skb.isra.105.part.106+0x1a/0x2b0 [] __dev_queue_xmit+0x8f5/0x950 [] ? __dev_queue_xmit+0x50/0x950 [] ? mark_held_locks+0x75/0xa0 [] dev_queue_xmit+0x10/0x20 [] neigh_resolve_output+0x178/0x220 [] ? ip6_finish_output2+0x219/0x7b0 [] ip6_finish_output2+0x219/0x7b0 [] ? ip6_finish_output2+0x65/0x7b0 [] ? ip_idents_reserve+0x6b/0x80 [] ? ip6_fragment+0x93f/0xc50 [] ip6_fragment+0xba1/0xc50 [] ? ip6_flush_pending_frames+0x40/0x40 [] ip6_finish_output+0xcb/0x1d0 [] ip6_output+0x5f/0x1a0 [] ? ip6_fragment+0xc50/0xc50 [] ip6_local_out+0x3d/0x80 [] ip6_send_skb+0x2f/0xc0 [] ip6_push_pending_frames+0x4d/0x50 [] icmpv6_push_pending_frames+0xac/0xe0 [] icmpv6_echo_reply+0x42e/0x500 [] icmpv6_rcv+0x4cf/0x580 [] ip6_input_finish+0x1a7/0x690 [] ? ip6_input_finish+0x5/0x690 [] ip6_input+0x30/0xa0 [] ? ip6_rcv_finish+0x1a0/0x1a0 [] ip6_rcv_finish+0x4e/0x1a0 [] ipv6_rcv+0x45f/0x7c0 [] ? ipv6_rcv+0x36/0x7c0 [] ? ip6_make_skb+0x1c0/0x1c0 [] __netif_receive_skb_core+0x229/0xb80 [] ? mark_held_locks+0x75/0xa0 [] ? process_backlog+0x6f/0x230 [] __netif_receive_skb+0x16/0x70 [] process_backlog+0x78/0x230 [] ? process_backlog+0xdd/0x230 [] net_rx_action+0x203/0x480 [] ? mark_held_locks+0x75/0xa0 [] __do_softirq+0xde/0x49f [] ? ip6_finish_output2+0x228/0x7b0 [] do_softirq_own_stack+0x1c/0x30 [] do_softirq.part.18+0x3b/0x40 [] __local_bh_enable_ip+0xb6/0xc0 [] ip6_finish_output2+0x251/0x7b0 [] ? ip6_fragment+0xba1/0xc50 [] ? ip_idents_reserve+0x6b/0x80 [] ? ip6_fragment+0x93f/0xc50 [] ip6_fragment+0xba1/0xc50 [] ? ip6_flush_pending_frames+0x40/0x40 [] ip6_finish_output+0xcb/0x1d0 [] ip6_output+0x5f/0x1a0 [] ? ip6_fragment+0xc50/0xc50 [] ip6_local_out+0x3d/0x80 [] ip6_send_skb+0x2f/0xc0 [] ip6_push_pending_frames+0x4d/0x50 [] rawv6_sendmsg+0xa28/0xe30 [] ? inet_sendmsg+0xc7/0x1d0 [] inet_sendmsg+0x106/0x1d0 [] ? inet_sendmsg+0x5/0x1d0 [] sock_sendmsg+0x38/0x50 [] SYSC_sendto+0xf6/0x170 [] ? trace_hardirqs_on_thunk+0x1b/0x1d [] SyS_sendto+0xe/0x10 [] entry_SYSCALL_64_fastpath+0x18/0xa8 Code: 06 48 83 3f 00 75 26 48 8b 87 d8 00 00 00 2b 87 d0 00 00 00 48 39 d0 72 14 8b 87 e4 00 00 00 83 f8 01 75 09 48 83 7f 18 00 74 9a <0f> 0b 41 8b 86 cc 00 00 00 49 8# RIP [] ip6_fragment+0x73a/0xc50 RSP Fixes: 029f7f3b8701 ("netfilter: ipv6: nf_defrag: avoid/free clone operations") Reported-by: Daniele Di Proietto Signed-off-by: Joe Stringer Signed-off-by: David S. Miller net/openvswitch/conntrack.c | 1 + 1 file changed, 1 insertion(+) commit 882416c1e4d1c9d4c7b50e0f5c3fa9ef043cd710 Author: Dave Martin Date: Mon Apr 18 18:57:26 2016 +0100 arm64: Fix EL1/EL2 early init inconsistencies with VHE When using the Virtualisation Host Extensions, EL1 is not used in the host and requires no separate configuration. In addition, with VHE enabled, non-hyp-specific EL2 configuration that does not need to be done early will be done anyway in __cpu_setup via the _EL1 system register aliases. In particular, the layout and definition of CPTR_EL2 are changed by enabling VHE so that they resemble CPACR_EL1, so existing code to initialise CPTR_EL2 becomes architecturally wrong in this case. This patch simply skips the affected initialisation code in the non-VHE case. Signed-off-by: Dave Martin Reviewed-by: Marc Zyngier Signed-off-by: Catalin Marinas arch/arm64/kernel/head.S | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 3194ed497939c6448005542e3ca4fa2386968fa0 Author: Takashi Iwai Date: Thu Apr 21 17:49:11 2016 +0200 ALSA: hda - Fix possible race on regmap bypass flip HD-audio driver uses regmap cache bypass feature for reading a raw value without the cache. But this is racy since both the cached and the uncached reads may occur concurrently. The former is done via the normal control API access while the latter comes from the proc file read. Even though the regmap itself has the protection against the concurrent accesses, the flag set/reset is done without the protection, so it may lead to inconsistent state of bypass flag that doesn't match with the current read and occasionally result in a kernel WARNING like: WARNING: CPU: 3 PID: 2731 at drivers/base/regmap/regcache.c:499 regcache_cache_only+0x78/0x93 One way to work around such a problem is to wrap with a mutex. But in this case, the solution is simpler: for the uncached read, we just skip the regmap and directly calls its accessor. The verb execution there is protected by itself, so basically it's safe to call individually. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=116171 Signed-off-by: Takashi Iwai include/sound/hda_regmap.h | 2 ++ sound/hda/hdac_device.c | 10 ++++------ sound/hda/hdac_regmap.c | 40 ++++++++++++++++++++++++++++------------ 3 files changed, 34 insertions(+), 18 deletions(-) commit f862d66a1a4609e61cd87c7ff4c7d9a234103d67 Merge: 90e6a68 ac36a88 Author: Linus Torvalds Date: Thu Apr 21 08:45:02 2016 -0700 Merge branch 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm Pull ARM fixes from Russell King: "Three further fixes for ARM. Alexandre Courbot was having problems with DMA allocations with the GFP flags affecting where the tracking data was being allocated from. Vladimir Murzin noticed that the CPU feature code was not entirely correct, which can cause some features to be misreported" * 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm: ARM: 8564/1: fix cpu feature extracting helper ARM: 8563/1: fix demoting HWCAP_SWP ARM: 8551/2: DMA: Fix kzalloc flags in __dma_alloc commit 67f3754b51f22b18c4820fb84062f658c30e8644 Author: Takashi Iwai Date: Thu Apr 21 17:37:54 2016 +0200 ALSA: pcxhr: Fix missing mutex unlock The commit [9bef72bdb26e: ALSA: pcxhr: Use nonatomic PCM ops] converted to non-atomic PCM ops, but shamelessly with an unbalanced mutex locking, which leads to the hangup easily. Fix it. Fixes: 9bef72bdb26e ('ALSA: pcxhr: Use nonatomic PCM ops') Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=116441 Cc: # 3.18+ Signed-off-by: Takashi Iwai sound/pci/pcxhr/pcxhr_core.c | 1 + 1 file changed, 1 insertion(+) commit 90e6a6894b1f197e134f4771dd6df06e45862c39 Merge: b9358b2 4dacad6 Author: Linus Torvalds Date: Thu Apr 21 08:27:48 2016 -0700 Merge tag 'fbdev-fixes-4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux Pull fbdev fixes from Tomi Valkeinen: - ARM CLCD: fix regression on multiplatform kernels - panel-sharp-ls037v7dw01: fix possible NULL deref * tag 'fbdev-fixes-4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux: omapfb: panel-sharp-ls037v7dw01: fix check of gpio_to_desc() return value video: ARM CLCD: runtime check for Versatile commit b9358b247291a11cf1be982c2dc087bb95f26729 Merge: 55f058e 5d07163 Author: Linus Torvalds Date: Thu Apr 21 08:23:59 2016 -0700 Merge tag 'platform-drivers-x86-v4.6-2' of git://git.infradead.org/users/dvhart/linux-platform-drivers-x86 Pull x86 platform driver fixes from Darren Hart: "An S4 fix for intel-hid, new platform 'quirk' for hp_accel, a fix for broader support of ACPI resources for the Intel P-unit, and a few uninitialized variable fixes. intel p-unit: - decouple telemetry driver from the optional IPC resources thinkpad_acpi: - Silence an uninitialized variable warning intel_telemetry_pltdrv: - Silence an uninitialized variable warning hp_accel: - Silence an uninitialized variable warning - Add support for HP ProBook 440 G3 intel-hid: - add a workaround to ignore an event after waking up from S4" * tag 'platform-drivers-x86-v4.6-2' of git://git.infradead.org/users/dvhart/linux-platform-drivers-x86: platform:x86 decouple telemetry driver from the optional IPC resources thinkpad_acpi: Silence an uninitialized variable warning intel_telemetry_pltdrv: Silence an uninitialized variable warning hp_accel: Silence an uninitialized variable warning hp_accel: Add support for HP ProBook 440 G3 intel-hid: add a workaround to ignore an event after waking up from S4. commit 9800699c645952da6a7399194d3e762b84cde3cd Author: Robin Murphy Date: Wed Apr 20 14:53:33 2016 +0100 iommu/arm-smmu: Don't allocate resources for bypass domains Until we get fully plumbed into of_iommu_configure, our default IOMMU_DOMAIN_DMA domains just bypass translation. Since we achieve that by leaving the stream table entries set to bypass instead of pointing at a translation context, the context bank we allocate for the domain is completely wasted. Context banks are typically a rather limited resource, so don't hog ones we don't need. Reported-by: Eric Auger Tested-by: Eric Auger Signed-off-by: Robin Murphy Signed-off-by: Will Deacon Signed-off-by: Joerg Roedel drivers/iommu/arm-smmu.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 5f634956cc550768ebd75cf26fdba01044bc600e Author: Will Deacon Date: Wed Apr 20 14:53:32 2016 +0100 iommu/arm-smmu: Fix stream-match conflict with IOMMU_DOMAIN_DMA Commit cbf8277ef456 ("iommu/arm-smmu: Treat IOMMU_DOMAIN_DMA as bypass for now") ignores requests to attach a device to the default domain since, without IOMMU-basked DMA ops available everywhere, the default domain will just lead to unexpected transaction faults being reported. Unfortunately, the way this was implemented on SMMUv2 causes a regression with VFIO PCI device passthrough under KVM on AMD Seattle. On this system, the host controller device is associated with both a pci_dev *and* a platform_device, and can therefore end up with duplicate SMR entries, resulting in a stream-match conflict at runtime. This patch amends the original fix so that attaching to IOMMU_DOMAIN_DMA is rejected even before configuring the SMRs. This restores the old behaviour for now, but we'll need to look at handing host controllers specially when we come to supporting the default domain fully. Reported-by: Eric Auger Tested-by: Eric Auger Tested-by: Yang Shi Signed-off-by: Will Deacon Signed-off-by: Joerg Roedel drivers/iommu/arm-smmu.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) commit cbcc72e037b8a3eb1fad3c1ae22021df21c97a51 Author: Lorenzo Pieralisi Date: Thu Apr 21 10:24:34 2016 +0100 drivers/perf: arm-pmu: fix RCU usage on pmu resume from low-power Commit da4e4f18afe0 ("drivers/perf: arm_pmu: implement CPU_PM notifier") added code in the arm perf infrastructure that allows the kernel to save/restore perf counters whenever the CPU enters a low-power state. The kernel saves/restores the counters for each active event through the armpmu_{stop/start} ARM pmu API, so that the low-power state enter/exit cycle is emulated through pmu start/stop operations for each event in use. However, calling armpmu_start() for each active event on power up executes code that requires RCU locking (perf_event_update_userpage()) to be functional, so, given that the core may call the CPU_PM notifiers while running the idle thread in an quiescent RCU state this is not allowed as detected through the following splat when kernel is run with CONFIG_PROVE_LOCKING enabled: [ 49.293286] [ 49.294761] =============================== [ 49.298895] [ INFO: suspicious RCU usage. ] [ 49.303031] 4.6.0-rc3+ #421 Not tainted [ 49.306821] ------------------------------- [ 49.310956] include/linux/rcupdate.h:872 rcu_read_lock() used illegally while idle! [ 49.318530] [ 49.318530] other info that might help us debug this: [ 49.318530] [ 49.326451] [ 49.326451] RCU used illegally from idle CPU! [ 49.326451] rcu_scheduler_active = 1, debug_locks = 0 [ 49.337209] RCU used illegally from extended quiescent state! [ 49.342892] 2 locks held by swapper/2/0: [ 49.346768] #0: (cpu_pm_notifier_lock){......}, at: [] cpu_pm_exit+0x18/0x80 [ 49.355492] #1: (rcu_read_lock){......}, at: [] perf_event_update_userpage+0x0/0x260 This patch wraps the armpmu_start() call (that indirectly calls perf_event_update_userpage()) on CPU_PM notifier power state exit (or failed entry) within the RCU_NONIDLE() macro so that the RCU subsystem is made aware the calling cpu is not idle from an RCU perspective for the armpmu_start() call duration, therefore fixing the issue. Fixes: da4e4f18afe0 ("drivers/perf: arm_pmu: implement CPU_PM notifier") Signed-off-by: Lorenzo Pieralisi Reported-by: James Morse Suggested-by: Kevin Hilman Cc: Ashwin Chaugule Cc: Kevin Hilman Cc: Sudeep Holla Cc: Daniel Lezcano Cc: Mathieu Poirier Acked-by: Mark Rutland Acked-by: Paul E. McKenney Acked-by: Will Deacon Signed-off-by: Catalin Marinas drivers/perf/arm_pmu.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) commit d4f6e272f2600bc1295d195a52a9e8bb81656bc7 Author: Dan Carpenter Date: Thu Apr 14 12:33:37 2016 +0300 firmware: qemu_fw_cfg.c: potential unintialized variable It acpi_acquire_global_lock() return AE_NOT_CONFIGURED then "glk" isn't initialized, which, if you got very unlucky, could cause a bug. Signed-off-by: Dan Carpenter Signed-off-by: Michael S. Tsirkin drivers/firmware/qemu_fw_cfg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2144fff7df8e76654fa72b0a9d2324ce2e0c8a5c Author: Lucas Stach Date: Thu Apr 21 13:52:38 2016 +0200 drm/etnaviv: don't move linear memory window on 3D cores without MC2.0 On cores with MC1.0 the memory window offset is not properly respected by all engines in the core, leading to different views of the memory if the offset in non-zero. This causes relocs for those engines to be wrong and might lead to other subtile problems. Rather than trying to work around this, just disable the linear memory window offset for those cores. Suggested-by: Russell King Signed-off-by: Lucas Stach drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-) commit e2841ea91611622370f66b4dfaa62599e8850d48 Merge: de478a6 f742aaf Author: Kalle Valo Date: Thu Apr 21 15:40:13 2016 +0300 Merge tag 'iwlwifi-for-kalle-2016-04-12_2' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes * add new device IDs for 8265 * fix a NULL pointer dereference when paging firmware asserts * remove a WARNING on gscan capabilities * fix MODULE_FIRMWARE for 8260 commit 4589f450fb285ab85f7513b6649e51ec2a820653 Author: Matt Redfearn Date: Thu Apr 21 10:08:32 2016 +0100 genirq: Dont allow affinity mask to be updated on IPIs The IPI domain re-purposes the IRQ affinity to signify the mask of CPUs that this IPI will deliver to. This must not be modified before the IPI is destroyed again, so set the IRQ_NO_BALANCING flag to prevent the affinity being overwritten by setup_affinity(). Without this, if an IPI is reserved for a single target CPU, then allocated using __setup_irq(), the affinity is overwritten with cpu_online_mask. When ipi_destroy() is subsequently called on a multi-cpu system, it will attempt to free cpumask_weight() IRQs that were never allocated, and crash. Fixes: d17bf24e6952 ("genirq: Add a new generic IPI reservation code to irq core") Signed-off-by: Matt Redfearn Cc: linux-mips@linux-mips.org Cc: jason@lakedaemon.net Cc: marc.zyngier@arm.com Cc: ralf@linux-mips.org Cc: Qais Yousef Cc: lisa.parratt@imgtec.com Link: http://lkml.kernel.org/r/1461229712-13057-1-git-send-email-matt.redfearn@imgtec.com Signed-off-by: Thomas Gleixner kernel/irq/ipi.c | 1 + 1 file changed, 1 insertion(+) commit fba7cd681b6155e2d93e7862fcd6f970336b83c3 Author: Romain Perier Date: Thu Apr 14 15:36:03 2016 +0200 asm-generic/futex: Re-enable preemption in futex_atomic_cmpxchg_inatomic() The recent decoupling of pagefault disable and preempt disable added an explicit preempt_disable/enable() pair to the futex_atomic_cmpxchg_inatomic() implementation in asm-generic/futex.h. But it forgot to add preempt_enable() calls to the error handling code pathes, which results in a preemption count imbalance. This is observable on boot when the test for atomic_cmpxchg() is calling futex_atomic_cmpxchg_inatomic() on a NULL pointer. Add the missing preempt_enable() calls to the error handling code pathes. [ tglx: Massaged changelog ] Fixes: d9b9ff8c1889 ("sched/preempt, futex: Disable preemption in UP futex_atomic_cmpxchg_inatomic() explicitly") Signed-off-by: Romain Perier Cc: linux-arch@vger.kernel.org Cc: Thomas Petazzoni Cc: Arnd Bergmann Cc: Peter Zijlstra Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/1460640963-690-1-git-send-email-romain.perier@free-electrons.com Signed-off-by: Thomas Gleixner include/asm-generic/futex.h | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit fe1bce9e2107ba3a8faffe572483b6974201a0e6 Author: Davidlohr Bueso Date: Wed Apr 20 20:09:24 2016 -0700 futex: Acknowledge a new waiter in counter before plist Otherwise an incoming waker on the dest hash bucket can miss the waiter adding itself to the plist during the lockless check optimization (small window but still the correct way of doing this); similarly to the decrement counterpart. Suggested-by: Peter Zijlstra Signed-off-by: Davidlohr Bueso Cc: Davidlohr Bueso Cc: bigeasy@linutronix.de Cc: dvhart@infradead.org Cc: stable@kernel.org Link: http://lkml.kernel.org/r/1461208164-29150-1-git-send-email-dave@stgolabs.net Signed-off-by: Thomas Gleixner kernel/futex.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 723cacbd9dc79582e562c123a0bacf8bfc69e72a Author: Gerald Schaefer Date: Fri Apr 15 16:38:40 2016 +0200 s390/mm: fix asce_bits handling with dynamic pagetable levels There is a race with multi-threaded applications between context switch and pagetable upgrade. In switch_mm() a new user_asce is built from mm->pgd and mm->context.asce_bits, w/o holding any locks. A concurrent mmap with a pagetable upgrade on another thread in crst_table_upgrade() could already have set new asce_bits, but not yet the new mm->pgd. This would result in a corrupt user_asce in switch_mm(), and eventually in a kernel panic from a translation exception. Fix this by storing the complete asce instead of just the asce_bits, which can then be read atomically from switch_mm(), so that it either sees the old value or the new value, but no mixture. Both cases are OK. Having the old value would result in a page fault on access to the higher level memory, but the fault handler would see the new mm->pgd, if it was a valid access after the mmap on the other thread has completed. So as worst-case scenario we would have a page fault loop for the racing thread until the next time slice. Also remove dead code and simplify the upgrade/downgrade path, there are no upgrades from 2 levels, and only downgrades from 3 levels for compat tasks. There are also no concurrent upgrades, because the mmap_sem is held with down_write() in do_mmap, so the flush and table checks during upgrade can be removed. Reported-by: Michael Munday Reviewed-by: Martin Schwidefsky Signed-off-by: Gerald Schaefer Signed-off-by: Martin Schwidefsky arch/s390/include/asm/mmu.h | 2 +- arch/s390/include/asm/mmu_context.h | 28 +++++++++--- arch/s390/include/asm/pgalloc.h | 4 +- arch/s390/include/asm/processor.h | 2 +- arch/s390/include/asm/tlbflush.h | 9 ++-- arch/s390/mm/init.c | 3 +- arch/s390/mm/mmap.c | 6 +-- arch/s390/mm/pgalloc.c | 85 ++++++++++++------------------------- 8 files changed, 62 insertions(+), 77 deletions(-) commit dba599091c191d209b1499511a524ad9657c0e5a Author: Sebastian Ott Date: Fri Apr 15 09:41:35 2016 +0200 s390/pci: fix use after free in dma_init After a failure during registration of the dma_table (because of the function being in error state) we free its memory but don't reset the associated pointer to zero. When we then receive a notification from firmware (about the function being in error state) we'll try to walk and free the dma_table again. Fix this by resetting the dma_table pointer. In addition to that make sure that we free the iommu_bitmap when appropriate. Signed-off-by: Sebastian Ott Reviewed-by: Gerald Schaefer Signed-off-by: Martin Schwidefsky arch/s390/pci/pci_dma.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) commit a6f4850dbca66e46a73b8774e85aaf9fc0caf265 Author: Johannes Berg Date: Thu Apr 14 15:15:20 2016 +0200 thermal: fix Mediatek thermal controller build At least with CONFIG_COMPILE_TEST, there's no reason to assume that CONFIG_RESET_CONTROLLER is set, but the code for this controller requires it since it calls device_reset(). Make CONFIG_MTK_THERMAL properly depend on CONFIG_RESET_CONTROLLER. Signed-off-by: Johannes Berg Signed-off-by: Eduardo Valentin drivers/thermal/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 1d0fd42fa31d18ba0a3e0dd008c9e93e1cebe451 Author: Wei Ni Date: Thu Mar 3 17:33:46 2016 +0800 thermal: consistently use int for trip temp The commit 17e8351a7739 consistently use int for temperature, however it missed a few in trip temperature and thermal_core. In current codes, the trip->temperature used "unsigned long" and zone->temperature used"int", if the temperature is negative value, it will get wrong result when compare temperature with trip temperature. This patch can fix it. Signed-off-by: Wei Ni Signed-off-by: Eduardo Valentin drivers/thermal/thermal_core.c | 8 ++++---- include/linux/thermal.h | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) commit 62e14f6fd383f756ff3fe5f6fb7aa5b546bb47e3 Author: Randy Dunlap Date: Tue Apr 19 09:44:23 2016 -0700 thermal: fix mtk_thermal build dependency Fix build errors when MTK_THERMAL=y and NVMEM=m by preventing that Kconfig combination. drivers/built-in.o: In function `mtk_thermal_probe': mtk_thermal.c:(.text+0xffa8f): undefined reference to `nvmem_cell_get' mtk_thermal.c:(.text+0xffabe): undefined reference to `nvmem_cell_read' mtk_thermal.c:(.text+0xffac9): undefined reference to `nvmem_cell_put' Signed-off-by: Randy Dunlap Cc: Zhang Rui Cc: Eduardo Valentin Cc: Cc: Sascha Hauer Cc: Hanyi Wu Signed-off-by: Eduardo Valentin drivers/thermal/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 9ebfb4e09959b03b58b65b5a6c04f70dd57d4f6b Author: Randy Dunlap Date: Tue Apr 19 16:45:01 2016 -0700 thermal: minor mtk_thermal.c cleanups Trivial cleanups: - delete one duplicate #include - end email address with closing '>' Signed-off-by: Randy Dunlap Cc: Zhang Rui Cc: Eduardo Valentin Cc: Sascha Hauer Cc: Hanyi Wu Signed-off-by: Eduardo Valentin drivers/thermal/mtk_thermal.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit f9d038144a171d42e057143b247ff7a12a5b06f5 Author: Javi Merino Date: Wed Apr 6 19:30:18 2016 +0100 thermal: power_allocator: req_range multiplication should be a 64 bit type req_range is declared as a u64 to cope with overflows in the multiplication of two u32. As both req_power and power_range are u32, we need to make sure the multiplication is done with u64 types. Reported-by: Dan Carpenter Cc: Zhang Rui Cc: Eduardo Valentin Signed-off-by: Javi Merino Signed-off-by: Eduardo Valentin drivers/thermal/power_allocator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c0ff8aaae369559fbef0e9f2606a9ae92db14f2f Author: Julia Lawall Date: Tue Apr 19 14:33:32 2016 +0200 thermal: of: add __init attribute Add __init attribute on a function that is only called from other __init functions and that is not inlined, at least with gcc version 4.8.4 on an x86 machine with allyesconfig. Currently, the function is put in the .text.unlikely segment. Declaring it as __init will cause it to be put in the .init.text and to disappear after initialization. The result of objdump -x on the function before the change is as follows: 0000000000000086 l F .text.unlikely 0000000000000739 thermal_of_build_thermal_zone And after the change it is as follows: 0000000000000000 l F .init.text 0000000000000734 thermal_of_build_thermal_zone Done with the help of Coccinelle. The semantic patch checks for local static non-init functions that are called from an __init function and are not called from any other function. Signed-off-by: Julia Lawall Signed-off-by: Eduardo Valentin drivers/thermal/of-thermal.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit dcc7597116c6713353522eb13c765063ff88bb89 Author: Dmitry Torokhov Date: Tue Apr 19 09:54:32 2016 -0700 Input: twl4030-vibra - do not reparent to grandparent For devm-managed input devices we should not modify input device's parent, otherwise automatic release of resources will not work properly. Signed-off-by: Dmitry Torokhov drivers/input/misc/twl4030-vibra.c | 1 - 1 file changed, 1 deletion(-) commit 4bfeefd085acf1ab70ecda6087fad6c32b2b065f Author: Dmitry Torokhov Date: Tue Apr 19 09:50:09 2016 -0700 Input: twl6040-vibra - do not reparent to grandparent For devm-managed input devices we should not modify input device's parent, otherwise automatic release of resources will not work properly. Tested-by: "H. Nikolaus Schaller" Signed-off-by: Dmitry Torokhov drivers/input/misc/twl6040-vibra.c | 1 - 1 file changed, 1 deletion(-) commit 8bbb6568428fa14c5bef120d443c20e0e7d52699 Author: Hans Verkuil Date: Fri Apr 15 08:58:10 2016 -0300 [media] davinci_vpfe: Revert "staging: media: davinci_vpfe: remove,unnecessary ret variable" This reverts commit afa5d19a2b5f ("staging: media: davinci_vpfe: remove unnecessary ret variable"). This patch is completely bogus and messed up the code big time. I'm not sure what was intended, but this isn't it. Cc: Thaissa Falbo Cc: Greg Kroah-Hartman Signed-off-by: Mauro Carvalho Chehab drivers/staging/media/davinci_vpfe/vpfe_video.c | 54 ++++++++++++++++--------- 1 file changed, 34 insertions(+), 20 deletions(-) commit 55f058e7574c3615dea4615573a19bdb258696c6 Merge: 9a0e3ee f709b45 Author: Linus Torvalds Date: Wed Apr 20 12:00:07 2016 -0700 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: "This fixes the following issues: - Incorrect output buffer size calculation in rsa-pkcs1pad - Uninitialised padding bytes on exported state in ccp driver - Potentially freed pointer used on completion callback in sha1-mb" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: ccp - Prevent information leakage on export crypto: sha1-mb - use corrcet pointer while completing jobs crypto: rsa-pkcs1pad - fix dst len commit d5468d7afaa9c9e961e150f0455a14a9f4872a98 Author: Vladis Dronov Date: Sun Jan 31 14:14:52 2016 -0200 [media] usbvision: revert commit 588afcc1 Commit 588afcc1c0e4 ("[media] usbvision fix overflow of interfaces array")' should be reverted, because: * "!dev->actconfig->interface[ifnum]" won't catch a case where the value is not NULL but some garbage. This way the system may crash later with GPF. * "(ifnum >= USB_MAXINTERFACES)" does not cover all the error conditions. "ifnum" should be compared to "dev->actconfig-> desc.bNumInterfaces", i.e. compared to the number of "struct usb_interface" kzalloc()-ed, not to USB_MAXINTERFACES. * There is a "struct usb_device" leak in this error path, as there is usb_get_dev(), but no usb_put_dev() on this path. * There is a bug of the same type several lines below with number of endpoints. The code is accessing hard-coded second endpoint ("interface->endpoint[1].desc") which may not exist. It would be great to handle this in the same patch too. * All the concerns above are resolved by already-accepted commit fa52bd50 ("[media] usbvision: fix crash on detecting device with invalid configuration") * Mailing list message: http://www.spinics.net/lists/linux-media/msg94832.html Signed-off-by: Vladis Dronov Signed-off-by: Hans Verkuil Cc: # for v4.5 Signed-off-by: Mauro Carvalho Chehab drivers/media/usb/usbvision/usbvision-video.c | 7 ------- 1 file changed, 7 deletions(-) commit df637193906a6b645d8678c748149a71852e63e9 Author: Andrew Goodbody Date: Wed Apr 20 16:14:51 2016 +0100 Revert "Prevent NUll pointer dereference with two PHYs on cpsw" This reverts commit cfe255600154f0072d4a8695590dbd194dfd1aeb This can result in a "Unable to handle kernel paging request" during boot. This was due to using an uninitialised struct member, data->slaves. Signed-off-by: Andrew Goodbody Tested-by: Tony Lindgren Signed-off-by: David S. Miller drivers/net/ethernet/ti/cpsw.c | 31 +++++++++++++++---------------- 1 file changed, 15 insertions(+), 16 deletions(-) commit 89e9e66ba1b3bde9d8ea90566c2aee20697ad681 Author: Sebastian Andrzej Siewior Date: Fri Apr 15 14:35:39 2016 +0200 futex: Handle unlock_pi race gracefully If userspace calls UNLOCK_PI unconditionally without trying the TID -> 0 transition in user space first then the user space value might not have the waiters bit set. This opens the following race: CPU0 CPU1 uval = get_user(futex) lock(hb) lock(hb) futex |= FUTEX_WAITERS .... unlock(hb) cmpxchg(futex, uval, newval) So the cmpxchg fails and returns -EINVAL to user space, which is wrong because the futex value is valid. To handle this (yes, yet another) corner case gracefully, check for a flag change and retry. [ tglx: Massaged changelog and slightly reworked implementation ] Fixes: ccf9e6a80d9e ("futex: Make unlock_pi more robust") Signed-off-by: Sebastian Andrzej Siewior Cc: stable@vger.kernel.org Cc: Davidlohr Bueso Cc: Darren Hart Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/1460723739-5195-1-git-send-email-bigeasy@linutronix.de Signed-off-by: Thomas Gleixner kernel/futex.c | 25 ++++++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-) commit 340ff60ae93a5db2b2be6f38868df9a1293b6007 Author: Horia Geant? Date: Tue Apr 19 20:33:48 2016 +0300 crypto: talitos - fix AEAD tcrypt tests After conversion to new AEAD interface, tcrypt tests fail as follows: [...] [ 1.145414] alg: aead: Test 1 failed on encryption for authenc-hmac-sha1-cbc-aes-talitos [ 1.153564] 00000000: 53 69 6e 67 6c 65 20 62 6c 6f 63 6b 20 6d 73 67 [ 1.160041] 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1.166509] 00000020: 00 00 00 00 [...] Fix them by providing the correct cipher in & cipher out pointers, i.e. must skip over associated data in src and dst S/G. While here, fix a problem with the HW S/G table index usage: tbl_off must be updated after the pointer to the table entries is set. Cc: # 4.3+ Fixes: aeb4c132f33d ("crypto: talitos - Convert to new AEAD interface") Reported-by: Jonas Eymann Signed-off-by: Horia Geant? Signed-off-by: Herbert Xu drivers/crypto/talitos.c | 46 ++++++++++++++++++++++++++++++---------------- 1 file changed, 30 insertions(+), 16 deletions(-) commit 89d124cb61b39900959e2839ac06b6339b6a54cb Author: Jonas Eymann Date: Tue Apr 19 20:33:47 2016 +0300 crypto: talitos - fix crash in talitos_cra_init() Conversion of talitos driver to the new AEAD interface hasn't been properly tested. AEAD algorithms crash in talitos_cra_init as follows: [...] [ 1.141095] talitos ffe30000.crypto: hwrng [ 1.145381] Unable to handle kernel paging request for data at address 0x00000058 [ 1.152913] Faulting instruction address: 0xc02accc0 [ 1.157910] Oops: Kernel access of bad area, sig: 11 [#1] [ 1.163315] SMP NR_CPUS=2 P1020 RDB [ 1.166810] Modules linked in: [ 1.169875] CPU: 0 PID: 1007 Comm: cryptomgr_test Not tainted 4.4.6 #1 [ 1.176415] task: db5ec200 ti: db4d6000 task.ti: db4d6000 [ 1.181821] NIP: c02accc0 LR: c02acd18 CTR: c02acd04 [ 1.186793] REGS: db4d7d30 TRAP: 0300 Not tainted (4.4.6) [ 1.192457] MSR: 00029000 CR: 95009359 XER: e0000000 [ 1.198585] DEAR: 00000058 ESR: 00000000 GPR00: c017bdc0 db4d7de0 db5ec200 df424b48 00000000 00000000 df424bfc db75a600 GPR08: df424b48 00000000 db75a628 db4d6000 00000149 00000000 c0044cac db5acda0 GPR16: 00000000 00000000 00000000 00000000 00000000 00000000 00000400 df424940 GPR24: df424900 00003083 00000400 c0180000 db75a640 c03e9f84 df424b40 df424b48 [ 1.230978] NIP [c02accc0] talitos_cra_init+0x28/0x6c [ 1.236039] LR [c02acd18] talitos_cra_init_aead+0x14/0x28 [ 1.241443] Call Trace: [ 1.243894] [db4d7de0] [c03e9f84] 0xc03e9f84 (unreliable) [ 1.249322] [db4d7df0] [c017bdc0] crypto_create_tfm+0x5c/0xf0 [ 1.255083] [db4d7e10] [c017beec] crypto_alloc_tfm+0x98/0xf8 [ 1.260769] [db4d7e40] [c0186a20] alg_test_aead+0x28/0xc8 [ 1.266181] [db4d7e60] [c0186718] alg_test+0x260/0x2e0 [ 1.271333] [db4d7ee0] [c0183860] cryptomgr_test+0x30/0x54 [ 1.276843] [db4d7ef0] [c0044d80] kthread+0xd4/0xd8 [ 1.281741] [db4d7f40] [c000e4a4] ret_from_kernel_thread+0x5c/0x64 [ 1.287930] Instruction dump: [ 1.290902] 38600000 4e800020 81230028 7c681b78 81490010 38e9ffc0 3929ffe8 554a073e [ 1.298691] 2b8a000a 7d474f9e 812a0008 91230030 <80e90058> 39270060 7c0004ac 7cc04828 Cc: # 4.3+ Fixes: aeb4c132f33d ("crypto: talitos - Convert to new AEAD interface") Signed-off-by: Jonas Eymann Fix typo - replaced parameter of __crypto_ahash_alg(): s/tfm/alg Remove checkpatch warnings. Add commit message. Signed-off-by: Horia Geant? Signed-off-by: Herbert Xu drivers/crypto/talitos.c | 41 +++++++++++++++++++++++++++-------------- 1 file changed, 27 insertions(+), 14 deletions(-) commit 2fee7d5b08b6419bb59de9e875d895e3a6e7bf5a Author: Masahiro Yamada Date: Wed Apr 20 10:23:31 2016 +0900 arm64: spin-table: add missing of_node_put() Since of_get_cpu_node() increments refcount, the node should be put. Signed-off-by: Masahiro Yamada Acked-by: Will Deacon Signed-off-by: Catalin Marinas arch/arm64/kernel/smp_spin_table.