--- /dev/null
+From 56dc66ff1c6d71f9a38c4a7c000b72b921fe4c89 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 10 Mar 2016 11:33:43 +0100
+Subject: ALSA: hda - Apply reboot D3 fix for CX20724 codec, too
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 56dc66ff1c6d71f9a38c4a7c000b72b921fe4c89 upstream.
+
+Just like CX20722, CX7024 codec also requires the power down at reboot
+in order to reduce the noise at reboot/shutdown.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=113511
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_conexant.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -204,8 +204,13 @@ static void cx_auto_reboot_notify(struct
+ {
+ struct conexant_spec *spec = codec->spec;
+
+- if (codec->core.vendor_id != 0x14f150f2)
++ switch (codec->core.vendor_id) {
++ case 0x14f150f2: /* CX20722 */
++ case 0x14f150f4: /* CX20724 */
++ break;
++ default:
+ return;
++ }
+
+ /* Turn the CX20722 codec into D3 to avoid spurious noises
+ from the internal speaker during (and after) reboot */
--- /dev/null
+From 4f8e4f3537cafc4de128e6bfdf83baa78bc60eb1 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 10 Mar 2016 12:02:49 +0100
+Subject: ALSA: hda - Don't handle ELD notify from invalid port
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 4f8e4f3537cafc4de128e6bfdf83baa78bc60eb1 upstream.
+
+The current Intel HDMI codec driver supports only three fixed ports
+from port B to port D. However, i915 driver may assign a DP on other
+ports, e.g. port A, when no eDP is used. This incompatibility is
+caught later at pin_nid_to_pin_index() and results in a warning
+message like "HDMI: pin nid 4 not registered" at each time.
+
+This patch filters out such invalid events beforehand, so that the
+kernel won't be too grumbling.
+
+Reported-by: Stefan Assmann <sassmann@kpanic.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_hdmi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2353,6 +2353,10 @@ static void intel_pin_eld_notify(void *a
+ struct hda_codec *codec = audio_ptr;
+ int pin_nid = port + 0x04;
+
++ /* we assume only from port-B to port-D */
++ if (port < 1 || port > 3)
++ return;
++
+ /* skip notification during system suspend (but not in runtime PM);
+ * the state will be updated at resume
+ */
--- /dev/null
+From 6ef2f68fa38bf415830f67903d87180d933e0f47 Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Fri, 11 Mar 2016 12:04:02 +0800
+Subject: ALSA: hda - fix the mic mute button and led problem for a Lenovo AIO
+
+From: Hui Wang <hui.wang@canonical.com>
+
+commit 6ef2f68fa38bf415830f67903d87180d933e0f47 upstream.
+
+This Lenovo ThinkCentre AIO also uses Line2 as mic mute button and
+uses GPIO2 to control the mic mute led, so applying this quirk can
+make both the button and led work.
+
+BugLink: https://bugs.launchpad.net/bugs/1555912
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5529,6 +5529,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE),
+ SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
++ SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
+ SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),
--- /dev/null
+From 1f7c6658962fa1260c1658d681bd6bb0c746b99a Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 15 Mar 2016 16:44:55 +0100
+Subject: ALSA: hda - Fix unconditional GPIO toggle via automute
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 1f7c6658962fa1260c1658d681bd6bb0c746b99a upstream.
+
+Cirrus HD-audio driver may adjust GPIO pins for EAPD dynamically
+depending on the jack plug state. This works fine for the auto-mute
+mode where the speaker gets muted upon the HP jack plug. OTOH, when
+the auto-mute mode is off, this turns off the EAPD unexpectedly
+depending on the jack state, which results in the silent speaker
+output.
+
+This patch fixes the silent speaker output issue by setting GPIO bits
+constantly when the auto-mute mode is off.
+
+Reported-and-tested-by: moosotc@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_cirrus.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -174,8 +174,12 @@ static void cs_automute(struct hda_codec
+ snd_hda_gen_update_outputs(codec);
+
+ if (spec->gpio_eapd_hp || spec->gpio_eapd_speaker) {
+- spec->gpio_data = spec->gen.hp_jack_present ?
+- spec->gpio_eapd_hp : spec->gpio_eapd_speaker;
++ if (spec->gen.automute_speaker)
++ spec->gpio_data = spec->gen.hp_jack_present ?
++ spec->gpio_eapd_hp : spec->gpio_eapd_speaker;
++ else
++ spec->gpio_data =
++ spec->gpio_eapd_hp | spec->gpio_eapd_speaker;
+ snd_hda_codec_write(codec, 0x01, 0,
+ AC_VERB_SET_GPIO_DATA, spec->gpio_data);
+ }
--- /dev/null
+From 4061db03dd71d195b9973ee466f6ed32f6a3fc16 Mon Sep 17 00:00:00 2001
+From: "Vittorio Gambaletta (VittGam)" <linuxbugs@vittgam.net>
+Date: Sun, 13 Mar 2016 22:19:34 +0100
+Subject: ALSA: intel8x0: Add clock quirk entry for AD1981B on IBM ThinkPad X41.
