--- /dev/null
+From 40384e4bbeb9f2651fe9bffc0062d9f31ef625bf Mon Sep 17 00:00:00 2001
+From: "K. Y. Srinivasan" <kys@microsoft.com>
+Date: Fri, 27 Feb 2015 11:26:04 -0800
+Subject: Drivers: hv: vmbus: Fix a bug in the error path in vmbus_open()
+
+From: "K. Y. Srinivasan" <kys@microsoft.com>
+
+commit 40384e4bbeb9f2651fe9bffc0062d9f31ef625bf upstream.
+
+Correctly rollback state if the failure occurs after we have handed over
+the ownership of the buffer to the host.
+
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hv/channel.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/hv/channel.c
++++ b/drivers/hv/channel.c
+@@ -135,7 +135,7 @@ int vmbus_open(struct vmbus_channel *new
+ GFP_KERNEL);
+ if (!open_info) {
+ err = -ENOMEM;
+- goto error0;
++ goto error_gpadl;
+ }
+
+ init_completion(&open_info->waitevent);
+@@ -151,7 +151,7 @@ int vmbus_open(struct vmbus_channel *new
+
+ if (userdatalen > MAX_USER_DEFINED_BYTES) {
+ err = -EINVAL;
+- goto error0;
++ goto error_gpadl;
+ }
+
+ if (userdatalen)
+@@ -195,6 +195,9 @@ error1:
+ list_del(&open_info->msglistentry);
+ spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
+
++error_gpadl:
++ vmbus_teardown_gpadl(newchannel, newchannel->ringbuffer_gpadlhandle);
++
+ error0:
+ free_pages((unsigned long)out,
+ get_order(send_ringbuffer_size + recv_ringbuffer_size));
--- /dev/null
+From c1c21f4e60ed4523292f1a89ff45a208bddd3849 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@kernel.org>
+Date: Wed, 15 Apr 2015 19:18:39 +0100
+Subject: i2c: core: Export bus recovery functions
+
+From: Mark Brown <broonie@kernel.org>
+
+commit c1c21f4e60ed4523292f1a89ff45a208bddd3849 upstream.
+
+Current -next fails to link an ARM allmodconfig because drivers that use
+the core recovery functions can be built as modules but those functions
+are not exported:
+
+ERROR: "i2c_generic_gpio_recovery" [drivers/i2c/busses/i2c-davinci.ko] undefined!
+ERROR: "i2c_generic_scl_recovery" [drivers/i2c/busses/i2c-davinci.ko] undefined!
+ERROR: "i2c_recover_bus" [drivers/i2c/busses/i2c-davinci.ko] undefined!
+
+Add exports to fix this.
+
+Fixes: 5f9296ba21b3c (i2c: Add bus recovery infrastructure)
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/i2c-core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/i2c/i2c-core.c
++++ b/drivers/i2c/i2c-core.c
+@@ -596,6 +596,7 @@ int i2c_generic_scl_recovery(struct i2c_
+ adap->bus_recovery_info->set_scl(adap, 1);
+ return i2c_generic_recovery(adap);
+ }
++EXPORT_SYMBOL_GPL(i2c_generic_scl_recovery);
+
+ int i2c_generic_gpio_recovery(struct i2c_adapter *adap)
+ {
+@@ -610,6 +611,7 @@ int i2c_generic_gpio_recovery(struct i2c
+
+ return ret;
+ }
++EXPORT_SYMBOL_GPL(i2c_generic_gpio_recovery);
+
+ int i2c_recover_bus(struct i2c_adapter *adap)
+ {
+@@ -619,6 +621,7 @@ int i2c_recover_bus(struct i2c_adapter *
+ dev_dbg(&adap->dev, "Trying i2c bus recovery\n");
+ return adap->bus_recovery_info->recover_bus(adap);
+ }
++EXPORT_SYMBOL_GPL(i2c_recover_bus);
+
+ static int i2c_device_probe(struct device *dev)
+ {
--- /dev/null
+From 133778482ec6c8fde69406be380333963627c17a Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Thu, 23 Apr 2015 10:29:09 +0200
+Subject: i2c: mux: use proper dev when removing "channel-X" symlinks
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+commit 133778482ec6c8fde69406be380333963627c17a upstream.