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) commit 9859a971ca228725425238756ee89c6133306ec8 Author: Lu, Han Date: Wed Apr 20 10:08:43 2016 +0800 ALSA: hda - add PCI ID for Intel Broxton-T Add HD Audio Device PCI ID for the Intel Broxton-T platform. It is an HDA Intel PCH controller. Signed-off-by: Lu, Han Cc: Signed-off-by: Takashi Iwai sound/pci/hda/hda_intel.c | 3 +++ 1 file changed, 3 insertions(+) commit 38740a5b87d53ceb89eb2c970150f6e94e00373a Author: Lars-Peter Clausen Date: Thu Apr 14 17:01:17 2016 +0200 usb: gadget: f_fs: Fix use-after-free When using asynchronous read or write operations on the USB endpoints the issuer of the IO request is notified by calling the ki_complete() callback of the submitted kiocb when the URB has been completed. Calling this ki_complete() callback will free kiocb. Make sure that the structure is no longer accessed beyond that point, otherwise undefined behaviour might occur. Fixes: 2e4c7553cd6f ("usb: gadget: f_fs: add aio support") Cc: # v3.15+ Signed-off-by: Lars-Peter Clausen Signed-off-by: Felipe Balbi drivers/usb/gadget/function/f_fs.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 9c995cc9a206a008699da82f6cd01e9b2615649a Author: Jorgen Hansen Date: Mon Apr 18 23:58:52 2016 -0700 VSOCK: Only check error on skb_recv_datagram when skb is NULL If skb_recv_datagram returns an skb, we should ignore the err value returned. Otherwise, datagram receives will return EAGAIN when they have to wait for a datagram. Acked-by: Adit Ranadive Signed-off-by: Jorgen Hansen Signed-off-by: David S. Miller net/vmw_vsock/vmci_transport.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) commit 2309236c13feae619572324efd3e910e66ef6bd0 Author: Konstantin Khlebnikov Date: Mon Apr 18 14:37:10 2016 +0300 cls_cgroup: get sk_classid only from full sockets skb->sk could point to timewait or request socket which has no sk_classid. Detected as "BUG: KASAN: slab-out-of-bounds in cls_cgroup_classify". Signed-off-by: Konstantin Khlebnikov Acked-by: Eric Dumazet Signed-off-by: David S. Miller include/net/cls_cgroup.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 851b10d60879539bec8acecb35ed361393399282 Author: Konstantin Khlebnikov Date: Mon Apr 18 14:34:05 2016 +0300 net/mlx4_en: do batched put_page using atomic_sub This patch fixes couple error paths after allocation failures. Atomic set of page reference counter is safe only if it is zero, otherwise set can race with any speculative get_page_unless_zero. Signed-off-by: Konstantin Khlebnikov Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/en_rx.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 04aeb56a173282210c5dab5c9b3071fa3613806f Author: Konstantin Khlebnikov Date: Mon Apr 18 14:33:54 2016 +0300 net/mlx4_en: allocate non 0-order pages for RX ring with __GFP_NOMEMALLOC High order pages are optional here since commit 51151a16a60f ("mlx4: allow order-0 memory allocations in RX path"), so here is no reason for depleting reserves. Generic __netdev_alloc_frag() implements the same logic. Signed-off-by: Konstantin Khlebnikov Acked-by: Eric Dumazet Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/en_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9a0e3eea25d3ab267aff9d4eaed83fbe46d989d0 Merge: 12566cc 67245ff Author: Linus Torvalds Date: Tue Apr 19 16:36:18 2016 -0700 Merge branch 'ptmx-cleanup' Merge the ptmx internal interface cleanup branch. This doesn't change semantics, but it should be a sane basis for eventually getting the multi-instance devpts code into some sane shape where we can get rid of the kernel config option. Which we can hopefully get done next merge window.. * ptmx-cleanup: devpts: clean up interface to pty drivers commit c531fb27e9699eaee478ee5686a3cca5dee73602 Author: Geert Uytterhoeven Date: Mon Jan 11 19:41:12 2016 +0100 ARM: shmobile: timer: Fix preset_lpj leading to too short delays On all shmobile ARM SoCs, loop-based delays may complete early, which can be after only 1/3 (Cortex A9) or 1/2 (Cortex A7 or A15) of the minimum required time. This is caused by calculating preset_lpj based on incorrect assumptions about the number of clock cycles per loop: - All of Cortex A7, A9, and A15 run __loop_delay() at 1 loop per CPU clock cycle, - As of commit 11d4bb1bd067f9d0 ("ARM: 7907/1: lib: delay-loop: Add align directive to fix BogoMIPS calculation"), Cortex A8 runs __loop_delay() at 1 loop per 2 instead of 3 CPU clock cycles. On SoCs with Cortex A7 and/or A15 CPU cores, this went unnoticed, as delays use the ARM arch timer if available. R-Car Gen2 doesn't work if the arch timer is disabled. However, APE6 can be used without the arch timer. Signed-off-by: Geert Uytterhoeven Signed-off-by: Simon Horman arch/arm/mach-shmobile/timer.c | 28 +++++++++++----------------- 1 file changed, 11 insertions(+), 17 deletions(-) commit 01638a7f5ef967e94e8aff455874d62e12fe32ed Author: Sjoerd Simons Date: Wed Apr 6 21:32:06 2016 +0200 Revert "ARM: dts: porter: Enable SCIF_CLK frequency and pins" This reverts commit 19417bd9c511 ("ARM: dts: porter: Enable SCIF_CLK frequency and pins") as according to http://elinux.org/File:R-CarM2-KOELSCH_PORTER-B_PORTER_C_Comparison.pdf the external oscillator for SCIF_CLK is not mounted on the porter boards. Signed-off-by: Sjoerd Simons Acked-by: Geert Uytterhoeven Signed-off-by: Simon Horman arch/arm/boot/dts/r8a7791-porter.dts | 13 ------------- 1 file changed, 13 deletions(-) commit ac6908b3049397b10bcfd8143d79cbdbbd266f02 Author: Sjoerd Simons Date: Wed Apr 6 14:52:53 2016 +0200 ARM: dts: r8a7791: Don't disable referenced optional clocks clk_get on a disabled clock node will return EPROBE_DEFER, which can cause drivers to be deferred forever if such clocks are referenced in their clocks property. Update the various disabled external clock nodes to default to a frequency of 0, but don't disable them to prevent this. Signed-off-by: Sjoerd Simons Reviewed-by: Geert Uytterhoeven Signed-off-by: Simon Horman arch/arm/boot/dts/r8a7791-koelsch.dts | 1 + arch/arm/boot/dts/r8a7791-porter.dts | 1 + arch/arm/boot/dts/r8a7791.dtsi | 5 +---- 3 files changed, 3 insertions(+), 4 deletions(-) commit 5d07163334ba016c053b033cd0bb3c92d7dc0229 Author: Aubrey Li Date: Thu Mar 31 14:28:09 2016 -0500 platform:x86 decouple telemetry driver from the optional IPC resources Currently the optional IPC resources prevent telemetry driver from probing if these resources are not in ACPI table. This patch decouples telemetry driver from these optional resources, so that telemetry driver has dependency only on the necessary ACPI resources. Signed-off-by: Aubrey Li Signed-off-by: Darren Hart drivers/platform/x86/intel_pmc_ipc.c | 48 ++++++++++++++++------------------ drivers/platform/x86/intel_punit_ipc.c | 48 ++++++++++++++++++++++------------ 2 files changed, 54 insertions(+), 42 deletions(-) commit de3df8a986b635082a1d94bae2c361d043c57106 Author: Takashi Iwai Date: Tue Apr 19 22:07:50 2016 +0200 ALSA: hda - Keep powering up ADCs on Cirrus codecs Although one weird behavior about the input path (inconsistent D0/D3 switch) on Cirrus CS420x codecs was fixed in the previous commit, there is still an issue on some Mac machines: the capture stream stalls when switching the ADCs on the fly. More badly, this keeps stuck until the next reboot. The dynamic ADC switching is already a bit fragile and assuming optimistically that the chip accepts the frequent power changes. On Cirrus codecs, this doesn't seem applicable. As a quick workaround, we pin down the ADCs to keep up in D0 when spec->dyn_adc_switch is set. In this way, the ADCs are kept up only for the system that were confirmed to be broken. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=116171 Cc: # v4.4+ Signed-off-by: Takashi Iwai sound/pci/hda/patch_cirrus.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit ac36a881b72a1e9831f1c59abf935868c90685cf Author: Vladimir Murzin Date: Tue Apr 19 12:35:55 2016 +0100 ARM: 8564/1: fix cpu feature extracting helper Commit b8c9592 "ARM: 8318/1: treat CPU feature register fields as signed quantities" introduced helper to extract signed quantities of 4-bit blocks. However, with a current code feature with value 0b1000 isn't rejected as negative. So fix the "if" condition. Reported-by: Jonathan Brawn Signed-off-by: Vladimir Murzin Acked-by: Ard Biesheuvel Signed-off-by: Russell King arch/arm/include/asm/cputype.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 03f1217e5fafac8eb9e28aa8d04a67b6db1e435b Author: Vladimir Murzin Date: Tue Apr 19 12:35:20 2016 +0100 ARM: 8563/1: fix demoting HWCAP_SWP Commit b8c9592 "ARM: 8318/1: treat CPU feature register fields as signed quantities" accidentally altered cpuid register used to demote HWCAP_SWP. ARM ARM says that SyncPrim_instrs bits in ID_ISAR3 should be used with SynchPrim_instrs_frac from ID_ISAR4. So, follow this rule. Signed-off-by: Vladimir Murzin Acked-by: Ard Biesheuvel Signed-off-by: Russell King arch/arm/kernel/setup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5f7fb6f1e514e0ed47aee97752d6ae10491b4841 Author: H. Nikolaus Schaller Date: Mon Apr 18 14:47:14 2016 -0700 Input: twl6040-vibra - ignore return value of schedule_work Returning ret is wrong. And checking for an error as well. User space may call multiple times until the work is really scheduled. twl4030-vibra.c also ignores the return value. Signed-off-by: H. Nikolaus Schaller Signed-off-by: Dmitry Torokhov drivers/input/misc/twl6040-vibra.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit 52dee2c9f0850704327d976ea5c5fa7f4696dab5 Author: H. Nikolaus Schaller Date: Mon Apr 18 14:46:30 2016 -0700 Input: twl6040-vibra - fix NULL pointer dereference by removing workqueue commit 21fb9f0d5e91 ("Input: twl6040-vibra - use system workqueue") says that it switches to use the system workqueue but it did neither - remove the workqueue struct variable - replace code to really use the system workqueue Instead it calls queue_work() on uninitialized info->workqueue. The result is a NULL pointer dereference in vibra_play(). Solution: use schedule_work Signed-off-by: H. Nikolaus Schaller Signed-off-by: Dmitry Torokhov drivers/input/misc/twl6040-vibra.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 3d51ae172d759198b2e47e104c31a92d20d17927 Author: Tony Lindgren Date: Tue Apr 19 08:01:05 2016 -0700 Revert "ARM: OMAP: Catch callers of revision information prior to it being populated" This reverts commit 571afb4c8a4bbe88541364e7f6827340562f2736. arch/arm/mach-omap1/id.c | 1 - arch/arm/mach-omap2/id.c | 1 - 2 files changed, 2 deletions(-) commit 6687659568e2ec5b3ac24b39c5d26ce8b9d90434 Author: Davidlohr Bueso Date: Sun Apr 17 23:31:41 2016 -0700 locking/pvqspinlock: Fix division by zero in qstat_read() While playing with the qstat statistics (in /qlockstat/) I ran into the following splat on a VM when opening pv_hash_hops: divide error: 0000 [#1] SMP ... RIP: 0010:[] [] qstat_read+0x12e/0x1e0 ... Call Trace: [] ? mem_cgroup_commit_charge+0x6c/0xd0 [] ? page_add_new_anon_rmap+0x8c/0xd0 [] ? handle_mm_fault+0x1439/0x1b40 [] ? do_mmap+0x449/0x550 [] ? __vfs_read+0x23/0xd0 [] ? rw_verify_area+0x52/0xd0 [] ? vfs_read+0x81/0x120 [] ? SyS_read+0x42/0xa0 [] ? entry_SYSCALL_64_fastpath+0x1e/0xa8 Fix this by verifying that qstat_pv_kick_unlock is in fact non-zero, similarly to what the qstat_pv_latency_wake case does, as if nothing else, this can come from resetting the statistics, thus having 0 kicks should be quite valid in this context. Signed-off-by: Davidlohr Bueso Reviewed-by: Waiman Long Cc: Andrew Morton Cc: Linus Torvalds Cc: Paul E. McKenney Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: dave@stgolabs.net Cc: waiman.long@hpe.com Link: http://lkml.kernel.org/r/1460961103-24953-1-git-send-email-dave@stgolabs.net Signed-off-by: Ingo Molnar kernel/locking/qspinlock_stat.h | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit a19cad6d66823ddd54b0e7c88d7bddd307cb1161 Merge: c3b46c7 1342e0b7 Author: Ingo Molnar Date: Tue Apr 19 08:41:59 2016 +0200 Merge tag 'perf-urgent-for-mingo-20160418' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull a perf/urgent fix from Arnaldo Carvalho de Melo: - Fix segfault tracing transactions in Intel PT (Adrian Hunter) Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit f077b73682910bc7dc9439e50e7b1ad97f28f3f1 Author: Greg Kroah-Hartman Date: Tue Apr 19 15:17:37 2016 +0900 Revert "serial: 8250: Add hardware dependency to RT288X option" This reverts commit 8d2acdb9fc3a544ab0442634531834d6007b5467. It's causing problems, and somehow I missed that Peter didn't like it at all :( So revert it for now until it gets sorted out. Reported-by: Mason Cc: Peter Hurley Cc: Jean Delvare Cc: Mans Rullgard Cc: Jiri Slaby Cc: John Crispin Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org drivers/tty/serial/8250/Kconfig | 1 - 1 file changed, 1 deletion(-) commit 0c66940d584d1aac92f6a78460dc0ba2efd3b7ba Author: Yegor Yefremov Date: Thu Mar 24 09:03:45 2016 +0100 tty/serial/8250: fix RS485 half-duplex RX When in half-duplex mode RX will be disabled before TX, but not enabled after deactivating transmitter. This patch enables UART_IER_RLSI and UART_IER_RDI interrupts after TX is over. Cc: Matwey V. Kornilov Signed-off-by: Yegor Yefremov Fixes: e490c9144cfa ("tty: Add software emulated RS485 support for 8250") Acked-by: Matwey V. Kornilov Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/8250/8250_port.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) commit 9220ebffda4aa23fe683c9ca6c94fb72d7c131c2 Author: Sudip Mukherjee Date: Mon Apr 11 20:23:31 2016 +0530 Revert "serial-uartlite: Constify uartlite_be/uartlite_le" This reverts commit 2905697a82eaf20606ced164d853b52d1b94aaa8. The commit introduced two build warnings: drivers/tty/serial/uartlite.c: In function ‘ulite_request_port’: drivers/tty/serial/uartlite.c:348:21: warning: assignment discards ‘const’ qualifier from pointer target type port->private_data = &uartlite_be; ^ drivers/tty/serial/uartlite.c:354:22: warning: assignment discards ‘const’ qualifier from pointer target type port->private_data = &uartlite_le; ^ Signed-off-by: Sudip Mukherjee Cc: Maarten Brock Cc: Arnd Bergmann Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/uartlite.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 12566cc35d0e68308bde7aad615743d560cb097b Merge: 95d0c42 67e6587 Author: Linus Torvalds Date: Mon Apr 18 19:52:47 2016 -0700 Merge tag 'pci-v4.6-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fixes from Bjorn Helgaas: "These are fixes for two issues: - The VPD parsing code we added for v4.6 keeps some devices from crashing, but also keeps cxgb4 from reading non-standard extra VPD data that is relies on. Hariprasad added a way for the driver to specify how much VPD is valid. - The i.MX6 active-low reset GPIO support we added in v4.5 caused regressions on some boards, so we're reverting that. VPD: Add pci_set_vpd_size() (Hariprasad Shenai) cxgb4: Set VPD size so we can read both VPD structures (Hariprasad Shenai) Freescale i.MX6 host bridge driver: Revert "PCI: imx6: Add support for active-low reset GPIO" (Fabio Estevam)" * tag 'pci-v4.6-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: cxgb4: Set VPD size so we can read both VPD structures PCI: Add pci_set_vpd_size() to set VPD size Revert "PCI: imx6: Add support for active-low reset GPIO" commit c9d9c929e6741118776eb0f385339d3c2b84d5f8 Author: Rafael J. Wysocki Date: Sun Apr 10 05:59:33 2016 +0200 cpufreq: Abort cpufreq_update_current_freq() for cpufreq_suspended set Since governor operations are generally skipped if cpufreq_suspended is set, cpufreq_start_governor() should do nothing in that case. That function is called in the cpufreq_online() path, and may also be called from cpufreq_offline() in some cases, which are invoked by the nonboot CPUs disabing/enabling code during system suspend to RAM and resume. That happens when all devices have been suspended, so if the cpufreq driver relies on things like I2C to get the current frequency, it may not be ready to do that then. To prevent problems from happening for this reason, make cpufreq_update_current_freq(), which is the only function invoked by cpufreq_start_governor() that doesn't check cpufreq_suspended already, return 0 upfront if cpufreq_suspended is set. Fixes: 3bbf8fe3ae08 (cpufreq: Always update current frequency before startig governor) Signed-off-by: Rafael J. Wysocki Acked-by: Viresh Kumar drivers/cpufreq/cpufreq.c | 3 +++ 1 file changed, 3 insertions(+) commit 67245ff332064c01b760afa7a384ccda024bfd24 Author: Linus Torvalds Date: Sat Apr 16 15:16:07 2016 -0700 devpts: clean up interface to pty drivers This gets rid of the horrible notion of having that struct inode *ptmx_inode be the linchpin of the interface between the pty code and devpts. By de-emphasizing the ptmx inode, a lot of things actually get cleaner, and we will have a much saner way forward. In particular, this will allow us to associate with any particular devpts instance at open-time, and not be artificially tied to one particular ptmx inode. The patch itself is actually fairly straightforward, and apart from some locking and return path cleanups it's pretty mechanical: - the interfaces that devpts exposes all take "struct pts_fs_info *" instead of "struct inode *ptmx_inode" now. NOTE! The "struct pts_fs_info" thing is a completely opaque structure as far as the pty driver is concerned: it's still declared entirely internally to devpts. So the pty code can't actually access it in any way, just pass it as a "cookie" to the devpts code. - the "look up the pts fs info" is now a single clear operation, that also does the reference count increment on the pts superblock. So "devpts_add/del_ref()" is gone, and replaced by a "lookup and get ref" operation (devpts_get_ref(inode)), along with a "put ref" op (devpts_put_ref()). - the pty master "tty->driver_data" field now contains the pts_fs_info, not the ptmx inode. - because we don't care about the ptmx inode any more as some kind of base index, the ref counting can now drop the inode games - it just gets the ref on the superblock. - the pts_fs_info now has a back-pointer to the super_block. That's so that we can easily look up the information we actually need. Although quite often, the pts fs info was actually all we wanted, and not having to look it up based on some magical inode makes things more straightforward. In particular, now that "devpts_get_ref(inode)" operation should really be the *only* place we need to look up what devpts instance we're associated with, and we do it exactly once, at ptmx_open() time. The other side of this is that one ptmx node could now be associated with multiple different devpts instances - you could have a single /dev/ptmx node, and then have multiple mount namespaces with their own instances of devpts mounted on /dev/pts/. And that's all perfectly sane in a model where we just look up the pts instance at open time. This will eventually allow us to get rid of our odd single-vs-multiple pts instance model, but this patch in itself changes no semantics, only an internal binding model. Cc: Eric Biederman Cc: Peter Anvin Cc: Andy Lutomirski Cc: Al Viro Cc: Peter Hurley Cc: Serge Hallyn Cc: Willy Tarreau Cc: Aurelien Jarno Cc: Alan Cox Cc: Jann Horn Cc: Greg KH Cc: Jiri Slaby Cc: Florian Weimer Signed-off-by: Linus Torvalds drivers/tty/pty.c | 63 ++++++++++++++++++++++------------------------- fs/devpts/inode.c | 49 ++++++++++++++++++------------------ include/linux/devpts_fs.h | 34 ++++++++----------------- 3 files changed, 64 insertions(+), 82 deletions(-) commit 8e6cb470bac6b1e7afa4642a40a71f9bcd066242 Author: Marek Vasut Date: Mon Apr 18 18:30:05 2016 +0200 iio:adc:at91-sama5d2: Repair crash on module removal The driver never calls platform_set_drvdata() , so platform_get_drvdata() in .remove returns NULL and thus $indio_dev variable in .remove is NULL. Then it's only a matter of dereferencing the indio_dev variable to make the kernel blow as seen below. This patch adds the platform_set_drvdata() call to fix the problem. root@armhf:~# rmmod at91-sama5d2_adc Unable to handle kernel NULL pointer dereference at virtual address 000001d4 pgd = dd57c000 [000001d4] *pgd=00000000 Internal error: Oops: 5 [#1] ARM Modules linked in: at91_sama5d2_adc(-) CPU: 0 PID: 1334 Comm: rmmod Not tainted 4.6.0-rc3-next-20160418+ #3 Hardware name: Atmel SAMA5 task: dd4fcc40 ti: de910000 task.ti: de910000 PC is at mutex_lock+0x4/0x24 LR is at iio_device_unregister+0x14/0x6c pc : [] lr : [] psr: a00d0013 sp : de911f00 ip : 00000000 fp : be898bd8 r10: 00000000 r9 : de910000 r8 : c0107724 r7 : 00000081 r6 : bf001048 r5 : 000001d4 r4 : 00000000 r3 : bf000000 r2 : 00000000 r1 : 00000004 r0 : 000001d4 Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 10c53c7d Table: 3d57c059 DAC: 00000051 Process rmmod (pid: 1334, stack limit = 0xde910208) Stack: (0xde911f00 to 0xde912000) 1f00: bf000000 00000000 df5c7e10 bf000010 bf000000 df5c7e10 df5c7e10 c0351ca8 1f20: c0351c84 df5c7e10 bf001048 c0350734 bf001048 df5c7e10 df5c7e44 c035087c 1f40: bf001048 7f62dd4c 00000800 c034fb30 bf0010c0 c0158ee8 de910000 31397461 1f60: 6d61735f 32643561 6364615f 00000000 de911f90 de910000 de910000 00000000 1f80: de911fb0 10c53c7d de911f9c c05f33d8 de911fa0 00910000 be898ecb 7f62dd10 1fa0: 00000000 c0107560 be898ecb 7f62dd10 7f62dd4c 00000800 6f844800 6f844800 1fc0: be898ecb 7f62dd10 00000000 00000081 00000000 7f62dd10 be898bd8 be898bd8 1fe0: b6eedab1 be898b6c 7f61056b b6eedab6 000d0030 7f62dd4c 00000000 00000000 [] (mutex_lock) from [] (iio_device_unregister+0x14/0x6c) [] (iio_device_unregister) from [] (at91_adc_remove+0x10/0x3c [at91_sama5d2_adc]) [] (at91_adc_remove [at91_sama5d2_adc]) from [] (platform_drv_remove+0x24/0x3c) [] (platform_drv_remove) from [] (__device_release_driver+0x84/0x110) [] (__device_release_driver) from [] (driver_detach+0x8c/0x90) [] (driver_detach) from [] (bus_remove_driver+0x4c/0xa0) [] (bus_remove_driver) from [] (SyS_delete_module+0x110/0x1d0) [] (SyS_delete_module) from [] (ret_fast_syscall+0x0/0x3c) Code: e3520001 1affffd5 eafffff4 f5d0f000 (e1902f9f) ---[ end trace 86914d7ad3696fca ]--- Signed-off-by: Marek Vasut Cc: Ludovic Desroches Cc: Signed-off-by: Jonathan Cameron drivers/iio/adc/at91-sama5d2_adc.c | 2 ++ 1 file changed, 2 insertions(+) commit 95d0c4277c27520cabdc40646f5a2e507fcd315a Merge: c3b46c7 2fd9227 Author: Linus Torvalds Date: Mon Apr 18 10:13:31 2016 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Martin Schwidefsky: "A couple of bug fixes" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390: add CPU_BIG_ENDIAN config option s390/spinlock: avoid yield to non existent cpu s390/dcssblk: fix possible deadlock in remove vs. per-device attributes s390/seccomp: include generic seccomp header file s390/pci: add extra padding to function measurement block s390/scm_blk: fix deadlock for requests != REQ_TYPE_FS commit dfc4f59d901bf72f93280b7c142c8ad846359c6f Author: Alex Deucher Date: Mon Apr 18 11:26:26 2016 -0400 drm/radeon: print a message if ATPX dGPU power control is missing It will help identify problematic boards. Signed-off-by: Alex Deucher drivers/gpu/drm/radeon/radeon_atpx_handler.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit adb4907007445ab9d392f4ce398cd7fa5d26612b Author: Ard Biesheuvel Date: Fri Apr 15 12:11:21 2016 +0200 arm64: fix invalidation of wrong __early_cpu_boot_status cacheline In head.S, the str_l macro, which takes a source register, a symbol name and a temp register, is used to store a status value to the variable __early_cpu_boot_status. Subsequently, the value of the temp register is reused to invalidate any cachelines covering this variable. However, since str_l resolves to adrp \tmp, \sym str \src, [\tmp, :lo12:\sym] the temp register never actually holds the address of the variable but only of the 4 KB window that covers it, and reusing it leads to the wrong cacheline being invalidated. So instead, take the address explicitly before doing the store, and reuse that value to perform the cache invalidation. Fixes: bb9052744f4b ("arm64: Handle early CPU boot failures") Signed-off-by: Ard Biesheuvel Acked-by: Mark Rutland Acked-by: Suzuki K Poulose Signed-off-by: Catalin Marinas arch/arm64/kernel/head.S | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit bfaddd9fc8ac048b99475f000dbef6f08297417f Author: Alex Deucher Date: Mon Apr 18 11:19:19 2016 -0400 Revert "drm/radeon: disable runtime pm on PX laptops without dGPU power control" This reverts commit e64c952efb8e0c15ae82cec8e455ab4910690ef1. ATPX is the ACPI method for controlling AMD PowerXpress laptops. There are flags to indicate which methods are supported. If the dGPU power down flag is not supported, the driver needs to implement the dGPU power down manually. We had previously always forced the driver to assume the ATPX dGPU power down was present, but this causes problems on boards where it is not, leading to GPU hangs when attempting to power down the dGPU. Manual dGPU power down is not currently supported in the Linux driver. Some laptops indicate that the ATPX dGPU power down method is not present, but it actually apparently is. I'm not sure if this is a bios bug and it should be set or if there is a reason it was unset and the method should not be used. This is not an issue on other OSes since both the ATPX and the manual driver power down methods are supported. This is apparently fairly widespread, so just revert for now. bugs: https://bugzilla.kernel.org/show_bug.cgi?id=115321 https://bugzilla.kernel.org/show_bug.cgi?id=116581 https://bugzilla.kernel.org/show_bug.cgi?id=116251 Cc: stable@vger.kernel.org drivers/gpu/drm/radeon/radeon_atpx_handler.c | 8 ++++---- drivers/gpu/drm/radeon/radeon_device.c | 8 +------- 2 files changed, 5 insertions(+), 11 deletions(-) commit 8f99455587855a5f79af08e40327ca40ab5f1999 Author: Alex Deucher Date: Wed Apr 13 23:37:42 2016 -0400 drm/amdgpu/acp: fix resume on CZ systems with AZ audio Nothing to do on resume on systems with AZ audio. Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 4 ++++ 1 file changed, 4 insertions(+) commit bcb31eba4a4ea356fd61cbd5dec5511c3883f57e Author: Alex Deucher Date: Thu Apr 14 14:15:16 2016 -0400 drm/radeon: add a quirk for a XFX R9 270X bug: https://bugs.freedesktop.org/show_bug.cgi?id=76490 Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/radeon/si_dpm.c | 1 + 1 file changed, 1 insertion(+) commit fe0d36e03a08a6f88e5cb9f81c3b819f797e8024 Author: Alex Deucher Date: Thu Apr 14 13:16:35 2016 -0400 drm/radeon: print pci revision as well as pci ids on driver load The pci revision id is useful in debugging certain things as it's part of how SKUs are defined on newer asics. Signed-off-by: Alex Deucher drivers/gpu/drm/radeon/radeon_device.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 1342e0b7a6c1a060c593037fbac9f4b717f1cb3b Author: Adrian Hunter Date: Mon Apr 18 13:57:48 2016 +0300 perf intel-pt: Fix segfault tracing transactions Tracing a workload that uses transactions gave a seg fault as follows: perf record -e intel_pt// workload perf report Program received signal SIGSEGV, Segmentation fault. 0x000000000054b58c in intel_pt_reset_last_branch_rb (ptq=0x1a36110) at util/intel-pt.c:929 929 ptq->last_branch_rb->nr = 0; (gdb) p ptq->last_branch_rb $1 = (struct branch_stack *) 0x0 (gdb) up 1148 intel_pt_reset_last_branch_rb(ptq); (gdb) l 1143 if (ret) 1144 pr_err("Intel Processor Trace: failed to deliver transaction event 1145 ret); 1146 1147 if (pt->synth_opts.callchain) 1148 intel_pt_reset_last_branch_rb(ptq); 1149 1150 return ret; 1151 } 1152 (gdb) p pt->synth_opts.callchain $2 = true (gdb) (gdb) bt #0 0x000000000054b58c in intel_pt_reset_last_branch_rb (ptq=0x1a36110) #1 0x000000000054c1e0 in intel_pt_synth_transaction_sample (ptq=0x1a36110) #2 0x000000000054c5b2 in intel_pt_sample (ptq=0x1a36110) Caused by checking the 'callchain' flag when it should have been the 'last_branch' flag. Fix that. Reported-by: Andi Kleen Signed-off-by: Adrian Hunter Cc: Jiri Olsa Cc: stable@vger.kernel.org # v4.4+ Fixes: f14445ee72c5 ("perf intel-pt: Support generating branch stack") Link: http://lkml.kernel.org/r/1460977068-11566-1-git-send-email-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/intel-pt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4705e02498d6d5a7ab98dfee9595cd5e91db2017 Author: Anton Blanchard Date: Fri Apr 15 12:08:19 2016 +1000 powerpc: Update TM user feature bits in scan_features() We need to update the user TM feature bits (PPC_FEATURE2_HTM and PPC_FEATURE2_HTM) to mirror what we do with the kernel TM feature bit. At the moment, if firmware reports TM is not available we turn off the kernel TM feature bit but leave the userspace ones on. Userspace thinks it can execute TM instructions and it dies trying. This (together with a QEMU patch) fixes PR KVM, which doesn't currently support TM. Signed-off-by: Anton Blanchard Cc: stable@vger.kernel.org Signed-off-by: Michael Ellerman arch/powerpc/kernel/prom.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit beff82374b259d726e2625ec6c518a5f2613f0ae Author: Anton Blanchard Date: Fri Apr 15 12:07:24 2016 +1000 powerpc: Update cpu_user_features2 in scan_features() scan_features() updates cpu_user_features but not cpu_user_features2. Amongst other things, cpu_user_features2 contains the user TM feature bits which we must keep in sync with the kernel TM feature bit. Signed-off-by: Anton Blanchard Cc: stable@vger.kernel.org Signed-off-by: Michael Ellerman arch/powerpc/kernel/prom.