+
+From: Vittorio Gambaletta (VittGam) <linuxbugs@vittgam.net>
+
+commit 4061db03dd71d195b9973ee466f6ed32f6a3fc16 upstream.
+
+The clock measurement on the AC'97 audio card found in the IBM ThinkPad X41
+will often fail, so add a quirk entry to fix it.
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=441087
+Signed-off-by: Vittorio Gambaletta <linuxbugs@vittgam.net>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/intel8x0.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/intel8x0.c
++++ b/sound/pci/intel8x0.c
+@@ -2879,6 +2879,7 @@ static void intel8x0_measure_ac97_clock(
+
+ static struct snd_pci_quirk intel8x0_clock_list[] = {
+ SND_PCI_QUIRK(0x0e11, 0x008a, "AD1885", 41000),
++ SND_PCI_QUIRK(0x1014, 0x0581, "AD1981B", 48000),
+ SND_PCI_QUIRK(0x1028, 0x00be, "AD1885", 44100),
+ SND_PCI_QUIRK(0x1028, 0x0177, "AD1980", 48000),
+ SND_PCI_QUIRK(0x1028, 0x01ad, "AD1981B", 48000),
--- /dev/null
+From 0ab1ace856205d10cbc1924b2d931c01ffd216a6 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 10 Mar 2016 20:56:20 +0100
+Subject: ALSA: pcm: Avoid "BUG:" string for warnings again
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 0ab1ace856205d10cbc1924b2d931c01ffd216a6 upstream.
+
+The commit [d507941beb1e: ALSA: pcm: Correct PCM BUG error message]
+made the warning prefix back to "BUG:" due to its previous wrong
+prefix. But a kernel message containing "BUG:" seems taken as an Oops
+message wrongly by some brain-dead daemons, and it annoys users in the
+end. Instead of teaching daemons, change the string again to a more
+reasonable one.
+
+Fixes: 507941beb1e ('ALSA: pcm: Correct PCM BUG error message')
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/pcm_lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -322,7 +322,7 @@ static int snd_pcm_update_hw_ptr0(struct
+ char name[16];
+ snd_pcm_debug_name(substream, name, sizeof(name));
+ pcm_err(substream->pcm,
+- "BUG: %s, pos = %ld, buffer size = %ld, period size = %ld\n",
++ "invalid position: %s, pos = %ld, buffer size = %ld, period size = %ld\n",
+ name, pos, runtime->buffer_size,
+ runtime->period_size);
+ }
--- /dev/null
+From 9b299728ed777428b3908ac72ace5f8f84b97789 Mon Sep 17 00:00:00 2001
+From: Eric Wheeler <git@linux.ewheeler.net>
+Date: Fri, 26 Feb 2016 14:33:56 -0800
+Subject: bcache: cleaned up error handling around register_cache()
+
+From: Eric Wheeler <git@linux.ewheeler.net>
+
+commit 9b299728ed777428b3908ac72ace5f8f84b97789 upstream.
+
+Fix null pointer dereference by changing register_cache() to return an int
+instead of being void. This allows it to return -ENOMEM or -ENODEV and
+enables upper layers to handle the OOM case without NULL pointer issues.
+
+See this thread:
+ http://thread.gmane.org/gmane.linux.kernel.bcache.devel/3521
+
+Fixes this error:
+ gargamel:/sys/block/md5/bcache# echo /dev/sdh2 > /sys/fs/bcache/register
+
+ bcache: register_cache() error opening sdh2: cannot allocate memory
+ BUG: unable to handle kernel NULL pointer dereference at 00000000000009b8
+ IP: [<ffffffffc05a7e8d>] cache_set_flush+0x102/0x15c [bcache]
+ PGD 120dff067 PUD 1119a3067 PMD 0
+ Oops: 0000 [#1] SMP
+ Modules linked in: veth ip6table_filter ip6_tables
+ (...)
