--- /dev/null
+From dcbff39da3d815f08750552fdd04f96b51751129 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sasha.levin@oracle.com>
+Date: Thu, 28 May 2015 15:44:29 -0700
+Subject: fs, omfs: add NULL terminator in the end up the token list
+
+From: Sasha Levin <sasha.levin@oracle.com>
+
+commit dcbff39da3d815f08750552fdd04f96b51751129 upstream.
+
+match_token() expects a NULL terminator at the end of the token list so
+that it would know where to stop. Not having one causes it to overrun
+to invalid memory.
+
+In practice, passing a mount option that omfs didn't recognize would
+sometimes panic the system.
+
+Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
+Signed-off-by: Bob Copeland <me@bobcopeland.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/omfs/inode.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/omfs/inode.c
++++ b/fs/omfs/inode.c
+@@ -361,7 +361,7 @@ nomem:
+ }
+
+ enum {
+- Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask
++ Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask, Opt_err
+ };
+
+ static const match_table_t tokens = {
+@@ -370,6 +370,7 @@ static const match_table_t tokens = {
+ {Opt_umask, "umask=%o"},
+ {Opt_dmask, "dmask=%o"},
+ {Opt_fmask, "fmask=%o"},
++ {Opt_err, NULL},
+ };
+
+ static int parse_options(char *options, struct omfs_sb_info *sbi)
--- /dev/null
+From 1b63bf617206ff35b93c57c67bbe067ac735a85a Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Thu, 28 May 2015 09:08:09 -0700
+Subject: hwmon: (nct6775) Add missing sysfs attribute initialization
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 1b63bf617206ff35b93c57c67bbe067ac735a85a upstream.
+
+The following error message is seen when loading the nct6775 driver
+with DEBUG_LOCK_ALLOC enabled.
+
+BUG: key ffff88040b2f0030 not in .data!
+------------[ cut here ]------------
+WARNING: CPU: 0 PID: 186 at kernel/locking/lockdep.c:2988
+ lockdep_init_map+0x469/0x630()
+DEBUG_LOCKS_WARN_ON(1)
+
+Caused by a missing call to sysfs_attr_init() when initializing
+sysfs attributes.
+
+Reported-by: Alexey Orishko <alexey.orishko@gmail.com>
+Reviewed-by: Jean Delvare <jdelvare@suse.de>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/nct6775.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/hwmon/nct6775.c
++++ b/drivers/hwmon/nct6775.c
+@@ -986,6 +986,7 @@ nct6775_create_attr_group(struct device
+ (*t)->dev_attr.attr.name, tg->base + i);
+ if ((*t)->s2) {
+ a2 = &su->u.a2;
++ sysfs_attr_init(&a2->dev_attr.attr);
+ a2->dev_attr.attr.name = su->name;
+ a2->nr = (*t)->u.s.nr + i;
+ a2->index = (*t)->u.s.index;
+@@ -996,6 +997,7 @@ nct6775_create_attr_group(struct device
+ *attrs = &a2->dev_attr.attr;
+ } else {
+ a = &su->u.a1;
++ sysfs_attr_init(&a->dev_attr.attr);
+ a->dev_attr.attr.name = su->name;
+ a->index = (*t)->u.index + i;
+ a->dev_attr.attr.mode =
--- /dev/null
+From adba657533bdd255f7b78bc8a324091f46b294cd Mon Sep 17 00:00:00 2001
+From: Chris Lesiak <chris.lesiak@licor.com>
+Date: Tue, 26 May 2015 15:40:44 -0500
+Subject: hwmon: (ntc_thermistor) Ensure iio channel is of type IIO_VOLTAGE
+
+From: Chris Lesiak <chris.lesiak@licor.com>
+
+commit adba657533bdd255f7b78bc8a324091f46b294cd upstream.
+
+When configured via device tree, the associated iio device needs to be
+measuring voltage for the conversion to resistance to be correct.
+Return -EINVAL if that is not the case.