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) commit 6997e57d693b07289694239e52a10d2f02c3a46f Author: Anton Blanchard Date: Fri Apr 15 12:06:13 2016 +1000 powerpc: scan_features() updates incorrect bits for REAL_LE The REAL_LE feature entry in the ibm_pa_feature struct is missing an MMU feature value, meaning all the remaining elements initialise the wrong values. This means instead of checking for byte 5, bit 0, we check for byte 0, bit 0, and then we incorrectly set the CPU feature bit as well as MMU feature bit 1 and CPU user feature bits 0 and 2 (5). Checking byte 0 bit 0 (IBM numbering), means we're looking at the "Memory Management Unit (MMU)" feature - ie. does the CPU have an MMU. In practice that bit is set on all platforms which have the property. This means we set CPU_FTR_REAL_LE always. In practice that seems not to matter because all the modern cpus which have this property also implement REAL_LE, and we've never needed to disable it. We're also incorrectly setting MMU feature bit 1, which is: #define MMU_FTR_TYPE_8xx 0x00000002 Luckily the only place that looks for MMU_FTR_TYPE_8xx is in Book3E code, which can't run on the same cpus as scan_features(). So this also doesn't matter in practice. Finally in the CPU user feature mask, we're setting bits 0 and 2. Bit 2 is not currently used, and bit 0 is: #define PPC_FEATURE_PPC_LE 0x00000001 Which says the CPU supports the old style "PPC Little Endian" mode. Again this should be harmless in practice as no 64-bit CPUs implement that mode. Fix the code by adding the missing initialisation of the MMU feature. Also add a comment marking CPU user feature bit 2 (0x4) as reserved. It would be unsafe to start using it as old kernels incorrectly set it. Fixes: 44ae3ab3358e ("powerpc: Free up some CPU feature bits by moving out MMU-related features") Signed-off-by: Anton Blanchard Cc: stable@vger.kernel.org [mpe: Flesh out changelog, add comment reserving 0x4] Signed-off-by: Michael Ellerman arch/powerpc/include/uapi/asm/cputable.h | 1 + arch/powerpc/kernel/prom.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) commit afecb146d8d8a60a1dde9cdf570c278649617fde Author: Bastien Nocera Date: Mon Apr 18 11:10:42 2016 +0200 ALSA: hda/realtek - Add ALC3234 headset mode for Optiplex 9020m The Optiplex 9020m with Haswell-DT processor needs a quirk for the headset jack at the front of the machine to be able to use microphones. A quirk for this model was originally added in 3127899, but c77900e removed it in favour of a more generic version. Unfortunately, pin configurations can changed based on firmware/BIOS versions, and the generic version doesn't have any effect on newer versions of the machine/firmware anymore. With help from David Henningsson Signed-off-by: Bastien Nocera Tested-by: Bastien Nocera Cc: Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit 31318a922395ec9e78d6e2ddf70779355afc7594 Author: Ville Syrjälä Date: Thu Apr 14 14:39:02 2016 +0300 drm/i915: Use fw_domains_put_with_fifo() on HSW HSW still has the wake FIFO, so let's check it. Cc: Mika Kuoppala Cc: Deepak S Fixes: 05a2fb157e44 ("drm/i915: Consolidate forcewake code") Signed-off-by: Ville Syrjälä Link: http://patchwork.freedesktop.org/patch/msgid/1460633942-24013-1-git-send-email-ville.syrjala@linux.intel.com Cc: stable@vger.kernel.org Reviewed-by: Mika Kuoppala (cherry picked from commit 3d7d0c85e41afb5a05e98b3a8a72c38357f02594) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_uncore.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 1b3e885a05d4f0a35dde035724e7c6453d2cbe71 Author: Chris Wilson Date: Wed Apr 13 17:35:11 2016 +0100 drm/i915: Force ringbuffers to not be at offset 0 For reasons unknown Sandybridge GT1 (at least) will eventually hang when it encounters a ring wraparound at offset 0. The test case that reproduces the bug reliably forces a large number of interrupted context switches, thereby causing very frequent ring wraparounds, but there are similar bug reports in the wild with the same symptoms, seqno writes stop just before the wrap and the ringbuffer at address 0. It is also timing crucial, but adding various delays hasn't helped pinpoint where the window lies. Whether the fault is restricted to the ringbuffer itself or the GTT addressing is unclear, but moving the ringbuffer fixes all the hangs I have been able to reproduce. References: (e.g.) https://bugs.freedesktop.org/show_bug.cgi?id=93262 Testcase: igt/gem_exec_whisper/render-contexts-interruptible #snb-gt1 Signed-off-by: Chris Wilson Cc: stable@vger.kernel.org Acked-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/1460565315-7748-12-git-send-email-chris@chris-wilson.co.uk (cherry picked from commit a687a43a48f0f91ba37dce5a14b467258ed6f035) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_ringbuffer.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 537d3b10086ffae30efbc7c66777c0a08b58d3e6 Author: Michał Winiarski Date: Tue Apr 12 15:51:55 2016 +0200 drm/i915: Adjust size of PIPE_CONTROL used for gen8 render seqno write We started to use PIPE_CONTROL to write render ring seqno in order to combat seqno write vs interrupt generation problems. This was introduced by commit 7c17d377374d ("drm/i915: Use ordered seqno write interrupt generation on gen8+ execlists"). On gen8+ size of PIPE_CONTROL with Post Sync Operation should be 6 dwords. When we're using older 5-dword variant it's possible to observe inconsistent values written by PIPE_CONTROL with Post Sync Operation from user batches, resulting in rendering corruptions. v2: Fix BAT failures v3: Comments on alignment and thrashing high dword of seqno (Chris) v4: Updated commit msg (Mika) Testcase: igt/gem_pipe_control_store_loop/*-qword-write Issue: VIZ-7393 Cc: stable@vger.kernel.org Cc: Chris Wilson Cc: Mika Kuoppala Cc: Abdiel Janulgue Signed-off-by: Michał Winiarski Reviewed-by: Mika Kuoppala Reviewed-by: Chris Wilson Tested-by: Abdiel Janulgue Signed-off-by: Mika Kuoppala Link: http://patchwork.freedesktop.org/patch/msgid/1460469115-26002-1-git-send-email-michal.winiarski@intel.com (cherry picked from commit ce81a65c79d6012a384563caf76d47e28947a347) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_lrc.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit 510650e8b2ab965931b35e9813467439d4df0b9c Author: Mika Kuoppala Date: Tue Apr 5 15:56:17 2016 +0300 drm/i915/skl: Fix spurious gpu hang with gt3/gt4 revs Experiments with heaven 4.0 benchmark and skylake gt3e (rev 0xa) suggest that WaForceContextSaveRestoreNonCoherent is needed for all revs. Extending this to all revs cures a gpu hang with rev 0xa when running heaven4.0 gpu benchmark. We have been here before, with problems enabling gt4e and extending up to revision F0 instead of false claims of bspec of E0 only. See commit ("drm/i915/skl: Default to noncoherent access up to F0"). In retrospect we should have covered this with this big blanket back then already, as E0 vs F0 discrepancy was suspicious enough. Previously the WaForceEnableNonCoherent has been tied to context non-coherence, atleast in relevant hsds. So keep this tie and extended this alongside. Cc: Abdiel Janulgue Cc: Ben Widawsky Cc: Timo Aaltonen Cc: stable@vger.kernel.org Reported-by: Mike Lothian References: https://bugs.freedesktop.org/show_bug.cgi?id=93491 Signed-off-by: Mika Kuoppala Reviewed-by: Ben Widawsky Tested-by: Timo Aaltonen Link: http://patchwork.freedesktop.org/patch/msgid/1459860977-27751-2-git-send-email-mika.kuoppala@intel.com (cherry picked from commit 97ea6be161c55dec896b65c95157d953c330ae05) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_ringbuffer.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit d528a6a0f3fd346bd7cc2de611a4149b6ebaab41 Author: Mika Kuoppala Date: Tue Apr 5 15:56:16 2016 +0300 drm/i915/skl: Fix rc6 based gpu/system hang For all gt3 and gt4 skylake variants, extend the usage of WaRsDisableCoarsePowerGating for all revisions. Without this gt3 and gt4 skylakes up to atleast rev 0xa can gpu hang or system hang. Cc: Abdiel Janulgue Cc: Ben Widawsky Cc: Timo Aaltonen Cc: Reported-by: Mikael Djurfeldt References: https://bugs.freedesktop.org/show_bug.cgi?id=94161 Signed-off-by: Mika Kuoppala Reviewed-by: Ben Widawsky Tested-by: Timo Aaltonen Link: http://patchwork.freedesktop.org/patch/msgid/1459860977-27751-1-git-send-email-mika.kuoppala@intel.com (cherry picked from commit 185c66e57ce725afeb58a3cfa48547706af3a7af) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_drv.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit db9f9203e27495b2d151b695504e286eec026e9b Author: Chris Wilson Date: Tue Apr 5 15:00:00 2016 +0100 drm/i915/userptr: Hold mmref whilst calling get-user-pages Holding a reference to the containing task_struct is not sufficient to prevent the mm_struct from being reaped under memory pressure. If this happens whilst we are calling get_user_pages(), explosions erupt - sometimes an immediate GPF, sometimes page flag corruption. To prevent the target mm from being reaped as we are reading from it, acquire a reference before we begin. Testcase: igt/gem_shrink/*userptr Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Cc: Michał Winiarski Cc: stable@vger.kernel.org Reviewed-by: Michał Winiarski Link: http://patchwork.freedesktop.org/patch/msgid/1459864801-28606-2-git-send-email-chris@chris-wilson.co.uk (cherry picked from commit 40313f0cd0b711a7a5905e5182422799e157d8aa) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_gem_userptr.c | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-) commit d43f3ebf12f59c57782ec652da65ef61c2662b40 Author: Akash Goel Date: Fri Mar 11 14:56:42 2016 +0530 drm/i915: Fixup the free space logic in ring_prepare Currently for the case where there is enough space at the end of Ring buffer for accommodating only the base request, the wrapround is done immediately and as a result the base request gets added at the start of Ring buffer. But there may not be enough free space at the beginning to accommodate the base request, as before the wraparound, the wait was effectively done for the reserved_size free space from the start of Ring buffer. In such a case there is a potential of Ring buffer overflow, the instructions at the head of Ring (ACTHD) can get overwritten. Since the base request can fit in the remaining space, there is no need to wraparound immediately. The wraparound will anyway happen later when the reserved part starts getting used. Cc: Chris Wilson Signed-off-by: Akash Goel Signed-off-by: Chris Wilson Link: http://patchwork.freedesktop.org/patch/msgid/1457688402-10411-1-git-send-email-akash.goel@intel.com Reviewed-by: Chris Wilson Cc: stable@vger.kernel.org (cherry picked from commit 782f6bc0aba037436d6a04d19b23f8b61020a576) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_lrc.c | 6 +++--- drivers/gpu/drm/i915/intel_ringbuffer.c | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) commit 9aec6a08f1163fb24c23f9036891e1d5bab3f1be Author: Kumar, Mahesh Date: Wed Apr 6 08:26:39 2016 -0700 drm/i915/skl+: Use plane size for relative data rate calculation Use plane size for relative data rate calculation. don't always use pipe source width & height. adjust height & width according to rotation. use plane size for watermark calculations also. v2: Address Matt's comments. Use intel_plane_state->visible to avoid divide-by-zero error. Where FB was present but not visible so causing total data rate to be zero, hence divide-by-zero. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=93917 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=94044 Cc: drm-intel-fixes@lists.freedesktop.org Signed-off-by: Kumar, Mahesh Reviewed-by: Matt Roper Signed-off-by: Matt Roper Link: http://patchwork.freedesktop.org/patch/msgid/1459956399-1296-1-git-send-email-matthew.d.roper@intel.com (cherry picked from commit a280f7dd9f1a85eed242d0f62498bfc11520a1a3) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_pm.c | 42 +++++++++++++++++++++++++++-------------- 1 file changed, 28 insertions(+), 14 deletions(-) commit 9772b47a4c2916d645c551228b6085ea24acbe5d Author: Roger Quadros Date: Tue Apr 12 11:33:29 2016 +0300 usb: dwc3: gadget: Fix suspend/resume during device mode Gadget controller might not be always active during system suspend/resume as gadget driver might not have yet been loaded or might have been unloaded prior to system suspend. Check if we're active and only then perform necessary actions during suspend/resume. Signed-off-by: Roger Quadros Signed-off-by: Felipe Balbi drivers/usb/dwc3/gadget.c | 6 ++++++ 1 file changed, 6 insertions(+) commit e6bdf8195b4a43ebff71f25fc7ca5e436e79161a Author: Du, Changbin Date: Tue Apr 12 16:24:34 2016 +0800 usb: dwc3: fix memory leak of dwc->regset dwc->regset is allocated on dwc3_debugfs_init, and should be released on init failure or dwc3_debugfs_exit. Btw, The line "dwc->root = NULL" is unnecessary, so remove it. Signed-off-by: Du, Changbin [ felipe.balbi@linux.intel.com : add another err label for the new error condition ] Signed-off-by: Felipe Balbi drivers/usb/dwc3/debugfs.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit 5c4ad318de3b8e8680d654c82a254c4b65243739 Author: Felipe Balbi Date: Mon Apr 11 17:12:34 2016 +0300 usb: dwc3: core: fix PHY handling during suspend we need to power off the PHY during suspend and power it back on during resume. Signed-off-by: Felipe Balbi [nsekhar@ti.com: fix call to usb_phy_set_suspend() in dwc3_suspend()] Signed-off-by: Sekhar Nori Signed-off-by: Roger Quadros Signed-off-by: Felipe Balbi drivers/usb/dwc3/core.c | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) commit 45d49cb706e5d8f0ca5e868118b5d453afbb938f Author: Felipe Balbi Date: Mon Apr 11 17:12:33 2016 +0300 usb: dwc3: omap: fix up error path on probe() Even if pm_runtime_get*() fails, we *MUST* call pm_runtime_put_sync() before disabling PM. While at it, remove superfluous dwc3_omap_disable_irqs() in error path. Signed-off-by: Felipe Balbi [nsekhar@ti.com: patch description updates] Signed-off-by: Sekhar Nori Signed-off-by: Roger Quadros Signed-off-by: Felipe Balbi drivers/usb/dwc3/dwc3-omap.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) commit 138b8638bb43d4b85eeaacde9be9c687cc7e5de7 Author: John Youn Date: Fri Apr 8 14:46:31 2016 -0700 usb: gadget: composite: Clear reserved fields of SSP Dev Cap Set the reserved fields of the SuperSpeed Plus Device Capability descriptor to 0. Otherwise there might be stale data there which will cause USB CV to fail. Fixes: f228a8de242a ("usb: gadget: composite: Return SSP Dev Cap descriptor") Signed-off-by: John Youn Signed-off-by: Felipe Balbi drivers/usb/gadget/composite.c | 2 ++ 1 file changed, 2 insertions(+) commit 6e1c7d6103fe7031035cec321307c6356809adf4 Author: Adrian Hunter Date: Fri Apr 15 14:06:57 2016 +0300 mmc: sdhci-acpi: Reduce Baytrail eMMC/SD/SDIO hangs Baytrail eMMC/SD/SDIO host controllers have been known to hang. A change to a hardware setting has been found to reduce the occurrence of such hangs. This patch ensures the correct setting. This patch applies cleanly to v4.4+. It could go to earlier kernels also, so I will send backports to the stable list in due course. Signed-off-by: Adrian Hunter Cc: stable@vger.kernel.org # v4.4+ Signed-off-by: Ulf Hansson drivers/mmc/host/Kconfig | 1 + drivers/mmc/host/sdhci-acpi.c | 81 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 82 insertions(+) commit 4dacad61514494f2eba9e60d5b4aa71971dac6a1 Author: Vladimir Zapolskiy Date: Wed Mar 23 00:51:54 2016 +0200 omapfb: panel-sharp-ls037v7dw01: fix check of gpio_to_desc() return value The change fixes a check of gpio_to_desc() return value, the function returns either a valid pointer to struct gpio_desc or NULL, this makes IS_ERR() check invalid and may lead to a NULL pointer dereference in runtime. Signed-off-by: Vladimir Zapolskiy Signed-off-by: Tomi Valkeinen .../fbdev/omap2/omapfb/displays/panel-sharp-ls037v7dw01.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) commit f36fdacc5fcdca7b0c0d89f031fcdc89717e0be3 Author: Linus Walleij Date: Tue Feb 23 11:01:38 2016 +0100 video: ARM CLCD: runtime check for Versatile The current compile-time check for inversed IENB/CNTL does not work in multiplatform boots: as soon as versatile is included in the build, the IENB/CNTL is switched and breaks graphics. Convert this to a runtime switch. Cc: stable@vger.kernel.org Cc: Rob Herring Cc: Russell King Fixes: a29da136de34 ("ARM: versatile: convert to multi-platform") Signed-off-by: Linus Walleij Signed-off-by: Tomi Valkeinen drivers/video/fbdev/amba-clcd.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) commit ed0739b577f2ddd53835f1e20d014fccab195c42 Author: Libin Yang Date: Mon Apr 18 09:16:28 2016 +0800 ALSA - hda: hdmi check NULL pointer in hdmi_set_chmap Make sure per_pin is not NULL before using it. Fixes: 9b3dc8aa3fb1 ('ALSA: hda - Register chmap obj as priv data instead of codec') Signed-off-by: Libin Yang Signed-off-by: Takashi Iwai sound/pci/hda/patch_hdmi.c | 2 ++ 1 file changed, 2 insertions(+) commit c3b46c73264b03000d1e18b22f5caf63332547c9 Author: Linus Torvalds Date: Sun Apr 17 19:13:32 2016 -0700 Linux 4.6-rc4 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ab2ed0171a50ddee8390f472bb83f60d393b4b04 Author: Arnd Bergmann Date: Sun Apr 17 11:19:55 2016 +0200 macsec: fix crypto Kconfig dependency The new MACsec driver uses the AES crypto algorithm, but can be configured even if CONFIG_CRYPTO is disabled, leading to a build error: warning: (MAC80211 && MACSEC) selects CRYPTO_GCM which has unmet direct dependencies (CRYPTO) warning: (BT && CEPH_LIB && INET && MAC802154 && MAC80211 && BLK_DEV_RBD && MACSEC && AIRO_CS && LIBIPW && HOSTAP && USB_WUSB && RTLLIB_CRYPTO_CCMP && FS_ENCRYPTION && EXT4_ENCRYPTION && CEPH_FS && BIG_KEYS && ENCRYPTED_KEYS) selects CRYPTO_AES which has unmet direct dependencies (CRYPTO) crypto/built-in.o: In function `gcm_enc_copy_hash': aes_generic.c:(.text+0x2b8): undefined reference to `crypto_xor' aes_generic.c:(.text+0x2dc): undefined reference to `scatterwalk_map_and_copy' This adds an explicit 'select CRYPTO' statement the way that other drivers handle it. Signed-off-by: Arnd Bergmann Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver") Signed-off-by: David S. Miller drivers/net/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 9d090d01e3efdcdb8f7f07e86fcac91e01ae30cd Merge: b9f5dba 6545b60 Author: Linus Torvalds Date: Sun Apr 17 12:30:06 2016 -0700 Merge tag 'dm-4.6-fix-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fix from Mike Snitzer: "Fix for earlier 4.6-rc4 stable@ commit that introduced improper use of write lock in cmd_read_lock() -- due to cut-n-paste gone awry (and sparse didn't catch it)" * tag 'dm-4.6-fix-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm cache metadata: fix cmd_read_lock() acquiring write lock commit 6545b60baaf880b0cd29a5e89dbe745a06027e89 Author: Ahmed Samy Date: Sun Apr 17 05:37:09 2016 +0000 dm cache metadata: fix cmd_read_lock() acquiring write lock Commit 9567366fefdd ("dm cache metadata: fix READ_LOCK macros and cleanup WRITE_LOCK macros") uses down_write() instead of down_read() in cmd_read_lock(), yet up_read() is used to release the lock in READ_UNLOCK(). Fix it. Fixes: 9567366fefdd ("dm cache metadata: fix READ_LOCK macros and cleanup WRITE_LOCK macros") Cc: stable@vger.kernel.org Signed-off-by: Ahmed Samy Signed-off-by: Mike Snitzer drivers/md/dm-cache-metadata.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit eda5ecc0a6b865561997e177c393f0b0136fe3b7 Author: Stephen Boyd Date: Sun Apr 17 05:21:42 2016 -0700 Input: pmic8xxx-pwrkey - fix algorithm for converting trigger delay The trigger delay algorithm that converts from microseconds to the register value looks incorrect. According to most of the PMIC documentation, the equation is delay (Seconds) = (1 / 1024) * 2 ^ (x + 4) except for one case where the documentation looks to have a formatting issue and the equation looks like delay (Seconds) = (1 / 1024) * 2 x + 4 Most likely this driver was written with the improper documentation to begin with. According to the downstream sources the valid delays are from 2 seconds to 1/64 second, and the latter equation just doesn't make sense for that. Let's fix the algorithm and the range check to match the documentation and the downstream sources. Reported-by: Bjorn Andersson Fixes: 92d57a73e410 ("input: Add support for Qualcomm PMIC8XXX power key") Signed-off-by: Stephen Boyd Tested-by: John Stultz Acked-by: Bjorn Andersson Signed-off-by: Dmitry Torokhov drivers/input/misc/pmic8xxx-pwrkey.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit ca3704c23a3b3dfc9d721cf21953fd6b3cbfc3e0 Author: Charles Keepax Date: Sun Apr 17 05:20:32 2016 -0700 Input: arizona-haptic - don't assign input_dev parent We shouldn't assign the parent device of the input_dev to be the parent MFD device, because this will be used for devres which causes input_unregister_device to run after the haptics device has been removed, since it is itself a child of the MFD device. The default of using the haptics device itself as the parent is correct. Signed-off-by: Charles Keepax Signed-off-by: Dmitry Torokhov drivers/input/misc/arizona-haptics.c | 1 - 1 file changed, 1 deletion(-) commit 05be8d4101d960bad271d32b4f6096af1ccb1534 Author: Richard Leitner Date: Tue Apr 5 15:03:48 2016 +0200 iio: ak8975: fix maybe-uninitialized warning If i2c_device_id *id is NULL and acpi_match_device returns NULL too, then chipset may be unitialized when accessing &ak_def_array[chipset] in ak8975_probe. Therefore initialize chipset to AK_MAX_TYPE, which will return an error when not changed. This patch fixes the following maybe-uninitialized warning: drivers/iio/magnetometer/ak8975.c: In function ‘ak8975_probe’: drivers/iio/magnetometer/ak8975.c:788:14: warning: ‘chipset’ may be used uninitialized in this function [-Wmaybe-uninitialized] data->def = &ak_def_array[chipset]; Signed-off-by: Richard Leitner Cc: Signed-off-by: Jonathan Cameron drivers/iio/magnetometer/ak8975.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 07d2390e36ee5b3265e9cc8305f2a106c8721e16 Author: Krzysztof Kozlowski Date: Mon Apr 4 14:54:59 2016 +0900 iio: ak8975: Fix NULL pointer exception on early interrupt In certain probe conditions the interrupt came right after registering the handler causing a NULL pointer exception because of uninitialized waitqueue: $ udevadm trigger i2c-gpio i2c-gpio-1: using pins 143 (SDA) and 144 (SCL) i2c-gpio i2c-gpio-3: using pins 53 (SDA) and 52 (SCL) Unable to handle kernel NULL pointer dereference at virtual address 00000000 pgd = e8b38000 [00000000] *pgd=00000000 Internal error: Oops: 5 [#1] SMP ARM Modules linked in: snd_soc_i2s(+) i2c_gpio(+) snd_soc_idma snd_soc_s3c_dma snd_soc_core snd_pcm_dmaengine snd_pcm snd_timer snd soundcore ac97_bus spi_s3c64xx pwm_samsung dwc2 exynos_adc phy_exynos_usb2 exynosdrm exynos_rng rng_core rtc_s3c CPU: 0 PID: 717 Comm: data-provider-m Not tainted 4.6.0-rc1-next-20160401-00011-g1b8d87473b9e-dirty #101 Hardware name: SAMSUNG EXYNOS (Flattened Device Tree) (...) (__wake_up_common) from [] (__wake_up+0x38/0x4c) (__wake_up) from [] (ak8975_irq_handler+0x28/0x30) (ak8975_irq_handler) from [] (handle_irq_event_percpu+0x88/0x140) (handle_irq_event_percpu) from [] (handle_irq_event+0x44/0x68) (handle_irq_event) from [] (handle_edge_irq+0xf0/0x19c) (handle_edge_irq) from [] (generic_handle_irq+0x24/0x34) (generic_handle_irq) from [] (exynos_eint_gpio_irq+0x50/0x68) (exynos_eint_gpio_irq) from [] (handle_irq_event_percpu+0x88/0x140) (handle_irq_event_percpu) from [] (handle_irq_event+0x44/0x68) (handle_irq_event) from [] (handle_fasteoi_irq+0xb4/0x194) (handle_fasteoi_irq) from [] (generic_handle_irq+0x24/0x34) (generic_handle_irq) from [] (__handle_domain_irq+0x5c/0xb4) (__handle_domain_irq) from [] (gic_handle_irq+0x54/0x94) (gic_handle_irq) from [] (__irq_usr+0x50/0x80) The bug was reproduced on exynos4412-trats2 (with a max77693 device also using i2c-gpio) after building max77693 as a module. Cc: Fixes: 94a6d5cf7caa ("iio:ak8975 Implement data ready interrupt handling") Signed-off-by: Krzysztof Kozlowski Tested-by: Gregor Boirie Signed-off-by: Jonathan Cameron drivers/iio/magnetometer/ak8975.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 50fd4987c4f3c3ebf0ce94d932732011bbdc7c71 Author: Takashi Iwai Date: Sun Apr 17 09:39:41 2016 +0200 ALSA: hda - Don't trust the reported actual power state We've got a regression report that the recording on Mac with a cirrus codec doesn't work any longer. This turned out to be the missing power up to D0 by power_save_node enablement. After analyzing the traces, we found out that the culprit is that the codec advertises the "actual" power state of a few nodes to be D0 while the "target" power state is D3. This inconsistency is usually OK, as it implies the power transition. But in the case of cirrus codec, this seems to be stuck to D3 while it's not actually D0. This patch addresses the issue by checking the power state difference more strictly. It sends the power-state change verb unless both the target and the actual power states show the given value. We may introduce yet another flag indicating the possible broken hardware power state, but it's anyway safer to set the proper power state even in a transition (at least it's harmless as long as the target state is same). So this simpler change was applied now. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=116171 Cc: # v4.4+ Signed-off-by: Takashi Iwai sound/pci/hda/hda_generic.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit b9f5dba225aede4518ab0a7374c2dc38c7c049ce Merge: e1e22b2 053f78d Author: Linus Torvalds Date: Sat Apr 16 20:59:06 2016 -0700 Merge tag 'char-misc-4.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc fixes from Greg KH: "Here are some small char/misc driver fixes for 4.6-rc4. Full details are in the shortlog, nothing major here. These have all been in linux-next for a while with no reported issues" * tag 'char-misc-4.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: lkdtm: do not leak free page on kmalloc failure lkdtm: fix memory leak of base lkdtm: fix memory leak of val extcon: palmas: Drop stray IRQF_EARLY_RESUME flag commit e1e22b27ec6c83d026c2ca14624f207a08c28ec3 Merge: b62dabf dea5c24 Author: Linus Torvalds Date: Sat Apr 16 20:53:50 2016 -0700 Merge tag 'driver-core-4.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull misc fixes from Greg KH: "Here are three small fixes for 4.6-rc4. Two fix up some lz4 issues with big endian systems, and the remaining one resolves a minor debugfs issue that was reported. All have been in linux-next with no reported issues" * tag 'driver-core-4.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: lib: lz4: cleanup unaligned access efficiency detection lib: lz4: fixed zram with lz4 on big endian machines debugfs: Make automount point inodes permanently empty commit b62dabfb4b28a2d88deb4907ed0249da4d33d279 Merge: 306a63b e86103a Author: Linus Torvalds Date: Sat Apr 16 20:48:14 2016 -0700 Merge tag 'usb-4.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB driver fixes from Greg KH: "Here are some small USB fixes for 4.6-rc4. Mostly xhci fixes for reported issues, a UAS bug that has hit a number of people, including stable tree users, and a few other minor things. All have been in linux-next for a while with no reported issues" * tag 'usb-4.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: hcd: out of bounds access in for_each_companion USB: uas: Add a new NO_REPORT_LUNS quirk USB: uas: Limit qdepth at the scsi-host level doc: usb: Fix typo in gadget_multi documentation usb: host: xhci-plat: Make enum xhci_plat_type start at a non zero value xhci: fix 10 second timeout on removal of PCI hotpluggable xhci controllers usb: xhci: fix wild pointers in xhci_mem_cleanup usb: host: xhci-plat: fix cannot work if R-Car Gen2/3 run on above 4GB phys usb: host: xhci: add a new quirk XHCI_NO_64BIT_SUPPORT xhci: resume USB 3 roothub first usb: xhci: applying XHCI_PME_STUCK_QUIRK to Intel BXT B0 host cdc-acm: fix crash if flushed with nothing buffered commit 6517eb59b03965689e6bb16bb2d480096b3ef95d Author: Eric Dumazet Date: Fri Apr 15 10:47:52 2016 -0700 net: bcmgenet: device stats are unsigned long On 64bit kernels, device stats are 64bit wide, not 32bit. Fixes: 1c1008c793fa4 ("net: bcmgenet: add main driver file") Signed-off-by: Eric Dumazet Cc: Florian Fainelli Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/genet/bcmgenet.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit cf6b5fb2514de55d5f97d5f55a251de4de17d07e Merge: e47db94 207afda Author: David S. Miller Date: Sat Apr 16 19:07:11 2016 -0400 Merge branch 'dsa-mv88e6xxx-fix-cross-chip-bridging' Vivien Didelot says: ==================== net: dsa: mv88e6xxx: fix hardware cross-chip bridging In order to accelerate cross-chip switching of frames with the hardware, the DSA Tag ports, used to interconnect switch devices, must learn SA and DA addresses, and share the same FDB with the user ports. The two first patches restore address learning on DSA links. This fixes hardware cross-chip bridging in a VLAN filtering enabled system, which implements a bridge group as a 802.1Q VLAN and thus share an isolated address database between DSA and user ports. The third patch changes the distinct default databases used for each port, to the same address database. This fixes the hardware cross-chip bridging in a VLAN filtering disabled system, where a bridge group gets implemented only as a port-based VLAN. ==================== Signed-off-by: David S. Miller commit 207afda1b5036009e611df2106e6d441be397bee Author: Vivien Didelot Date: Thu Apr 14 14:42:09 2016 -0400 net: dsa: mv88e6xxx: share the same default FDB For hardware cross-chip bridging to work, user ports *and* DSA ports need to share a common address database, in order to switch a frame to the correct interconnected device. This is currently working for VLAN filtering aware systems, since Linux will implement a bridge group as a 802.1Q VLAN, which has its own FDB, including DSA and CPU links as members. However when the system doesn't support VLAN filtering, Linux only relies on the port-based VLAN to implement a bridge group. To fix hardware cross-chip bridging for such systems, set the same default address database 0 for user and DSA ports, instead of giving them all a different default database. Note that the bridging code prevents frames to egress between unbridged ports, and flushes FDB entries of a port when changing its STP state. Also note that the FID 0 is special and means "all" for ATU operations, but it's OK since it is used as a default forwarding address database. Fixes: 2db9ce1fd9a3 ("net: dsa: mv88e6xxx: assign default FDB to ports") Fixes: 466dfa077022 ("net: dsa: mv88e6xxx: assign dynamic FDB to bridges") Signed-off-by: Vivien Didelot Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx.c | 28 ++-------------------------- 1 file changed, 2 insertions(+), 26 deletions(-) commit 996ecb8246676100af2a4dc1cfed747712a3c85f Author: Vivien Didelot Date: Thu Apr 14 14:42:08 2016 -0400 net: dsa: mv88e6xxx: enable SA learning on DSA ports In multi-chip systems, DSA Tag ports must learn SA addresses in order to correctly switch frames between interconnected chips. This fixes cross-chip hardware bridging in a VLAN filtering aware system, because a bridge group gets implemented as an hardware 802.1Q VLAN and thus DSA and user ports share the same FDB. Fixes: 4c7ea3c0791e ("net: dsa: mv88e6xxx: disable SA learning for DSA and CPU ports") Signed-off-by: Vivien Didelot Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 65fa40276ac1318e75264e5a204547b57c2cf397 Author: Vivien Didelot Date: Thu Apr 14 14:42:07 2016 -0400 net: dsa: mv88e6xxx: unlock DSA and CPU ports Locking a port generates an hardware interrupt when a new SA address is received. This enables CPU directed learning, which is needed for 802.1X MAC authentication. To disable automatic learning on a port, the only configuration needed is to set its Port Association Vector to all zero. Clear PAV when SA learning should be disabled instead of locking a port. Fixes: 4c7ea3c0791e ("net: dsa: mv88e6xxx: disable SA learning for DSA and CPU ports") Signed-off-by: Vivien Didelot Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e47db94e10447fc467777a40302f2b393e9af2fa Author: santosh.shilimkar@oracle.com Date: Thu Apr 14 10:43:27 2016 -0700 RDS: Fix the atomicity for congestion map update Two different threads with different rds sockets may be in rds_recv_rcvbuf_delta() via receive path. If their ports both map to the same word in the congestion map, then using non-atomic ops to update it could cause the map to be incorrect. Lets use atomics to avoid such an issue. Full credit to Wengang for finding the issue, analysing it and also pointing out to offending code with spin lock based fix. Reviewed-by: Leon Romanovsky Signed-off-by: Wengang Wang Signed-off-by: Santosh Shilimkar Signed-off-by: David S. Miller net/rds/cong.