+ CPU: 4 PID: 3371 Comm: kworker/4:3 Not tainted 4.4.2-amd64-i915-volpreempt-20160213bc1 #3
+ Hardware name: System manufacturer System Product Name/P8H67-M PRO, BIOS 3904 04/27/2013
+ Workqueue: events cache_set_flush [bcache]
+ task: ffff88020d5dc280 ti: ffff88020b6f8000 task.ti: ffff88020b6f8000
+ RIP: 0010:[<ffffffffc05a7e8d>] [<ffffffffc05a7e8d>] cache_set_flush+0x102/0x15c [bcache]
+
+Signed-off-by: Eric Wheeler <bcache@linux.ewheeler.net>
+Tested-by: Marc MERLIN <marc@merlins.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/bcache/super.c | 34 ++++++++++++++++++++++------------
+ 1 file changed, 22 insertions(+), 12 deletions(-)
+
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1828,11 +1828,12 @@ static int cache_alloc(struct cache_sb *
+ return 0;
+ }
+
+-static void register_cache(struct cache_sb *sb, struct page *sb_page,
++static int register_cache(struct cache_sb *sb, struct page *sb_page,
+ struct block_device *bdev, struct cache *ca)
+ {
+ char name[BDEVNAME_SIZE];
+- const char *err = "cannot allocate memory";
++ const char *err = NULL;
++ int ret = 0;
+
+ memcpy(&ca->sb, sb, sizeof(struct cache_sb));
+ ca->bdev = bdev;
+@@ -1847,27 +1848,35 @@ static void register_cache(struct cache_
+ if (blk_queue_discard(bdev_get_queue(ca->bdev)))
+ ca->discard = CACHE_DISCARD(&ca->sb);
+
+- if (cache_alloc(sb, ca) != 0)
++ ret = cache_alloc(sb, ca);
++ if (ret != 0)
+ goto err;
+
+- err = "error creating kobject";
+- if (kobject_add(&ca->kobj, &part_to_dev(bdev->bd_part)->kobj, "bcache"))
+- goto err;
++ if (kobject_add(&ca->kobj, &part_to_dev(bdev->bd_part)->kobj, "bcache")) {
++ err = "error calling kobject_add";
++ ret = -ENOMEM;
++ goto out;
++ }
+
+ mutex_lock(&bch_register_lock);
+ err = register_cache_set(ca);
+ mutex_unlock(&bch_register_lock);
+
+- if (err)
+- goto err;
++ if (err) {
++ ret = -ENODEV;
++ goto out;
++ }
+
+ pr_info("registered cache device %s", bdevname(bdev, name));
++
+ out:
+ kobject_put(&ca->kobj);
+- return;
++
+ err:
+- pr_notice("error opening %s: %s", bdevname(bdev, name), err);
+- goto out;
++ if (err)
++ pr_notice("error opening %s: %s", bdevname(bdev, name), err);
++
++ return ret;
+ }
+
+ /* Global interfaces/init */
+@@ -1965,7 +1974,8 @@ static ssize_t register_bcache(struct ko
+ if (!ca)
+ goto err_close;
+
+- register_cache(sb, sb_page, bdev, ca);
++ if (register_cache(sb, sb_page, bdev, ca) != 0)
++ goto err_close;
+ }
+ out:
+ if (sb_page)
--- /dev/null
+From f8b11260a445169989d01df75d35af0f56178f95 Mon Sep 17 00:00:00 2001
+From: Eric Wheeler <git@linux.ewheeler.net>
+Date: Mon, 7 Mar 2016 15:17:50 -0800
+Subject: bcache: fix cache_set_flush() NULL pointer dereference on OOM
+
+From: Eric Wheeler <git@linux.ewheeler.net>
+
+commit f8b11260a445169989d01df75d35af0f56178f95 upstream.
+
+When bch_cache_set_alloc() fails to kzalloc the cache_set, the
+asyncronous closure handling tries to dereference a cache_set that
+hadn't yet been allocated inside of cache_set_flush() which is called
+by __cache_set_unregister() during cleanup. This appears to happen only
+during an OOM condition on bcache_register.
+
+Signed-off-by: Eric Wheeler <bcache@linux.ewheeler.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/bcache/super.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1373,6 +1373,9 @@ static void cache_set_flush(struct closu
+ struct btree *b;
+ unsigned i;
+
++ if (!c)
++ closure_return(cl);
++
+ bch_cache_accounting_destroy(&c->accounting);
+
+ kobject_put(&c->internal);
--- /dev/null
+From 07cc6ef8edc47f8b4fc1e276d31127a0a5863d4d Mon Sep 17 00:00:00 2001
+From: Eric Wheeler <git@linux.ewheeler.net>
+Date: Fri, 26 Feb 2016 14:39:06 -0800
+Subject: bcache: fix race of writeback thread starting before complete initialization
+
+From: Eric Wheeler <git@linux.ewheeler.net>
+
+commit 07cc6ef8edc47f8b4fc1e276d31127a0a5863d4d upstream.
+
+The bch_writeback_thread might BUG_ON in read_dirty() if
+dc->sb==BDEV_STATE_DIRTY and bch_sectors_dirty_init has not yet completed
+its related initialization. This patch downs the dc->writeback_lock until
+after initialization is complete, thus preventing bch_writeback_thread
+from proceeding prematurely.
+
+See this thread:
+ http://thread.gmane.org/gmane.linux.kernel.bcache.devel/3453
+
+Signed-off-by: Eric Wheeler <bcache@linux.ewheeler.net>
+Tested-by: Marc MERLIN <marc@merlins.org>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/bcache/super.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1015,8 +1015,12 @@ int bch_cached_dev_attach(struct cached_
+ */
+ atomic_set(&dc->count, 1);
+
+- if (bch_cached_dev_writeback_start(dc))
++ /* Block writeback thread, but spawn it */
++ down_write(&dc->writeback_lock);
++ if (bch_cached_dev_writeback_start(dc)) {
++ up_write(&dc->writeback_lock);
+ return -ENOMEM;
++ }
+
+ if (BDEV_STATE(&dc->sb) == BDEV_STATE_DIRTY) {
+ bch_sectors_dirty_init(dc);
+@@ -1028,6 +1032,9 @@ int bch_cached_dev_attach(struct cached_
+ bch_cached_dev_run(dc);
+ bcache_device_link(&dc->disk, c, "bdev");
+
++ /* Allow the writeback thread to proceed */
++ up_write(&dc->writeback_lock);
++
+ pr_info("Caching %s as %s on set %pU",
+ bdevname(dc->bdev, buf), dc->disk.disk->disk_name,
+ dc->disk.c->sb.set_uuid);
--- /dev/null
+From 5e4298be45e83ecdffaabb370eea9396889b07f1 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+Date: Tue, 15 Dec 2015 16:38:22 +0100
+Subject: brd: Fix discard request processing
+
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+
+commit 5e4298be45e83ecdffaabb370eea9396889b07f1 upstream.