+
+Those symlinks are created for the mux_dev, so we need to remove it from
+there. Currently, it breaks for muxes where the mux_dev is not the device
+of the parent adapter like this:
+
+[ 78.234644] WARNING: CPU: 0 PID: 365 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x5c/0x78()
+[ 78.242438] sysfs: cannot create duplicate filename '/devices/platform/i2cbus@8/channel-0'
+
+Remove confusing comments while we are here.
+
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Fixes: c9449affad2ae0
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/i2c-mux.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/i2c/i2c-mux.c
++++ b/drivers/i2c/i2c-mux.c
+@@ -32,8 +32,9 @@ struct i2c_mux_priv {
+ struct i2c_algorithm algo;
+
+ struct i2c_adapter *parent;
+- void *mux_priv; /* the mux chip/device */
+- u32 chan_id; /* the channel id */
++ struct device *mux_dev;
++ void *mux_priv;
++ u32 chan_id;
+
+ int (*select)(struct i2c_adapter *, void *mux_priv, u32 chan_id);
+ int (*deselect)(struct i2c_adapter *, void *mux_priv, u32 chan_id);
+@@ -119,6 +120,7 @@ struct i2c_adapter *i2c_add_mux_adapter(
+
+ /* Set up private adapter data */
+ priv->parent = parent;
++ priv->mux_dev = mux_dev;
+ priv->mux_priv = mux_priv;
+ priv->chan_id = chan_id;
+ priv->select = select;
+@@ -203,7 +205,7 @@ void i2c_del_mux_adapter(struct i2c_adap
+ char symlink_name[20];
+
+ snprintf(symlink_name, sizeof(symlink_name), "channel-%u", priv->chan_id);
+- sysfs_remove_link(&adap->dev.parent->kobj, symlink_name);
++ sysfs_remove_link(&priv->mux_dev->kobj, symlink_name);
+
+ sysfs_remove_link(&priv->adap.dev.kobj, "mux_device");
+ i2c_del_adapter(adap);
--- /dev/null
+From c6cbfb91b878224e78408a2e15901c79de77115a Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Mon, 20 Apr 2015 15:14:47 -0700
+Subject: i2c: rk3x: report number of messages transmitted
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit c6cbfb91b878224e78408a2e15901c79de77115a upstream.
+
+master_xfer() method should return number of i2c messages transferred,
+but on Rockchip we were usually returning just 1, which caused trouble
+with users that actually check number of transferred messages vs.
+checking for negative error codes.
+
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-rk3x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-rk3x.c
++++ b/drivers/i2c/busses/i2c-rk3x.c
+@@ -800,7 +800,7 @@ static int rk3x_i2c_xfer(struct i2c_adap
+ clk_disable(i2c->clk);
+ spin_unlock_irqrestore(&i2c->lock, flags);
+
+- return ret;
++ return ret < 0 ? ret : num;
+ }
+
+ static u32 rk3x_i2c_func(struct i2c_adapter *adap)
--- /dev/null
+From 8abaae62f3fdead8f4ce0ab46b4ab93dee39bab2 Mon Sep 17 00:00:00 2001
+From: Yann Droneaud <ydroneaud@opteya.com>
+Date: Mon, 13 Apr 2015 14:56:22 +0200
+Subject: IB/core: disallow registering 0-sized memory region
+
+From: Yann Droneaud <ydroneaud@opteya.com>
+
+commit 8abaae62f3fdead8f4ce0ab46b4ab93dee39bab2 upstream.
+
+If ib_umem_get() is called with a size equal to 0 and an
+non-page aligned address, one page will be pinned and a
+0-sized umem will be returned to the caller.
+
+This should not be allowed: it's not expected for a memory
+region to have a size equal to 0.
+
+This patch adds a check to explicitly refuse to register
+a 0-sized region.
+
+Link: http://mid.gmane.org/cover.1428929103.git.ydroneaud@opteya.com
+Cc: Shachar Raindel <raindel@mellanox.com>
+Cc: Jack Morgenstein <jackm@mellanox.com>
+Cc: Or Gerlitz <ogerlitz@mellanox.com>
+Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/umem.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/infiniband/core/umem.c
++++ b/drivers/infiniband/core/umem.c
+@@ -99,6 +99,9 @@ struct ib_umem *ib_umem_get(struct ib_uc
+ if (dmasync)
+ dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
+
++ if (!size)
++ return ERR_PTR(-EINVAL);
++
+ /*
+ * If the combination of the addr and size requested for this memory
+ * region causes an integer overflow, return error.