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit a7c556546f610a331c22cb7edd9d1afe63f0cd52 Author: Qing Huang Date: Thu Apr 14 10:43:26 2016 -0700 RDS: fix endianness for dp_ack_seq dp->dp_ack_seq is used in big endian format. We need to do the big endianness conversion when we assign a value in host format to it. Signed-off-by: Qing Huang Signed-off-by: Santosh Shilimkar Signed-off-by: David S. Miller net/rds/ib_cm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 306a63bee192859ebd32c7328c7766636d882d8f Merge: ac82a57 956e6c8 Author: Linus Torvalds Date: Sat Apr 16 15:52:38 2016 -0700 Merge tag 'dmaengine-fix-4.6-rc4' of git://git.infradead.org/users/vkoul/slave-dma Pull dmaengine fixes from Vinod Koul: "This time we have some odd fixes in hsu, edma, omap and xilinx. Usual fixes and nothing special" * tag 'dmaengine-fix-4.6-rc4' of git://git.infradead.org/users/vkoul/slave-dma: dmaengine: dw: fix master selection dmaengine: edma: special case slot limit workaround dmaengine: edma: Remove dynamic TPTC power management feature dmaengine: vdma: don't crash when bad channel is requested dmaengine: omap-dma: Do not suppress interrupts for memcpy dmaengine: omap-dma: Fix polled channel completion detection and handling dmaengine: hsu: correct use of channel status register dmaengine: hsu: correct residue calculation of active descriptor dmaengine: hsu: set HSU_CH_MTSR to memory width commit ac82a57aff853599db757f666204ac8d2af4b26b Merge: e2f50c5 5c8a010 Author: Linus Torvalds Date: Sat Apr 16 15:43:19 2016 -0700 Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fixlet from Ingo Molnar: "Fixes a build warning on certain Kconfig combinations" * 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: locking/lockdep: Fix print_collision() unused warning commit e2f50c5c6cd8dcfda30b8d656fe213f7e285c54a Merge: 2e57259 f4d5b8a Author: Linus Torvalds Date: Sat Apr 16 15:37:05 2016 -0700 Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull EFI fix from Ingo Molnar: "An arm64 boot crash fix" * 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: efi/arm64: Don't apply MEMBLOCK_NOMAP to UEFI memory map mapping commit 956e6c8e18fa666ccc118c85fb32f92ebde3baf1 Merge: 1cc3334 a482f4e Author: Vinod Koul Date: Sat Apr 16 22:52:03 2016 +0530 Merge branch 'fix/edma' into fixes commit 1cc3334e2e0263b02163a9edd43d0448ac00770c Merge: 4bd6135 330ed4d Author: Vinod Koul Date: Sat Apr 16 22:45:26 2016 +0530 Merge branch 'fix/xilinx' into fixes commit 4bd613596bc8572dee8a0683a24f6f931841b695 Merge: 09c505c b96c033 Author: Vinod Koul Date: Sat Apr 16 22:45:17 2016 +0530 Merge branch 'fix/omap' into fixes commit 09c505ced310016ff064d827f053a78988a8bb1d Merge: 3fe6409 4f4bc0a Author: Vinod Koul Date: Sat Apr 16 22:44:32 2016 +0530 Merge branch 'fix/hsu' into fixes commit 1e2ae9ec072f3b7887f456426bc2cf23b80f661a Author: Vitaly Kuznetsov Date: Fri Apr 15 15:50:32 2016 +0200 x86/hyperv: Avoid reporting bogus NMI status for Gen2 instances Generation2 instances don't support reporting the NMI status on port 0x61, read from there returns 'ff' and we end up reporting nonsensical PCI error (as there is no PCI bus in these instances) on all NMIs: NMI: PCI system error (SERR) for reason ff on CPU 0. Dazed and confused, but trying to continue Fix the issue by overriding x86_platform.get_nmi_reason. Use 'booted on EFI' flag to detect Gen2 instances. Signed-off-by: Vitaly Kuznetsov Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Cathy Avery Cc: Haiyang Zhang Cc: Jiri Olsa Cc: K. Y. Srinivasan Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: devel@linuxdriverproject.org Link: http://lkml.kernel.org/r/1460728232-31433-1-git-send-email-vkuznets@redhat.com Signed-off-by: Ingo Molnar arch/x86/kernel/cpu/mshyperv.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit b1547d3101e74e809b9790174b27f1080747b009 Author: Josh Poimboeuf Date: Fri Apr 15 09:17:10 2016 -0500 objtool: Detect falling through to the next function There are several cases in compiled C code where a function may not return at the end, and may instead fall through to the next function. That may indicate a bug in the code, or a gcc bug, or even an objtool bug. But in each case, objtool reports an unhelpful warning, something like: drivers/scsi/qla2xxx/qla_attr.o: warning: objtool: qla2x00_get_fc_host_stats()+0x0: duplicate frame pointer save drivers/scsi/qla2xxx/qla_attr.o: warning: objtool: qla2x00_get_fc_host_stats()+0x0: frame pointer state mismatch Detect this situation and print a more useful error message: drivers/scsi/qla2xxx/qla_attr.o: warning: objtool: qla2x00_get_host_fabric_name() falls through to next function qla2x00_get_starget_node_name() Also add some information about this warning and its potential causes to the documentation. Reported-by: kbuild test robot Signed-off-by: Josh Poimboeuf Cc: Alexander Shishkin Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Borislav Petkov Cc: Brian Gerst Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/caa4ec6c687931db805e692d4e4bf06cd87d33e6.1460729697.git.jpoimboe@redhat.com Signed-off-by: Ingo Molnar tools/objtool/Documentation/stack-validation.txt | 38 +++++++++++++++----- tools/objtool/builtin-check.c | 46 ++++++++++++++++-------- 2 files changed, 61 insertions(+), 23 deletions(-) commit 9241e2df4fbc648a92ea0752918e05c26255649e Author: Daniel Borkmann Date: Sat Apr 16 02:27:58 2016 +0200 vlan: pull on __vlan_insert_tag error path and fix csum correction When __vlan_insert_tag() fails from skb_vlan_push() path due to the skb_cow_head(), we need to undo the __skb_push() in the error path as well that was done earlier to move skb->data pointer to mac header. Moreover, I noticed that when in the non-error path the __skb_pull() is done and the original offset to mac header was non-zero, we fixup from a wrong skb->data offset in the checksum complete processing. So the skb_postpush_rcsum() really needs to be done before __skb_pull() where skb->data still points to the mac header start and thus operates under the same conditions as in __vlan_insert_tag(). Fixes: 93515d53b133 ("net: move vlan pop/push functions into common code") Signed-off-by: Daniel Borkmann Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller net/core/skbuff.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 2e572599139d27db3aaf540b0d34f0a4f58dfca1 Merge: f3c9a1a a7297a6 Author: Linus Torvalds Date: Fri Apr 15 15:44:10 2016 -0700 Merge branch 'for-linus' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "A few fixes for the current series. This contains: - Two fixes for NVMe: One fixes a reset race that can be triggered by repeated insert/removal of the module. The other fixes an issue on some platforms, where we get probe timeouts since legacy interrupts isn't working. This used not to be a problem since we had the worker thread poll for completions, but since that was killed off, it means those poor souls can't successfully probe their NVMe device. Use a proper IRQ check and probe (msi-x -> msi ->legacy), like most other drivers to work around this. Both from Keith. - A loop corruption issue with offset in iters, from Ming Lei. - A fix for not having the partition stat per cpu ref count initialized before sending out the KOBJ_ADD, which could cause user space to access the counter prior to initialization. Also from Ming Lei. - A fix for using the wrong congestion state, from Kaixu Xia" * 'for-linus' of git://git.kernel.dk/linux-block: block: loop: fix filesystem corruption in case of aio/dio NVMe: Always use MSI/MSI-x interrupts NVMe: Fix reset/remove race writeback: fix the wrong congested state variable definition block: partition: initialize percpuref before sending out KOBJ_ADD commit 2c49477f2a0fdccfe4765326efa5567c5b259aa1 Merge: 2aac7dd 7196c52 Author: Stephen Boyd Date: Fri Apr 15 15:40:49 2016 -0700 Merge tag 'imx-clk-fixes-4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into clk-fixes The i.MX clk fixes for 4.6: - Fix the typo in CAN clock definition which is introduced by commit ee36027427c7 ("clk: imx: Add clock support for imx6qp") * tag 'imx-clk-fixes-4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: clk: imx6q: fix typo in CAN clock definition commit f3c9a1abbe9d4c9565fdb0755e2c7814f32d4f62 Merge: 29dde7c 0a370d26 Author: Linus Torvalds Date: Fri Apr 15 15:34:27 2016 -0700 Merge branch 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm fixes from Ross Zwisler: "Two fixes: - Fix memcpy_from_pmem() to fallback to memcpy() for architectures where CONFIG_ARCH_HAS_PMEM_API=n. - Add a comment explaining why we write data twice when clearing poison in pmem_do_bvec(). This has passed a boot test on an X86_32 config, which was the architecture where issue #1 above was first noticed" Dan Williams adds: "We're giving this multi-maintainer setup a shot, so expect libnvdimm pull requests from either Ross or I going forward" * 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: libnvdimm, pmem: clarify the write+clear_poison+write flow pmem: fix BUG() error in pmem.h:48 on X86_32 commit 29dde7c25adafcdcbde3a14bce3f07e5a201dc30 Merge: 2fffad1 20c07a5 Author: Linus Torvalds Date: Fri Apr 15 15:25:09 2016 -0700 Merge tag 'for-linus-20160415' of git://git.infradead.org/linux-mtd Pull MTD fix from Brian Norris: "One MTD fix for v4.6-rc4: In the v4.4 cycle, we relaxed the requirement for assigning mtd->owner, but we didn't remove this error case. It's hit only by drivers that are both: (a) using nand_scan() directly and (b) built as modules We haven't seen explicit complaints about this (most use cases don't fit one or both of the above), but we should definitely not be BUG()'ing here" * tag 'for-linus-20160415' of git://git.infradead.org/linux-mtd: mtd: nand: Drop mtd.owner requirement in nand_scan commit 2fffad128730526799eb9f37329e8b598f0fc8d8 Merge: ab5f9eb 70ad7f7 Author: Linus Torvalds Date: Fri Apr 15 15:10:32 2016 -0700 Merge tag 'mmc-v4.6-rc3' of git://git.linaro.org/people/ulf.hansson/mmc Pull MMC fixes from Ulf Hansson: "Here are a couple of mmc fixes intended for v4.6 rc4. Regarding the fix for the regression about mmcblk device indexes. The approach taken to solve the problem seems to be good enough. There were some discussions around the solution, but it seems like people were happy about it in the end. MMC core: - Restore similar old behaviour when assigning mmcblk device indexes MMC host: - tegra: Disable UHS-I modes for Tegra124 to fix regression" * tag 'mmc-v4.6-rc3' of git://git.linaro.org/people/ulf.hansson/mmc: mmc: tegra: Disable UHS-I modes for Tegra124 mmc: block: Use the mmc host device index as the mmcblk device index commit ab5f9ebac1fcdf7feaf41a55e463e181ea0b4ea2 Merge: 60ea7bb ff3e84e Author: Linus Torvalds Date: Fri Apr 15 14:59:28 2016 -0700 Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux Pull drm fixes from Dave Airlie: "This contains fixes for exynos, amdgpu, radeon, i915 and qxl. It also contains some fixes to the core drm edid parser. qxl: - fix for a cursor hotspot issue radeon: - some MST fixes that I've been running locally and make my monitor a bit happier exynos: - fix some regressions and build fixes amdgpu: - a couple of small fixes i915: - two DP MST fixes and a couple of other regression fixes Nothing too out of the ordinary or surprising at this point" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/exynos: Use VIDEO_SAMSUNG_S5P_G2D=n as G2D Kconfig dependency drm/exynos: fix a warning message drm/exynos: mic: fix an error code drm/exynos: fimd: fix broken dp_clock control drm/exynos: build fbdev code conditionally drm/exynos: fix adjusted_mode pointer in exynos_plane_mode_set drm/exynos: fix error handling in exynos_drm_subdrv_open drm/amd/amdgpu: fix irq domain remove for tonga ih drm/i915: fix deadlock on lid open drm/radeon: use helper for mst connector dpms. drm/radeon/mst: port some MST setup code from DAL. drm/amdgpu: add invisible pin size statistic drm/edid: Fix DMT 1024x768@43Hz (interlaced) timings drm/i915: Exit cherryview_irq_handler() after one pass drm/i915: Call intel_dp_mst_resume() before resuming displays drm/i915: Fix race condition in intel_dp_destroy_mst_connector() drm/edid: Fix parsing of EDID 1.4 Established Timings III descriptor drm/edid: Fix EDID Established Timings I and II drm/qxl: fix cursor position with non-zero hotspot commit 60ea7bb0077b38f80a3a27b9e32ad45879944a57 Merge: 806fdcc 366dd4e Author: Linus Torvalds Date: Fri Apr 15 14:51:45 2016 -0700 Merge branch 'parisc-4.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc ftrace fixes from Helge Deller: "This is (most likely) the last pull request for v4.6 for the parisc architecture. It fixes the FTRACE feature for parisc, which is horribly broken since quite some time and doesn't even compile. This patch just fixes the bare minimum (it actually removes more lines than it adds), so that the function tracer works again on 32- and 64bit kernels. I've queued up additional patches on top of this patch which e.g. add the syscall tracer, but those have to wait for the merge window for v4.7." * 'parisc-4.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Fix ftrace function tracer commit cfe255600154f0072d4a8695590dbd194dfd1aeb Author: Andrew Goodbody Date: Wed Apr 13 15:36:48 2016 +0100 cpsw: Prevent NUll pointer dereference with two PHYs Adding a 2nd PHY to cpsw results in a NULL pointer dereference as below. Fix by maintaining a reference to each PHY node in slave struct instead of a single reference in the priv struct which was overwritten by the 2nd PHY. [ 17.870933] Unable to handle kernel NULL pointer dereference at virtual address 00000180 [ 17.879557] pgd = dc8bc000 [ 17.882514] [00000180] *pgd=9c882831, *pte=00000000, *ppte=00000000 [ 17.889213] Internal error: Oops: 17 [#1] ARM [ 17.893838] Modules linked in: [ 17.897102] CPU: 0 PID: 1657 Comm: connmand Not tainted 4.5.0-ge463dfb-dirty #11 [ 17.904947] Hardware name: Cambrionix whippet [ 17.909576] task: dc859240 ti: dc968000 task.ti: dc968000 [ 17.915339] PC is at phy_attached_print+0x18/0x8c [ 17.920339] LR is at phy_attached_info+0x14/0x18 [ 17.925247] pc : [] lr : [] psr: 600f0113 [ 17.925247] sp : dc969cf8 ip : dc969d28 fp : dc969d18 [ 17.937425] r10: dda7a400 r9 : 00000000 r8 : 00000000 [ 17.942971] r7 : 00000001 r6 : ddb00480 r5 : ddb8cb34 r4 : 00000000 [ 17.949898] r3 : c0954cc0 r2 : c09562b0 r1 : 00000000 r0 : 00000000 [ 17.956829] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none [ 17.964401] Control: 10c5387d Table: 9c8bc019 DAC: 00000051 [ 17.970500] Process connmand (pid: 1657, stack limit = 0xdc968210) [ 17.977059] Stack: (0xdc969cf8 to 0xdc96a000) [ 17.981692] 9ce0: dc969d28 dc969d08 [ 17.990386] 9d00: c038f9bc c038f6b4 ddb00480 dc969d34 dc969d28 c042bb74 c042bae4 00000000 [ 17.999080] 9d20: c09562b0 c0954cc0 dc969d5c dc969d38 c043ebfc c042bb6c 00000007 00000003 [ 18.007773] 9d40: ddb00000 ddb8cb58 ddb00480 00000001 dc969dec dc969d60 c0441614 c043ea68 [ 18.016465] 9d60: 00000000 00000003 00000000 fffffff4 dc969df4 0000000d 00000000 00000000 [ 18.025159] 9d80: dc969db4 dc969d90 c005dc08 c05839e0 dc969df4 0000000d ddb00000 00001002 [ 18.033851] 9da0: 00000000 00000000 dc969dcc dc969db8 c005ddf4 c005dbc8 00000000 00000118 [ 18.042544] 9dc0: dc969dec dc969dd0 ddb00000 c06db27c ffff9003 00001002 00000000 00000000 [ 18.051237] 9de0: dc969e0c dc969df0 c057c88c c04410dc dc969e0c ddb00000 ddb00000 00000001 [ 18.059930] 9e00: dc969e34 dc969e10 c057cb44 c057c7d8 ddb00000 ddb00138 00001002 beaeda20 [ 18.068622] 9e20: 00000000 00000000 dc969e5c dc969e38 c057cc28 c057cac0 00000000 dc969e80 [ 18.077315] 9e40: dda7a40c beaeda20 00000000 00000000 dc969ecc dc969e60 c05e36d0 c057cc14 [ 18.086007] 9e60: dc969e84 00000051 beaeda20 00000000 dda7a40c 00000014 ddb00000 00008914 [ 18.094699] 9e80: 30687465 00000000 00000000 00000000 00009003 00000000 00000000 00000000 [ 18.103391] 9ea0: 00001002 00008914 dd257ae0 beaeda20 c098a428 beaeda20 00000011 00000000 [ 18.112084] 9ec0: dc969edc dc969ed0 c05e4e54 c05e3030 dc969efc dc969ee0 c055f5ac c05e4cc4 [ 18.120777] 9ee0: beaeda20 dd257ae0 dc8ab4c0 00008914 dc969f7c dc969f00 c010b388 c055f45c [ 18.129471] 9f00: c071ca40 dd257ac0 c00165e8 dc968000 dc969f3c dc969f20 dc969f64 dc969f28 [ 18.138164] 9f20: c0115708 c0683ec8 dd257ac0 dd257ac0 dc969f74 dc969f40 c055f350 c00fc66c [ 18.146857] 9f40: dd82e4d0 00000011 00000000 00080000 dd257ac0 00000000 dc8ab4c0 dc8ab4c0 [ 18.155550] 9f60: 00008914 beaeda20 00000011 00000000 dc969fa4 dc969f80 c010bc34 c010b2fc [ 18.164242] 9f80: 00000000 00000011 00000002 00000036 c00165e8 dc968000 00000000 dc969fa8 [ 18.172935] 9fa0: c00163e0 c010bbcc 00000000 00000011 00000011 00008914 beaeda20 00009003 [ 18.181628] 9fc0: 00000000 00000011 00000002 00000036 00081018 00000001 00000000 beaedc10 [ 18.190320] 9fe0: 00083188 beaeda1c 00043a5d b6d29c0c 600b0010 00000011 00000000 00000000 [ 18.198989] Backtrace: [ 18.201621] [] (phy_attached_print) from [] (phy_attached_info+0x14/0x18) [ 18.210664] r3:c0954cc0 r2:c09562b0 r1:00000000 [ 18.215588] r4:ddb00480 [ 18.218322] [] (phy_attached_info) from [] (cpsw_slave_open+0x1a0/0x280) [ 18.227293] [] (cpsw_slave_open) from [] (cpsw_ndo_open+0x544/0x674) [ 18.235874] r7:00000001 r6:ddb00480 r5:ddb8cb58 r4:ddb00000 [ 18.241944] [] (cpsw_ndo_open) from [] (__dev_open+0xc0/0x128) [ 18.249972] r9:00000000 r8:00000000 r7:00001002 r6:ffff9003 r5:c06db27c r4:ddb00000 [ 18.258255] [] (__dev_open) from [] (__dev_change_flags+0x90/0x154) [ 18.266745] r5:00000001 r4:ddb00000 [ 18.270575] [] (__dev_change_flags) from [] (dev_change_flags+0x20/0x50) [ 18.279523] r9:00000000 r8:00000000 r7:beaeda20 r6:00001002 r5:ddb00138 r4:ddb00000 [ 18.287811] [] (dev_change_flags) from [] (devinet_ioctl+0x6ac/0x76c) [ 18.296483] r9:00000000 r8:00000000 r7:beaeda20 r6:dda7a40c r5:dc969e80 r4:00000000 [ 18.304762] [] (devinet_ioctl) from [] (inet_ioctl+0x19c/0x1c8) [ 18.312882] r10:00000000 r9:00000011 r8:beaeda20 r7:c098a428 r6:beaeda20 r5:dd257ae0 [ 18.321235] r4:00008914 [ 18.323956] [] (inet_ioctl) from [] (sock_ioctl+0x15c/0x2d8) [ 18.331829] [] (sock_ioctl) from [] (do_vfs_ioctl+0x98/0x8d0) [ 18.339765] r7:00008914 r6:dc8ab4c0 r5:dd257ae0 r4:beaeda20 [ 18.345822] [] (do_vfs_ioctl) from [] (SyS_ioctl+0x74/0x84) [ 18.353573] r10:00000000 r9:00000011 r8:beaeda20 r7:00008914 r6:dc8ab4c0 r5:dc8ab4c0 [ 18.361924] r4:00000000 [ 18.364653] [] (SyS_ioctl) from [] (ret_fast_syscall+0x0/0x3c) [ 18.372682] r9:dc968000 r8:c00165e8 r7:00000036 r6:00000002 r5:00000011 r4:00000000 [ 18.380960] Code: e92dd810 e24cb010 e24dd010 e59b4004 (e5902180) [ 18.387580] ---[ end trace c80529466223f3f3 ]--- Signed-off-by: Andrew Goodbody Signed-off-by: David S. Miller drivers/net/ethernet/ti/cpsw.c | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-) commit 0a370d261c805286cbdfa1f96661322a28cce860 Author: Dan Williams Date: Thu Apr 14 19:40:47 2016 -0700 libnvdimm, pmem: clarify the write+clear_poison+write flow The ACPI specification does not specify the state of data after a clear poison operation. Potential future libnvdimm bus implementations for other architectures also might not specify or disagree on the state of data after clear poison. Clarify why we write twice. Reported-by: Jeff Moyer Reported-by: Vishal Verma Signed-off-by: Dan Williams Signed-off-by: Ross Zwisler Reviewed-by: Johannes Thumshirn Reviewed-by: Jeff Moyer Reviewed-by: Vishal Verma drivers/nvdimm/pmem.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit de478a61389cacafe94dc8b035081b681b878f9d Author: Oleksij Rempel Date: Tue Apr 12 19:37:44 2016 +0200 ath9k: ar5008_hw_cmn_spur_mitigate: add missing mask_m & mask_p initialisation by moving common code to ar5008_hw_cmn_spur_mitigate i forgot to move mask_m & mask_p initialisation. This coused a performance regression on ar9281. Fixes: f911085ffa88 ("ath9k: split ar5008_hw_spur_mitigate and reuse common code in ar9002_hw_spur_mitigate.") Reported-by: Gustav Frederiksen Tested-by: Gustav Frederiksen Cc: # 4.2+ Signed-off-by: Oleksij Rempel Signed-off-by: Kalle Valo drivers/net/wireless/ath/ath9k/ar5008_phy.c | 8 +++----- drivers/net/wireless/ath/ath9k/ar9002_phy.c | 5 ----- 2 files changed, 3 insertions(+), 10 deletions(-) commit 67e658794ca191b3221b143f2a1c10d002c40bc8 Author: Hariprasad Shenai Date: Fri Apr 15 13:00:18 2016 -0500 cxgb4: Set VPD size so we can read both VPD structures Chelsio adapters have two VPD structures stored in the VPD: - offset 0x000: an abbreviated VPD, and - offset 0x400: the complete VPD. After 104daa71b396 ("PCI: Determine actual VPD size on first access"), the PCI core computes the valid VPD size by parsing the VPD starting at offset 0x0. That size only includes the abbreviated VPD structure, so reads of the complete VPD at 0x400 fail. Explicitly set the VPD size with pci_set_vpd_size() so the driver can read both VPD structures. [bhelgaas: changelog, split patches, rename to pci_set_vpd_size() and return int (not ssize_t)] Fixes: 104daa71b396 ("PCI: Determine actual VPD size on first access") Tested-by: Steve Wise Signed-off-by: Casey Leedom Signed-off-by: Hariprasad Shenai Signed-off-by: Bjorn Helgaas drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit cb92148b58a49455f3a7204eba3aee09a8b7683c Author: Hariprasad Shenai Date: Fri Apr 15 13:00:11 2016 -0500 PCI: Add pci_set_vpd_size() to set VPD size After 104daa71b396 ("PCI: Determine actual VPD size on first access"), the PCI core computes the valid VPD size by parsing the VPD starting at offset 0x0. We don't attempt to read past that valid size because that causes some devices to crash. However, some devices do have data past that valid size. For example, Chelsio adapters contain two VPD structures, and the driver needs both of them. Add pci_set_vpd_size(). If a driver knows it is safe to read past the end of the VPD data structure at offset 0, it can use pci_set_vpd_size() to allow access to as much data as it needs. [bhelgaas: changelog, split patches, rename to pci_set_vpd_size() and return int (not ssize_t)] Fixes: 104daa71b396 ("PCI: Determine actual VPD size on first access") Tested-by: Steve Wise Signed-off-by: Casey Leedom Signed-off-by: Hariprasad Shenai Signed-off-by: Bjorn Helgaas drivers/pci/access.c | 42 ++++++++++++++++++++++++++++++++++++++++++ drivers/pci/pci.h | 1 + include/linux/pci.h | 1 + 3 files changed, 44 insertions(+) commit ab9f87c413c297cb9e7d544e0e634aaadc7fb87d Author: Charles Keepax Date: Fri Apr 15 13:11:57 2016 +0100 ASoC: wm5102: Free compressed IRQ in CODEC remove We request one of the DSP IRQs during CODEC probe, as such we should free it during CODEC remove, this patch does so. Signed-off-by: Charles Keepax Signed-off-by: Mark Brown sound/soc/codecs/wm5102.c | 3 +++ 1 file changed, 3 insertions(+) commit 54dca7015a7d6c09d34623c6ec61de30896186dd Author: Charles Keepax Date: Fri Apr 15 13:11:56 2016 +0100 ASoC: arizona: Free speaker thermal IRQs in CODEC remove The thermal warning IRQs for the speaker are requested in CODEC probe but never freed. This patch frees them in CODEC remove. Signed-off-by: Charles Keepax Signed-off-by: Mark Brown sound/soc/codecs/arizona.c | 12 ++++++++++++ sound/soc/codecs/arizona.h | 2 ++ sound/soc/codecs/cs47l24.c | 3 +++ sound/soc/codecs/wm5102.c | 2 ++ sound/soc/codecs/wm5110.c | 2 ++ sound/soc/codecs/wm8997.c | 2 ++ sound/soc/codecs/wm8998.c | 2 ++ 7 files changed, 25 insertions(+) commit 2fd92273646abad21766ddfbfa00b6f927362308 Author: Heiko Carstens Date: Thu Apr 14 09:00:27 2016 +0200 s390: add CPU_BIG_ENDIAN config option Make sure that s390 appears to be a big endian machine by defining this config option. Without this s390 appears to be little endian as seen by e.g. the recordmount script: "perl ./scripts/recordmcount.pl "s390" "little" "64"" This has no practical impact within the script since the endian variable is only evaluated for mips. However there are already a couple of common code places which evaluate this config option. None of them is relevant for s390 currently though. To avoid any issues in the future (and fix the recordmcount oddity) add the new config option. Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky arch/s390/Kconfig | 3 +++ 1 file changed, 3 insertions(+) commit 8497695243f70fd19ed6cf28b63584f1b608b5f9 Author: Heiko Carstens Date: Wed Apr 13 11:05:20 2016 +0200 s390/spinlock: avoid yield to non existent cpu arch_spin_lock_wait_flags() checks if a spinlock is not held before trying a compare and swap instruction. If the lock is unlocked it tries the compare and swap instruction, however if a different cpu grabbed the lock in the meantime the instruction will fail as expected. Subsequently the arch_spin_lock_wait_flags() incorrectly tries to figure out if the cpu that holds the lock is running. However it is using the wrong cpu number for this (-1) and then will also yield the current cpu to the wrong cpu. Fix this by adding a missing continue statement. Fixes: 470ada6b1a1d ("s390/spinlock: refactor arch_spin_lock_wait[_flags]") Signed-off-by: Heiko Carstens Acked-by: Martin Schwidefsky arch/s390/lib/spinlock.c | 1 + 1 file changed, 1 insertion(+) commit 1378a683443753923eb22d01ce322e92a383ba8a Author: Gerald Schaefer Date: Fri Apr 8 13:23:52 2016 +0200 s390/dcssblk: fix possible deadlock in remove vs. per-device attributes dcssblk_remove_store() holds the dcssblk_devices_sem semaphore while calling device_unregister(), which in turn tries to acquire the kernfs kn->dev_map rwsem for the device sysfs subtree. The same rwsem is also acquired when using the per-device sysfs attributes in the device sub-tree, and the attribute handlers then also acquire the dcssblk_devices_sem. This can lead to a deadlock when removing a DCSS while concurrently reading from / writing to one of its sysfs attributes. The following lockdep warning hinted towards the issue (CPU0 = dcssblk_remove_store, CPU1 = dcssblk_shared_store): [ 76.496047] Possible unsafe locking scenario: [ 76.496054] CPU0 CPU1 [ 76.496059] ---- ---- [ 76.496087] lock(&dcssblk_devices_sem); [ 76.496090] lock(s_active#175); [ 76.496106] lock(&dcssblk_devices_sem); [ 76.496110] lock(s_active#175); [ 76.496115] *** DEADLOCK *** Fix this by releasing the dcssblk_devices_sem semaphore, which only protects internal DCSS data, before calling device_unregister(). Signed-off-by: Gerald Schaefer Signed-off-by: Martin Schwidefsky drivers/s390/block/dcssblk.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit a7718360d91eedbedd58978ec8fff4a67a866f86 Author: Dan Carpenter Date: Fri Apr 15 17:46:34 2016 +0300 thinkpad_acpi: Silence an uninitialized variable warning If fan_get_status() fails then "s" is not initialized. Tweak the error handling a bit to silence this warning. Signed-off-by: Dan Carpenter Signed-off-by: Darren Hart drivers/platform/x86/thinkpad_acpi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit d0192dca2d6b64c043db5babb40076d13a6e955b Author: Dan Carpenter Date: Fri Apr 15 17:45:58 2016 +0300 intel_telemetry_pltdrv: Silence an uninitialized variable warning Presumably "pss_period" and "ioss_period" can't both be zero, but this function is never called so we can't infer that using static analysis alone. Silence the warning by setting "ret" to zero. Signed-off-by: Dan Carpenter Signed-off-by: Darren Hart drivers/platform/x86/intel_telemetry_pltdrv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ff22b4806dd79ba06c78255b67e73c10e34d47cc Author: Dan Carpenter Date: Fri Apr 15 17:47:20 2016 +0300 hp_accel: Silence an uninitialized variable warning If acpi_evaluate_integer() fails then "lret" isn't initialized. I've tweaked the error handling to avoid this issue. Signed-off-by: Dan Carpenter Signed-off-by: Darren Hart drivers/platform/x86/hp_accel.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit a7297a6a3a3322b054592e8e988981d2f5f29cc4 Author: Ming Lei Date: Fri Apr 15 18:51:28 2016 +0800 block: loop: fix filesystem corruption in case of aio/dio Starting from commit e36f620428(block: split bios to max possible length), block core starts to split bio in the middle of bvec. Unfortunately loop dio/aio doesn't consider this situation, and always treat 'iter.iov_offset' as zero. Then filesystem corruption is observed. This patch figures out the offset of the base bvevc via 'bio->bi_iter.bi_bvec_done' and fixes the issue by passing the offset to iov iterator. Fixes: e36f6204288088f (block: split bios to max possible length) Cc: Keith Busch Cc: Al Viro Cc: stable@vger.kernel.org (4.5) Signed-off-by: Ming Lei Signed-off-by: Jens Axboe drivers/block/loop.c | 6 ++++++ 1 file changed, 6 insertions(+) commit f709b45ec461b548c41a00044dba1f1b572783bf Author: Tom Lendacky Date: Wed Apr 13 10:52:25 2016 -0500 crypto: ccp - Prevent information leakage on export Prevent information from leaking to userspace by doing a memset to 0 of the export state structure before setting the structure values and copying it. This prevents un-initialized padding areas from being copied into the export area. Cc: # 3.14.x- Reported-by: Ben Hutchings Signed-off-by: Tom Lendacky Signed-off-by: Herbert Xu drivers/crypto/ccp/ccp-crypto-aes-cmac.c | 3 +++ drivers/crypto/ccp/ccp-crypto-sha.c | 3 +++ 2 files changed, 6 insertions(+) commit 0851561d9c965df086ef8a53f981f5f95a57c2c8 Author: Xiaodong Liu Date: Tue Apr 12 09:45:51 2016 +0000 crypto: sha1-mb - use corrcet pointer while completing jobs In sha_complete_job, incorrect mcryptd_hash_request_ctx pointer is used when check and complete other jobs. If the memory of first completed req is freed, while still completing other jobs in the func, kernel will crash since NULL pointer is assigned to RIP. Cc: Signed-off-by: Xiaodong Liu Acked-by: Tim Chen Signed-off-by: Herbert Xu arch/x86/crypto/sha-mb/sha1_mb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 6f0904ada402a45b3a0a3b9b6507d91d3a9da67a Author: Tadeusz Struk Date: Wed Apr 6 14:42:32 2016 -0700 crypto: rsa-pkcs1pad - fix dst len The output buffer length has to be at least as big as the key_size. It is then updated to the actual output size by the implementation. Cc: Signed-off-by: Tadeusz Struk Signed-off-by: Herbert Xu crypto/rsa-pkcs1pad.