+
+Avoid that discard requests with size => PAGE_SIZE fail with
+-EIO. Refuse discard requests if the discard size is not a
+multiple of the page size.
+
+Fixes: 2dbe54957636 ("brd: Refuse improperly aligned discard requests")
+Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
+Reviewed-by: Jan Kara <jack@suse.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Robert Elliot <elliott@hp.com>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/brd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/block/brd.c
++++ b/drivers/block/brd.c
+@@ -338,7 +338,7 @@ static blk_qc_t brd_make_request(struct
+
+ if (unlikely(bio->bi_rw & REQ_DISCARD)) {
+ if (sector & ((PAGE_SIZE >> SECTOR_SHIFT) - 1) ||
+- bio->bi_iter.bi_size & PAGE_MASK)
++ bio->bi_iter.bi_size & ~PAGE_MASK)
+ goto io_error;
+ discard_from_brd(brd, sector, bio->bi_iter.bi_size);
+ goto out;
--- /dev/null
+From b0f84ac352762ed02d7ea9f284942a8cab7f9077 Mon Sep 17 00:00:00 2001
+From: "Luis R. Rodriguez" <mcgrof@kernel.org>
+Date: Thu, 17 Mar 2016 14:17:16 -0700
+Subject: ia64: define ioremap_uc()
+
+From: Luis R. Rodriguez <mcgrof@kernel.org>
+
+commit b0f84ac352762ed02d7ea9f284942a8cab7f9077 upstream.
+
+All architectures now need ioremap_uc(), ia64 seems defines this already
+through its ioremap_nocache() and it already ensures it *only* uses UC.
+
+This is needed since v4.3 to complete an allyesconfig compile on ia64,
+there were others archs that needed this, and this one seems to have
+fallen through the cracks.
+
+Signed-off-by: Luis R. Rodriguez <mcgrof@kernel.org>
+Reported-by: kbuild test robot <fengguang.wu@intel.com>
+Acked-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/ia64/include/asm/io.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/ia64/include/asm/io.h
++++ b/arch/ia64/include/asm/io.h
+@@ -436,6 +436,7 @@ static inline void __iomem * ioremap_cac
+ return ioremap(phys_addr, size);
+ }
+ #define ioremap_cache ioremap_cache
++#define ioremap_uc ioremap_nocache
+
+
+ /*
--- /dev/null
+From 51093254bf879bc9ce96590400a87897c7498463 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+Date: Thu, 11 Feb 2016 11:03:09 -0800
+Subject: IB/srpt: Simplify srpt_handle_tsk_mgmt()
+
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+
+commit 51093254bf879bc9ce96590400a87897c7498463 upstream.
+
+Let the target core check task existence instead of the SRP target
+driver. Additionally, let the target core check the validity of the
+task management request instead of the ib_srpt driver.
+
+This patch fixes the following kernel crash:
+
+BUG: unable to handle kernel NULL pointer dereference at 0000000000000001
+IP: [<ffffffffa0565f37>] srpt_handle_new_iu+0x6d7/0x790 [ib_srpt]
+Oops: 0002 [#1] SMP
+Call Trace:
+ [<ffffffffa05660ce>] srpt_process_completion+0xde/0x570 [ib_srpt]
+ [<ffffffffa056669f>] srpt_compl_thread+0x13f/0x160 [ib_srpt]
+ [<ffffffff8109726f>] kthread+0xcf/0xe0
+ [<ffffffff81613cfc>] ret_from_fork+0x7c/0xb0
+
+Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
+Fixes: 3e4f574857ee ("ib_srpt: Convert TMR path to target_submit_tmr")
+Tested-by: Alex Estrin <alex.estrin@intel.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Cc: Nicholas Bellinger <nab@linux-iscsi.org>
+Cc: Sagi Grimberg <sagig@mellanox.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/srpt/ib_srpt.c | 59 ----------------------------------
+ 1 file changed, 1 insertion(+), 58 deletions(-)
+
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -1737,47 +1737,6 @@ send_sense:
+ return -1;
+ }
+
+-/**
+- * srpt_rx_mgmt_fn_tag() - Process a task management function by tag.
+- * @ch: RDMA channel of the task management request.
+- * @fn: Task management function to perform.
+- * @req_tag: Tag of the SRP task management request.
+- * @mgmt_ioctx: I/O context of the task management request.
+- *
+- * Returns zero if the target core will process the task management
+- * request asynchronously.
+- *
+- * Note: It is assumed that the initiator serializes tag-based task management
+- * requests.