+
+Signed-off-by: Chris Lesiak <chris.lesiak@licor.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/ntc_thermistor.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/hwmon/ntc_thermistor.c
++++ b/drivers/hwmon/ntc_thermistor.c
+@@ -181,8 +181,10 @@ static struct ntc_thermistor_platform_da
+ ntc_thermistor_parse_dt(struct platform_device *pdev)
+ {
+ struct iio_channel *chan;
++ enum iio_chan_type type;
+ struct device_node *np = pdev->dev.of_node;
+ struct ntc_thermistor_platform_data *pdata;
++ int ret;
+
+ if (!np)
+ return NULL;
+@@ -195,6 +197,13 @@ ntc_thermistor_parse_dt(struct platform_
+ if (IS_ERR(chan))
+ return ERR_CAST(chan);
+
++ ret = iio_get_channel_type(chan, &type);
++ if (ret < 0)
++ return ERR_PTR(ret);
++
++ if (type != IIO_VOLTAGE)
++ return ERR_PTR(-EINVAL);
++
+ if (of_property_read_u32(np, "pullup-uv", &pdata->pullup_uv))
+ return ERR_PTR(-ENODEV);
+ if (of_property_read_u32(np, "pullup-ohm", &pdata->pullup_ohm))
--- /dev/null
+From 83a35114d0e4583e6b0ca39502e68b6a92e2910c Mon Sep 17 00:00:00 2001
+From: Rusty Russell <rusty@rustcorp.com.au>
+Date: Wed, 27 May 2015 10:59:26 +0930
+Subject: lguest: fix out-by-one error in address checking.
+
+From: Rusty Russell <rusty@rustcorp.com.au>
+
+commit 83a35114d0e4583e6b0ca39502e68b6a92e2910c upstream.
+
+This bug has been there since day 1; addresses in the top guest physical
+page weren't considered valid. You could map that page (the check in
+check_gpte() is correct), but if a guest tried to put a pagetable there
+we'd check that address manually when walking it, and kill the guest.
+
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/lguest/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/lguest/core.c
++++ b/drivers/lguest/core.c
+@@ -176,7 +176,7 @@ static void unmap_switcher(void)
+ bool lguest_address_ok(const struct lguest *lg,
+ unsigned long addr, unsigned long len)
+ {
+- return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr);
++ return addr+len <= lg->pfn_limit * PAGE_SIZE && (addr+len >= addr);
+ }
+
+ /*
--- /dev/null
+From b0494532214bdfbf241e94fabab5dd46f7b82631 Mon Sep 17 00:00:00 2001
+From: Ilya Dryomov <idryomov@gmail.com>
+Date: Mon, 11 May 2015 17:53:10 +0300
+Subject: libceph: request a new osdmap if lingering request maps to no osd
+
+From: Ilya Dryomov <idryomov@gmail.com>
+
+commit b0494532214bdfbf241e94fabab5dd46f7b82631 upstream.
+
+This commit does two things. First, if there are any homeless
+lingering requests, we now request a new osdmap even if the osdmap that
+is being processed brought no changes, i.e. if a given lingering
+request turned homeless in one of the previous epochs and remained
+homeless in the current epoch. Not doing so leaves us with a stale
+osdmap and as a result we may miss our window for reestablishing the
+watch and lose notifies.
+
+MON=1 OSD=1:
+
+ # cat linger-needmap.sh
+ #!/bin/bash
+ rbd create --size 1 test
+ DEV=$(rbd map test)
+ ceph osd out 0
+ rbd map dne/dne # obtain a new osdmap as a side effect (!)
+ sleep 1
+ ceph osd in 0
+ rbd resize --size 2 test
+ # rbd info test | grep size -> 2M
+ # blockdev --getsize $DEV -> 1M
+
+N.B.: Not obtaining a new osdmap in between "osd out" and "osd in"
+above is enough to make it miss that resize notify, but that is a
+bug^Wlimitation of ceph watch/notify v1.