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 7e578441a4a3bba2a79426ca0f709c801210d08e Author: Josh Poimboeuf Date: Thu Apr 14 14:52:24 2016 -0500 objtool: Add workaround for GCC switch jump table bug GCC has a rare quirk, currently only seen in three driver functions in the kernel, and only with certain obscure non-distro configs, which can cause objtool to produce "unreachable instruction" false positive warnings. As part of an optimization, GCC makes a copy of an existing switch jump table, modifies it, and then hard-codes the jump (albeit with an indirect jump) to use a single entry in the table. The rest of the jump table and some of its jump targets remain as dead code. In such a case we can just crudely ignore all unreachable instruction warnings for the entire object file. Ideally we would just ignore them for the function, but that would require redesigning the code quite a bit. And honestly that's just not worth doing: unreachable instruction warnings are of questionable value anyway, and this is a very rare issue. kbuild reports: https://lkml.kernel.org/r/201603231906.LWcVUpxm%25fengguang.wu@intel.com https://lkml.kernel.org/r/201603271114.K9i45biy%25fengguang.wu@intel.com https://lkml.kernel.org/r/201603291058.zuJ6ben1%25fengguang.wu@intel.com GCC bug: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70604 Reported-by: kbuild test robot Signed-off-by: Josh Poimboeuf Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/700fa029bbb0feff34f03ffc69d666a3c3b57a61.1460663532.git.jpoimboe@redhat.com Signed-off-by: Ingo Molnar tools/objtool/builtin-check.c | 53 +++++++++++++++++++++++++++++++++---------- 1 file changed, 41 insertions(+), 12 deletions(-) commit 56b367c0cd67d4c3006738e7dc9dda9273fd2bfe Author: Keerthy Date: Thu Apr 14 10:29:16 2016 +0530 pinctrl: single: Fix pcs_parse_bits_in_pinctrl_entry to use __ffs than ffs pcs_parse_bits_in_pinctrl_entry uses ffs which gives bit indices ranging from 1 to MAX. This leads to a corner case where we try to request the pin number = MAX and fails. bit_pos value is being calculted using ffs. pin_num_from_lsb uses bit_pos value. pins array is populated with: pin + pin_num_from_lsb. The above is 1 more than usual bit indices as bit_pos uses ffs to compute first set bit. Hence the last of the pins array is populated with the MAX value and not MAX - 1 which causes error when we call pin_request. mask_pos is rightly calculated as ((pcs->fmask) << (bit_pos - 1)) Consequently val_pos and submask are correct. Hence use __ffs which gives (ffs(x) - 1) as the first bit set. fixes: 4e7e8017a8 ("pinctrl: pinctrl-single: enhance to configure multiple pins of different modules") Signed-off-by: Keerthy Acked-by: Tony Lindgren Signed-off-by: Linus Walleij drivers/pinctrl/pinctrl-single.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit dec8e8f6e6504aa3496c0f7cc10c756bb0e10f44 Author: Jack Pham Date: Thu Apr 14 23:37:26 2016 -0700 regmap: spmi: Fix regmap_spmi_ext_read in multi-byte case Specifically for the case of reads that use the Extended Register Read Long command, a multi-byte read operation is broken up into 8-byte chunks. However the call to spmi_ext_register_readl() is incorrectly passing 'val_size', which if greater than 8 will always fail. The argument should instead be 'len'. Fixes: c9afbb05a9ff ("regmap: spmi: support base and extended register spaces") Signed-off-by: Jack Pham Signed-off-by: Mark Brown Cc: stable@vger.kernel.org drivers/base/regmap/regmap-spmi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9c18fcf7ae0ef87f0723dfd74c27d608c7486e0e Author: Alexandre Courbot Date: Wed Apr 13 05:55:29 2016 +0100 ARM: 8551/2: DMA: Fix kzalloc flags in __dma_alloc Commit 19e6e5e5392b ("ARM: 8547/1: dma-mapping: store buffer information") allocates a structure meant for internal buffer management with the GFP flags of the buffer itself. This can trigger the following safeguard in the slab/slub allocator: if (unlikely(flags & GFP_SLAB_BUG_MASK)) { pr_emerg("gfp: %un", flags & GFP_SLAB_BUG_MASK); BUG(); } Fix this by filtering the flags that make the slab allocator unhappy. Signed-off-by: Alexandre Courbot Acked-by: Rabin Vincent Signed-off-by: Russell King arch/arm/mm/dma-mapping.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 5fedbb923936174ab4d1d5cc92bca1cf6b2e0ca2 Author: Yingjoe Chen Date: Sat Apr 2 14:57:49 2016 +0800 pinctrl: mediatek: correct debounce time unit in mtk_gpio_set_debounce The debounce time unit for gpio_chip.set_debounce is us but mtk_gpio_set_debounce regard it as ms. Fix this by correct debounce time array dbnc_arr so it can find correct debounce setting. Debounce time for first debounce setting is 500us, correct this as well. While I'm at it, also change the debounce time array name to "debounce_time" for readability. Cc: stable@vger.kernel.org Signed-off-by: Yingjoe Chen Reviewed-by: Daniel Kurtz Acked-by: Hongzhou Yang Signed-off-by: Linus Walleij drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 330a106508128056b3d7b6c940a4e906da2282dc Author: Martin Vajnar Date: Sat Apr 2 20:11:13 2016 +0200 hp_accel: Add support for HP ProBook 440 G3 HP ProBook 440 G3 laptop needs a non-standard mapping (x_inverted_usd). Signed-off-by: Martin Vajnar Acked-by: Éric Piel Signed-off-by: Darren Hart drivers/platform/x86/hp_accel.c | 2 ++ 1 file changed, 2 insertions(+) commit 806fdcce017dc98c4dbf8ed001750a0d7d2bb0af Merge: a1f9831 a312549 Author: Linus Torvalds Date: Thu Apr 14 19:53:46 2016 -0700 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "Misc fixes: a binutils fix, an lguest fix, an mcelog fix and a missing documentation fix" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce: Avoid using object after free in genpool lguest, x86/entry/32: Fix handling of guest syscalls using interrupt gates x86/build: Build compressed x86 kernels as PIE x86/mm/pkeys: Add missing Documentation commit a1f983174dd7e535e50ca850fcfb3b8d38149f39 Merge: 63a1281 c12d2da Author: Linus Torvalds Date: Thu Apr 14 19:31:34 2016 -0700 Merge branch 'mm-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull mm gup cleanup from Ingo Molnar: "This removes the ugly get-user-pages API hack, now that all upstream code has been migrated to it" ("ugly" is putting it mildly. But it worked.. - Linus) * 'mm-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: mm/gup: Remove the macro overload API migration helpers from the get_user*() APIs commit 63a1281b651b8ebc04c829254c62bd6fbaf83eb0 Merge: 0a3f5af 9567366 Author: Linus Torvalds Date: Thu Apr 14 19:07:45 2016 -0700 Merge tag 'dm-4.6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - fix a 4.6-rc1 bio-based DM 'struct dm_target_io' leak in an error path - stable@ fix for DM cache metadata's READ_LOCK macros that were incorrectly returning error if the block manager was in read-only mode; also cleanup multi-statement macros to use do {} while(0) * tag 'dm-4.6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm cache metadata: fix READ_LOCK macros and cleanup WRITE_LOCK macros dm: fix dm_target_io leak if clone_bio() returns an error commit 0a3f5af188c4f7df44517e50bee4dbf87c256813 Merge: c8c5285 ad06fde Author: Linus Torvalds Date: Thu Apr 14 19:02:06 2016 -0700 Merge tag 'pwm/for-4.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm Pull pwm fix from Thierry Reding: "A single one-line fix to turn the regmap cache from an RB-tree to a flat cache to avoid lockdep and abort issues" * tag 'pwm/for-4.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm: pwm: fsl-ftm: Use flat regmap cache commit c8c52850e642117899d592682ce857df00cdc753 Merge: a7109a2 c44da62 Author: Linus Torvalds Date: Thu Apr 14 18:47:51 2016 -0700 Merge tag 'sound-4.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "We've had a very calm development cycle, so far. Here are the few fixes for HD-audio and USB-audio, all of which are small and easy" * tag 'sound-4.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda - Fix inconsistent monitor_present state until repoll ALSA: hda - Fix regression of monitor_present flag in eld proc file ALSA: usb-audio: Skip volume controls triggers hangup on Dell USB Dock ALSA: hda/realtek - Enable the ALC292 dock fixup on the Thinkpad T460s ALSA: sscape: Use correct format identifier for size_t ALSA: usb-audio: Add a quirk for Plantronics BT300 ALSA: usb-audio: Add a sample rate quirk for Phoenix Audio TMX320 ALSA: hda - Bind with i915 only when Intel graphics is present commit a7109a2ca79ce868620db3fff884277084a9d646 Merge: dfe7058 0c44d78 Author: Linus Torvalds Date: Thu Apr 14 18:40:47 2016 -0700 Merge branch 'mailbox-devel' of git://git.linaro.org/landing-teams/working/fujitsu/integration Pull mailbox fixes from Jussi Brar: "Misc fixes: mailbox-test driver: - prevent memory leak and another cosmetic change mailbox: - change the returned error code Xgene driver: - return -ENOMEM instead of PTR_ERR for failed devm_kzalloc" * 'mailbox-devel' of git://git.linaro.org/landing-teams/working/fujitsu/integration: mailbox: Stop using ENOSYS for anything other than unimplemented syscalls mailbox: mailbox-test: Prevent memory leak mailbox: mailbox-test: Use more consistent format for calling copy_from_user() mailbox: xgene-slimpro: Fix wrong test for devm_kzalloc commit dfe70581c1b7a7625baa6ba26f8876d337845a23 Merge: 16382ed 03a8bb0 Author: Linus Torvalds Date: Thu Apr 14 18:22:42 2016 -0700 Merge tag 'for-linus-4.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs/fscrypto fixes from Jaegeuk Kim: "In addition to f2fs/fscrypto fixes, I've added one patch which prevents RCU mode lookup in d_revalidate, as Al mentioned. These patches fix f2fs and fscrypto based on -rc3 bug fixes in ext4 crypto, which have not yet been fully propagated as follows. - use of dget_parent and file_dentry to avoid crashes - disallow RCU-mode lookup in d_invalidate - disallow -ENOMEM in the core data encryption path" * tag 'for-linus-4.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: ext4/fscrypto: avoid RCU lookup in d_revalidate fscrypto: don't let data integrity writebacks fail with ENOMEM f2fs: use dget_parent and file_dentry in f2fs_file_open fscrypto: use dget_parent() in fscrypt_d_revalidate() commit c02bc350f9dbce7d637c394a6e1c4d29dc5b28b2 Author: Felix Fietkau Date: Tue Apr 12 18:27:29 2016 +0200 bgmac: fix MAC soft-reset bit for corerev > 4 Only core revisions older than 4 use BGMAC_CMDCFG_SR_REV0. This mainly fixes support for BCM4708A0KF SoCs with Ethernet core rev 5 (it means only some devices as most of BCM4708A0KF-s got core rev 4). This was tested for regressions on BCM47094 which doesn't seem to care which bit gets used. Signed-off-by: Felix Fietkau Signed-off-by: Rafał Miłecki Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bgmac.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 16382ed978cb40713684cfa0f25dc255a58d0c59 Merge: 4c0b1c6 47cd3060 Author: Linus Torvalds Date: Thu Apr 14 18:15:40 2016 -0700 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: "This fixes an NFS regression caused by the skcipher/hash conversion in sunrpc. It also fixes a build problem in certain configurations with bcm63xx" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: hwrng: bcm63xx - fix device tree compilation sunrpc: Fix skcipher/shash conversion commit 01c445a4bde99684effe873848b2ea65f6f8a7d1 Merge: c5b5343 d6a61f8 Author: David S. Miller Date: Thu Apr 14 21:14:04 2016 -0400 Merge branch 'soreuseport-mixed-v4-v6-fixes' Craig Gallek says: ==================== Fixes for SO_REUSEPORT and mixed v4/v6 sockets Recent changes to the datastructures associated with SO_REUSEPORT broke an existing behavior when equivalent SO_REUSEPORT sockets are created using both AF_INET and AF_INET6. This patch series restores the previous behavior and includes a test to validate it. This series should be a trivial merge to stable kernels (if deemed necessary), but will have conflicts in net-next. The following patches recently replaced the use of hlist_nulls with hlists for UDP and TCP socket lists: ca065d0cf80f ("udp: no longer use SLAB_DESTROY_BY_RCU") 3b24d854cb35 ("tcp/dccp: do not touch listener sk_refcnt under synflood") If this series is accepted, I will send an RFC for the net-next change to assist with the merge. ==================== Signed-off-by: David S. Miller commit d6a61f80b8718abbb82dcfc95d56404e3218e7b0 Author: Craig Gallek Date: Tue Apr 12 13:11:26 2016 -0400 soreuseport: test mixed v4/v6 sockets Test to validate the behavior of SO_REUSEPORT sockets that are created with both AF_INET and AF_INET6. See the commit prior to this for a description of this behavior. Signed-off-by: Craig Gallek Signed-off-by: David S. Miller tools/testing/selftests/net/.gitignore | 1 + tools/testing/selftests/net/Makefile | 2 +- tools/testing/selftests/net/reuseport_dualstack.c | 208 ++++++++++++++++++++++ 3 files changed, 210 insertions(+), 1 deletion(-) commit d894ba18d4e449b3a7f6eb491f16c9e02933736e Author: Craig Gallek Date: Tue Apr 12 13:11:25 2016 -0400 soreuseport: fix ordering for mixed v4/v6 sockets With the SO_REUSEPORT socket option, it is possible to create sockets in the AF_INET and AF_INET6 domains which are bound to the same IPv4 address. This is only possible with SO_REUSEPORT and when not using IPV6_V6ONLY on the AF_INET6 sockets. Prior to the commits referenced below, an incoming IPv4 packet would always be routed to a socket of type AF_INET when this mixed-mode was used. After those changes, the same packet would be routed to the most recently bound socket (if this happened to be an AF_INET6 socket, it would have an IPv4 mapped IPv6 address). The change in behavior occurred because the recent SO_REUSEPORT optimizations short-circuit the socket scoring logic as soon as they find a match. They did not take into account the scoring logic that favors AF_INET sockets over AF_INET6 sockets in the event of a tie. To fix this problem, this patch changes the insertion order of AF_INET and AF_INET6 addresses in the TCP and UDP socket lists when the sockets have SO_REUSEPORT set. AF_INET sockets will be inserted at the head of the list and AF_INET6 sockets with SO_REUSEPORT set will always be inserted at the tail of the list. This will force AF_INET sockets to always be considered first. Fixes: e32ea7e74727 ("soreuseport: fast reuseport UDP socket selection") Fixes: 125e80b88687 ("soreuseport: fast reuseport TCP socket selection") Reported-by: Maciej Żenczykowski Signed-off-by: Craig Gallek Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller include/linux/rculist_nulls.h | 39 +++++++++++++++++++++++++++++++++++++++ include/net/sock.h | 6 +++++- net/ipv4/udp.c | 9 +++++++-- 3 files changed, 51 insertions(+), 3 deletions(-) commit c5b5343cfbc9f46af65033fa4f407d7b7d98371d Author: Bjørn Mork Date: Tue Apr 12 16:11:12 2016 +0200 cdc_mbim: apply "NDP to end" quirk to all Huawei devices We now have a positive report of another Huawei device needing this quirk: The ME906s-158 (12d1:15c1). This is an m.2 form factor modem with no obvious relationship to the E3372 (12d1:157d) we already have a quirk entry for. This is reason enough to believe the quirk might be necessary for any number of current and future Huawei devices. Applying the quirk to all Huawei devices, since it is crucial to any device affected by the firmware bug, while the impact on non-affected devices is negligible. The quirk can if necessary be disabled per-device by writing N to /sys/class/net//cdc_ncm/ndp_to_end Reported-by: Andreas Fett Signed-off-by: Bjørn Mork Signed-off-by: David S. Miller drivers/net/usb/cdc_mbim.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit 4c0b1c67c6250be73cedeac935b860e09de4420f Merge: 51d7b12 58976ee Author: Linus Torvalds Date: Thu Apr 14 18:03:29 2016 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull keys bugfixes from James Morris: "Two bugfixes for Keys related code" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: ASN.1: fix open failure check on headername assoc_array: don't call compare_object() on a node commit 2193a3fd7bc6ffd607c1a791d05d22a4a2282c57 Merge: 0b24f7a d9c9f3b Author: Kevin Hilman Date: Thu Apr 14 14:51:51 2016 -0700 Merge tag 'v4.6-soc-fixes' of https://github.com/mbgg/linux-mediatek into fixes - fix boot error reverting commit cc8ed76938b5 ("soc: mediatek: SCPSYS: Fix double enabling of regulators") * tag 'v4.6-soc-fixes' of https://github.com/mbgg/linux-mediatek: Revert "soc: mediatek: SCPSYS: Fix double enabling of regulators" commit 9567366fefddeaea4ed1d713270535d93a3b3c76 Author: Mike Snitzer Date: Tue Apr 12 12:14:46 2016 -0400 dm cache metadata: fix READ_LOCK macros and cleanup WRITE_LOCK macros The READ_LOCK macro was incorrectly returning -EINVAL if dm_bm_is_read_only() was true -- it will always be true once the cache metadata transitions to read-only by dm_cache_metadata_set_read_only(). Wrap READ_LOCK and WRITE_LOCK multi-statement macros in do {} while(0). Also, all accesses of the 'cmd' argument passed to these related macros are now encapsulated in parenthesis. A follow-up patch can be developed to eliminate the use of macros in favor of pure C code. Avoiding that now given that this needs to apply to stable@. Reported-by: Ben Hutchings Signed-off-by: Mike Snitzer Fixes: d14fcf3dd79 ("dm cache: make sure every metadata function checks fail_io") Cc: stable@vger.kernel.org drivers/md/dm-cache-metadata.c | 64 ++++++++++++++++++++++++++---------------- 1 file changed, 40 insertions(+), 24 deletions(-) commit b4dfd8e92956b396d3438212bc9a0be6267b8b34 Author: Rafał Miłecki Date: Tue Apr 12 13:30:45 2016 +0200 bgmac: reset & enable Ethernet core before using it This fixes Ethernet on D-Link DIR-885L with BCM47094 SoC. Felix reported similar fix was needed for his BCM4709 device (Buffalo WXR-1900DHP?). I tested this for regressions on BCM4706, BCM4708A0 and BCM47081A0. Cc: Felix Fietkau Signed-off-by: Rafał Miłecki Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bgmac.c | 5 +++++ 1 file changed, 5 insertions(+) commit 97cc931fc928a5cef50b104c0c225975ff729fce Merge: f1d0540 e646b65 Author: David S. Miller Date: Thu Apr 14 16:29:54 2016 -0400 Merge branch 'ipv6-dgram-dst-cache' Martin KaFai Lau says: ==================== ipv6: datagram: Update dst cache of a connected udp sk during pmtu update v2: ~ Protect __sk_dst_get() operations with rcu_read_lock in release_cb() because another thread may do ip6_dst_store() for a udp sk without taking the sk lock (e.g. in sendmsg). ~ Do a ipv6_addr_v4mapped(&sk->sk_v6_daddr) check before calling ip6_datagram_dst_update() in patch 3 and 4. It is similar to how __ip6_datagram_connect handles it. ~ One fix in ip6_datagram_dst_update() in patch 2. It needs to check (np->flow_label & IPV6_FLOWLABEL_MASK) before doing fl6_sock_lookup. I was confused with the naming of IPV6_FLOWLABEL_MASK and IPV6_FLOWINFO_MASK. ~ Check dst->obsolete just on the safe side, although I think it should at least have DST_OBSOLETE_FORCE_CHK by now. ~ Add Fixes tag to patch 3 and 4 ~ Add some points from the previous discussion about holding sk lock to the commit message in patch 3. v1: There is a case in connected UDP socket such that getsockopt(IPV6_MTU) will return a stale MTU value. The reproducible sequence could be the following: 1. Create a connected UDP socket 2. Send some datagrams out 3. Receive a ICMPV6_PKT_TOOBIG 4. No new outgoing datagrams to trigger the sk_dst_check() logic to update the sk->sk_dst_cache. 5. getsockopt(IPV6_MTU) returns the mtu from the invalid sk->sk_dst_cache instead of the newly created RTF_CACHE clone. Patch 1 and 2 are the prep work. Patch 3 and 4 are the fixes. ==================== Signed-off-by: David S. Miller commit e646b657f6983017783914a951039e323120dc55 Author: Martin KaFai Lau Date: Mon Apr 11 15:29:37 2016 -0700 ipv6: udp: Do a route lookup and update during release_cb This patch adds a release_cb for UDPv6. It does a route lookup and updates sk->sk_dst_cache if it is needed. It picks up the left-over job from ip6_sk_update_pmtu() if the sk was owned by user during the pmtu update. It takes a rcu_read_lock to protect the __sk_dst_get() operations because another thread may do ip6_dst_store() without taking the sk lock (e.g. sendmsg). Fixes: 45e4fd26683c ("ipv6: Only create RTF_CACHE routes after encountering pmtu exception") Signed-off-by: Martin KaFai Lau Reported-by: Wei Wang Cc: Cong Wang Cc: Eric Dumazet Cc: Wei Wang Signed-off-by: David S. Miller include/net/ipv6.h | 1 + net/ipv6/datagram.c | 20 ++++++++++++++++++++ net/ipv6/udp.c | 1 + 3 files changed, 22 insertions(+) commit 33c162a980fe03498fcecb917f618ad7e7c55e61 Author: Martin KaFai Lau Date: Mon Apr 11 15:29:36 2016 -0700 ipv6: datagram: Update dst cache of a connected datagram sk during pmtu update There is a case in connected UDP socket such that getsockopt(IPV6_MTU) will return a stale MTU value. The reproducible sequence could be the following: 1. Create a connected UDP socket 2. Send some datagrams out 3. Receive a ICMPV6_PKT_TOOBIG 4. No new outgoing datagrams to trigger the sk_dst_check() logic to update the sk->sk_dst_cache. 5. getsockopt(IPV6_MTU) returns the mtu from the invalid sk->sk_dst_cache instead of the newly created RTF_CACHE clone. This patch updates the sk->sk_dst_cache for a connected datagram sk during pmtu-update code path. Note that the sk->sk_v6_daddr is used to do the route lookup instead of skb->data (i.e. iph). It is because a UDP socket can become connected after sending out some datagrams in un-connected state. or It can be connected multiple times to different destinations. Hence, iph may not be related to where sk is currently connected to. It is done under '!sock_owned_by_user(sk)' condition because the user may make another ip6_datagram_connect() (i.e changing the sk->sk_v6_daddr) while dst lookup is happening in the pmtu-update code path. For the sock_owned_by_user(sk) == true case, the next patch will introduce a release_cb() which will update the sk->sk_dst_cache. Test: Server (Connected UDP Socket): ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Route Details: [root@arch-fb-vm1 ~]# ip -6 r show | egrep '2fac' 2fac::/64 dev eth0 proto kernel metric 256 pref medium 2fac:face::/64 via 2fac::face dev eth0 metric 1024 pref medium A simple python code to create a connected UDP socket: import socket import errno HOST = '2fac::1' PORT = 8080 s = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM) s.bind((HOST, PORT)) s.connect(('2fac:face::face', 53)) print("connected") while True: try: data = s.recv(1024) except socket.error as se: if se.errno == errno.EMSGSIZE: pmtu = s.getsockopt(41, 24) print("PMTU:%d" % pmtu) break s.close() Python program output after getting a ICMPV6_PKT_TOOBIG: [root@arch-fb-vm1 ~]# python2 ~/devshare/kernel/tasks/fib6/udp-connect-53-8080.py connected PMTU:1300 Cache routes after recieving TOOBIG: [root@arch-fb-vm1 ~]# ip -6 r show table cache 2fac:face::face via 2fac::face dev eth0 metric 0 cache expires 463sec mtu 1300 pref medium Client (Send the ICMPV6_PKT_TOOBIG): ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ scapy is used to generate the TOOBIG message. Here is the scapy script I have used: >>> p=Ether(src='da:75:4d:36:ac:32', dst='52:54:00:12:34:66', type=0x86dd)/IPv6(src='2fac::face', dst='2fac::1')/ICMPv6PacketTooBig(mtu=1300)/IPv6(src='2fac:: 1',dst='2fac:face::face', nh='UDP')/UDP(sport=8080,dport=53) >>> sendp(p, iface='qemubr0') Fixes: 45e4fd26683c ("ipv6: Only create RTF_CACHE routes after encountering pmtu exception") Signed-off-by: Martin KaFai Lau Reported-by: Wei Wang Cc: Cong Wang Cc: Eric Dumazet Cc: Wei Wang Signed-off-by: David S. Miller include/net/ipv6.h | 1 + net/ipv6/datagram.c | 20 +++++++++++--------- net/ipv6/route.c | 12 ++++++++++++ 3 files changed, 24 insertions(+), 9 deletions(-) commit 7e2040db1539a904924b997a14ebd3de53172100 Author: Martin KaFai Lau Date: Mon Apr 11 15:29:35 2016 -0700 ipv6: datagram: Refactor dst lookup and update codes to a new function This patch moves the route lookup and update codes for connected datagram sk to a newly created function ip6_datagram_dst_update() It will be reused during the pmtu update in the later patch. Signed-off-by: Martin KaFai Lau Cc: Cong Wang Cc: Eric Dumazet Cc: Wei Wang Signed-off-by: David S. Miller net/ipv6/datagram.c | 103 +++++++++++++++++++++++++++++----------------------- 1 file changed, 57 insertions(+), 46 deletions(-) commit 80fbdb208f37740774652ba095a5b2045205ed59 Author: Martin KaFai Lau Date: Mon Apr 11 15:29:34 2016 -0700 ipv6: datagram: Refactor flowi6 init codes to a new function Move flowi6 init codes for connected datagram sk to a newly created function ip6_datagram_flow_key_init(). Notes: 1. fl6_flowlabel is used instead of fl6.flowlabel in __ip6_datagram_connect 2. ipv6_addr_is_multicast(&fl6->daddr) is used instead of (addr_type & IPV6_ADDR_MULTICAST) in ip6_datagram_flow_key_init() This new function will be reused during pmtu update in the later patch. Signed-off-by: Martin KaFai Lau Cc: Cong Wang Cc: Eric Dumazet Cc: Wei Wang Signed-off-by: David S. Miller net/ipv6/datagram.c | 50 ++++++++++++++++++++++++++++++-------------------- 1 file changed, 30 insertions(+), 20 deletions(-) commit f1d0540db6a21395a58268f4392c7420ebae8c1d Author: John Crispin Date: Tue Apr 12 08:35:18 2016 +0200 net: mediatek: update the IRQ part of the binding document The current binding document only describes a single interrupt. Update the document by adding the 2 other interrupts. The driver currently only uses a single interrupt. The HW is however able to using IRQ grouping to split TX and RX onto separate GIC irqs. Signed-off-by: John Crispin Cc: devicetree@vger.kernel.org Acked-by: Rob Herring Signed-off-by: David S. Miller Documentation/devicetree/bindings/net/mediatek-net.txt | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit a5229050b69cfffb690b546c357ca5a60434c0c8 Author: Keith Busch Date: Fri Apr 8 16:09:10 2016 -0600 NVMe: Always use MSI/MSI-x interrupts Multiple users have reported device initialization failure due the driver not receiving legacy PCI interrupts. This is not unique to any particular controller, but has been observed on multiple platforms. There have been no issues reported or observed when with message signaled interrupts, so this patch attempts to use MSI-x during initialization, falling back to MSI. If that fails, legacy would become the default. The setup_io_queues error handling had to change as a result: the admin queue's msix_entry used to be initialized to the legacy IRQ. The case where nr_io_queues is 0 would fail request_irq when setting up the admin queue's interrupt since re-enabling MSI-x fails with 0 vectors, leaving the admin queue's msix_entry invalid. Instead, return success immediately. Reported-by: Tim Muhlemmer Reported-by: Jon Derrick Signed-off-by: Keith Busch Signed-off-by: Jens Axboe drivers/nvme/host/pci.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) commit 51d7b120418e99d6b3bf8df9eb3cc31e8171dee4 Author: Linus Torvalds Date: Thu Apr 14 12:05:37 2016 -0700 /proc/iomem: only expose physical resource addresses to privileged users In commit c4004b02f8e5b ("x86: remove the kernel code/data/bss resources from /proc/iomem") I was hoping to remove the phyiscal kernel address data from /proc/iomem entirely, but that had to be reverted because some system programs actually use it. This limits all the detailed resource information to properly credentialed users instead. Signed-off-by: Linus Torvalds kernel/resource.