+- */
+-static int srpt_rx_mgmt_fn_tag(struct srpt_send_ioctx *ioctx, u64 tag)
+-{
+- struct srpt_device *sdev;
+- struct srpt_rdma_ch *ch;
+- struct srpt_send_ioctx *target;
+- int ret, i;
+-
+- ret = -EINVAL;
+- ch = ioctx->ch;
+- BUG_ON(!ch);
+- BUG_ON(!ch->sport);
+- sdev = ch->sport->sdev;
+- BUG_ON(!sdev);
+- spin_lock_irq(&sdev->spinlock);
+- for (i = 0; i < ch->rq_size; ++i) {
+- target = ch->ioctx_ring[i];
+- if (target->cmd.se_lun == ioctx->cmd.se_lun &&
+- target->cmd.tag == tag &&
+- srpt_get_cmd_state(target) != SRPT_STATE_DONE) {
+- ret = 0;
+- /* now let the target core abort &target->cmd; */
+- break;
+- }
+- }
+- spin_unlock_irq(&sdev->spinlock);
+- return ret;
+-}
+-
+ static int srp_tmr_to_tcm(int fn)
+ {
+ switch (fn) {
+@@ -1812,7 +1771,6 @@ static void srpt_handle_tsk_mgmt(struct
+ struct se_cmd *cmd;
+ struct se_session *sess = ch->sess;
+ uint64_t unpacked_lun;
+- uint32_t tag = 0;
+ int tcm_tmr;
+ int rc;
+
+@@ -1828,25 +1786,10 @@ static void srpt_handle_tsk_mgmt(struct
+ srpt_set_cmd_state(send_ioctx, SRPT_STATE_MGMT);
+ send_ioctx->cmd.tag = srp_tsk->tag;
+ tcm_tmr = srp_tmr_to_tcm(srp_tsk->tsk_mgmt_func);
+- if (tcm_tmr < 0) {
+- send_ioctx->cmd.se_tmr_req->response =
+- TMR_TASK_MGMT_FUNCTION_NOT_SUPPORTED;
+- goto fail;
+- }
+ unpacked_lun = srpt_unpack_lun((uint8_t *)&srp_tsk->lun,
+ sizeof(srp_tsk->lun));
+-
+- if (srp_tsk->tsk_mgmt_func == SRP_TSK_ABORT_TASK) {
+- rc = srpt_rx_mgmt_fn_tag(send_ioctx, srp_tsk->task_tag);
+- if (rc < 0) {
+- send_ioctx->cmd.se_tmr_req->response =
+- TMR_TASK_DOES_NOT_EXIST;
+- goto fail;
+- }
+- tag = srp_tsk->task_tag;
+- }
+ rc = target_submit_tmr(&send_ioctx->cmd, sess, NULL, unpacked_lun,
+- srp_tsk, tcm_tmr, GFP_KERNEL, tag,
++ srp_tsk, tcm_tmr, GFP_KERNEL, srp_tsk->task_tag,
+ TARGET_SCF_ACK_KREF);
+ if (rc != 0) {
+ send_ioctx->cmd.se_tmr_req->response = TMR_FUNCTION_REJECTED;
--- /dev/null
+From c0a2ad9b50dd80eeccd73d9ff962234590d5ec93 Mon Sep 17 00:00:00 2001
+From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Date: Wed, 9 Mar 2016 23:47:25 -0500
+Subject: jbd2: fix FS corruption possibility in jbd2_journal_destroy() on umount path
+
+From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+
+commit c0a2ad9b50dd80eeccd73d9ff962234590d5ec93 upstream.
+
+On umount path, jbd2_journal_destroy() writes latest transaction ID
+(->j_tail_sequence) to be used at next mount.
+
+The bug is that ->j_tail_sequence is not holding latest transaction ID
+in some cases. So, at next mount, there is chance to conflict with
+remaining (not overwritten yet) transactions.
+
+ mount (id=10)
+ write transaction (id=11)
+ write transaction (id=12)
+ umount (id=10) <= the bug doesn't write latest ID
+
+ mount (id=10)
+ write transaction (id=11)
+ crash
+
+ mount
+ [recovery process]
+ transaction (id=11)
+ transaction (id=12) <= valid transaction ID, but old commit
+ must not replay
+
+Like above, this bug become the cause of recovery failure, or FS
+corruption.
+
+So why ->j_tail_sequence doesn't point latest ID?
+
+Because if checkpoint transactions was reclaimed by memory pressure
+(i.e. bdev_try_to_free_page()), then ->j_tail_sequence is not updated.
+(And another case is, __jbd2_journal_clean_checkpoint_list() is called
+with empty transaction.)
+
+So in above cases, ->j_tail_sequence is not pointing latest
+transaction ID at umount path. Plus, REQ_FLUSH for checkpoint is not
+done too.
+
+So, to fix this problem with minimum changes, this patch updates
+->j_tail_sequence, and issue REQ_FLUSH. (With more complex changes,
+some optimizations would be possible to avoid unnecessary REQ_FLUSH
+for example though.)
+
+BTW,
+
+ journal->j_tail_sequence =
+ ++journal->j_transaction_sequence;
+
+Increment of ->j_transaction_sequence seems to be unnecessary, but
+ext3 does this.
