--- /dev/null
+From 40384e4bbeb9f2651fe9bffc0062d9f31ef625bf Mon Sep 17 00:00:00 2001
+From: "K. Y. Srinivasan" <kys@microsoft.com>
+Date: Fri, 27 Feb 2015 11:26:04 -0800
+Subject: Drivers: hv: vmbus: Fix a bug in the error path in vmbus_open()
+
+From: "K. Y. Srinivasan" <kys@microsoft.com>
+
+commit 40384e4bbeb9f2651fe9bffc0062d9f31ef625bf upstream.
+
+Correctly rollback state if the failure occurs after we have handed over
+the ownership of the buffer to the host.
+
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hv/channel.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/hv/channel.c
++++ b/drivers/hv/channel.c
+@@ -169,7 +169,7 @@ int vmbus_open(struct vmbus_channel *new
+ GFP_KERNEL);
+ if (!open_info) {
+ err = -ENOMEM;
+- goto error0;
++ goto error_gpadl;
+ }
+
+ init_completion(&open_info->waitevent);
+@@ -185,7 +185,7 @@ int vmbus_open(struct vmbus_channel *new
+
+ if (userdatalen > MAX_USER_DEFINED_BYTES) {
+ err = -EINVAL;
+- goto error0;
++ goto error_gpadl;
+ }
+
+ if (userdatalen)
+@@ -226,6 +226,9 @@ error1:
+ list_del(&open_info->msglistentry);
+ spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
+
++error_gpadl:
++ vmbus_teardown_gpadl(newchannel, newchannel->ringbuffer_gpadlhandle);
++
+ error0:
+ free_pages((unsigned long)out,
+ get_order(send_ringbuffer_size + recv_ringbuffer_size));
--- /dev/null
+From c1c21f4e60ed4523292f1a89ff45a208bddd3849 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@kernel.org>
+Date: Wed, 15 Apr 2015 19:18:39 +0100
+Subject: i2c: core: Export bus recovery functions
+
+From: Mark Brown <broonie@kernel.org>
+
+commit c1c21f4e60ed4523292f1a89ff45a208bddd3849 upstream.
+
+Current -next fails to link an ARM allmodconfig because drivers that use
+the core recovery functions can be built as modules but those functions
+are not exported:
+
+ERROR: "i2c_generic_gpio_recovery" [drivers/i2c/busses/i2c-davinci.ko] undefined!
+ERROR: "i2c_generic_scl_recovery" [drivers/i2c/busses/i2c-davinci.ko] undefined!
+ERROR: "i2c_recover_bus" [drivers/i2c/busses/i2c-davinci.ko] undefined!
+
+Add exports to fix this.
+
+Fixes: 5f9296ba21b3c (i2c: Add bus recovery infrastructure)
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/i2c-core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/i2c/i2c-core.c
++++ b/drivers/i2c/i2c-core.c
+@@ -206,6 +206,7 @@ int i2c_generic_scl_recovery(struct i2c_
+ adap->bus_recovery_info->set_scl(adap, 1);
+ return i2c_generic_recovery(adap);
+ }
++EXPORT_SYMBOL_GPL(i2c_generic_scl_recovery);
+
+ int i2c_generic_gpio_recovery(struct i2c_adapter *adap)
+ {
+@@ -220,6 +221,7 @@ int i2c_generic_gpio_recovery(struct i2c
+
+ return ret;
+ }
++EXPORT_SYMBOL_GPL(i2c_generic_gpio_recovery);
+
+ int i2c_recover_bus(struct i2c_adapter *adap)
+ {
+@@ -229,6 +231,7 @@ int i2c_recover_bus(struct i2c_adapter *
+ dev_dbg(&adap->dev, "Trying i2c bus recovery\n");
+ return adap->bus_recovery_info->recover_bus(adap);
+ }
++EXPORT_SYMBOL_GPL(i2c_recover_bus);
+
+ static int i2c_device_probe(struct device *dev)
+ {
--- /dev/null
+From 8abaae62f3fdead8f4ce0ab46b4ab93dee39bab2 Mon Sep 17 00:00:00 2001
+From: Yann Droneaud <ydroneaud@opteya.com>
+Date: Mon, 13 Apr 2015 14:56:22 +0200
+Subject: IB/core: disallow registering 0-sized memory region
+
+From: Yann Droneaud <ydroneaud@opteya.com>
+
+commit 8abaae62f3fdead8f4ce0ab46b4ab93dee39bab2 upstream.