+
+Second, homeless lingering requests are now kicked just like those
+lingering requests whose mapping has changed. This is mainly to
+recognize that a homeless lingering request makes no sense and to
+preserve the invariant that a registered lingering request is not
+sitting on any of r_req_lru_item lists. This spares us a WARN_ON,
+which commit ba9d114ec557 ("libceph: clear r_req_lru_item in
+__unregister_linger_request()") tried to fix the _wrong_ way.
+
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Reviewed-by: Sage Weil <sage@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ceph/osd_client.c | 31 ++++++++++++++++++++-----------
+ 1 file changed, 20 insertions(+), 11 deletions(-)
+
+--- a/net/ceph/osd_client.c
++++ b/net/ceph/osd_client.c
+@@ -1932,20 +1932,29 @@ static void kick_requests(struct ceph_os
+ err = __map_request(osdc, req,
+ force_resend || force_resend_writes);
+ dout("__map_request returned %d\n", err);
+- if (err == 0)
+- continue; /* no change and no osd was specified */
+ if (err < 0)
+ continue; /* hrm! */
+- if (req->r_osd == NULL) {
+- dout("tid %llu maps to no valid osd\n", req->r_tid);
+- needmap++; /* request a newer map */
+- continue;
+- }
++ if (req->r_osd == NULL || err > 0) {
++ if (req->r_osd == NULL) {
++ dout("lingering %p tid %llu maps to no osd\n",
++ req, req->r_tid);
++ /*
++ * A homeless lingering request makes
++ * no sense, as it's job is to keep
++ * a particular OSD connection open.
++ * Request a newer map and kick the
++ * request, knowing that it won't be
++ * resent until we actually get a map
++ * that can tell us where to send it.
++ */
++ needmap++;
++ }
+
+- dout("kicking lingering %p tid %llu osd%d\n", req, req->r_tid,
+- req->r_osd ? req->r_osd->o_osd : -1);
+- __register_request(osdc, req);
+- __unregister_linger_request(osdc, req);
++ dout("kicking lingering %p tid %llu osd%d\n", req,
++ req->r_tid, req->r_osd ? req->r_osd->o_osd : -1);
++ __register_request(osdc, req);
++ __unregister_linger_request(osdc, req);
++ }
+ }
+ reset_changed_osds(osdc);
+ mutex_unlock(&osdc->request_mutex);
x86-fpu-disable-xsaves-support-for-now.patch
kvm-mmu-fix-cr4.smep-1-cr0.wp-0-with-shadow-pages.patch
net-socket-fix-the-wrong-returns-for-recvmsg-and-sendmsg.patch
+fs-omfs-add-null-terminator-in-the-end-up-the-token-list.patch
+xfs-xfs_iozero-can-return-positive-errno.patch
+lguest-fix-out-by-one-error-in-address-checking.patch
+libceph-request-a-new-osdmap-if-lingering-request-maps-to-no-osd.patch
+xen-events-don-t-bind-non-percpu-virqs-with-percpu-chip.patch
+hwmon-ntc_thermistor-ensure-iio-channel-is-of-type-iio_voltage.patch
+hwmon-nct6775-add-missing-sysfs-attribute-initialization.patch
--- /dev/null
+From 77bb3dfdc0d554befad58fdefbc41be5bc3ed38a Mon Sep 17 00:00:00 2001
+From: David Vrabel <david.vrabel@citrix.com>
+Date: Tue, 19 May 2015 18:40:49 +0100
+Subject: xen/events: don't bind non-percpu VIRQs with percpu chip
+
+From: David Vrabel <david.vrabel@citrix.com>
+
+commit 77bb3dfdc0d554befad58fdefbc41be5bc3ed38a upstream.
+
+A non-percpu VIRQ (e.g., VIRQ_CONSOLE) may be freed on a different
+VCPU than it is bound to. This can result in a race between
+handle_percpu_irq() and removing the action in __free_irq() because
+handle_percpu_irq() does not take desc->lock. The interrupt handler
+sees a NULL action and oopses.
+
+Only use the percpu chip/handler for per-CPU VIRQs (like VIRQ_TIMER).