+
+Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/jbd2/journal.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -1408,11 +1408,12 @@ out:
+ /**
+ * jbd2_mark_journal_empty() - Mark on disk journal as empty.
+ * @journal: The journal to update.
++ * @write_op: With which operation should we write the journal sb
+ *
+ * Update a journal's dynamic superblock fields to show that journal is empty.
+ * Write updated superblock to disk waiting for IO to complete.
+ */
+-static void jbd2_mark_journal_empty(journal_t *journal)
++static void jbd2_mark_journal_empty(journal_t *journal, int write_op)
+ {
+ journal_superblock_t *sb = journal->j_superblock;
+
+@@ -1430,7 +1431,7 @@ static void jbd2_mark_journal_empty(jour
+ sb->s_start = cpu_to_be32(0);
+ read_unlock(&journal->j_state_lock);
+
+- jbd2_write_superblock(journal, WRITE_FUA);
++ jbd2_write_superblock(journal, write_op);
+
+ /* Log is no longer empty */
+ write_lock(&journal->j_state_lock);
+@@ -1716,7 +1717,13 @@ int jbd2_journal_destroy(journal_t *jour
+ if (journal->j_sb_buffer) {
+ if (!is_journal_aborted(journal)) {
+ mutex_lock(&journal->j_checkpoint_mutex);
+- jbd2_mark_journal_empty(journal);
++
++ write_lock(&journal->j_state_lock);
++ journal->j_tail_sequence =
++ ++journal->j_transaction_sequence;
++ write_unlock(&journal->j_state_lock);
++
++ jbd2_mark_journal_empty(journal, WRITE_FLUSH_FUA);
+ mutex_unlock(&journal->j_checkpoint_mutex);
+ } else
+ err = -EIO;
+@@ -1975,7 +1982,7 @@ int jbd2_journal_flush(journal_t *journa
+ * the magic code for a fully-recovered superblock. Any future
+ * commits of data to the journal will restore the current
+ * s_start value. */
+- jbd2_mark_journal_empty(journal);
++ jbd2_mark_journal_empty(journal, WRITE_FUA);
+ mutex_unlock(&journal->j_checkpoint_mutex);
+ write_lock(&journal->j_state_lock);
+ J_ASSERT(!journal->j_running_transaction);
+@@ -2021,7 +2028,7 @@ int jbd2_journal_wipe(journal_t *journal
+ if (write) {
+ /* Lock to make assertions happy... */
+ mutex_lock(&journal->j_checkpoint_mutex);
+- jbd2_mark_journal_empty(journal);
++ jbd2_mark_journal_empty(journal, WRITE_FUA);
+ mutex_unlock(&journal->j_checkpoint_mutex);
+ }
+
--- /dev/null
+From b6e6edcfa40561e9c8abe5eecf1c96f8e5fd9c6f Mon Sep 17 00:00:00 2001
+From: Johannes Weiner <hannes@cmpxchg.org>
+Date: Thu, 17 Mar 2016 14:20:28 -0700
+Subject: mm: memcontrol: reclaim and OOM kill when shrinking memory.max below usage
+
+From: Johannes Weiner <hannes@cmpxchg.org>
+
+commit b6e6edcfa40561e9c8abe5eecf1c96f8e5fd9c6f upstream.
+
+Setting the original memory.limit_in_bytes hardlimit is subject to a
+race condition when the desired value is below the current usage. The
+code tries a few times to first reclaim and then see if the usage has
+dropped to where we would like it to be, but there is no locking, and
+the workload is free to continue making new charges up to the old limit.
+Thus, attempting to shrink a workload relies on pure luck and hope that
+the workload happens to cooperate.
+
+To fix this in the cgroup2 memory.max knob, do it the other way round:
+set the limit first, then try enforcement. And if reclaim is not able
+to succeed, trigger OOM kills in the group. Keep going until the new
+limit is met, we run out of OOM victims and there's only unreclaimable
+memory left, or the task writing to memory.max is killed. This allows
+users to shrink groups reliably, and the behavior is consistent with
+what happens when new charges are attempted in excess of memory.max.