+
+If ib_umem_get() is called with a size equal to 0 and an
+non-page aligned address, one page will be pinned and a
+0-sized umem will be returned to the caller.
+
+This should not be allowed: it's not expected for a memory
+region to have a size equal to 0.
+
+This patch adds a check to explicitly refuse to register
+a 0-sized region.
+
+Link: http://mid.gmane.org/cover.1428929103.git.ydroneaud@opteya.com
+Cc: Shachar Raindel <raindel@mellanox.com>
+Cc: Jack Morgenstein <jackm@mellanox.com>
+Cc: Or Gerlitz <ogerlitz@mellanox.com>
+Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/umem.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/infiniband/core/umem.c
++++ b/drivers/infiniband/core/umem.c
+@@ -94,6 +94,9 @@ struct ib_umem *ib_umem_get(struct ib_uc
+ if (dmasync)
+ dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
+
++ if (!size)
++ return ERR_PTR(-EINVAL);
++
+ /*
+ * If the combination of the addr and size requested for this memory
+ * region causes an integer overflow, return error.
--- /dev/null
+From 66578b0b2f69659f00b6169e6fe7377c4b100d18 Mon Sep 17 00:00:00 2001
+From: Yann Droneaud <ydroneaud@opteya.com>
+Date: Mon, 13 Apr 2015 14:56:23 +0200
+Subject: IB/core: don't disallow registering region starting at 0x0
+
+From: Yann Droneaud <ydroneaud@opteya.com>
+
+commit 66578b0b2f69659f00b6169e6fe7377c4b100d18 upstream.
+
+In a call to ib_umem_get(), if address is 0x0 and size is
+already page aligned, check added in commit 8494057ab5e4
+("IB/uverbs: Prevent integer overflow in ib_umem_get address
+arithmetic") will refuse to register a memory region that
+could otherwise be valid (provided vm.mmap_min_addr sysctl
+and mmap_low_allowed SELinux knobs allow userspace to map
+something at address 0x0).
+
+This patch allows back such registration: ib_umem_get()
+should probably don't care of the base address provided it
+can be pinned with get_user_pages().
+
+There's two possible overflows, in (addr + size) and in
+PAGE_ALIGN(addr + size), this patch keep ensuring none
+of them happen while allowing to pin memory at address
+0x0. Anyway, the case of size equal 0 is no more (partially)
+handled as 0-length memory region are disallowed by an
+earlier check.
+
+Link: http://mid.gmane.org/cover.1428929103.git.ydroneaud@opteya.com
+Cc: Shachar Raindel <raindel@mellanox.com>
+Cc: Jack Morgenstein <jackm@mellanox.com>
+Cc: Or Gerlitz <ogerlitz@mellanox.com>
+Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
+Reviewed-by: Sagi Grimberg <sagig@mellanox.com>
+Reviewed-by: Haggai Eran <haggaie@mellanox.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/umem.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/core/umem.c
++++ b/drivers/infiniband/core/umem.c
+@@ -101,8 +101,8 @@ struct ib_umem *ib_umem_get(struct ib_uc
+ * If the combination of the addr and size requested for this memory
+ * region causes an integer overflow, return error.
+ */
+- if ((PAGE_ALIGN(addr + size) <= size) ||
+- (PAGE_ALIGN(addr + size) <= addr))
++ if (((addr + size) < addr) ||
++ PAGE_ALIGN(addr + size) < (addr + size))
+ return ERR_PTR(-EINVAL);
+
+ if (!can_do_mlock())
--- /dev/null
+From ca9b590caa17bcbbea119594992666e96cde9c2f Mon Sep 17 00:00:00 2001
+From: Erez Shitrit <erezsh@mellanox.com>
+Date: Thu, 2 Apr 2015 13:39:05 +0300
+Subject: IB/mlx4: Fix WQE LSO segment calculation
+
+From: Erez Shitrit <erezsh@mellanox.com>
+
+commit ca9b590caa17bcbbea119594992666e96cde9c2f upstream.