--- /dev/null
+From 66578b0b2f69659f00b6169e6fe7377c4b100d18 Mon Sep 17 00:00:00 2001
+From: Yann Droneaud <ydroneaud@opteya.com>
+Date: Mon, 13 Apr 2015 14:56:23 +0200
+Subject: IB/core: don't disallow registering region starting at 0x0
+
+From: Yann Droneaud <ydroneaud@opteya.com>
+
+commit 66578b0b2f69659f00b6169e6fe7377c4b100d18 upstream.
+
+In a call to ib_umem_get(), if address is 0x0 and size is
+already page aligned, check added in commit 8494057ab5e4
+("IB/uverbs: Prevent integer overflow in ib_umem_get address
+arithmetic") will refuse to register a memory region that
+could otherwise be valid (provided vm.mmap_min_addr sysctl
+and mmap_low_allowed SELinux knobs allow userspace to map
+something at address 0x0).
+
+This patch allows back such registration: ib_umem_get()
+should probably don't care of the base address provided it
+can be pinned with get_user_pages().
+
+There's two possible overflows, in (addr + size) and in
+PAGE_ALIGN(addr + size), this patch keep ensuring none
+of them happen while allowing to pin memory at address
+0x0. Anyway, the case of size equal 0 is no more (partially)
+handled as 0-length memory region are disallowed by an
+earlier check.
+
+Link: http://mid.gmane.org/cover.1428929103.git.ydroneaud@opteya.com
+Cc: Shachar Raindel <raindel@mellanox.com>
+Cc: Jack Morgenstein <jackm@mellanox.com>
+Cc: Or Gerlitz <ogerlitz@mellanox.com>
+Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
+Reviewed-by: Sagi Grimberg <sagig@mellanox.com>
+Reviewed-by: Haggai Eran <haggaie@mellanox.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/umem.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/core/umem.c
++++ b/drivers/infiniband/core/umem.c
+@@ -106,8 +106,8 @@ struct ib_umem *ib_umem_get(struct ib_uc
+ * If the combination of the addr and size requested for this memory
+ * region causes an integer overflow, return error.
+ */
+- if ((PAGE_ALIGN(addr + size) <= size) ||
+- (PAGE_ALIGN(addr + size) <= addr))
++ if (((addr + size) < addr) ||
++ PAGE_ALIGN(addr + size) < (addr + size))
+ return ERR_PTR(-EINVAL);
+
+ if (!can_do_mlock())
--- /dev/null
+From a065fe6aa25ba6ba93c02dc13486131bb3c64d5f Mon Sep 17 00:00:00 2001
+From: Sagi Grimberg <sagig@mellanox.com>
+Date: Tue, 14 Apr 2015 18:08:13 +0300
+Subject: IB/iser: Fix wrong calculation of protection buffer length
+
+From: Sagi Grimberg <sagig@mellanox.com>
+
+commit a065fe6aa25ba6ba93c02dc13486131bb3c64d5f upstream.
+
+This length miss-calculation may cause a silent data corruption
+in the DIX case and cause the device to reference unmapped area.
+
+Fixes: d77e65350f2d ('libiscsi, iser: Adjust data_length to include protection information')
+Signed-off-by: Sagi Grimberg <sagig@mellanox.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/iser/iser_initiator.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/ulp/iser/iser_initiator.c
++++ b/drivers/infiniband/ulp/iser/iser_initiator.c
+@@ -409,8 +409,8 @@ int iser_send_command(struct iscsi_conn
+ if (scsi_prot_sg_count(sc)) {
+ prot_buf->buf = scsi_prot_sglist(sc);
+ prot_buf->size = scsi_prot_sg_count(sc);
+- prot_buf->data_len = data_buf->data_len >>
+- ilog2(sc->device->sector_size) * 8;
++ prot_buf->data_len = (data_buf->data_len >>
++ ilog2(sc->device->sector_size)) * 8;
+ }
+
+ if (hdr->flags & ISCSI_FLAG_CMD_READ) {
--- /dev/null
+From ca9b590caa17bcbbea119594992666e96cde9c2f Mon Sep 17 00:00:00 2001
+From: Erez Shitrit <erezsh@mellanox.com>
+Date: Thu, 2 Apr 2015 13:39:05 +0300
+Subject: IB/mlx4: Fix WQE LSO segment calculation
+
+From: Erez Shitrit <erezsh@mellanox.com>
+
+commit ca9b590caa17bcbbea119594992666e96cde9c2f upstream.