+
+Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Cc: Vladimir Davydov <vdavydov@virtuozzo.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/memcontrol.c | 38 ++++++++++++++++++++++++++++++++++----
+ 1 file changed, 34 insertions(+), 4 deletions(-)
+
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -1332,7 +1332,7 @@ static unsigned long mem_cgroup_get_limi
+ return limit;
+ }
+
+-static void mem_cgroup_out_of_memory(struct mem_cgroup *memcg, gfp_t gfp_mask,
++static bool mem_cgroup_out_of_memory(struct mem_cgroup *memcg, gfp_t gfp_mask,
+ int order)
+ {
+ struct oom_control oc = {
+@@ -1410,6 +1410,7 @@ static void mem_cgroup_out_of_memory(str
+ }
+ unlock:
+ mutex_unlock(&oom_lock);
++ return chosen;
+ }
+
+ #if MAX_NUMNODES > 1
+@@ -5158,6 +5159,8 @@ static ssize_t memory_max_write(struct k
+ char *buf, size_t nbytes, loff_t off)
+ {
+ struct mem_cgroup *memcg = mem_cgroup_from_css(of_css(of));
++ unsigned int nr_reclaims = MEM_CGROUP_RECLAIM_RETRIES;
++ bool drained = false;
+ unsigned long max;
+ int err;
+
+@@ -5166,9 +5169,36 @@ static ssize_t memory_max_write(struct k
+ if (err)
+ return err;
+
+- err = mem_cgroup_resize_limit(memcg, max);
+- if (err)
+- return err;
++ xchg(&memcg->memory.limit, max);
++
++ for (;;) {
++ unsigned long nr_pages = page_counter_read(&memcg->memory);
++
++ if (nr_pages <= max)
++ break;
++
++ if (signal_pending(current)) {
++ err = -EINTR;
++ break;
++ }
++
++ if (!drained) {
++ drain_all_stock(memcg);
++ drained = true;
++ continue;
++ }
++
++ if (nr_reclaims) {
++ if (!try_to_free_mem_cgroup_pages(memcg, nr_pages - max,
++ GFP_KERNEL, true))
++ nr_reclaims--;
++ continue;
++ }
++
++ mem_cgroup_events(memcg, MEMCG_OOM, 1);
++ if (!mem_cgroup_out_of_memory(memcg, GFP_KERNEL, 0))
++ break;
++ }
+
+ memcg_wb_domain_size_changed(memcg);
+ return nbytes;
--- /dev/null
+From 588083bb37a3cea8533c392370a554417c8f29cb Mon Sep 17 00:00:00 2001
+From: Johannes Weiner <hannes@cmpxchg.org>
+Date: Thu, 17 Mar 2016 14:20:25 -0700
+Subject: mm: memcontrol: reclaim when shrinking memory.high below usage
+
+From: Johannes Weiner <hannes@cmpxchg.org>
+
+commit 588083bb37a3cea8533c392370a554417c8f29cb upstream.
+
+When setting memory.high below usage, nothing happens until the next
+charge comes along, and then it will only reclaim its own charge and not
+the now potentially huge excess of the new memory.high. This can cause
+groups to stay in excess of their memory.high indefinitely.
+
+To fix that, when shrinking memory.high, kick off a reclaim cycle that
+goes after the delta.
+
+Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Cc: Vladimir Davydov <vdavydov@virtuozzo.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/memcontrol.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -5121,6 +5121,7 @@ static ssize_t memory_high_write(struct
+ char *buf, size_t nbytes, loff_t off)
+ {
+ struct mem_cgroup *memcg = mem_cgroup_from_css(of_css(of));
++ unsigned long nr_pages;
+ unsigned long high;
+ int err;
+
+@@ -5131,6 +5132,11 @@ static ssize_t memory_high_write(struct
+
+ memcg->high = high;
+
++ nr_pages = page_counter_read(&memcg->memory);
++ if (nr_pages > high)
++ try_to_free_mem_cgroup_pages(memcg, nr_pages - high,
++ GFP_KERNEL, true);
++
+ memcg_wb_domain_size_changed(memcg);
+ return nbytes;
+ }
mtip32xx-handle-ftl-rebuild-failure-state-during-device-initialization.patch
mtip32xx-implement-timeout-handler.patch
mtip32xx-cleanup-queued-requests-after-surprise-removal.patch
+alsa-hda-apply-reboot-d3-fix-for-cx20724-codec-too.patch
+alsa-pcm-avoid-bug-string-for-warnings-again.patch
+alsa-intel8x0-add-clock-quirk-entry-for-ad1981b-on-ibm-thinkpad-x41.patch
+alsa-hda-don-t-handle-eld-notify-from-invalid-port.patch
+alsa-hda-fix-the-mic-mute-button-and-led-problem-for-a-lenovo-aio.patch
+alsa-hda-fix-unconditional-gpio-toggle-via-automute.patch
+tools-hv-use-include-uapi-with-__exported_headers__.patch
+jbd2-fix-fs-corruption-possibility-in-jbd2_journal_destroy-on-umount-path.patch
+brd-fix-discard-request-processing.patch
+ib-srpt-simplify-srpt_handle_tsk_mgmt.patch
+bcache-cleaned-up-error-handling-around-register_cache.patch
+bcache-fix-race-of-writeback-thread-starting-before-complete-initialization.patch
+bcache-fix-cache_set_flush-null-pointer-dereference-on-oom.patch
+mm-memcontrol-reclaim-when-shrinking-memory.high-below-usage.patch
+mm-memcontrol-reclaim-and-oom-kill-when-shrinking-memory.max-below-usage.patch
+ia64-define-ioremap_uc.patch
+watchdog-don-t-run-proc_watchdog_update-if-new-value-is-same-as-old.patch
+watchdog-rc32434_wdt-fix-ioctl-error-handling.patch
--- /dev/null
+From 50fe6dd10069e7c062e27f29606f6e91ea979399 Mon Sep 17 00:00:00 2001
+From: Kamal Mostafa <kamal@canonical.com>
+Date: Wed, 27 Jan 2016 22:29:33 -0800
+Subject: tools/hv: Use include/uapi with __EXPORTED_HEADERS__
+
+From: Kamal Mostafa <kamal@canonical.com>
+
+commit 50fe6dd10069e7c062e27f29606f6e91ea979399 upstream.