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) commit ab0fa82b2df96ddadb327ac39f26b5d80cb3d104 Author: Linus Torvalds Date: Thu Apr 14 12:00:21 2016 -0700 pci-sysfs: use proper file capability helper function The PCI config access checked the file capabilities correctly, but used the itnernal security capability check rather than the helper function that is actually meant for that. The security_capable() has unusual return values and is not meant to be used elsewhere (the only other use is in the capability checking functions that we actually intend people to use, and this odd PCI usage really stood out when looking around the capability code. Signed-off-by: Linus Torvalds drivers/pci/pci-sysfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 34dbbcdbf63360661ff7bda6c5f52f99ac515f92 Author: Linus Torvalds Date: Thu Apr 14 11:22:00 2016 -0700 Make file credentials available to the seqfile interfaces A lot of seqfile users seem to be using things like %pK that uses the credentials of the current process, but that is actually completely wrong for filesystem interfaces. The unix semantics for permission checking files is to check permissions at _open_ time, not at read or write time, and that is not just a small detail: passing off stdin/stdout/stderr to a suid application and making the actual IO happen in privileged context is a classic exploit technique. So if we want to be able to look at permissions at read time, we need to use the file open credentials, not the current ones. Normal file accesses can just use "f_cred" (or any of the helper functions that do that, like file_ns_capable()), but the seqfile interfaces do not have any such options. It turns out that seq_file _does_ save away the user_ns information of the file, though. Since user_ns is just part of the full credential information, replace that special case with saving off the cred pointer instead, and suddenly seq_file has all the permission information it needs. Signed-off-by: Linus Torvalds fs/seq_file.c | 7 ++++--- include/linux/seq_file.h | 13 ++++--------- 2 files changed, 8 insertions(+), 12 deletions(-) commit 4046d6e81f33b7ef50d6668b78076d54c5e066b6 Author: Linus Torvalds Date: Thu Apr 14 11:18:57 2016 -0700 Revert "x86: remove the kernel code/data/bss resources from /proc/iomem" This reverts commit c4004b02f8e5b9ce357a0bb1641756cc86962664. Sadly, my hope that nobody would actually use the special kernel entries in /proc/iomem were dashed by kexec. Which reads /proc/iomem explicitly to find the kernel base address. Nasty. Anyway, that means we can't do the sane and simple thing and just remove the entries, and we'll instead have to mask them out based on permissions. Reported-by: Zhengyu Zhang Reported-by: Dave Young Reported-by: Freeman Zhang Reported-by: Emrah Demir Reported-by: Baoquan He Signed-off-by: Linus Torvalds arch/x86/kernel/setup.c | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) commit 7dedd15dd2527055390b9742c87a02556d3180f4 Author: Dan Carpenter Date: Thu Apr 14 12:31:49 2016 +0300 md/raid0: fix uninitialized variable bug If this function fails the callers expect that *private_conf is set to an ERR_PTR() but that isn't true for the first error path where we can't allocate "conf". It leads to some uninitialized variable bugs. Signed-off-by: Dan Carpenter Signed-off-by: Shaohua Li drivers/md/raid0.c | 1 + 1 file changed, 1 insertion(+) commit 5e265029124fc8ff9e5350972abeddc7c7a0b9cc Merge: d82bccc 8f815cd Author: David S. Miller Date: Thu Apr 14 12:00:59 2016 -0400 Merge tag 'mac80211-for-davem-2016-04-14' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== This has just the single fix from Dmitry Ivanov, adding the missing netlink notifier family check to avoid the socket close DoS problem. ==================== Signed-off-by: David S. Miller commit 366dd4ea9d5f0eb78fdf4982d76506f99480ec0a Author: Helge Deller Date: Wed Apr 13 22:27:22 2016 +0200 parisc: Fix ftrace function tracer Fix the FTRACE function tracer for 32- and 64-bit kernel. The former code was horribly broken. Reimplement most coding in assembly and utilize optimizations, e.g. put mcount() and ftrace_stub() into one L1 cacheline. Signed-off-by: Helge Deller arch/parisc/Kconfig | 4 +- arch/parisc/Kconfig.debug | 4 ++ arch/parisc/Makefile | 4 +- arch/parisc/include/asm/ftrace.h | 18 +---- arch/parisc/kernel/Makefile | 4 -- arch/parisc/kernel/entry.S | 93 ++++++++++++++++++++----- arch/parisc/kernel/ftrace.c | 146 ++++++--------------------------------- arch/parisc/kernel/head.S | 9 +++ 8 files changed, 114 insertions(+), 168 deletions(-) commit 1560d15861769c23fd981e2d60dc7fd790b21e1e Author: Dave Gerlach Date: Wed Apr 13 20:49:48 2016 -0500 ARM: OMAP3: Fix external abort on 36xx waking from off mode idle Depending on timing during the resume path from off mode on 36xx, we may see external aborts. These seem to be caused by the following: - OMAP3 Advisory 1.62 "MPU Cannot Exit from Standby" says we need to disable intc autoidle before WFI - DM3730 Advisory 1.106 "MPU Leaves MSTANDBY State Before IDLEREQ of Interrupt Controller is Released" says we need to wait before accessing intc omap3_intc_resume_idle restores the intc autoidle for all resume paths, however in the resume path from off mode only it is also being restored by omap_intc_restore_context before this call to omap3_intc_resume_idle happens. The second restore of the intc autoidle in this path is what appears to be causing the external abort so for the off mode resume path let's rely on omap_intc_restore_context to restore intc autoidle, and for all other paths let omap3_intc_resume_idle handle it as it is now. Signed-off-by: Dave Gerlach Signed-off-by: Tony Lindgren arch/arm/mach-omap2/pm34xx.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) commit cba2e47abcbd80e3f46f460899290402f98090ec Author: Toshi Kani Date: Tue Apr 12 18:10:52 2016 -0600 pmem: fix BUG() error in pmem.h:48 on X86_32 After 'commit fc0c2028135c ("x86, pmem: use memcpy_mcsafe() for memcpy_from_pmem()")', probing a PMEM device hits the BUG() error below on X86_32 kernel. kernel BUG at include/linux/pmem.h:48! memcpy_from_pmem() calls arch_memcpy_from_pmem(), which is unimplemented since CONFIG_ARCH_HAS_PMEM_API is undefined on X86_32. Fix the BUG() error by adding default_memcpy_from_pmem(). Acked-by: Dan Williams Signed-off-by: Toshi Kani Signed-off-by: Ross Zwisler Cc: Dan Williams Cc: Ross Zwisler include/linux/pmem.h | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) commit ad06fdeeef1cbadf86ebbe510e8079abada8b44e Author: Stefan Agner Date: Wed Jan 20 18:56:22 2016 -0800 pwm: fsl-ftm: Use flat regmap cache Use flat regmap cache to avoid lockdep warning at probe: [ 0.697285] WARNING: CPU: 0 PID: 1 at kernel/locking/lockdep.c:2755 lockdep_trace_alloc+0x15c/0x160() [ 0.697449] DEBUG_LOCKS_WARN_ON(irqs_disabled_flags(flags)) The RB-tree regmap cache needs to allocate new space on first writes. However, allocations in an atomic context (e.g. when a spinlock is held) are not allowed. The function regmap_write calls map->lock, which acquires a spinlock in the fast_io case. Since the pwm-fsl-ftm driver uses MMIO, the regmap bus of type regmap_mmio is being used which has fast_io set to true. The MMIO space of the pwm-fsl-ftm driver is reasonable condense, hence using the much faster flat regmap cache is anyway the better choice. Signed-off-by: Stefan Agner Cc: Mark Brown Signed-off-by: Thierry Reding drivers/pwm/pwm-fsl-ftm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6dd22a116614acf33aeef13861e32510ef9d5392 Author: Alexander Kurz Date: Sun Apr 10 20:41:38 2016 +0200 pinctrl: imx: Kconfig: PINCTRL_IMX select REGMAP Regmap functionality has been integrated into pinctrl-imx.c with commit 8626ada8 which might trigger build failures when regmap is not selected otherwise. Hence, make Kconfig aware about this new dependency. Signed-off-by: Alexander Kurz Acked-by: Philipp Zabel Acked-by: Shawn Guo Signed-off-by: Linus Walleij drivers/pinctrl/freescale/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 70ad7f7e40af31e7ab4a1719602542856b7ea856 Author: Jon Hunter Date: Wed Apr 13 15:35:56 2016 +0100 mmc: tegra: Disable UHS-I modes for Tegra124 Tegra124 has been randomly hanging during system suspend when entering the Tegra LP1 low power state. The hang is caused by the Tegra SDHCI driver and linked to the UHS-I tuning sequence. Disabling the UHS-I modes for Tegra124 prevents any hangs from occurring when entering system suspend. Unfortunately, the tuning sequence described in the public Tegra documentation is incomplete and on inspection of the current tuning sequence that has been implemented is also incomplete and may cause problems. In the short-term it is safer to disable UHS-I modes for now and fix later because it would be too large of a change to simply patch now. Therefore, disable UHS-I modes for Tegra124. Signed-off-by: Jon Hunter Acked-by: Thierry Reding Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-tegra.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) commit 9aaf3437aa72ed5370bf32c99580a3fa2c330e3d Author: Ulf Hansson Date: Wed Apr 6 16:12:08 2016 +0200 mmc: block: Use the mmc host device index as the mmcblk device index Commit 520bd7a8b415 ("mmc: core: Optimize boot time by detecting cards simultaneously") causes regressions for some platforms. These platforms relies on fixed mmcblk device indexes, instead of deploying the defacto standard with UUID/PARTUUID. In other words their rootfs needs to be available at hardcoded paths, like /dev/mmcblk0p2. Such guarantees have never been made by the kernel, but clearly the above commit changes the behaviour. More precisely, because of that the order changes of how cards becomes detected, so do their corresponding mmcblk device indexes. As the above commit significantly improves boot time for some platforms (magnitude of seconds), let's avoid reverting this change but instead restore the behaviour of how mmcblk device indexes becomes picked. By using the same index for the mmcblk device as for the corresponding mmc host device, the probe order of mmc host devices decides the index we get for the mmcblk device. For those platforms that suffers from a regression, one could expect that this updated behaviour should be sufficient to meet their expectations of "fixed" mmcblk device indexes. Another side effect from this change, is that the same index is used for the mmc host device, the mmcblk device and the mmc block queue. That should clarify their relationship. Reported-by: Peter Hurley Reported-by: Laszlo Fiat Cc: Linus Torvalds Fixes: 520bd7a8b415 ("mmc: core: Optimize boot time by detecting cards simultaneously") Cc: Signed-off-by: Ulf Hansson drivers/mmc/card/block.c | 18 +----------------- 1 file changed, 1 insertion(+), 17 deletions(-) commit d82bccc69041a51f7b7b9b4a36db0772f4cdba21 Author: Alexei Starovoitov Date: Tue Apr 12 10:26:19 2016 -0700 bpf/verifier: reject invalid LD_ABS | BPF_DW instruction verifier must check for reserved size bits in instruction opcode and reject BPF_LD | BPF_ABS | BPF_DW and BPF_LD | BPF_IND | BPF_DW instructions, otherwise interpreter will WARN_RATELIMIT on them during execution. Fixes: ddd872bc3098 ("bpf: verifier: add checks for BPF_ABS | BPF_IND instructions") Signed-off-by: Alexei Starovoitov Acked-by: Daniel Borkmann Signed-off-by: David S. Miller kernel/bpf/verifier.c | 1 + 1 file changed, 1 insertion(+) commit 3dcd493fbebfd631913df6e2773cc295d3bf7d22 Author: Lars Persson Date: Tue Apr 12 08:45:52 2016 +0200 net: sched: do not requeue a NULL skb A failure in validate_xmit_skb_list() triggered an unconditional call to dev_requeue_skb with skb=NULL. This slowly grows the queue discipline's qlen count until all traffic through the queue stops. We take the optimistic approach and continue running the queue after a failure since it is unknown if later packets also will fail in the validate path. Fixes: 55a93b3ea780 ("qdisc: validate skb without holding lock") Signed-off-by: Lars Persson Acked-by: Eric Dumazet Signed-off-by: David S. Miller net/sched/sch_generic.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 309cf37fe2a781279b7675d4bb7173198e532867 Author: Mathias Krause Date: Sun Apr 10 12:52:28 2016 +0200 packet: fix heap info leak in PACKET_DIAG_MCLIST sock_diag interface Because we miss to wipe the remainder of i->addr[] in packet_mc_add(), pdiag_put_mclist() leaks uninitialized heap bytes via the PACKET_DIAG_MCLIST netlink attribute. Fix this by explicitly memset(0)ing the remaining bytes in i->addr[]. Fixes: eea68e2f1a00 ("packet: Report socket mclist info via diag module") Signed-off-by: Mathias Krause Cc: Eric W. Biederman Cc: Pavel Emelyanov Acked-by: Pavel Emelyanov Signed-off-by: David S. Miller net/packet/af_packet.c | 1 + 1 file changed, 1 insertion(+) commit 41015e89d9ea8b3d94af22bcd8582f6f3f23d9c1 Merge: d6d5e99 f808c5d Author: David S. Miller Date: Thu Apr 14 00:31:45 2016 -0400 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue Jeff Kirsher says: ==================== Intel Wired LAN Driver Updates 2016-04-13 This series contains updates to i40e, i40evf and fm10k. Alex fixes a bug introduced earlier based on his interpretation of the XL710 datasheet. The actual limit for fragments with TSO and a skbuff that has payload data in the header portion of the buffer is actually only 7 fragments and the skb-data portion counts as 2 buffers, one for the TSO header, and the one for a segment payload buffer. Jacob fixes a bug where in a previous refactor of the code broke multi-bit updates for VFs. The problem occurs because a multi-bit request has a non-zero length, and the PF would simply drop any request with the upper 16 bits set. ==================== Signed-off-by: David S. Miller commit 85cc88f02eb0ecf44493c1b2ebb6f206cd5fc321 Author: Rex Zhu Date: Tue Apr 12 19:25:52 2016 +0800 drm/amdgpu: when suspending, if uvd/vce was running. need to cancel delay work. fix the issue that when resume back, uvd/vce dpm was disabled and uvd/vce's performace dropped. Signed-off-by: Rex Zhu Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 2 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 1 + 2 files changed, 3 insertions(+) commit 7403c515c49c033fec33df0814fffdc977e6acdc Author: Alex Deucher Date: Wed Apr 13 12:08:27 2016 -0400 drm/radeon: fix initial connector audio value This got lost somewhere along the way. This fixes audio not working until set_property was called. Noticed-by: Hyungwon Hwang Cc: stable@vger.kernel.org Signed-off-by: Alex Deucher drivers/gpu/drm/radeon/radeon_connectors.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit d6d5e999e5df67f8ec20b6be45e2229455ee3699 Author: Chris Friesen Date: Fri Apr 8 15:21:30 2016 -0600 route: do not cache fib route info on local routes with oif For local routes that require a particular output interface we do not want to cache the result. Caching the result causes incorrect behaviour when there are multiple source addresses on the interface. The end result being that if the intended recipient is waiting on that interface for the packet he won't receive it because it will be delivered on the loopback interface and the IP_PKTINFO ipi_ifindex will be set to the loopback interface as well. This can be tested by running a program such as "dhcp_release" which attempts to inject a packet on a particular interface so that it is received by another program on the same board. The receiving process should see an IP_PKTINFO ipi_ifndex value of the source interface (e.g., eth1) instead of the loopback interface (e.g., lo). The packet will still appear on the loopback interface in tcpdump but the important aspect is that the CMSG info is correct. Sample dhcp_release command line: dhcp_release eth1 192.168.204.222 02:11:33:22:44:66 Signed-off-by: Allain Legacy Signed off-by: Chris Friesen Reviewed-by: Julian Anastasov Signed-off-by: David S. Miller net/ipv4/route.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit f808c5dbcdc393be8e9f676c61baac6a3db382c1 Author: Jacob Keller Date: Thu Mar 31 09:52:30 2016 -0700 fm10k: fix multi-bit VLAN update requests from VF The VF uses a multi-bit update request to clear unused VLANs whenever it resets. However, an accident in a previous refector broke multi-bit updates for VFs, due to misreading a comment in fm10k_vf.c and attempting to reduce code duplication. The problem occurs because a multi-bit request has a non-zero length, and the PF would simply drop any request with the upper 16 bits set. We can't simply remove the check of the upper 16 bits and the call to fm10k_iov_select vid, because this would remove the checks for default VID and for ensuring no other VLANs can be enabled except pf_vid when it has been set. To resolve that issue, this revision uses the iov_select_vid when we have a single-bit update, and denies any multi-bit update when the VLAN was administratively set by the PF. This should be ok since the PF properly updates VLAN_TABLE when it assigns the PF vid. This ensures that requests to add or remove the PF vid work as expected, but a rogue VF could not use the multi-bit update as a loophole to attempt receiving traffic on other VLANs. Reported-by: Ngai-Mint Kwan Signed-off-by: Jacob Keller Tested-by: Krishneil Singh Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/fm10k/fm10k_pf.c | 30 +++++++++++++++++++++-------- 1 file changed, 22 insertions(+), 8 deletions(-) commit 65c66af6609f0e76617184b40efea8eea1aae505 Author: David Daney Date: Fri Apr 8 13:37:27 2016 -0700 net: thunderx: Fix broken of_node_put() code. commit b7d3e3d3d21a ("net: thunderx: Don't leak phy device references on -EPROBE_DEFER condition.") incorrectly moved the call to of_node_put() outside of the loop. Under normal loop exit, the node has already had of_node_put() called, so the extra call results in: [ 8.228020] ERROR: Bad of_node_put() on /soc@0/pci@848000000000/mrml-bridge0@1,0/bgx0/xlaui00 [ 8.239433] CPU: 16 PID: 608 Comm: systemd-udevd Not tainted 4.6.0-rc1-numa+ #157 [ 8.247380] Hardware name: www.cavium.com EBB8800/EBB8800, BIOS 0.3 Mar 2 2016 [ 8.273541] Call trace: [ 8.273550] [] dump_backtrace+0x0/0x210 [ 8.273557] [] show_stack+0x24/0x2c [ 8.273560] [] dump_stack+0x8c/0xb4 [ 8.273566] [] of_node_release+0xa8/0xac [ 8.273570] [] kobject_cleanup+0x8c/0x194 [ 8.273573] [] kobject_put+0x44/0x6c [ 8.273576] [] of_node_put+0x24/0x30 [ 8.273587] [] bgx_probe+0x17c/0xcd8 [thunder_bgx] [ 8.273591] [] pci_device_probe+0xa0/0x114 [ 8.273596] [] driver_probe_device+0x178/0x418 [ 8.273599] [] __driver_attach+0x100/0x118 [ 8.273602] [] bus_for_each_dev+0x6c/0xac [ 8.273605] [] driver_attach+0x30/0x38 [ 8.273608] [] bus_add_driver+0x1f8/0x29c [ 8.273611] [] driver_register+0x70/0x110 [ 8.273617] [] __pci_register_driver+0x60/0x6c [ 8.273623] [] bgx_init_module+0x40/0x48 [thunder_bgx] [ 8.273626] [] do_one_initcall+0xcc/0x1c0 [ 8.273631] [] do_init_module+0x68/0x1c8 [ 8.273635] [] load_module+0xf44/0x11f4 [ 8.273638] [] SyS_finit_module+0xb8/0xe0 [ 8.273641] [] el0_svc_naked+0x24/0x28 Go back to the previous (correct) code that only did the extra of_node_put() call on early exit from the loop. Signed-off-by: David Daney Signed-off-by: David S. Miller drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit ff3e84e8e479c3ba7148f8dc35a56cf091ab56d9 Merge: 25451c1 2072fe5 Author: Dave Airlie Date: Thu Apr 14 13:06:19 2016 +1000 Merge branch 'exynos-drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes fix some exynos regressions. * 'exynos-drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos: drm/exynos: Use VIDEO_SAMSUNG_S5P_G2D=n as G2D Kconfig dependency drm/exynos: fix a warning message drm/exynos: mic: fix an error code drm/exynos: fimd: fix broken dp_clock control drm/exynos: build fbdev code conditionally drm/exynos: fix adjusted_mode pointer in exynos_plane_mode_set drm/exynos: fix error handling in exynos_drm_subdrv_open commit 25451c195a4e5097d4e74f2165e57f35a58197e4 Merge: 9288152 303f551 Author: Dave Airlie Date: Thu Apr 14 13:05:56 2016 +1000 Merge branch 'drm-fixes-4.6' of git://people.freedesktop.org/~agd5f/linux into drm-fixes some misc radeon fixes. * 'drm-fixes-4.6' of git://people.freedesktop.org/~agd5f/linux: drm/amd/amdgpu: fix irq domain remove for tonga ih drm/radeon: use helper for mst connector dpms. drm/radeon/mst: port some MST setup code from DAL. drm/amdgpu: add invisible pin size statistic commit b821646826e22f0491708768fccce58eef3f5704 Author: Emrah Demir Date: Fri Apr 8 22:16:11 2016 +0300 mISDN: Fixing missing validation in base_sock_bind() Add validation code into mISDN/socket.c Signed-off-by: Emrah Demir Signed-off-by: David S. Miller drivers/isdn/mISDN/socket.c | 3 +++ 1 file changed, 3 insertions(+) commit 3f3f7cb875c0f621485644d4fd7453b0d37f00e4 Author: Alexander Duyck Date: Wed Mar 30 16:15:37 2016 -0700 i40e/i40evf: Limit TSO to 7 descriptors for payload instead of 8 per packet This patch addresses a bug introduced based on my interpretation of the XL710 datasheet. Specifically section 8.4.1 states that "A single transmit packet may span up to 8 buffers (up to 8 data descriptors per packet including both the header and payload buffers)." It then later goes on to say that each segment for a TSO obeys the previous rule, however it then refers to TSO header and the segment payload buffers. I believe the actual limit for fragments with TSO and a skbuff that has payload data in the header portion of the buffer is actually only 7 fragments as the skb->data portion counts as 2 buffers, one for the TSO header, and one for a segment payload buffer. Fixes: 2d37490b82af ("i40e/i40evf: Rewrite logic for 8 descriptor per packet check") Reported-by: Sowmini Varadhan Signed-off-by: Alexander Duyck Acked-by: Jesse Brandeburg Tested-by: Sowmini Varadhan Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/i40e/i40e_txrx.c | 49 +++++++++++++-------------- drivers/net/ethernet/intel/i40e/i40e_txrx.h | 10 ++++-- drivers/net/ethernet/intel/i40evf/i40e_txrx.c | 49 +++++++++++++-------------- drivers/net/ethernet/intel/i40evf/i40e_txrx.h | 10 ++++-- 4 files changed, 62 insertions(+), 56 deletions(-) commit 70af921db6f8835f4b11c65731116560adb00c14 Author: David Ahern Date: Fri Apr 8 12:01:21 2016 -0700 net: ipv6: Do not keep linklocal and loopback addresses f1705ec197e7 added the option to retain user configured addresses on an admin down. A comment to one of the later revisions suggested using the IFA_F_PERMANENT flag rather than adding a user_managed boolean to the ifaddr struct. A side effect of this change is that link local and loopback addresses are also retained which is not part of the objective of f1705ec197e7. Add check to drop those addresses. Fixes: f1705ec197e7 ("net: ipv6: Make address flushing on ifdown optional") Signed-off-by: David Ahern Signed-off-by: David S. Miller net/ipv6/addrconf.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) commit a6d37131c02f15463daa00e2f1da6824e8e00de2 Author: Wolfram Sang Date: Fri Apr 8 13:28:42 2016 +0200 net: ethernet: renesas: ravb_main: test clock rate to avoid division by 0 The clk API may return 0 on clk_get_rate, so we should check the result before using it as a divisor. Signed-off-by: Wolfram Sang Acked-by: Sergei Shtylyov Signed-off-by: David S. Miller drivers/net/ethernet/renesas/ravb_main.c | 3 +++ 1 file changed, 3 insertions(+) commit 60e19518d657018c4e25f0c20ca4f623536714b5 Merge: 4bc0eb3 bcf4934 Author: David S. Miller Date: Wed Apr 13 21:49:03 2016 -0400 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for your net tree. More specifically, they are: 1) Fix missing filter table per-netns registration in arptables, from Florian Westphal. 2) Resolve out of bound access when parsing TCP options in nf_conntrack_tcp, patch from Jozsef Kadlecsik. 3) Prefer NFPROTO_BRIDGE extensions over NFPROTO_UNSPEC in ebtables, this resolves conflict between xt_limit and ebt_limit, from Phil Sutter. ==================== Signed-off-by: David S. Miller commit 4bc0eb3a1b20facbbf5c4939df863d8928e5c1b7 Merge: 1ecf689 15da5d1 Author: David S. Miller Date: Wed Apr 13 17:55:39 2016 -0400 Merge tag 'wireless-drivers-for-davem-2016-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for 4.6 b43 * fix memory leaks when removing the device bcma * fix building without OF_IRQ rtlwifi * fix gcc-6 indentation warning iwlwifi * lower the debug level of a benign print * fix a memory leak ==================== Signed-off-by: David S. Miller commit 90de6800c240dfe089e254116a7c055e70b709fd Merge: 5b523ff ccc7d5a Author: Linus Torvalds Date: Wed Apr 13 13:02:06 2016 -0700 Merge tag 'sh-fixes-4.6-rc1' of git://git.libc.org/linux-sh Pull arch/sh fixes from Rich Felker: "Fixes for two arch/sh build regressions that appeared in 4.6-rc1, one introduced by me, and one caused by changes elsewhere" * tag 'sh-fixes-4.6-rc1' of git://git.libc.org/linux-sh: sh: fix function signature of cpu_coregroup_mask to match pointer type sh: fix smp-shx3 build regression from removal of arch localtimer commit a1def45365594dd16be0d8cc52b0d5a6a79d6ae6 Author: Roger Quadros Date: Wed Apr 6 17:32:38 2016 +0300 ARM: dts: am57xx-beagle-x15: remove extcon_usb1 USB1 controller is hardwired to be used as Host only port so we don't need to check ID pin state and can get rid of extcon_usb1. This also reduces USB1 controller's and so eSATA power's dependency with EXTCON. This fixes eSATA port with multi_v7_defconfig. Cc: Franklin S Cooper Jr. Cc: Vagrant Cascadian Signed-off-by: Roger Quadros Tested-by: Franklin S Cooper Jr. [tony@atomide.com: updated to describe what it fixes] Signed-off-by: Tony Lindgren arch/arm/boot/dts/am57xx-beagle-x15.dts | 17 ----------------- 1 file changed, 17 deletions(-) commit 883cbc901b570625f54250a37b008d3635f1fbda Author: Franklin S Cooper Jr Date: Thu Mar 10 17:56:39 2016 -0600 ARM: dts: am437x: Fix GPMC dma properties This patch updates the GPMC's DT DMA property to reflect the updated eDMA bindings. Fixes: cce1ee000187 ("ARM: DTS: am437x: Use the new DT bindings for the eDMA3") Signed-off-by: Franklin S Cooper Jr Acked-by: Roger Quadros Acked-by: Peter Ujfalusi Signed-off-by: Tony Lindgren arch/arm/boot/dts/am4372.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a2abf904a6b594b93c0e73a36c98ecbaa7388463 Author: Franklin S Cooper Jr Date: Thu Mar 10 17:56:38 2016 -0600 ARM: dts: am33xx: Fix GPMC dma properties This patch updates the GPMC's DT DMA property to reflect the updated eDMA bindings. Fixes: b5e509066074 ("ARM: DTS: am33xx: Use the new DT bindings for the eDMA3") Signed-off-by: Franklin S Cooper Jr Acked-by: Roger Quadros Acked-by: Peter Ujfalusi Signed-off-by: Tony Lindgren arch/arm/boot/dts/am33xx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e2567075be35e98472411fcea233713df997ef5b Merge: 19e831b 1cbabcb Author: Tony Lindgren Date: Wed Apr 13 12:31:47 2016 -0700 Merge tag 'for-v4.6-rc/omap-fixes-b' of git://git.kernel.org/pub/scm/linux/kernel/git/pjw/omap-pending into omap-for-v4.6/fixes ARM: OMAP2+: clockdomain: another fix for v4.6-rc For DRA7xx platforms, add a workaround for missed timer interrupts that appears to be due to an integration bug (erratum i874) Basic build, boot, and PM test logs are available here: http://www.pwsan.com/omap/testlogs/omap-fixes-b-for-v4.6-rc/20160413020850/ (The DRA7xx board here has not yet been added into the testbed.) commit 2c1f6951a8a82e6de0d82b1158b5e493fc6c54ab Author: Sakari Ailus Date: Sun Apr 3 16:31:03 2016 -0300 [media] videobuf2-v4l2: Verify planes array in buffer dequeueing When a buffer is being dequeued using VIDIOC_DQBUF IOCTL, the exact buffer which will be dequeued is not known until the buffer has been removed from the queue. The number of planes is specific to a buffer, not to the queue. This does lead to the situation where multi-plane buffers may be requested and queued with n planes, but VIDIOC_DQBUF IOCTL may be passed an argument struct with fewer planes. __fill_v4l2_buffer() however uses the number of planes from the dequeued videobuf2 buffer, overwriting kernel memory (the m.planes array allocated in video_usercopy() in v4l2-ioctl.c) if the user provided fewer planes than the dequeued buffer had. Oops! Fixes: b0e0e1f83de3 ("[media] media: videobuf2: Prepare to divide videobuf2") Signed-off-by: Sakari Ailus Acked-by: Hans Verkuil Cc: stable@vger.kernel.org # for v4.4 and later Signed-off-by: Mauro Carvalho Chehab drivers/media/v4l2-core/videobuf2-v4l2.c | 6 ++++++ 1 file changed, 6 insertions(+) commit e7e0c3e26587749b62d17b9dd0532874186c77f7 Author: Sakari Ailus Date: Sun Apr 3 16:15:00 2016 -0300 [media] videobuf2-core: Check user space planes array in dqbuf The number of planes in videobuf2 is specific to a buffer. In order to verify that the planes array provided by the user is long enough, a new vb2_buf_op is required. Call __verify_planes_array() when the dequeued buffer is known. Return an error to the caller if there was one, otherwise remove the buffer from the done list. Signed-off-by: Sakari Ailus Acked-by: Hans Verkuil Cc: stable@vger.kernel.org # for v4.4 and later Signed-off-by: Mauro Carvalho Chehab drivers/media/v4l2-core/videobuf2-core.c | 10 +++++----- include/media/videobuf2-core.h | 4 ++++ 2 files changed, 9 insertions(+), 5 deletions(-) commit 535dac4ab5f42e040e8405b31e309a6b6d4eee57 Author: Brijesh Singh Date: Thu Jan 14 10:31:11 2016 -0600 ata: add AMD Seattle platform driver AMD Seattle SATA controller mostly conforms to AHCI interface with some special register to control SGPIO interface. In the case of an AHCI controller, the SGPIO feature is ideally implemented using the "Enclosure Management" register of the AHCI controller, but those registeres are not implemented in the Seattle SoC. Instead SoC (Rev B0 onwards) provides a 32-bit SGPIO control register which should be programmed to control the activity, locate and fault LEDs. The driver is based on ahci_platform driver. Signed-off-by: Brijesh Singh Acked-by: Hans de Goede CC: tj@kernel.org CC: linux-ide@vger.kernel.org Signed-off-by: Tejun Heo drivers/ata/Kconfig | 8 ++ drivers/ata/Makefile | 1 + drivers/ata/ahci_seattle.c | 210 +++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 219 insertions(+) commit e86103a75705c7c530768f4ffaba74cf382910f2 Author: Robert Dobrowolski Date: Thu Mar 24 03:30:07 2016 -0700 usb: hcd: out of bounds access in for_each_companion On BXT platform Host Controller and Device Controller figure as same PCI device but with different device function. HCD should not pass data to Device Controller but only to Host Controllers. Checking if companion device is Host Controller, otherwise skip. Cc: Signed-off-by: Robert Dobrowolski Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman drivers/usb/core/hcd-pci.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit 1363074667a6b7d0507527742ccd7bbed5e3ceaa Author: Hans de Goede Date: Tue Apr 12 12:27:09 2016 +0200 USB: uas: Add a new NO_REPORT_LUNS quirk Add a new NO_REPORT_LUNS quirk and set it for Seagate drives with an usb-id of: 0bc2:331a, as these will fail to respond to a REPORT_LUNS command. Cc: stable@vger.kernel.org Reported-and-tested-by: David Webb Signed-off-by: Hans de Goede Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman Documentation/kernel-parameters.txt | 2 ++ drivers/usb/storage/uas.c | 14 +++++++++++++- drivers/usb/storage/unusual_uas.h | 7 +++++++ drivers/usb/storage/usb.c | 5 ++++- include/linux/usb_usual.h | 2 ++ 5 files changed, 28 insertions(+), 2 deletions(-) commit 198de51dbc3454d95b015ca0a055b673f85f01bb Author: Hans de Goede Date: Tue Apr 12 12:27:08 2016 +0200 USB: uas: Limit qdepth at the scsi-host level Commit 64d513ac31bd ("scsi: use host wide tags by default") causes the SCSI core to queue more commands then we can handle on devices with multiple LUNs, limit the queue depth at the scsi-host level instead of per slave to fix this. BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1315013 Cc: stable@vger.kernel.org # 4.4.x and 4.5.x Signed-off-by: Hans de Goede Signed-off-by: Greg Kroah-Hartman drivers/usb/storage/uas.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 2dc0194c1d0df078dc4a7bf539ce9bda7e6f1a41 Author: Diego Herranz Date: Tue Apr 12 18:13:27 2016 +0100 doc: usb: Fix typo in gadget_multi documentation It tries to "match" drivers for each interface (not "much"). Signed-off-by: Diego Herranz Signed-off-by: Greg Kroah-Hartman Documentation/usb/gadget_multi.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f9a85f6e61c695daeb427dfc6c1d5a279654207b Author: Peter Griffin Date: Wed Apr 13 19:58:44 2016 +0300 usb: host: xhci-plat: Make enum xhci_plat_type start at a non zero value Otherwise generic-xhci and xhci-platform which have no data get wrongly detected as XHCI_PLAT_TYPE_MARVELL_ARMADA by xhci_plat_type_is(). This fixes a regression in v4.5 for STiH407 family SoC's which use the synopsis dwc3 IP, whereby the disable_clk error path gets taken due to wrongly being detected as XHCI_PLAT_TYPE_MARVELL_ARMADA and the hcd never gets added. I suspect this will also fix other dwc3 DT platforms such as Exynos, although I've only tested on STih410 SoC. Fixes: 4efb2f694114 ("usb: host: xhci-plat: add struct xhci_plat_priv") Cc: stable@vger.kernel.org Cc: gregory.clement@free-electrons.com Cc: yoshihiro.shimoda.uh@renesas.com Signed-off-by: Peter Griffin Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman drivers/usb/host/xhci-plat.