+
+The current code decreases from the mss size (which is the gso_size
+from the kernel skb) the size of the packet headers.
+
+It shouldn't do that because the mss that comes from the stack
+(e.g IPoIB) includes only the tcp payload without the headers.
+
+The result is indication to the HW that each packet that the HW sends
+is smaller than what it could be, and too many packets will be sent
+for big messages.
+
+An easy way to demonstrate one more aspect of the problem is by
+configuring the ipoib mtu to be less than 2*hlen (2*56) and then
+run app sending big TCP messages. This will tell the HW to send packets
+with giant (negative value which under unsigned arithmetics becomes
+a huge positive one) length and the QP moves to SQE state.
+
+Fixes: b832be1e4007 ('IB/mlx4: Add IPoIB LSO support')
+Reported-by: Matthew Finlay <matt@mellanox.com>
+Signed-off-by: Erez Shitrit <erezsh@mellanox.com>
+Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx4/qp.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -2564,8 +2564,7 @@ static int build_lso_seg(struct mlx4_wqe
+
+ memcpy(wqe->header, wr->wr.ud.header, wr->wr.ud.hlen);
+
+- *lso_hdr_sz = cpu_to_be32((wr->wr.ud.mss - wr->wr.ud.hlen) << 16 |
+- wr->wr.ud.hlen);
++ *lso_hdr_sz = cpu_to_be32(wr->wr.ud.mss << 16 | wr->wr.ud.hlen);
+ *lso_seg_len = halign;
+ return 0;
+ }
--- /dev/null
+From 56cbd0ccc1b508de19561211d7ab9e1c77e6b384 Mon Sep 17 00:00:00 2001
+From: James Bottomley <JBottomley@Odin.com>
+Date: Wed, 15 Apr 2015 22:16:01 -0700
+Subject: mvsas: fix panic on expander attached SATA devices
+
+From: James Bottomley <JBottomley@Odin.com>
+
+commit 56cbd0ccc1b508de19561211d7ab9e1c77e6b384 upstream.
+
+mvsas is giving a General protection fault when it encounters an expander
+attached ATA device. Analysis of mvs_task_prep_ata() shows that the driver is
+assuming all ATA devices are locally attached and obtaining the phy mask by
+indexing the local phy table (in the HBA structure) with the phy id. Since
+expanders have many more phys than the HBA, this is causing the index into the
+HBA phy table to overflow and returning rubbish as the pointer.
+
+mvs_task_prep_ssp() instead does the phy mask using the port properties.
+Mirror this in mvs_task_prep_ata() to fix the panic.
+
+Reported-by: Adam Talbot <ajtalbot1@gmail.com>
+Tested-by: Adam Talbot <ajtalbot1@gmail.com>
+Signed-off-by: James Bottomley <JBottomley@Odin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/mvsas/mv_sas.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/drivers/scsi/mvsas/mv_sas.c
++++ b/drivers/scsi/mvsas/mv_sas.c
+@@ -441,14 +441,11 @@ static u32 mvs_get_ncq_tag(struct sas_ta
+ static int mvs_task_prep_ata(struct mvs_info *mvi,
+ struct mvs_task_exec_info *tei)
+ {
+- struct sas_ha_struct *sha = mvi->sas;
+ struct sas_task *task = tei->task;
+ struct domain_device *dev = task->dev;
+ struct mvs_device *mvi_dev = dev->lldd_dev;
+ struct mvs_cmd_hdr *hdr = tei->hdr;
+ struct asd_sas_port *sas_port = dev->port;
+- struct sas_phy *sphy = dev->phy;
+- struct asd_sas_phy *sas_phy = sha->sas_phy[sphy->number];
+ struct mvs_slot_info *slot;
+ void *buf_prd;
+ u32 tag = tei->tag, hdr_tag;
+@@ -468,7 +465,7 @@ static int mvs_task_prep_ata(struct mvs_
+ slot->tx = mvi->tx_prod;
+ del_q = TXQ_MODE_I | tag |
+ (TXQ_CMD_STP << TXQ_CMD_SHIFT) |
+- (MVS_PHY_ID << TXQ_PHY_SHIFT) |
++ ((sas_port->phy_mask & TXQ_PHY_MASK) << TXQ_PHY_SHIFT) |
+ (mvi_dev->taskfileset << TXQ_SRS_SHIFT);
+ mvi->tx[mvi->tx_prod] = cpu_to_le32(del_q);
+
--- /dev/null
+From 80ccf4ad06dc9d2f06a8347b2d309cdc959f72b3 Mon Sep 17 00:00:00 2001
+From: Sifan Naeem <sifan.naeem@imgtec.com>
+Date: Tue, 10 Feb 2015 07:41:56 -0300
+Subject: [media] rc: img-ir: fix error in parameters passed to irq_free()
+
+From: Sifan Naeem <sifan.naeem@imgtec.com>
+
+commit 80ccf4ad06dc9d2f06a8347b2d309cdc959f72b3 upstream.