+
+ # cat /proc/interrupts | grep virq
+ 40: 87246 0 xen-percpu-virq timer0
+ 44: 0 0 xen-percpu-virq debug0
+ 47: 0 20995 xen-percpu-virq timer1
+ 51: 0 0 xen-percpu-virq debug1
+ 69: 0 0 xen-dyn-virq xen-pcpu
+ 74: 0 0 xen-dyn-virq mce
+ 75: 29 0 xen-dyn-virq hvc_console
+
+Signed-off-by: David Vrabel <david.vrabel@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/hvc/hvc_xen.c | 2 +-
+ drivers/xen/events/events_base.c | 12 ++++++++----
+ include/xen/events.h | 2 +-
+ 3 files changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/tty/hvc/hvc_xen.c
++++ b/drivers/tty/hvc/hvc_xen.c
+@@ -289,7 +289,7 @@ static int xen_initial_domain_console_in
+ return -ENOMEM;
+ }
+
+- info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0);
++ info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0, false);
+ info->vtermno = HVC_COOKIE;
+
+ spin_lock(&xencons_lock);
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -973,7 +973,7 @@ unsigned xen_evtchn_nr_channels(void)
+ }
+ EXPORT_SYMBOL_GPL(xen_evtchn_nr_channels);
+
+-int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
++int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu)
+ {
+ struct evtchn_bind_virq bind_virq;
+ int evtchn, irq, ret;
+@@ -987,8 +987,12 @@ int bind_virq_to_irq(unsigned int virq,
+ if (irq < 0)
+ goto out;
+
+- irq_set_chip_and_handler_name(irq, &xen_percpu_chip,
+- handle_percpu_irq, "virq");
++ if (percpu)
++ irq_set_chip_and_handler_name(irq, &xen_percpu_chip,
++ handle_percpu_irq, "virq");
++ else
++ irq_set_chip_and_handler_name(irq, &xen_dynamic_chip,
++ handle_edge_irq, "virq");
+
+ bind_virq.virq = virq;
+ bind_virq.vcpu = cpu;
+@@ -1078,7 +1082,7 @@ int bind_virq_to_irqhandler(unsigned int
+ {
+ int irq, retval;
+
+- irq = bind_virq_to_irq(virq, cpu);
++ irq = bind_virq_to_irq(virq, cpu, irqflags & IRQF_PERCPU);
+ if (irq < 0)
+ return irq;
+ retval = request_irq(irq, handler, irqflags, devname, dev_id);
+--- a/include/xen/events.h
++++ b/include/xen/events.h
+@@ -14,7 +14,7 @@ int bind_evtchn_to_irqhandler(unsigned i
+ irq_handler_t handler,
+ unsigned long irqflags, const char *devname,
+ void *dev_id);
+-int bind_virq_to_irq(unsigned int virq, unsigned int cpu);
++int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu);
+ int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu,
+ irq_handler_t handler,
+ unsigned long irqflags, const char *devname,
--- /dev/null
+From cddc116228cb9d51d3224d23ba3e61fbbc3ec3d2 Mon Sep 17 00:00:00 2001
+From: Dave Chinner <dchinner@redhat.com>
+Date: Fri, 29 May 2015 07:40:32 +1000
+Subject: xfs: xfs_iozero can return positive errno
+
+From: Dave Chinner <dchinner@redhat.com>
+
+commit cddc116228cb9d51d3224d23ba3e61fbbc3ec3d2 upstream.
+
+It was missed when we converted everything in XFs to use negative error
+numbers, so fix it now. Bug introduced in 3.17 by commit 2451337 ("xfs: global
+error sign conversion"), and should go back to stable kernels.
+
+Thanks to Brian Foster for noticing it.
+
+Signed-off-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Brian Foster <bfoster@redhat.com>
+Signed-off-by: Dave Chinner <david@fromorbit.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/xfs/xfs_file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/xfs/xfs_file.c
++++ b/fs/xfs/xfs_file.c
+@@ -126,7 +126,7 @@ xfs_iozero(
+ status = 0;
+ } while (count);
+
+- return (-status);
++ return status;
+ }
+
+ /*
projects / thirdparty / kernel / stable-queue.git / commitdiff