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 98d74f9ceaefc2b6c4a6440050163a83be0abede Author: Mathias Nyman Date: Fri Apr 8 16:25:10 2016 +0300 xhci: fix 10 second timeout on removal of PCI hotpluggable xhci controllers PCI hotpluggable xhci controllers such as some Alpine Ridge solutions will remove the xhci controller from the PCI bus when the last USB device is disconnected. Add a flag to indicate that the host is being removed to avoid queueing configure_endpoint commands for the dropped endpoints. For PCI hotplugged controllers this will prevent 5 second command timeouts For static xhci controllers the configure_endpoint command is not needed in the removal case as everything will be returned, freed, and the controller is reset. For now the flag is only set for PCI connected host controllers. Cc: Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman drivers/usb/host/xhci-pci.c | 1 + drivers/usb/host/xhci-ring.c | 3 ++- drivers/usb/host/xhci.c | 8 +++++--- drivers/usb/host/xhci.h | 1 + 4 files changed, 9 insertions(+), 4 deletions(-) commit 71504062a7c34838c3fccd92c447f399d3cb5797 Author: Lu Baolu Date: Fri Apr 8 16:25:09 2016 +0300 usb: xhci: fix wild pointers in xhci_mem_cleanup This patch fixes some wild pointers produced by xhci_mem_cleanup. These wild pointers will cause system crash if xhci_mem_cleanup() is called twice. Reported-and-tested-by: Pengcheng Li Signed-off-by: Lu Baolu Cc: stable@vger.kernel.org Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman drivers/usb/host/xhci-mem.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 5ad3b03e4910f9f62342956ecdc758c7af6b8699 Author: Yoshihiro Shimoda Date: Fri Apr 8 16:25:08 2016 +0300 usb: host: xhci-plat: fix cannot work if R-Car Gen2/3 run on above 4GB phys This patch fixes an issue that cannot work if R-Car Gen2/3 run on above 4GB physical memory environment to use a quirk XHCI_NO_64BIT_SUPPORT. Cc: Signed-off-by: Yoshihiro Shimoda Reviewed-by: Felipe Balbi Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman drivers/usb/host/xhci-plat.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit 0a380be8233dbf8dd20795b801c5d5d5ef3992f7 Author: Yoshihiro Shimoda Date: Fri Apr 8 16:25:07 2016 +0300 usb: host: xhci: add a new quirk XHCI_NO_64BIT_SUPPORT On some xHCI controllers (e.g. R-Car SoCs), the AC64 bit (bit 0) of HCCPARAMS1 is set to 1. However, the xHCs don't support 64-bit address memory pointers actually. So, in this case, this driver should call dma_set_coherent_mask(dev, DMA_BIT_MASK(32)) in xhci_gen_setup(). Otherwise, the xHCI controller will be died after a usb device is connected if it runs on above 4GB physical memory environment. So, this patch adds a new quirk XHCI_NO_64BIT_SUPPORT to resolve such an issue. Cc: Signed-off-by: Yoshihiro Shimoda Reviewed-by: Felipe Balbi Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman drivers/usb/host/xhci.c | 10 ++++++++++ drivers/usb/host/xhci.h | 1 + 2 files changed, 11 insertions(+) commit 671ffdff5b13314b1fc65d62cf7604b873fb5dc4 Author: Mathias Nyman Date: Fri Apr 8 16:25:06 2016 +0300 xhci: resume USB 3 roothub first Give USB3 devices a better chance to enumerate at USB 3 speeds if they are connected to a suspended host. Solves an issue with NEC uPD720200 host hanging when partially enumerating a USB3 device as USB2 after host controller runtime resume. Cc: Tested-by: Mike Murdoch Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman drivers/usb/host/xhci.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 0d46faca6f887a849efb07c1655b5a9f7c288b45 Author: Rafal Redzimski Date: Fri Apr 8 16:25:05 2016 +0300 usb: xhci: applying XHCI_PME_STUCK_QUIRK to Intel BXT B0 host Broxton B0 also requires XHCI_PME_STUCK_QUIRK. Adding PCI device ID for Broxton B and adding to quirk. Cc: Signed-off-by: Rafal Redzimski Signed-off-by: Robert Dobrowolski Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman drivers/usb/host/xhci-pci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 2a14759a03a0a57b2fc99b1e416180788b8ba24c Author: Oliver Neukum Date: Mon Apr 4 14:30:53 2016 +0200 cdc-acm: fix crash if flushed with nothing buffered Under some circumstances acm_tty_flush_chars() is called with no buffer to flush. We simply need to do nothing. Signed-off-by: Oliver Neukum Reported-by: Torsten Hilbrich Signed-off-by: Greg Kroah-Hartman drivers/usb/class/cdc-acm.c | 4 ++++ 1 file changed, 4 insertions(+) commit dea5c24a14047b7d6b6b269434a85ffd05f1d2cb Author: Rui Salvaterra Date: Sat Apr 9 22:05:35 2016 +0100 lib: lz4: cleanup unaligned access efficiency detection These identifiers are bogus. The interested architectures should define HAVE_EFFICIENT_UNALIGNED_ACCESS whenever relevant to do so. If this isn't true for some arch, it should be fixed in the arch definition. Signed-off-by: Rui Salvaterra Reviewed-by: Sergey Senozhatsky Signed-off-by: Greg Kroah-Hartman lib/lz4/lz4defs.h | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 3e26a691fe3fe1e02a76e5bab0c143ace4b137b4 Author: Rui Salvaterra Date: Sat Apr 9 22:05:34 2016 +0100 lib: lz4: fixed zram with lz4 on big endian machines Based on Sergey's test patch [1], this fixes zram with lz4 compression on big endian cpus. Note that the 64-bit preprocessor test is not a cleanup, it's part of the fix, since those identifiers are bogus (for example, __ppc64__ isn't defined anywhere else in the kernel, which means we'd fall into the 32-bit definitions on ppc64). Tested on ppc64 with no regression on x86_64. [1] http://marc.info/?l=linux-kernel&m=145994470805853&w=4 Cc: stable@vger.kernel.org Suggested-by: Sergey Senozhatsky Signed-off-by: Rui Salvaterra Reviewed-by: Sergey Senozhatsky Signed-off-by: Greg Kroah-Hartman lib/lz4/lz4defs.h | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) commit 3fe6409c23e2bee4b2b1b6d671d2da8daa15271c Author: Andy Shevchenko Date: Fri Apr 8 16:22:17 2016 +0300 dmaengine: dw: fix master selection The commit 895005202987 ("dmaengine: dw: apply both HS interfaces and remove slave_id usage") cleaned up the code to avoid usage of depricated slave_id member of generic slave configuration. Meanwhile it broke the master selection by removing important call to dwc_set_masters() in ->device_alloc_chan_resources() which copied masters from custom slave configuration to the internal channel structure. Everything works until now since there is no customized connection of DesignWare DMA IP to the bus, i.e. one bus and one or more masters are in use. The configurations where 2 masters are connected to the different masters are not working anymore. We are expecting one user of such configuration and need to select masters properly. Besides that it is obviously a performance regression since only one master is in use in multi-master configuration. Select masters in accordance with what user asked for. Keep this patch in a form more suitable for back porting. We are safe to take necessary data in ->device_alloc_chan_resources() because we don't support generic slave configuration embedded into custom one, and thus the only way to provide such is to use the parameter to a filter function which is called exactly before channel resource allocation. While here, replase BUG_ON to less noisy dev_warn() and prevent channel allocation in case of error. Fixes: 895005202987 ("dmaengine: dw: apply both HS interfaces and remove slave_id usage") Cc: stable@vger.kernel.org Signed-off-by: Andy Shevchenko Signed-off-by: Vinod Koul drivers/dma/dw/core.c | 34 +++++++++++++++++++--------------- 1 file changed, 19 insertions(+), 15 deletions(-) commit 5b523ff281b9f97ec75d526e2750381c6e8c9326 Merge: e012766 2763ee6 Author: Linus Torvalds Date: Wed Apr 13 08:58:32 2016 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu Pull m68knommu/coldfire fix from Greg Ungerer: "Only a single change that removes a local arch specific gpio bus sysfs device that now clashes with the generic gpio bus sysfs device interface" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68k/gpio: remove arch specific sysfs bus device commit e012766258ad7a90a3474ac24905b7df336e698f Merge: 5e1b59a 0b24f7a Author: Linus Torvalds Date: Wed Apr 13 08:57:18 2016 -0700 Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Olof Johansson: "A batch of fixes for -rc4, for various platforms. Nothing really substantial and worth pointing out in particular; small fixes for various bugs, see shortlog for details" * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: ARM: sa1100: remove references to the defunct handhelds.org bus: uniphier-system-bus: fix condition of overlap check ARM: uniphier: drop weird sizeof() ARM: dts: am335x-baltos-ir5221: fix cpsw_emac0 link type ARM: OMAP: Correct interrupt type for ARM TWD ARM: DRA722: Add ID detect for Silicon Rev 2.0 ARM: dts: am43xx: fix edma memcpy channel allocation ARM: dts: AM43x-epos: Fix clk parent for synctimer ARM: OMAP2: Fix up interconnect barrier initialization for DRA7 documentation: Fix pinctrl documentation for Meson8 / Meson8b ARM: dts: amlogic: Split pinctrl device for Meson8 / Meson8b ARM: mvebu: Correct unit address for linksys bus: mvebu-mbus: use %pa to print phys_addr_t arm64: dts: vulcan: Update PCI ranges ARM: u8500_defconfig: turn on the Synaptics RMI4 driver ARM: pxa: fix the number of DMA requestor lines ARM: OMAP2+: hwmod: Fix updating of sysconfig register ARM: OMAP2+: Use srst_udelay for USB on dm814x commit 5e1b59abef69e405eabfbe0ad09ad6b6e5303c7d Merge: 1c74a7f 316314c Author: Linus Torvalds Date: Wed Apr 13 08:53:26 2016 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fixes from Radim Krčmář: "ARM fixes: - Wrong indentation in the PMU code from the merge window - A long-time bug occuring with running ntpd on the host, candidate for stable - Properly handle (and warn about) the unsupported configuration of running on systems with less than 40 bits of PA space - More fixes to the PM and hotplug notifier stuff from the merge window x86: - leak of guest xcr0 (typically shows up as SIGILL) - new maintainer (who is sending the pull request too) - fix for merge window regression - fix for guest CPUID" Paolo Bonzini points out: "For the record, this tag is signed by me because I prepared the pull request. Further pull requests for 4.6 will be signed and sent out by Radim directly" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86: mask CPUID(0xD,0x1).EAX against host value kvm: x86: do not leak guest xcr0 into host interrupt handlers KVM: MMU: fix permission_fault() KVM: new maintainer on the block arm64: KVM: unregister notifiers in hyp mode teardown path arm64: KVM: Warn when PARange is less than 40 bits KVM: arm/arm64: Handle forward time correction gracefully arm64: KVM: Add braces to multi-line if statement in virtual PMU code commit 5128de85124c728cdbb6b35bd9dc7410f02c0ca1 Author: Heiko Stuebner Date: Thu Mar 24 22:29:03 2016 +0100 phy: rockchip-emmc: adapt binding to specifiy register offset and length The emmc-phy occupies a contiguous set of 8 registers inside the general register files, so the reg property should specify this. Signed-off-by: Heiko Stuebner Acked-by: Rob Herring Signed-off-by: Kishon Vijay Abraham I Documentation/devicetree/bindings/phy/rockchip-emmc-phy.txt | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 332184adff50de9596f03735496c545e8bccc73e Author: Heiko Stuebner Date: Thu Mar 24 22:29:02 2016 +0100 phy: rockchip-emmc: should be a child device of the GRF The emmc-phy is fully enclosed in the general register files (GRF). Therefore as seen from the device-tree it shouldn't be a separate platform- device but instead a sub-device of the GRF - using the simply-mfd mechanism. The driver entered the kernel in the current merge-window, so we can still adapt the binding without needing a fallback, as the binding hasn't been released with a full kernel yet. Signed-off-by: Heiko Stuebner Acked-by: Rob Herring Reviewed-by: Shawn Lin Signed-off-by: Kishon Vijay Abraham I .../devicetree/bindings/phy/rockchip-emmc-phy.txt | 18 +++++++++++------- drivers/phy/phy-rockchip-emmc.c | 5 ++++- 2 files changed, 15 insertions(+), 8 deletions(-) commit 0311c76e4722b8d6e5fa47eaee63c6552bcc74f5 Author: Heiko Stuebner Date: Thu Mar 24 22:29:01 2016 +0100 phy: rockchip-dp: should be a child device of the GRF The displayport-phy is fully enclosed in the general register files (GRF). Therefore as seen from the device-tree it shouldn't be a separate platform- device but instead a sub-device of the GRF - using the simply-mfd mechanism. The driver entered the kernel in the current merge-window, so we can still adapt the binding without needing a fallback, as the binding hasn't been released with a full kernel yet. While the edp phy is fully part of the GRF, it doesn't have any separate register set there, so doesn't get any register-area assigned. Signed-off-by: Heiko Stuebner Acked-by: Rob Herring Reviewed-by: Yakir Yang Signed-off-by: Kishon Vijay Abraham I .../devicetree/bindings/phy/rockchip-dp-phy.txt | 18 +++++++++++------- drivers/phy/phy-rockchip-dp.c | 7 +++++-- 2 files changed, 16 insertions(+), 9 deletions(-) commit d9c9f3b809d2bb0356f013e88d10730eafab5346 Author: James Liao Date: Tue Apr 12 16:34:30 2016 +0800 Revert "soc: mediatek: SCPSYS: Fix double enabling of regulators" This reverts commit cc8ed76938b5cf6a54ab3d60edabaf808dc960d1 ("soc: mediatek: SCPSYS: Fix double enabling of regulators") [1]. This patch fixes mt8173-evb failing boot issue. With commit [1], genpd state will not sync to real power domain state. So some resources such as clocks and regulators may stay in a wrong state. There is no regulator double enabling issue on mainline kernel, so we can refert commit [1] safely. Signed-off-by: James Liao Signed-off-by: Matthias Brugger drivers/soc/mediatek/mtk-scpsys.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) commit a3125494cff084b098c80bb36fbe2061ffed9d52 Author: Tony Luck Date: Wed Apr 6 10:05:16 2016 +0200 x86/mce: Avoid using object after free in genpool When we loop over all queued machine check error records to pass them to the registered notifiers we use llist_for_each_entry(). But the loop calls gen_pool_free() for the entry in the body of the loop - and then the iterator looks at node->next after the free. Use llist_for_each_entry_safe() instead. Signed-off-by: Tony Luck Signed-off-by: Borislav Petkov Cc: Cc: Gong Chen Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-edac Link: http://lkml.kernel.org/r/0205920@agluck-desk.sc.intel.com Link: http://lkml.kernel.org/r/1459929916-12852-4-git-send-email-bp@alien8.de Signed-off-by: Ingo Molnar arch/x86/kernel/cpu/mcheck/mce-genpool.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit fc26fe9c3869f02dd9dc54ff3a45c6d9d4bbbdfa Author: Alexander Kurz Date: Mon Apr 11 10:20:46 2016 +0200 ARM: mach-imx: sdhci-esdhc-imx: initialize DMA mask With commit 7b91369b4655 ("mmc: sdhci: Set DMA mask when adding host") DMA access got disabled for device drivers with zero DMA mask property. sdhci-esdhc-imx got blocked from DMA access by this. Hence: initialize the DMA mask to enable access again. Signed-off-by: Alexander Kurz Signed-off-by: Shawn Guo arch/arm/mach-imx/devices/platform-sdhci-esdhc-imx.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit c44da62b55bb453052869ab095bcda7aa0bd6bba Author: Takashi Iwai Date: Wed Apr 13 09:45:53 2016 +0200 ALSA: hda - Fix inconsistent monitor_present state until repoll While the previous commit fixed the missing monitor_present flag update, it may be still in an inconsistent state while the driver repolls: the flag itself is updated, but the eld_valid flag and the contents don't follow until the repoll finishes (and may be repeated for a few times). The basic problem is that pin_eld->monitor_present is updated in the caller side. This should have been updated only in update_eld(). So, the proper fix is to avoid accessing pin_eld but only spec->temp_eld. Signed-off-by: Takashi Iwai sound/pci/hda/patch_hdmi.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) commit 023d8218ec0dfc30e11d4ec54f640e8f127d1fbe Author: Hyungwon Hwang Date: Wed Apr 13 09:27:39 2016 +0900 ALSA: hda - Fix regression of monitor_present flag in eld proc file The commit [bd48128539ab: ALSA: hda - Fix forgotten HDMI monitor_present update] covered the missing update of monitor_present flag, but this caused a regression for devices without the i915 eld notifier. Since the old code supposed that pin_eld->monitor_present was updated by the caller side, the hdmi_present_sense_via_verbs() doesn't update the temporary eld->monitor_present but only pin_eld->monitor_present, which is now overridden in update_eld(). The fix is to update pin_eld->monitor_present as well before calling update_eld(). Note that this may still leave monitor_present flag in an inconsistent state when the driver repolls, but this is at least the old behavior. More proper fix will follow in the later patch. Fixes: bd48128539ab ('ALSA: hda - Fix forgotten HDMI monitor_present update') Signed-off-by: Hyungwon Hwang Cc: Signed-off-by: Takashi Iwai sound/pci/hda/patch_hdmi.c | 2 ++ 1 file changed, 2 insertions(+) commit 7196c52c9377df0175b510ff5896bda524f7345e Author: Lothar Waßmann Date: Wed Mar 30 14:23:03 2016 +0200 clk: imx6q: fix typo in CAN clock definition commit ee36027427c7 ("clk: imx: Add clock support for imx6qp") introduced a regression due to a subtle typo in the 'can_root' clock definition. The effect is that trying to configure the bitrate of the can interfaces fails with -EDOM or produces a division by zero error due to the clock_freq of the can serial clock being reported as '0'. Signed-off-by: Lothar Waßmann Fixes: ee36027427c7 ("clk: imx: Add clock support for imx6qp") Signed-off-by: Shawn Guo drivers/clk/imx/clk-imx6q.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1ff7760ff66b98ef244bf0e5e2bd5310651205ad Author: Ben Hutchings Date: Tue Apr 12 12:58:14 2016 +0100 spi: spi-ti-qspi: Handle truncated frames properly We clamp frame_len_words to a maximum of 4096, but do not actually limit the number of words written or read through the DATA registers or the length added to spi_message::actual_length. This results in silent data corruption for commands longer than this maximum. Recalculate the length of each transfer, taking frame_len_words into account. Use this length in qspi_{read,write}_msg(), and to increment spi_message::actual_length. Signed-off-by: Ben Hutchings Signed-off-by: Mark Brown Cc: stable@vger.kernel.org drivers/spi/spi-ti-qspi.c | 32 ++++++++++++++++++++------------ 1 file changed, 20 insertions(+), 12 deletions(-) commit ea1b60fb085839a9544cb3a0069992991beabb7f Author: Ben Hutchings Date: Tue Apr 12 12:56:25 2016 +0100 spi: spi-ti-qspi: Fix FLEN and WLEN settings if bits_per_word is overridden Each transfer can specify 8, 16 or 32 bits per word independently of the default for the device being addressed. However, currently we calculate the number of words in the frame assuming that the word size is the device default. If multiple transfers in the same message have differing bits_per_word, we bitwise-or the different values in the WLEN register field. Fix both of these. Also rename 'frame_length' to 'frame_len_words' to make clear that it's not a byte count like spi_message::frame_length. Signed-off-by: Ben Hutchings Signed-off-by: Mark Brown Cc: stable@vger.kernel.org drivers/spi/spi-ti-qspi.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) commit 03a8bb0e53d9562276045bdfcf2b5de2e4cff5a1 Author: Jaegeuk Kim Date: Tue Apr 12 16:05:36 2016 -0700 ext4/fscrypto: avoid RCU lookup in d_revalidate As Al pointed, d_revalidate should return RCU lookup before using d_inode. This was originally introduced by: commit 34286d666230 ("fs: rcu-walk aware d_revalidate method"). Reported-by: Al Viro Signed-off-by: Jaegeuk Kim Cc: Theodore Ts'o Cc: stable fs/crypto/crypto.c | 4 ++++ fs/ext4/crypto.c | 4 ++++ 2 files changed, 8 insertions(+) commit 58976eef9dc0318ef87bb81a6303b69d941d04bc Merge: 1c74a7f 952cca6 Author: James Morris Date: Wed Apr 13 11:06:52 2016 +1000 Merge tag 'keys-fixes-20160412' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs into for-linus commit bcf4934288402be3464110109a4dae3bd6fb3e93 Author: Phil Sutter Date: Tue Apr 12 01:31:14 2016 +0200 netfilter: ebtables: Fix extension lookup with identical name If a requested extension exists as module and is not loaded, ebt_check_match() might accidentally use an NFPROTO_UNSPEC one with same name and fail. Reproduced with limit match: Given xt_limit and ebt_limit both built as module, the following would fail: modprobe xt_limit ebtables -I INPUT --limit 1/s -j ACCEPT The fix is to make ebt_check_match() distrust a found NFPROTO_UNSPEC extension and retry after requesting an appropriate module. Cc: Florian Westphal Signed-off-by: Phil Sutter Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/bridge/netfilter/ebtables.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 87243deb88671f70def4c52dfa7ca7830707bd31 Author: Seth Forshee Date: Wed Mar 9 09:18:07 2016 -0600 debugfs: Make automount point inodes permanently empty Starting with 4.1 the tracing subsystem has its own filesystem which is automounted in the tracing subdirectory of debugfs. Prior to this debugfs could be bind mounted in a cloned mount namespace, but if tracefs has been mounted under debugfs this now fails because there is a locked child mount. This creates a regression for container software which bind mounts debugfs to satisfy the assumption of some userspace software. In other pseudo filesystems such as proc and sysfs we're already creating mountpoints like this in such a way that no dirents can be created in the directories, allowing them to be exceptions to some MNT_LOCKED tests. In fact we're already do this for the tracefs mountpoint in sysfs. Do the same in debugfs_create_automount(), since the intention here is clearly to create a mountpoint. This fixes the regression, as locked child mounts on permanently empty directories do not cause a bind mount to fail. Cc: stable@vger.kernel.org # v4.1+ Signed-off-by: Seth Forshee Acked-by: Serge Hallyn Signed-off-by: Greg Kroah-Hartman fs/debugfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit abaa7b0c1286ca1610a6dfa079e1d2e27dca1f25 Author: Mika Westerberg Date: Fri Apr 8 15:41:08 2016 +0300 i2c: ismt: Add Intel DNV PCI ID Intel DNV has the same iSMT SMBus host controller than Intel Avoton. Add DNV PCI ID to the list of supported devices. Signed-off-by: Mika Westerberg Acked-by: Andy Shevchenko Acked-by: Neil Horman Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-ismt.c | 2 ++ 1 file changed, 2 insertions(+) commit 8574ad7800ad298dc7f184f12b454a67fa3dd839 Author: Tanmay Jagdale Date: Mon Apr 11 18:01:26 2016 +0530 i2c: xlp9xx: add support for Broadcom Vulcan The Broadcom Vulcan ARM64 processor uses the same I2C controller present on the Broadcom XLP9xx/5xx MIPS processor family. Updated the Kconfig by adding ARCH_VULCAN option. Signed-off-by: Tanmay Jagdale Signed-off-by: Wolfram Sang drivers/i2c/busses/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit b0b6d123f5df189d7d3a62d450e5f5c33ad614d8 Author: Yakir Yang Date: Mon Mar 14 11:09:15 2016 +0800 i2c: rk3x: add support for rk3228 Enable the I2C core for this SoC. Signed-off-by: Yakir Yang Reviewed-by: Heiko Stuebner Acked-by: Rob Herring Signed-off-by: Wolfram Sang Documentation/devicetree/bindings/i2c/i2c-rk3x.txt | 4 ++-- drivers/i2c/busses/i2c-rk3x.c | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) commit e1123fe975852cc0970b4e53ea65ca917e54c923 Author: Ping Cheng Date: Tue Apr 12 13:37:45 2016 -0700 HID: wacom: Add support for DTK-1651 DTK-1651 is a display pen-only tablet Signed-off-by: Ping Cheng Signed-off-by: Jiri Kosina drivers/hid/wacom_wac.c | 5 +++++ 1 file changed, 5 insertions(+) commit 0b24f7a8d6e0d17bcf24433ce5827841a05b5b46 Merge: 452a31f 199831c Author: Olof Johansson Date: Tue Apr 12 12:35:07 2016 -0700 Merge tag 'mvebu-fixes-4.6-1' of git://git.infradead.org/linux-mvebu into fixes mvebu fixes for 4.6 (part 1) - fix USB adress register for Linksys Armada 388 based boards - fix build warning in mvebu-mbus * tag 'mvebu-fixes-4.6-1' of git://git.infradead.org/linux-mvebu: ARM: mvebu: Correct unit address for linksys bus: mvebu-mbus: use %pa to print phys_addr_t Signed-off-by: Olof Johansson commit 452a31fd36255fc7d9dd9dce9d820fe0e5bb97b8 Author: Linus Walleij Date: Mon Apr 4 14:43:38 2016 +0200 ARM: sa1100: remove references to the defunct handhelds.org The website handhelds.org has been down for a long time and is likely never coming back online. Signed-off-by: Linus Walleij Signed-off-by: Olof Johansson arch/arm/mach-sa1100/Kconfig | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) commit 13ab2c80e2aae436fa7f0b8a1b0133e9c143f42b Merge: 2e1d18c 4c35430 Author: Olof Johansson Date: Tue Apr 12 12:33:41 2016 -0700 Merge tag 'pxa-fixes-v4.6' of https://github.com/rjarzmik/linux into fixes ARM: pxa: fixes for v4.6 There is only a single fix for dma requestor lines initial setup, triggered by dmaengine previous fix. * tag 'pxa-fixes-v4.6' of https://github.com/rjarzmik/linux: ARM: pxa: fix the number of DMA requestor lines Signed-off-by: Olof Johansson commit 2e1d18c6997da888217f66b0bdc210de9742b936 Merge: 3de7bee 6f40fed Author: Olof Johansson Date: Tue Apr 12 12:32:35 2016 -0700 Merge tag 'omap-for-v4.6/fixes-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes Fixes for omaps against v4.6-rc1. Mostly minor fixes for the newer SoCs with few board fixes and a fix for a long time hwmod bug: - Fix cpsw_emac0 link type for baltos-ir5221 - Fix interrupt type for TWD - Fix edma memcpy channel allocation for am43x - Fix am43x-epos sycntimer32k by using the correct assigned clock - Fix interconnect barrier for dra7 - Fix a long time hwmod bug for updating sysconfig register properly - Fix flakey booting on dm814x where USB reset needs a delay And there is one minor change that is not strictly a fix, but is good to have for proper hardware detection: - Detect dra7 silicon revision 2.0 properly * tag 'omap-for-v4.6/fixes-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: dts: am335x-baltos-ir5221: fix cpsw_emac0 link type ARM: OMAP: Correct interrupt type for ARM TWD ARM: DRA722: Add ID detect for Silicon Rev 2.0 ARM: dts: am43xx: fix edma memcpy channel allocation ARM: dts: AM43x-epos: Fix clk parent for synctimer ARM: OMAP2: Fix up interconnect barrier initialization for DRA7 ARM: OMAP2+: hwmod: Fix updating of sysconfig register ARM: OMAP2+: Use srst_udelay for USB on dm814x Signed-off-by: Olof Johansson commit 3de7beebddf8d56dcaa17b41c723d602dd0c513c Author: Kunihiko Hayashi Date: Fri Apr 1 19:32:43 2016 +0900 bus: uniphier-system-bus: fix condition of overlap check This patch fixes condition whether the specified address ranges overlap each other. Fixes: 4b7f48d395a7 ("bus: uniphier-system-bus: add UniPhier System Bus driver") Signed-off-by: Kunihiko Hayashi Acked-by: Masahiro Yamada Signed-off-by: Olof Johansson drivers/bus/uniphier-system-bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3137b716568f3ca8ca575fd13b91ddb42abd6844 Author: Masahiro Yamada Date: Fri Mar 25 11:14:02 2016 +0900 ARM: uniphier: drop weird sizeof() My intention was to ioremap a 4-byte register. Coincidentally enough, sizeof(SZ_4) equals to SZ_4, but this code is weird anyway. Signed-off-by: Masahiro Yamada Signed-off-by: Olof Johansson arch/arm/mach-uniphier/platsmp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b32e4482aadfd1322357f46d4ed8a990603664d9 Author: Jaegeuk Kim Date: Mon Apr 11 15:51:57 2016 -0700 fscrypto: don't let data integrity writebacks fail with ENOMEM This patch fixes the issue introduced by the ext4 crypto fix in a same manner. For F2FS, however, we flush the pending IOs and wait for a while to acquire free memory. Fixes: c9af28fdd4492 ("ext4 crypto: don't let data integrity writebacks fail with ENOMEM") Cc: Theodore Ts'o Signed-off-by: Jaegeuk Kim fs/crypto/crypto.c | 36 ++++++++++++++++++++---------------- fs/f2fs/data.c | 16 +++++++++++++--- include/linux/fscrypto.h | 9 +++++---- 3 files changed, 38 insertions(+), 23 deletions(-) commit 33b1395124c63ed4a42e33c1dd14859f9b3f29c2 Author: Jaegeuk Kim Date: Mon Apr 11 15:15:38 2016 -0700 f2fs: use dget_parent and file_dentry in f2fs_file_open This patch synced with the below two ext4 crypto fixes together. In 4.6-rc1, f2fs newly introduced accessing f_path.dentry which crashes overlayfs. To fix, now we need to use file_dentry() to access that field. Fixes: c0a37d487884 ("ext4: use file_dentry()") Fixes: 9dd78d8c9a7b ("ext4: use dget_parent() in ext4_file_open()") Cc: Miklos Szeredi Cc: Theodore Ts'o Signed-off-by: Jaegeuk Kim fs/f2fs/file.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit d7d75352890447b55c13a81df316a6894ff32ecf Author: Jaegeuk Kim Date: Mon Apr 11 15:10:11 2016 -0700 fscrypto: use dget_parent() in fscrypt_d_revalidate() This patch updates fscrypto along with the below ext4 crypto change. Fixes: 3d43bcfef5f0 ("ext4 crypto: use dget_parent() in ext4_d_revalidate()") Cc: Theodore Ts'o Signed-off-by: Jaegeuk Kim fs/crypto/crypto.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit 2072fe51466f86e1f0eedf12bff7106913807efc Author: Javier Martinez Canillas Date: Tue Mar 29 10:28:55 2016 +0900 drm/exynos: Use VIDEO_SAMSUNG_S5P_G2D=n as G2D Kconfig dependency Commit 254d4d111ee1 ("drm/exynos: Add dependency for G2D in Kconfig") made the DRM_EXYNOS_G2D symbol to only be selectable if the s5p-g2d V4L2 driver is not enabled, since both use the same HW IP block. But added the dependency as depends on !VIDEO_SAMSUNG_S5P_G2D which isn't correct since Kconfig expressions are not boolean but tristate. So it will only evaluate to 'n' if VIDEO_SAMSUNG_S5P_G2D=y but it will evaluate to m if VIDEO_SAMSUNG_S5P_G2D=m. This means that both the V4L2 and DRM drivers can be enabled if the former is enabled as a module, which is not what we want. Signed-off-by: Javier Martinez Canillas Signed-off-by: Inki Dae drivers/gpu/drm/exynos/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 36ffc2bde5fc743aa64c2e1f53de163a92824a27 Author: Dan Carpenter Date: Fri Mar 25 23:05:59 2016 +0300 drm/exynos: fix a warning message The "ret = regmap_write()" assignment was missing so this error message is never printed. Signed-off-by: Dan Carpenter Signed-off-by: Inki Dae drivers/gpu/drm/exynos/exynos_drm_mic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6c9c15813b21ce75bc82db86db1163a34b772437 Author: Dan Carpenter Date: Thu Mar 17 13:32:15 2016 +0300 drm/exynos: mic: fix an error code We accidentally return success instead of a negative error code here. Signed-off-by: Dan Carpenter Signed-off-by: Inki Dae drivers/gpu/drm/exynos/exynos_drm_mic.c | 1 + 1 file changed, 1 insertion(+) commit d42a114d88dcead9c3a41574aa0647d56d0a28f7 Author: Marek Szyprowski Date: Thu Mar 17 07:53:12 2016 +0100 drm/exynos: fimd: fix broken dp_clock control Commit 1feafd3afd294b03dbbedb8e8f94e0c4db526f10 ("drm/exynos: add exynos5420 support for fimd") add support for Exynos 5420 SoC, but it broke enabling display clock feature because of incorrect condition check. This patch fixes it, so display is working again on platforms requiring display clock control (i.e. Exynos5250-based SNOW platform). Signed-off-by: Marek Szyprowski Reviewed-by: Krzysztof Kozlowski Signed-off-by: Inki Dae drivers/gpu/drm/exynos/exynos_drm_fimd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9b988a0dc93689c93214b518bcb5fd52c44691ba Author: Andrzej Hajda Date: Tue Mar 15 12:43:21 2016 +0100 drm/exynos: build fbdev code conditionally Fbdev code should be compiled only if CONFIG_DRM_FBDEV_EMULATION option is enabled. The patch fixes exynos-drm code trying to manipulate fbdev data which is not initialized in case CONFIG_DRM_FBDEV_EMULATION is disabled. Signed-off-by: Andrzej Hajda Signed-off-by: Inki Dae drivers/gpu/drm/exynos/Makefile | 6 +++--- drivers/gpu/drm/exynos/exynos_drm_fb.c | 11 ----------- drivers/gpu/drm/exynos/exynos_drm_fbdev.c | 11 +++++++++++ drivers/gpu/drm/exynos/exynos_drm_fbdev.h | 23 ++++++++++++++++++++++- 4 files changed, 36 insertions(+), 15 deletions(-) commit 311521e25630b9c61ce22f3adc3ad0b35d5f2667 Author: Andrzej Hajda Date: Tue Mar 15 12:38:02 2016 +0100 drm/exynos: fix adjusted_mode pointer in exynos_plane_mode_set exynos_plane_mode_set should use adjusted_mode from the same atomic state as plane state. Otherwise it will result in incorrect behavior in case crtc mode changes. The patch fixes bug with black console framebuffer in case of command mode panels. Signed-off-by: Andrzej Hajda Signed-off-by: Inki Dae drivers/gpu/drm/exynos/exynos_drm_plane.