+
+img_ir_remove() passes a pointer to the ISR function as the 2nd
+parameter to irq_free() instead of a pointer to the device data
+structure.
+This issue causes unloading img-ir module to fail with the below
+warning after building and loading img-ir as a module.
+
+WARNING: CPU: 2 PID: 155 at ../kernel/irq/manage.c:1278
+__free_irq+0xb4/0x214() Trying to free already-free IRQ 58
+Modules linked in: img_ir(-)
+CPU: 2 PID: 155 Comm: rmmod Not tainted 3.14.0 #55 ...
+Call Trace:
+...
+[<8048d420>] __free_irq+0xb4/0x214
+[<8048d6b4>] free_irq+0xac/0xf4
+[<c009b130>] img_ir_remove+0x54/0xd4 [img_ir] [<8073ded0>]
+platform_drv_remove+0x30/0x54 ...
+
+Fixes: 160a8f8aec4d ("[media] rc: img-ir: add base driver")
+
+Signed-off-by: Sifan Naeem <sifan.naeem@imgtec.com>
+Acked-by: James Hogan <james.hogan@imgtec.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/rc/img-ir/img-ir-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/rc/img-ir/img-ir-core.c
++++ b/drivers/media/rc/img-ir/img-ir-core.c
+@@ -146,7 +146,7 @@ static int img_ir_remove(struct platform
+ {
+ struct img_ir_priv *priv = platform_get_drvdata(pdev);
+
+- free_irq(priv->irq, img_ir_isr);
++ free_irq(priv->irq, priv);
+ img_ir_remove_hw(priv);
+ img_ir_remove_raw(priv);
+
dm-crypt-fix-deadlock-when-async-crypto-algorithm-returns-ebusy.patch
sd-unregister-integrity-profile.patch
sd-fix-missing-ato-tag-check.patch
+drivers-hv-vmbus-fix-a-bug-in-the-error-path-in-vmbus_open.patch
+mvsas-fix-panic-on-expander-attached-sata-devices.patch
+rc-img-ir-fix-error-in-parameters-passed-to-irq_free.patch
+stk1160-make-sure-current-buffer-is-released.patch
+ib-core-disallow-registering-0-sized-memory-region.patch
+ib-core-don-t-disallow-registering-region-starting-at-0x0.patch
+ib-mlx4-fix-wqe-lso-segment-calculation.patch
+ib-iser-fix-wrong-calculation-of-protection-buffer-length.patch
+tracing-handle-ftrace_dump-atomic-context-in-graph_trace_open.patch
+tracing-fix-incorrect-enabling-of-trace-events-by-boot-cmdline.patch
+i2c-mux-use-proper-dev-when-removing-channel-x-symlinks.patch
+i2c-rk3x-report-number-of-messages-transmitted.patch
+i2c-core-export-bus-recovery-functions.patch
--- /dev/null
+From aeff09276748b66072f2db2e668cec955cf41959 Mon Sep 17 00:00:00 2001
+From: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
+Date: Tue, 10 Mar 2015 11:37:14 -0300
+Subject: [media] stk1160: Make sure current buffer is released
+
+From: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
+
+commit aeff09276748b66072f2db2e668cec955cf41959 upstream.
+
+The available (i.e. not used) buffers are returned by stk1160_clear_queue(),
+on the stop_streaming() path. However, this is insufficient and the current
+buffer must be released as well. Fix it.
+
+Signed-off-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/stk1160/stk1160-v4l.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/usb/stk1160/stk1160-v4l.c
++++ b/drivers/media/usb/stk1160/stk1160-v4l.c
+@@ -244,6 +244,11 @@ static int stk1160_stop_streaming(struct
+ if (mutex_lock_interruptible(&dev->v4l_lock))
+ return -ERESTARTSYS;
+
++ /*
++ * Once URBs are cancelled, the URB complete handler
++ * won't be running. This is required to safely release the
++ * current buffer (dev->isoc_ctl.buf).