+
+The current code decreases from the mss size (which is the gso_size
+from the kernel skb) the size of the packet headers.
+
+It shouldn't do that because the mss that comes from the stack
+(e.g IPoIB) includes only the tcp payload without the headers.
+
+The result is indication to the HW that each packet that the HW sends
+is smaller than what it could be, and too many packets will be sent
+for big messages.
+
+An easy way to demonstrate one more aspect of the problem is by
+configuring the ipoib mtu to be less than 2*hlen (2*56) and then
+run app sending big TCP messages. This will tell the HW to send packets
+with giant (negative value which under unsigned arithmetics becomes
+a huge positive one) length and the QP moves to SQE state.
+
+Fixes: b832be1e4007 ('IB/mlx4: Add IPoIB LSO support')
+Reported-by: Matthew Finlay <matt@mellanox.com>
+Signed-off-by: Erez Shitrit <erezsh@mellanox.com>
+Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx4/qp.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -2174,8 +2174,7 @@ static int build_lso_seg(struct mlx4_wqe
+
+ memcpy(wqe->header, wr->wr.ud.header, wr->wr.ud.hlen);
+
+- *lso_hdr_sz = cpu_to_be32((wr->wr.ud.mss - wr->wr.ud.hlen) << 16 |
+- wr->wr.ud.hlen);
++ *lso_hdr_sz = cpu_to_be32(wr->wr.ud.mss << 16 | wr->wr.ud.hlen);
+ *lso_seg_len = halign;
+ return 0;
+ }
--- /dev/null
+From 56cbd0ccc1b508de19561211d7ab9e1c77e6b384 Mon Sep 17 00:00:00 2001
+From: James Bottomley <JBottomley@Odin.com>
+Date: Wed, 15 Apr 2015 22:16:01 -0700
+Subject: mvsas: fix panic on expander attached SATA devices
+
+From: James Bottomley <JBottomley@Odin.com>
+
+commit 56cbd0ccc1b508de19561211d7ab9e1c77e6b384 upstream.
+
+mvsas is giving a General protection fault when it encounters an expander
+attached ATA device. Analysis of mvs_task_prep_ata() shows that the driver is
+assuming all ATA devices are locally attached and obtaining the phy mask by
+indexing the local phy table (in the HBA structure) with the phy id. Since
+expanders have many more phys than the HBA, this is causing the index into the
+HBA phy table to overflow and returning rubbish as the pointer.
+
+mvs_task_prep_ssp() instead does the phy mask using the port properties.
+Mirror this in mvs_task_prep_ata() to fix the panic.
+
+Reported-by: Adam Talbot <ajtalbot1@gmail.com>
+Tested-by: Adam Talbot <ajtalbot1@gmail.com>
+Signed-off-by: James Bottomley <JBottomley@Odin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/mvsas/mv_sas.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/drivers/scsi/mvsas/mv_sas.c
++++ b/drivers/scsi/mvsas/mv_sas.c
+@@ -441,14 +441,11 @@ static u32 mvs_get_ncq_tag(struct sas_ta
+ static int mvs_task_prep_ata(struct mvs_info *mvi,
+ struct mvs_task_exec_info *tei)
+ {
+- struct sas_ha_struct *sha = mvi->sas;
+ struct sas_task *task = tei->task;
+ struct domain_device *dev = task->dev;
+ struct mvs_device *mvi_dev = dev->lldd_dev;
+ struct mvs_cmd_hdr *hdr = tei->hdr;
+ struct asd_sas_port *sas_port = dev->port;
+- struct sas_phy *sphy = dev->phy;
+- struct asd_sas_phy *sas_phy = sha->sas_phy[sphy->number];
+ struct mvs_slot_info *slot;
+ void *buf_prd;
+ u32 tag = tei->tag, hdr_tag;
+@@ -468,7 +465,7 @@ static int mvs_task_prep_ata(struct mvs_
+ slot->tx = mvi->tx_prod;