+
+Use the local uapi headers to keep in sync with "recently" added #define's
+(e.g. VSS_OP_REGISTER1).
+
+Fixes: 3eb2094c59e8 ("Adding makefile for tools/hv")
+Signed-off-by: Kamal Mostafa <kamal@canonical.com>
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/hv/Makefile | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/tools/hv/Makefile
++++ b/tools/hv/Makefile
+@@ -5,6 +5,8 @@ PTHREAD_LIBS = -lpthread
+ WARNINGS = -Wall -Wextra
+ CFLAGS = $(WARNINGS) -g $(PTHREAD_LIBS) $(shell getconf LFS_CFLAGS)
+
++CFLAGS += -D__EXPORTED_HEADERS__ -I../../include/uapi -I../../include
++
+ all: hv_kvp_daemon hv_vss_daemon hv_fcopy_daemon
+ %: %.c
+ $(CC) $(CFLAGS) -o $@ $^
--- /dev/null
+From a1ee1932aa6bea0bb074f5e3ced112664e4637ed Mon Sep 17 00:00:00 2001
+From: Joshua Hunt <johunt@akamai.com>
+Date: Thu, 17 Mar 2016 14:17:23 -0700
+Subject: watchdog: don't run proc_watchdog_update if new value is same as old
+
+From: Joshua Hunt <johunt@akamai.com>
+
+commit a1ee1932aa6bea0bb074f5e3ced112664e4637ed upstream.
+
+While working on a script to restore all sysctl params before a series of
+tests I found that writing any value into the
+/proc/sys/kernel/{nmi_watchdog,soft_watchdog,watchdog,watchdog_thresh}
+causes them to call proc_watchdog_update().
+
+ NMI watchdog: enabled on all CPUs, permanently consumes one hw-PMU counter.
+ NMI watchdog: enabled on all CPUs, permanently consumes one hw-PMU counter.
+ NMI watchdog: enabled on all CPUs, permanently consumes one hw-PMU counter.
+ NMI watchdog: enabled on all CPUs, permanently consumes one hw-PMU counter.
+
+There doesn't appear to be a reason for doing this work every time a write
+occurs, so only do it when the values change.
+
+Signed-off-by: Josh Hunt <johunt@akamai.com>
+Acked-by: Don Zickus <dzickus@redhat.com>
+Reviewed-by: Aaron Tomlin <atomlin@redhat.com>
+Cc: Ulrich Obergfell <uobergfe@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/watchdog.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/kernel/watchdog.c
++++ b/kernel/watchdog.c
+@@ -907,6 +907,9 @@ static int proc_watchdog_common(int whic
+ * both lockup detectors are disabled if proc_watchdog_update()
+ * returns an error.
+ */
++ if (old == new)
++ goto out;
++
+ err = proc_watchdog_update();
+ }
+ out:
+@@ -951,7 +954,7 @@ int proc_soft_watchdog(struct ctl_table
+ int proc_watchdog_thresh(struct ctl_table *table, int write,
+ void __user *buffer, size_t *lenp, loff_t *ppos)
+ {
+- int err, old;
++ int err, old, new;
+
+ get_online_cpus();
+ mutex_lock(&watchdog_proc_mutex);
+@@ -971,6 +974,10 @@ int proc_watchdog_thresh(struct ctl_tabl
+ /*
+ * Update the sample period. Restore on failure.
+ */
++ new = ACCESS_ONCE(watchdog_thresh);
++ if (old == new)
++ goto out;
++
+ set_sample_period();
+ err = proc_watchdog_update();
+ if (err) {
--- /dev/null
+From 10e7ac22cdd4d211cef99afcb9371b70cb175be6 Mon Sep 17 00:00:00 2001
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Sun, 28 Feb 2016 17:44:09 +0200
+Subject: watchdog: rc32434_wdt: fix ioctl error handling
+
+From: Michael S. Tsirkin <mst@redhat.com>
+
+commit 10e7ac22cdd4d211cef99afcb9371b70cb175be6 upstream.
+
+Calling return copy_to_user(...) in an ioctl will not do the right thing
+if there's a pagefault: copy_to_user returns the number of bytes not
+copied in this case.
+
+Fix up watchdog/rc32434_wdt to do
+ return copy_to_user(...)) ? -EFAULT : 0;
+
+instead.
+
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/watchdog/rc32434_wdt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/watchdog/rc32434_wdt.c
++++ b/drivers/watchdog/rc32434_wdt.c
+@@ -237,7 +237,7 @@ static long rc32434_wdt_ioctl(struct fil
+ return -EINVAL;
+ /* Fall through */
+ case WDIOC_GETTIMEOUT:
+- return copy_to_user(argp, &timeout, sizeof(int));
++ return copy_to_user(argp, &timeout, sizeof(int)) ? -EFAULT : 0;
+ default:
+ return -ENOTTY;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