++ */
+ stk1160_cancel_isoc(dev);
+
+ /*
+@@ -624,8 +629,16 @@ void stk1160_clear_queue(struct stk1160
+ stk1160_info("buffer [%p/%d] aborted\n",
+ buf, buf->vb.v4l2_buf.index);
+ }
+- /* It's important to clear current buffer */
+- dev->isoc_ctl.buf = NULL;
++
++ /* It's important to release the current buffer */
++ if (dev->isoc_ctl.buf) {
++ buf = dev->isoc_ctl.buf;
++ dev->isoc_ctl.buf = NULL;
++
++ vb2_buffer_done(&buf->vb, VB2_BUF_STATE_ERROR);
++ stk1160_info("buffer [%p/%d] aborted\n",
++ buf, buf->vb.v4l2_buf.index);
++ }
+ spin_unlock_irqrestore(&dev->buf_lock, flags);
+ }
+
--- /dev/null
+From 84fce9db4d7eaebd6cb2ee30c15da6d4e4daf846 Mon Sep 17 00:00:00 2001
+From: Joonsoo Kim <iamjoonsoo.kim@lge.com>
+Date: Thu, 16 Apr 2015 13:44:44 +0900
+Subject: tracing: Fix incorrect enabling of trace events by boot cmdline
+
+From: Joonsoo Kim <iamjoonsoo.kim@lge.com>
+
+commit 84fce9db4d7eaebd6cb2ee30c15da6d4e4daf846 upstream.
+
+There is a problem that trace events are not properly enabled with
+boot cmdline. The problem is that if we pass "trace_event=kmem:mm_page_alloc"
+to the boot cmdline, it enables all kmem trace events, and not just
+the page_alloc event.
+
+This is caused by the parsing mechanism. When we parse the cmdline, the buffer
+contents is modified due to tokenization. And, if we use this buffer
+again, we will get the wrong result.
+
+Unfortunately, this buffer is be accessed three times to set trace events
+properly at boot time. So, we need to handle this situation.
+
+There is already code handling ",", but we need another for ":".
+This patch adds it.
+
+Link: http://lkml.kernel.org/r/1429159484-22977-1-git-send-email-iamjoonsoo.kim@lge.com
+
+Signed-off-by: Joonsoo Kim <iamjoonsoo.kim@lge.com>
+[ added missing return ret; ]
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/trace_events.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -565,6 +565,7 @@ static int __ftrace_set_clr_event(struct
+ static int ftrace_set_clr_event(struct trace_array *tr, char *buf, int set)
+ {
+ char *event = NULL, *sub = NULL, *match;
++ int ret;
+
+ /*
+ * The buf format can be <subsystem>:<event-name>
+@@ -590,7 +591,13 @@ static int ftrace_set_clr_event(struct t
+ event = NULL;
+ }
+
+- return __ftrace_set_clr_event(tr, match, sub, event, set);
++ ret = __ftrace_set_clr_event(tr, match, sub, event, set);
++
++ /* Put back the colon to allow this to be called again */
++ if (buf)
++ *(buf - 1) = ':';
++
++ return ret;
+ }
+
+ /**
--- /dev/null
+From ef99b88b16bee753fa51207abdc58ae660453ec6 Mon Sep 17 00:00:00 2001
+From: Rabin Vincent <rabin@rab.in>
+Date: Mon, 13 Apr 2015 22:30:12 +0200
+Subject: tracing: Handle ftrace_dump() atomic context in graph_trace_open()
+
+From: Rabin Vincent <rabin@rab.in>
+
+commit ef99b88b16bee753fa51207abdc58ae660453ec6 upstream.
+
+graph_trace_open() can be called in atomic context from ftrace_dump().
+Use GFP_ATOMIC for the memory allocations when that's the case, in order
+to avoid the following splat.
+
+ BUG: sleeping function called from invalid context at mm/slab.c:2849
+ in_atomic(): 1, irqs_disabled(): 128, pid: 0, name: swapper/0
+ Backtrace:
+ ..