+ del_q = TXQ_MODE_I | tag |
+ (TXQ_CMD_STP << TXQ_CMD_SHIFT) |
+- (MVS_PHY_ID << TXQ_PHY_SHIFT) |
++ ((sas_port->phy_mask & TXQ_PHY_MASK) << TXQ_PHY_SHIFT) |
+ (mvi_dev->taskfileset << TXQ_SRS_SHIFT);
+ mvi->tx[mvi->tx_prod] = cpu_to_le32(del_q);
+
xtensa-xtfpga-fix-hardware-lockup-caused-by-lcd-driver.patch
xtensa-provide-__nr_sync_file_range2-instead-of-__nr_sync_file_range.patch
gpio-mvebu-fix-mask-unmask-managment-per-irq-chip-type.patch
+drivers-hv-vmbus-fix-a-bug-in-the-error-path-in-vmbus_open.patch
+mvsas-fix-panic-on-expander-attached-sata-devices.patch
+stk1160-make-sure-current-buffer-is-released.patch
+ib-core-disallow-registering-0-sized-memory-region.patch
+ib-core-don-t-disallow-registering-region-starting-at-0x0.patch
+ib-mlx4-fix-wqe-lso-segment-calculation.patch
+tracing-handle-ftrace_dump-atomic-context-in-graph_trace_open.patch
+i2c-core-export-bus-recovery-functions.patch
--- /dev/null
+From aeff09276748b66072f2db2e668cec955cf41959 Mon Sep 17 00:00:00 2001
+From: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
+Date: Tue, 10 Mar 2015 11:37:14 -0300
+Subject: [media] stk1160: Make sure current buffer is released
+
+From: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
+
+commit aeff09276748b66072f2db2e668cec955cf41959 upstream.
+
+The available (i.e. not used) buffers are returned by stk1160_clear_queue(),
+on the stop_streaming() path. However, this is insufficient and the current
+buffer must be released as well. Fix it.
+
+Signed-off-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/stk1160/stk1160-v4l.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/usb/stk1160/stk1160-v4l.c
++++ b/drivers/media/usb/stk1160/stk1160-v4l.c
+@@ -245,6 +245,11 @@ static int stk1160_stop_streaming(struct
+ if (mutex_lock_interruptible(&dev->v4l_lock))
+ return -ERESTARTSYS;
+
++ /*
++ * Once URBs are cancelled, the URB complete handler
++ * won't be running. This is required to safely release the
++ * current buffer (dev->isoc_ctl.buf).
++ */
+ stk1160_cancel_isoc(dev);
+
+ /*
+@@ -665,8 +670,16 @@ void stk1160_clear_queue(struct stk1160
+ stk1160_info("buffer [%p/%d] aborted\n",
+ buf, buf->vb.v4l2_buf.index);
+ }
+- /* It's important to clear current buffer */
+- dev->isoc_ctl.buf = NULL;
++
++ /* It's important to release the current buffer */
++ if (dev->isoc_ctl.buf) {
++ buf = dev->isoc_ctl.buf;
++ dev->isoc_ctl.buf = NULL;
++
++ vb2_buffer_done(&buf->vb, VB2_BUF_STATE_ERROR);
++ stk1160_info("buffer [%p/%d] aborted\n",
++ buf, buf->vb.v4l2_buf.index);
++ }
+ spin_unlock_irqrestore(&dev->buf_lock, flags);
+ }
+
--- /dev/null
+From ef99b88b16bee753fa51207abdc58ae660453ec6 Mon Sep 17 00:00:00 2001
+From: Rabin Vincent <rabin@rab.in>
+Date: Mon, 13 Apr 2015 22:30:12 +0200
+Subject: tracing: Handle ftrace_dump() atomic context in graph_trace_open()
+
+From: Rabin Vincent <rabin@rab.in>
+
+commit ef99b88b16bee753fa51207abdc58ae660453ec6 upstream.
+
+graph_trace_open() can be called in atomic context from ftrace_dump().
+Use GFP_ATOMIC for the memory allocations when that's the case, in order
+to avoid the following splat.
+
+ BUG: sleeping function called from invalid context at mm/slab.c:2849
+ in_atomic(): 1, irqs_disabled(): 128, pid: 0, name: swapper/0
+ Backtrace:
+ ..