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit 55c4b906aa2aec3fa66310ec03c6842e34a04b2a Author: Arnd Bergmann Date: Mon Mar 14 15:22:25 2016 +0100 drm/exynos: fix error handling in exynos_drm_subdrv_open gcc-6 warns about a pointless loop in exynos_drm_subdrv_open: drivers/gpu/drm/exynos/exynos_drm_core.c: In function 'exynos_drm_subdrv_open': drivers/gpu/drm/exynos/exynos_drm_core.c:104:199: error: self-comparison always evaluates to false [-Werror=tautological-compare] list_for_each_entry_reverse(subdrv, &subdrv->list, list) { Here, the list_for_each_entry_reverse immediately terminates because the subdrv pointer is compared to itself as the loop end condition. If we were to take the current subdrv pointer as the start of the list (as we would do if list_for_each_entry_reverse() was not a macro), we would iterate backwards over the &exynos_drm_subdrv_list anchor, which would be even worse. Instead, we need to use list_for_each_entry_continue_reverse() to go back over each subdrv that was successfully opened until the first entry. Signed-off-by: Arnd Bergmann Signed-off-by: Inki Dae drivers/gpu/drm/exynos/exynos_drm_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8f815cdde3e550e10c2736990d791f60c2ce43eb Author: Dmitry Ivanov Date: Wed Apr 6 17:23:18 2016 +0300 nl80211: check netlink protocol in socket release notification A non-privileged user can create a netlink socket with the same port_id as used by an existing open nl80211 netlink socket (e.g. as used by a hostapd process) with a different protocol number. Closing this socket will then lead to the notification going to nl80211's socket release notification handler, and possibly cause an action such as removing a virtual interface. Fix this issue by checking that the netlink protocol is NETLINK_GENERIC. Since generic netlink has no notifier chain of its own, we can't fix the problem more generically. Fixes: 026331c4d9b5 ("cfg80211/mac80211: allow registering for and sending action frames") Cc: stable@vger.kernel.org Signed-off-by: Dmitry Ivanov [rewrite commit message] Signed-off-by: Johannes Berg net/wireless/nl80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit adcdd0d5a1cb779f6d455ae70882c19c527627a8 Author: Kailang Yang Date: Tue Apr 12 10:55:03 2016 +0800 ALSA: usb-audio: Skip volume controls triggers hangup on Dell USB Dock This is Dell usb dock audio workaround. It was fixed the master volume keep lower. [Some background: the patch essentially skips the controls of a couple of FU volumes. Although the firmware exposes the dB and the value information via the usb descriptor, changing the values (we set the min volume as default) screws up the device. Although this has been fixed in the newer firmware, the devices are shipped with the old firmware, thus we need the workaround in the driver side. -- tiwai] Signed-off-by: Kailang Yang Cc: Signed-off-by: Takashi Iwai sound/usb/mixer_maps.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit f742aaf36edf0390c54d0614bc4d20fd4cd3762a Author: Matti Gottlieb Date: Sun Apr 10 10:53:57 2016 +0300 iwlwifi: mvm: fix accessing Null pointer during fw dump collection The firwmare file can come with data that is relevant for paging. This data is availablet to the firmware upon request, but it stored in the host's memory. During the firmware init flow, the driver configures the firmware so that the firwmare knows where is the data. When paging is used, the variable paging_mem_size is the number of bytes that are available through paging. This variable is not zeror-ed if the driver fails to configure the paging in the firmware, but the memory is freed which is inconsistent. This inconsistency led to a NULL pointer dereference in the code that collects the debug data. Fix this by zero-ing the paging_mem_size variable and NULLify the relevant pointers, so that the code that collects the debug data will know that the paging data is not available. Signed-off-by: Matti Gottlieb Signed-off-by: Emmanuel Grumbach drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c | 6 ++++-- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 2 ++ 2 files changed, 6 insertions(+), 2 deletions(-) commit e1ba684f762b9a8064de2c916bb60b1694dd8a17 Author: Sara Sharon Date: Mon Apr 11 15:01:46 2016 +0300 iwlwifi: 8000: fix MODULE_FIRMWARE input The firwmare name for 8000 is iwlwifi-8000C. The C is appended based on a value read from a register. This allows to load different firwmare versions based on the hardware step during development. Now that the hardware development is completed, we can hard code the 'C' and along the way, fix the input to MODULE_FIRMWARE. This fixes: https://bugzilla.kernel.org/show_bug.cgi?id=116041 Signed-off-by: Sara Sharon Signed-off-by: Emmanuel Grumbach drivers/net/wireless/intel/iwlwifi/iwl-8000.c | 2 +- drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 13 ------------- 2 files changed, 1 insertion(+), 14 deletions(-) commit ce0e2c60e69e5f87ab4ac10c935d8bd85d4d11f7 Author: Linus Walleij Date: Tue Apr 12 10:05:22 2016 +0200 Revert "gpio: rcar: Fine-grained Runtime PM support" This reverts commit 65194cb174b873448b208eb6e04ecb72237af76e. drivers/gpio/gpio-rcar.c | 23 ++++++----------------- 1 file changed, 6 insertions(+), 17 deletions(-) commit 42c25013ca95ce79b4ed192188ca843ae48f8c71 Author: Linus Walleij Date: Tue Apr 12 10:00:34 2016 +0200 Revert "gpio: rcar: Add Runtime PM handling for interrupts" This reverts commit b26a719bdba9aa926ceaadecc66e07623d2b8a53. drivers/gpio/gpio-rcar.c | 42 ------------------------------------------ 1 file changed, 42 deletions(-) commit 0c44d7896cbf9156b8bb10da4f665005622235ae Author: Lee Jones Date: Wed Mar 23 14:43:43 2016 +0000 mailbox: Stop using ENOSYS for anything other than unimplemented syscalls In accordance with e15f431fe2d5 ("errno.h: Improve ENOSYS's comment") and 91c9afaf97ee ("checkpatch.pl: new instances of ENOSYS are errors") we're converting from the old meaning of: ENOSYS "Function not implemented" to a more standard EINVAL. Reported-by: Seraphin Bonnaffe Signed-off-by: Lee Jones Signed-off-by: Jassi Brar drivers/mailbox/mailbox.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d1c2f87c9a8f79fa8816bbe7de98da38eae2be5e Author: Lee Jones Date: Wed Mar 23 14:43:42 2016 +0000 mailbox: mailbox-test: Prevent memory leak If we set the Signal twice or more, without using it as part of a message, memory will be re-allocated and the pointer over-written. Prevent this potential leak by only allocating memory when there isn't any already. Reported-by: Dan Carpenter Signed-off-by: Lee Jones Signed-off-by: Jassi Brar drivers/mailbox/mailbox-test.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 17f5f28ffa6e81461a569290ae802a9b05a89072 Author: Lee Jones Date: Wed Mar 23 14:43:41 2016 +0000 mailbox: mailbox-test: Use more consistent format for calling copy_from_user() While we're at it, ensure copy-to location is NULL'ed in the error path. Suggested-by: Dan Carpenter Signed-off-by: Lee Jones Signed-off-by: Jassi Brar drivers/mailbox/mailbox-test.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit cd49727e1a2bccc4ff008dde24c2f8430dd9e368 Author: Ayala Beker Date: Wed Feb 3 15:36:52 2016 +0200 iwlwifi: mvm: avoid to WARN about gscan capabilities Gscan capabilities were updated with new capabilities supported by the device. Update GSCAN capabilities TLV and avoid to WARN if the firmware does not have the new capabilities. Signed-off-by: Ayala Beker Signed-off-by: Emmanuel Grumbach drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) commit d34475b964b01067ed25187c4f52d8bdf2c0e113 Author: Oren Givon Date: Thu Mar 24 10:20:28 2016 +0200 iwlwifi: add device IDs for the 8265 device Add new 8265 series PCI IDs. Signed-off-by: Oren Givon Signed-off-by: Emmanuel Grumbach drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit f0c8e1d9c4f473dfc771a613b602f1841afe8f8b Author: Subhransu S. Prusty Date: Tue Apr 12 10:31:23 2016 +0530 ASoC: Intel: Skylake: Fix ibs/obs calc for non-integral sampling rates FW expects sampling rate rounded up to next higher integer value when calculating ibs/obs. For example for 44.1k, it should be rounded up to 45 to calculate ibs/obs. Signed-off-by: Subhransu S. Prusty Signed-off-by: Vinod Koul Signed-off-by: Mark Brown sound/soc/intel/skylake/skl-topology.c | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-) commit 1ecf689013b598918cd9a261a078e64571b60f90 Author: stephen hemminger Date: Mon Apr 11 13:39:08 2016 -0700 devlink: add missing install of header The new devlink.h in uapi was not being installed by make headers_install Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller include/uapi/linux/Kbuild | 1 + 1 file changed, 1 insertion(+) commit 8070954d7c9fffa527e785292e901867338f79a9 Author: Akinobu Mita Date: Sat Apr 9 03:43:15 2016 +0900 spi: omap2-mcspi: Undo broken fix for dma transfer of vmalloced buffer This reverts commit 3525e0aac91c4de5d20b1f22a6c6e2b39db3cc96. The DMA transfer for RX buffer was not handled correctly in this change. The actual transfer length for DMA RX can be less than xfer->len in the specific condition and the last words will be filled after the DMA completion, but the commit doesn't consider it and the dmaengine is started with rx_sg mapped by spi core. The solution for this at least requires more lines than this commit has inserted. So revert it for now. Signed-off-by: Akinobu Mita Signed-off-by: Mark Brown drivers/spi/spi-omap2-mcspi.c | 62 +++++++++++++++++++++++++++++++------------ 1 file changed, 45 insertions(+), 17 deletions(-) commit 4f7f34eaab9f68c9bcd45386b15c414c38b40587 Author: David Ahern Date: Thu Apr 7 11:10:41 2016 -0700 net: vrf: Fix dev refcnt leak due to IPv6 prefix route ifupdown2 found a kernel bug with IPv6 routes and movement from the main table to the VRF table. Sequence of events: Create the interface and add addresses: ip link add dev eth4.105 link eth4 type vlan id 105 ip addr add dev eth4.105 8.105.105.10/24 ip -6 addr add dev eth4.105 2008:105:105::10/64 At this point IPv6 has inserted a prefix route in the main table even though the interface is 'down'. From there the VRF device is created: ip link add dev vrf105 type vrf table 105 ip addr add dev vrf105 9.9.105.10/32 ip -6 addr add dev vrf105 2000:9:105::10/128 ip link set vrf105 up Then the interface is enslaved, while still in the 'down' state: ip link set dev eth4.105 master vrf105 Since the device is down the VRF driver cycling the device does not send the NETDEV_UP and NETDEV_DOWN but rather the NETDEV_CHANGE event which does not flush the routes inserted prior. When the link is brought up ip link set dev eth4.105 up the prefix route is added in the VRF table, but does not remove the route from the main table. Fix by handling the NETDEV_CHANGEUPPER event similar what was implemented for IPv4 in 7f49e7a38b77 ("net: Flush local routes when device changes vrf association") Fixes: 35402e3136634 ("net: Add IPv6 support to VRF device") Signed-off-by: David Ahern Signed-off-by: David S. Miller net/ipv6/addrconf.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 9ab179d83b4e31ea277a123492e419067c2f129a Author: David Ahern Date: Thu Apr 7 11:10:06 2016 -0700 net: vrf: Fix dst reference counting Vivek reported a kernel exception deleting a VRF with an active connection through it. The root cause is that the socket has a cached reference to a dst that is destroyed. Converting the dst_destroy to dst_release and letting proper reference counting kick in does not work as the dst has a reference to the device which needs to be released as well. I talked to Hannes about this at netdev and he pointed out the ipv4 and ipv6 dst handling has dst_ifdown for just this scenario. Rather than continuing with the reinvented dst wheel in VRF just remove it and leverage the ipv4 and ipv6 versions. Fixes: 193125dbd8eb2 ("net: Introduce VRF device driver") Fixes: 35402e3136634 ("net: Add IPv6 support to VRF device") Signed-off-by: David Ahern Signed-off-by: David S. Miller drivers/net/vrf.c | 177 +++++------------------------------------------- include/net/ip6_route.h | 3 + include/net/route.h | 3 + net/ipv4/route.c | 7 +- net/ipv6/route.c | 7 +- 5 files changed, 30 insertions(+), 167 deletions(-) commit 1c74a7f812b135d3df41d7c3671b647aed6467bf Merge: 6c6563a 326ea2a Author: Linus Torvalds Date: Mon Apr 11 12:31:09 2016 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid Pull HID fixes from Jiri Kosina: - fix for how scaling linearization is computed in wiimote driver, by Cyan Ogilvie - endless retry loop fix in generic USB HID core reset-resume handling, by Alan Stern - two functional fixes affecting particular devices, and oops fix for wacom driver, by Jason Gerecke - multitouch slot numbering fix from Gabriele Mazzotta - a couple more small fixes on top * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: HID: wacom: Support switching from vendor-defined device mode on G9 and G11 HID: wacom: Initialize hid_data.inputmode to -1 HID: microsoft: add support for 3 more devices HID: multitouch: Synchronize MT frame on reset_resume HID: wacom: fix Bamboo ONE oops HID: lenovo: Don't use stack variables for DMA buffers HID: usbhid: fix inconsistent reset/resume/reset-resume behavior HID: wiimote: Fix wiimote mp scale linearization commit 6c6563a4894238a3ed9c40601018816b60c31ec4 Merge: a56711f 7b8ba82 Author: Linus Torvalds Date: Mon Apr 11 12:24:59 2016 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k update from Geert Uytterhoeven. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k/defconfig: Update defconfigs for v4.6-rc2 m68k: Wire up preadv2 and pwritev2 commit 10c3c02255124e28c8bb63a274a543ee7e77f223 Merge: ebf4dc2 ddb1d33 Author: David S. Miller Date: Mon Apr 11 15:22:21 2016 -0400 Merge branch 'tipc-fixes' Jon Maloy says: ==================== tipc: name distributor pernet queue Commit #1 fixes a potential issue with deferred binding table updates being pushed to the wrong namespace. Commit #2 solves a problem with deferred binding table updates remaining in the the defer queue after the issuing node has gone down. ==================== Signed-off-by: David S. Miller commit ddb1d33969ef52687ad00f75eecf87029f62e382 Author: Erik Hugne Date: Thu Apr 7 10:40:44 2016 -0400 tipc: purge deferred updates from dead nodes If a peer node becomes unavailable, in addition to removing the nametable entries from this node we also need to purge all deferred updates associated with this node. Signed-off-by: Erik Hugne Signed-off-by: Jon Maloy Signed-off-by: David S. Miller net/tipc/name_distr.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) commit 541726abe7daca64390c2ec34e6a203145f1686d Author: Erik Hugne Date: Thu Apr 7 10:40:43 2016 -0400 tipc: make dist queue pernet Nametable updates received from the network that cannot be applied immediately are placed on a defer queue. This queue is global to the TIPC module, which might cause problems when using TIPC in containers. To prevent nametable updates from escaping into the wrong namespace, we make the queue pernet instead. Signed-off-by: Erik Hugne Signed-off-by: Jon Maloy Signed-off-by: David S. Miller net/tipc/core.c | 1 + net/tipc/core.h | 3 +++ net/tipc/name_distr.c | 16 +++++++--------- 3 files changed, 11 insertions(+), 9 deletions(-) commit a56711fa0b418a2cf5eefa00ee65e16443e47790 Merge: bf16200 0dee6c8 Author: Linus Torvalds Date: Mon Apr 11 12:19:57 2016 -0700 Merge tag 'arc-4.6-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC fixes from Vineet Gupta: - fix Kconfig splat due to pcie rework - make ethernet work again on axs103 - provide fb_pgprotect() for future video driver integration * tag 'arc-4.6-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: ARC: [plat-axs103] Enable loop block devices Revert "ARC: [plat-axs10x] add Ethernet PHY description in .dts" arc: Add our own implementation of fb_pgprotect() ARC: Don't source drivers/pci/pcie/Kconfig ourselves commit ebf4dc2b1b2b9c8c7797f01a952bce3cf0247a4f Author: Hariprasad Shenai Date: Mon Apr 11 11:07:58 2016 +0530 cxgb4: Stop Rx Queues before freeing it up Stop all Ethernet RX Queues before freeing up various Ingress/Egress Queues, etc. We were seeing cases of Ingress Queues not getting serviced during the shutdown process leading to Ingress Paths jamming up through the chip and blocking the shutdown effort itself. One such case involved the Firmware sending a "Flush Token" through the ULP-TX -> ULP-RX path for an Ethernet TX Queue being freed in order to make sure there weren't any remaining TX Work Requests in the pipeline. But the return path was stalled by Ingress Data unable to be delivered to the Host because those Ingress Queues were no longer being serviced. Based on original work by Casey Leedom Signed-off-by: Hariprasad Shenai Signed-off-by: David S. Miller drivers/net/ethernet/chelsio/cxgb4/cxgb4.h | 3 +++ drivers/net/ethernet/chelsio/cxgb4/sge.c | 20 +++++++++++++++--- drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 33 ++++++++++++++++++++++++++++++ 3 files changed, 53 insertions(+), 3 deletions(-) commit 9bf2b972afeaffd173fe2ce211ebc555ea7e8a87 Author: Keith Busch Date: Fri Apr 8 16:11:02 2016 -0600 NVMe: Fix reset/remove race This fixes a scenario where device is present and being reset, but a request to unbind the driver occurs. A previous patch series addressing a device failure removal scenario flushed reset_work after controller disable to unblock reset_work waiting on a completion that wouldn't occur. This isn't safe as-is. The broken scenario can potentially be induced with: modprobe nvme && modprobe -r nvme To fix, the reset work is flushed immediately after setting the controller removing flag, and any subsequent reset will not proceed with controller initialization if the flag is set. The controller status must be polled while active, so the watchdog timer is also left active until the controller is disabled to cleanup requests that may be stuck during namespace removal. [Fixes: ff23a2a15a2117245b4599c1352343c8b8fb4c43] Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Reviewed-by: Sagi Grimberg Signed-off-by: Jens Axboe drivers/nvme/host/pci.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 072623de1f964c7ff01c46a9101af1c822fd2873 Author: Mikulas Patocka Date: Sat Apr 9 12:48:18 2016 -0400 dm: fix dm_target_io leak if clone_bio() returns an error Commit c80914e81ec5b08 ("dm: return error if bio_integrity_clone() fails in clone_bio()") changed clone_bio() such that if it does return error then the alloc_tio() created resources (both the bio that was allocated to be a clone and the containing dm_target_io struct) will leak. Fix this by calling free_tio() in __clone_and_map_data_bio()'s clone_bio() error path. Fixes: c80914e81ec5b08 ("dm: return error if bio_integrity_clone() fails in clone_bio()") Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit c636b95ec5980345674ad7960a3c67135a84b687 Author: Sven Eckelmann Date: Mon Apr 11 16:55:26 2016 +0200 ALSA: hda/realtek - Enable the ALC292 dock fixup on the Thinkpad T460s The Lenovo Thinkpad T460s requires the alc_fixup_tpt440_dock as well in order to get working sound output on the docking stations headphone jack. Patch tested on a Thinkpad T460s (20F9CT01WW) using a ThinkPad Ultradock on kernel 4.4.6. Signed-off-by: Sven Eckelmann Tested-by: Simon Wunderlich Cc: Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit e3156048346c28c695f5cf9db67a8cf88c90f947 Author: Joerg Roedel Date: Fri Apr 8 15:12:24 2016 +0200 iommu/amd: Fix checking of pci dma aliases Commit 61289cb ('iommu/amd: Remove old alias handling code') removed the old alias handling code from the AMD IOMMU driver because this is now handled by the IOMMU core code. But this also removed the handling of PCI aliases, which is not handled by the core code. This caused issues with PCI devices that have hidden PCIe-to-PCI bridges that rewrite the request-id. Fix this bug by re-introducing some of the removed functions from commit 61289cbaf6c8 and add a alias field 'struct iommu_dev_data'. This field carrys the return value of the get_alias() function and uses that instead of the amd_iommu_alias_table[] array in the code. Fixes: 61289cbaf6c8 ('iommu/amd: Remove old alias handling code') Cc: stable@vger.kernel.org # v4.4+ Tested-by: Tomasz Golinski Signed-off-by: Joerg Roedel drivers/iommu/amd_iommu.c | 87 +++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 76 insertions(+), 11 deletions(-) commit dc5027a72369f4979a48d628ddebeeb974b7eb37 Author: William Breathitt Gray Date: Mon Apr 11 09:25:52 2016 -0400 ALSA: sscape: Use correct format identifier for size_t The 'size' member of a struct firmware is passed to snd_printk with a respective format string using the %d identifier. The 'size' member is of type size_t, but format identifier %d indicates a signed int data type. This patch replaces the %d format identifier with the correct %zu format identifier for size_t data types. Signed-off-by: William Breathitt Gray Signed-off-by: Takashi Iwai sound/isa/sscape.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 734e00fa02eff5003827abc06a7ebf9449349109 Author: Phil Reid Date: Thu Apr 7 15:55:35 2016 +0800 net: stmmac: socfgpa: Ensure emac bit set in System Manger for PTP When using the PTP fpga to hps clock source for the stmmac module the appropriate bit in the System Manager FPGA Interface Group register needs to be set. This is not set by the bootloader setup when the HPS emac pins are being for this emac module. This allows the PTP clock to be sourced from the FPGA and also connects the PTP pps and ext trig signals to the stmmac PTP hardware. Patch proposed by Phil Collins. Signed-off-by: Phil Reid Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) commit e27260203912b40751fa353d009eaa5a642c739f Author: Dmitry Ivanov Date: Thu Apr 7 09:31:38 2016 +0200 netlink: don't send NETLINK_URELEASE for unbound sockets All existing users of NETLINK_URELEASE use it to clean up resources that were previously allocated to a socket via some command. As a result, no users require getting this notification for unbound sockets. Sending it for unbound sockets, however, is a problem because any user (including unprivileged users) can create a socket that uses the same ID as an existing socket. Binding this new socket will fail, but if the NETLINK_URELEASE notification is generated for such sockets, the users thereof will be tricked into thinking the socket that they allocated the resources for is closed. In the nl80211 case, this will cause destruction of virtual interfaces that still belong to an existing hostapd process; this is the case that Dmitry noticed. In the NFC case, it will cause a poll abort. In the case of netlink log/queue it will cause them to stop reporting events, as if NFULNL_CFG_CMD_UNBIND/NFQNL_CFG_CMD_UNBIND had been called. Fix this problem by checking that the socket is bound before generating the NETLINK_URELEASE notification. Cc: stable@vger.kernel.org Signed-off-by: Dmitry Ivanov Signed-off-by: Johannes Berg Signed-off-by: David S. Miller net/netlink/af_netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 928815245cbdaa611873424759d5e7a7293dd18b Merge: d3de1b8 42bf7b4 Author: Dave Airlie Date: Mon Apr 11 13:30:05 2016 +1000 Merge tag 'drm-intel-fixes-2016-04-07' of git://anongit.freedesktop.org/drm-intel into drm-fixes misc i915 fixes. * tag 'drm-intel-fixes-2016-04-07' of git://anongit.freedesktop.org/drm-intel: drm/i915: fix deadlock on lid open drm/i915: Exit cherryview_irq_handler() after one pass drm/i915: Call intel_dp_mst_resume() before resuming displays drm/i915: Fix race condition in intel_dp_destroy_mst_connector() commit d3de1b81a08a06be2f4a5ac2dd5dc9d87bd85193 Merge: bf16200 735b100 Author: Dave Airlie Date: Mon Apr 11 13:29:42 2016 +1000 Merge tag 'topic/drm-fixes-2016-04-07' of git://anongit.freedesktop.org/drm-intel into drm-fixes The qxl fix I've picked up quite some time ago, and unfortunately neglected. Then there's established timing fixes, of which particularly "drm/edid: Fix parsing of EDID 1.4 Established Timings III descriptor" is quite surprising. It looks like we've never got any of them right. I am not sure what the full implications of this are. That combined with lack of any details of real world bugs fixed made me decide against cc: stable. * tag 'topic/drm-fixes-2016-04-07' of git://anongit.freedesktop.org/drm-intel: drm/edid: Fix DMT 1024x768@43Hz (interlaced) timings drm/edid: Fix parsing of EDID 1.4 Established Timings III descriptor drm/edid: Fix EDID Established Timings I and II drm/qxl: fix cursor position with non-zero hotspot commit a36a0d4008488fa545c74445d69eaf56377d5d4e Author: David S. Miller Date: Sun Apr 10 23:01:30 2016 -0400 decnet: Do not build routes to devices without decnet private data. In particular, make sure we check for decnet private presence for loopback devices. Signed-off-by: David S. Miller net/decnet/dn_route.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit ba6f5e33bdbb9ed2014b778fbbaecf20060ca989 Author: Marcelo Ricardo Leitner Date: Wed Apr 6 15:15:19 2016 -0300 sctp: avoid refreshing heartbeat timer too often Currently on high rate SCTP streams the heartbeat timer refresh can consume quite a lot of resources as timer updates are costly and it contains a random factor, which a) is also costly and b) invalidates mod_timer() optimization for not editing a timer to the same value. It may even cause the timer to be slightly advanced, for no good reason. As suggested by David Laight this patch now removes this timer update from hot path by leaving the timer on and re-evaluating upon its expiration if the heartbeat is still needed or not, similarly to what is done for TCP. If it's not needed anymore the timer is re-scheduled to the new timeout, considering the time already elapsed. For this, we now record the last tx timestamp per transport, updated in the same spots as hb timer was restarted on tx. Also split up sctp_transport_reset_timers into sctp_transport_reset_t3_rtx and sctp_transport_reset_hb_timer, so we can re-arm T3 without re-arming the heartbeat one. On loopback with MTU of 65535 and data chunks with 1636, so that we have a considerable amount of chunks without stressing system calls, netperf -t SCTP_STREAM -l 30, perf looked like this before: Samples: 103K of event 'cpu-clock', Event count (approx.): 25833000000 Overhead Command Shared Object Symbol + 6,15% netperf [kernel.vmlinux] [k] copy_user_enhanced_fast_string - 5,43% netperf [kernel.vmlinux] [k] _raw_write_unlock_irqrestore - _raw_write_unlock_irqrestore - 96,54% _raw_spin_unlock_irqrestore - 36,14% mod_timer + 97,24% sctp_transport_reset_timers + 2,76% sctp_do_sm + 33,65% __wake_up_sync_key + 28,77% sctp_ulpq_tail_event + 1,40% del_timer - 1,84% mod_timer + 99,03% sctp_transport_reset_timers + 0,97% sctp_do_sm + 1,50% sctp_ulpq_tail_event And after this patch, now with netperf -l 60: Samples: 230K of event 'cpu-clock', Event count (approx.): 57707250000 Overhead Command Shared Object Symbol + 5,65% netperf [kernel.vmlinux] [k] memcpy_erms + 5,59% netperf [kernel.vmlinux] [k] copy_user_enhanced_fast_string - 5,05% netperf [kernel.vmlinux] [k] _raw_spin_unlock_irqrestore - _raw_spin_unlock_irqrestore + 49,89% __wake_up_sync_key + 45,68% sctp_ulpq_tail_event - 2,85% mod_timer + 76,51% sctp_transport_reset_t3_rtx + 23,49% sctp_do_sm + 1,55% del_timer + 2,50% netperf [sctp] [k] sctp_datamsg_from_user + 2,26% netperf [sctp] [k] sctp_sendmsg Throughput-wise, from 6800mbps without the patch to 7050mbps with it, ~3.7%. Signed-off-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller include/net/sctp/structs.h | 8 +++++++- net/sctp/outqueue.c | 15 ++++++++++----- net/sctp/sm_make_chunk.c | 3 +-- net/sctp/sm_sideeffect.c | 36 ++++++++++++++++-------------------- net/sctp/transport.c | 19 +++++++++++++------ 5 files changed, 47 insertions(+), 34 deletions(-) commit 2763ee644809820fb1b741f1e7dd779038092324 Author: Greg Ungerer Date: Thu Apr 7 05:26:26 2016 +1000 m68k/gpio: remove arch specific sysfs bus device The ColdFire architecture specific gpio support code registers a sysfs bus device named "gpio". This clashes with the new generic API device added in commit 3c702e99 ("gpio: add a userspace chardev ABI for GPIOs"). The old ColdFire sysfs gpio device was never used for anything specific, and no links or other nodes were created under it. The new API sysfs gpio device has all the same default sysfs links (device, drivers, etc) and they are properly populated. Remove the old ColdFire sysfs gpio registration. Signed-off-by: Greg Ungerer Acked-by: Linus Walleij arch/m68k/coldfire/gpio.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) commit bf16200689118d19de1b8d2a3c314fc21f5dc7bb Author: Linus Torvalds Date: Sun Apr 10 17:58:30 2016 -0700 Linux 4.6-rc3 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 08b15d13864279aae10443c48cb268d823895b14 Merge: 2f422f9 208fae5 Author: Linus Torvalds Date: Sun Apr 10 17:48:17 2016 -0700 Merge branch 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm Pull ARM fixes from Russell King: "A couple of small fixes, and wiring up the new syscalls which appeared during the merge window" * 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm: ARM: 8550/1: protect idiv patching against undefined gcc behavior ARM: wire up preadv2 and pwritev2 syscalls ARM: SMP enable of cache maintanence broadcast commit 2f422f94eea83f50755df76be8f5ff86ef89ad80 Merge: 6a7c924 01d6b2a Author: Linus Torvalds Date: Sun Apr 10 17:38:55 2016 -0700 Merge tag 'mmc-v4.6-rc1' of git://git.linaro.org/people/ulf.hansson/mmc Pull MMC fixes from Ulf Hansson: "Here are a couple of mmc fixes intended for v4.6 rc3: MMC host: - sdhci: Fix regression setting power on Trats2 board - sdhci-pci: Add support and PCI IDs for more Broxton host controllers" * tag 'mmc-v4.6-rc1' of git://git.linaro.org/people/ulf.h