+ [<8004dc94>] (__might_sleep) from [<801371f4>] (kmem_cache_alloc_trace+0x160/0x238)
+ r7:87800040 r6:000080d0 r5:810d16e8 r4:000080d0
+ [<80137094>] (kmem_cache_alloc_trace) from [<800cbd60>] (graph_trace_open+0x30/0xd0)
+ r10:00000100 r9:809171a8 r8:00008e28 r7:810d16f0 r6:00000001 r5:810d16e8
+ r4:810d16f0
+ [<800cbd30>] (graph_trace_open) from [<800c79c4>] (trace_init_global_iter+0x50/0x9c)
+ r8:00008e28 r7:808c853c r6:00000001 r5:810d16e8 r4:810d16f0 r3:800cbd30
+ [<800c7974>] (trace_init_global_iter) from [<800c7aa0>] (ftrace_dump+0x90/0x2ec)
+ r4:810d2580 r3:00000000
+ [<800c7a10>] (ftrace_dump) from [<80414b2c>] (sysrq_ftrace_dump+0x1c/0x20)
+ r10:00000100 r9:809171a8 r8:808f6e7c r7:00000001 r6:00000007 r5:0000007a
+ r4:808d5394
+ [<80414b10>] (sysrq_ftrace_dump) from [<800169b8>] (return_to_handler+0x0/0x18)
+ [<80415498>] (__handle_sysrq) from [<800169b8>] (return_to_handler+0x0/0x18)
+ r8:808c8100 r7:808c8444 r6:00000101 r5:00000010 r4:84eb3210
+ [<80415668>] (handle_sysrq) from [<800169b8>] (return_to_handler+0x0/0x18)
+ [<8042a760>] (pl011_int) from [<800169b8>] (return_to_handler+0x0/0x18)
+ r10:809171bc r9:809171a8 r8:00000001 r7:00000026 r6:808c6000 r5:84f01e60
+ r4:8454fe00
+ [<8007782c>] (handle_irq_event_percpu) from [<80077b44>] (handle_irq_event+0x4c/0x6c)
+ r10:808c7ef0 r9:87283e00 r8:00000001 r7:00000000 r6:8454fe00 r5:84f01e60
+ r4:84f01e00
+ [<80077af8>] (handle_irq_event) from [<8007aa28>] (handle_fasteoi_irq+0xf0/0x1ac)
+ r6:808f52a4 r5:84f01e60 r4:84f01e00 r3:00000000
+ [<8007a938>] (handle_fasteoi_irq) from [<80076dc0>] (generic_handle_irq+0x3c/0x4c)
+ r6:00000026 r5:00000000 r4:00000026 r3:8007a938
+ [<80076d84>] (generic_handle_irq) from [<80077128>] (__handle_domain_irq+0x8c/0xfc)
+ r4:808c1e38 r3:0000002e
+ [<8007709c>] (__handle_domain_irq) from [<800087b8>] (gic_handle_irq+0x34/0x6c)
+ r10:80917748 r9:00000001 r8:88802100 r7:808c7ef0 r6:808c8fb0 r5:00000015
+ r4:8880210c r3:808c7ef0
+ [<80008784>] (gic_handle_irq) from [<80014044>] (__irq_svc+0x44/0x7c)
+
+Link: http://lkml.kernel.org/r/1428953721-31349-1-git-send-email-rabin@rab.in
+Link: http://lkml.kernel.org/r/1428957012-2319-1-git-send-email-rabin@rab.in
+
+Signed-off-by: Rabin Vincent <rabin@rab.in>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/trace_functions_graph.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/kernel/trace/trace_functions_graph.c
++++ b/kernel/trace/trace_functions_graph.c
+@@ -1309,15 +1309,19 @@ void graph_trace_open(struct trace_itera
+ {
+ /* pid and depth on the last trace processed */
+ struct fgraph_data *data;
++ gfp_t gfpflags;
+ int cpu;
+
+ iter->private = NULL;
+
+- data = kzalloc(sizeof(*data), GFP_KERNEL);
++ /* We can be called in atomic context via ftrace_dump() */
++ gfpflags = (in_atomic() || irqs_disabled()) ? GFP_ATOMIC : GFP_KERNEL;
++
++ data = kzalloc(sizeof(*data), gfpflags);
+ if (!data)
+ goto out_err;
+
+- data->cpu_data = alloc_percpu(struct fgraph_cpu_data);
++ data->cpu_data = alloc_percpu_gfp(struct fgraph_cpu_data, gfpflags);
+ if (!data->cpu_data)
+ goto out_err_free;
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