+ [<8004dc94>] (__might_sleep) from [<801371f4>] (kmem_cache_alloc_trace+0x160/0x238)
+ r7:87800040 r6:000080d0 r5:810d16e8 r4:000080d0
+ [<80137094>] (kmem_cache_alloc_trace) from [<800cbd60>] (graph_trace_open+0x30/0xd0)
+ r10:00000100 r9:809171a8 r8:00008e28 r7:810d16f0 r6:00000001 r5:810d16e8
+ r4:810d16f0
+ [<800cbd30>] (graph_trace_open) from [<800c79c4>] (trace_init_global_iter+0x50/0x9c)
+ r8:00008e28 r7:808c853c r6:00000001 r5:810d16e8 r4:810d16f0 r3:800cbd30
+ [<800c7974>] (trace_init_global_iter) from [<800c7aa0>] (ftrace_dump+0x90/0x2ec)
+ r4:810d2580 r3:00000000
+ [<800c7a10>] (ftrace_dump) from [<80414b2c>] (sysrq_ftrace_dump+0x1c/0x20)
+ r10:00000100 r9:809171a8 r8:808f6e7c r7:00000001 r6:00000007 r5:0000007a
+ r4:808d5394
+ [<80414b10>] (sysrq_ftrace_dump) from [<800169b8>] (return_to_handler+0x0/0x18)
+ [<80415498>] (__handle_sysrq) from [<800169b8>] (return_to_handler+0x0/0x18)
+ r8:808c8100 r7:808c8444 r6:00000101 r5:00000010 r4:84eb3210
+ [<80415668>] (handle_sysrq) from [<800169b8>] (return_to_handler+0x0/0x18)
+ [<8042a760>] (pl011_int) from [<800169b8>] (return_to_handler+0x0/0x18)
+ r10:809171bc r9:809171a8 r8:00000001 r7:00000026 r6:808c6000 r5:84f01e60
+ r4:8454fe00
+ [<8007782c>] (handle_irq_event_percpu) from [<80077b44>] (handle_irq_event+0x4c/0x6c)
+ r10:808c7ef0 r9:87283e00 r8:00000001 r7:00000000 r6:8454fe00 r5:84f01e60
+ r4:84f01e00
+ [<80077af8>] (handle_irq_event) from [<8007aa28>] (handle_fasteoi_irq+0xf0/0x1ac)
+ r6:808f52a4 r5:84f01e60 r4:84f01e00 r3:00000000
+ [<8007a938>] (handle_fasteoi_irq) from [<80076dc0>] (generic_handle_irq+0x3c/0x4c)
+ r6:00000026 r5:00000000 r4:00000026 r3:8007a938
+ [<80076d84>] (generic_handle_irq) from [<80077128>] (__handle_domain_irq+0x8c/0xfc)
+ r4:808c1e38 r3:0000002e
+ [<8007709c>] (__handle_domain_irq) from [<800087b8>] (gic_handle_irq+0x34/0x6c)
+ r10:80917748 r9:00000001 r8:88802100 r7:808c7ef0 r6:808c8fb0 r5:00000015
+ r4:8880210c r3:808c7ef0
+ [<80008784>] (gic_handle_irq) from [<80014044>] (__irq_svc+0x44/0x7c)
+
+Link: http://lkml.kernel.org/r/1428953721-31349-1-git-send-email-rabin@rab.in
+Link: http://lkml.kernel.org/r/1428957012-2319-1-git-send-email-rabin@rab.in
+
+Signed-off-by: Rabin Vincent <rabin@rab.in>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/trace_functions_graph.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/kernel/trace/trace_functions_graph.c
++++ b/kernel/trace/trace_functions_graph.c
+@@ -1382,15 +1382,19 @@ void graph_trace_open(struct trace_itera
+ {
+ /* pid and depth on the last trace processed */
+ struct fgraph_data *data;
++ gfp_t gfpflags;
+ int cpu;
+
+ iter->private = NULL;
+
+- data = kzalloc(sizeof(*data), GFP_KERNEL);
++ /* We can be called in atomic context via ftrace_dump() */
++ gfpflags = (in_atomic() || irqs_disabled()) ? GFP_ATOMIC : GFP_KERNEL;
++
++ data = kzalloc(sizeof(*data), gfpflags);
+ if (!data)
+ goto out_err;
+
+- data->cpu_data = alloc_percpu(struct fgraph_cpu_data);
++ data->cpu_data = alloc_percpu_gfp(struct fgraph_cpu_data, gfpflags);
+ if (!data->cpu_data)
+ goto out_err_free;
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
