--- /dev/null
+From 15c75b09f8d190f89ab4db463b87d411ca349dfe Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 28 Feb 2017 17:16:48 +0100
+Subject: ALSA: ctxfi: Fallback DMA mask to 32bit
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 15c75b09f8d190f89ab4db463b87d411ca349dfe upstream.
+
+Currently ctxfi driver tries to set only the 64bit DMA mask on 64bit
+architectures, and bails out if it fails. This causes a problem on
+some platforms since the 64bit DMA isn't always guaranteed. We should
+fall back to the default 32bit DMA when 64bit DMA fails.
+
+Fixes: 6d74b86d3c0f ("ALSA: ctxfi - Allow 64bit DMA")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/ctxfi/cthw20k1.c | 19 ++++++-------------
+ sound/pci/ctxfi/cthw20k2.c | 19 ++++++-------------
+ 2 files changed, 12 insertions(+), 26 deletions(-)
+
+--- a/sound/pci/ctxfi/cthw20k1.c
++++ b/sound/pci/ctxfi/cthw20k1.c
+@@ -27,12 +27,6 @@
+ #include "cthw20k1.h"
+ #include "ct20k1reg.h"
+
+-#if BITS_PER_LONG == 32
+-#define CT_XFI_DMA_MASK DMA_BIT_MASK(32) /* 32 bit PTE */
+-#else
+-#define CT_XFI_DMA_MASK DMA_BIT_MASK(64) /* 64 bit PTE */
+-#endif
+-
+ struct hw20k1 {
+ struct hw hw;
+ spinlock_t reg_20k1_lock;
+@@ -1904,19 +1898,18 @@ static int hw_card_start(struct hw *hw)
+ {
+ int err;
+ struct pci_dev *pci = hw->pci;
++ const unsigned int dma_bits = BITS_PER_LONG;
+
+ err = pci_enable_device(pci);
+ if (err < 0)
+ return err;
+
+ /* Set DMA transfer mask */
+- if (dma_set_mask(&pci->dev, CT_XFI_DMA_MASK) < 0 ||
+- dma_set_coherent_mask(&pci->dev, CT_XFI_DMA_MASK) < 0) {
+- dev_err(hw->card->dev,
+- "architecture does not support PCI busmaster DMA with mask 0x%llx\n",
+- CT_XFI_DMA_MASK);
+- err = -ENXIO;
+- goto error1;
++ if (dma_set_mask(&pci->dev, DMA_BIT_MASK(dma_bits))) {
++ dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(dma_bits));
++ } else {
++ dma_set_mask(&pci->dev, DMA_BIT_MASK(32));
++ dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(32));
+ }
+
+ if (!hw->io_base) {
+--- a/sound/pci/ctxfi/cthw20k2.c
++++ b/sound/pci/ctxfi/cthw20k2.c
+@@ -26,12 +26,6 @@
+ #include "cthw20k2.h"
+ #include "ct20k2reg.h"
+
+-#if BITS_PER_LONG == 32
+-#define CT_XFI_DMA_MASK DMA_BIT_MASK(32) /* 32 bit PTE */
+-#else
+-#define CT_XFI_DMA_MASK DMA_BIT_MASK(64) /* 64 bit PTE */
+-#endif
+-
+ struct hw20k2 {
+ struct hw hw;
+ /* for i2c */
+@@ -2029,19 +2023,18 @@ static int hw_card_start(struct hw *hw)
+ int err = 0;
+ struct pci_dev *pci = hw->pci;
+ unsigned int gctl;
++ const unsigned int dma_bits = BITS_PER_LONG;
+
+ err = pci_enable_device(pci);
+ if (err < 0)
+ return err;
+
+ /* Set DMA transfer mask */
+- if (dma_set_mask(&pci->dev, CT_XFI_DMA_MASK) < 0 ||
+- dma_set_coherent_mask(&pci->dev, CT_XFI_DMA_MASK) < 0) {
+- dev_err(hw->card->dev,
+- "architecture does not support PCI busmaster DMA with mask 0x%llx\n",
+- CT_XFI_DMA_MASK);
+- err = -ENXIO;
+- goto error1;
++ if (!dma_set_mask(&pci->dev, DMA_BIT_MASK(dma_bits))) {
++ dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(dma_bits));
++ } else {
++ dma_set_mask(&pci->dev, DMA_BIT_MASK(32));
++ dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(32));
+ }
+
+ if (!hw->io_base) {
--- /dev/null
+From 493de342748cc6f52938096f5480cf291da58a0b Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 28 Feb 2017 17:27:57 +0100
+Subject: ALSA: hda - Add subwoofer support for Dell Inspiron 17 7000 Gaming
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 493de342748cc6f52938096f5480cf291da58a0b upstream.
+
+Dell Inspiron 17 7000 Gaming laptop needs a similar quirk like
+Inspiron 7599 to support its subwoofer speaker.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=194191
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5577,6 +5577,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
+ SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
+ SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
++ SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
+ SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
--- /dev/null
+From e7480b34ad1ab84a63540b2c884cb92c0764ab74 Mon Sep 17 00:00:00 2001
+From: Jaroslav Kysela <perex@perex.cz>
+Date: Wed, 15 Feb 2017 17:09:42 +0100
+Subject: ALSA: hda - fix Lewisburg audio issue
+
+From: Jaroslav Kysela <perex@perex.cz>
+
+commit e7480b34ad1ab84a63540b2c884cb92c0764ab74 upstream.
+
+Like for Sunrise Point, the total stream number of Lewisburg's
+input and output stream exceeds 15 (GCAP is 0x9701), which will
+cause some streams do not work because of the overflow on
+SDxCTL.STRM field if using the legacy stream tag allocation method.
+
+Fixes: 5cf92c8b3dc5 ("ALSA: hda - Add Intel Lewisburg device IDs Audio")
+Signed-off-by: Jaroslav Kysela <perex@perex.cz>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_intel.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2197,9 +2197,9 @@ static const struct pci_device_id azx_id
+ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
+ /* Lewisburg */
+ { PCI_DEVICE(0x8086, 0xa1f0),
+- .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
++ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE },
+ { PCI_DEVICE(0x8086, 0xa270),
+- .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
++ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE },
+ /* Lynx Point-LP */
+ { PCI_DEVICE(0x8086, 0x9c20),
+ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
--- /dev/null
+From 29693efcea0f38cf40d0055d2401490a4f9bf8be Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Mon, 27 Feb 2017 10:11:47 +0800
+Subject: ALSA: hda - Fix micmute hotkey problem for a lenovo AIO machine
+
+From: Hui Wang <hui.wang@canonical.com>
+
+commit 29693efcea0f38cf40d0055d2401490a4f9bf8be upstream.
+
+On this machine, the micmute button is connected to Line2 of the
+codec and the micmute led is connected to GPIO2 of the codec.
+
+After applying this quirk, both hotkey and led work well.
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5693,6 +5693,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC292_FIXUP_TPT460),
+ SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
++ SND_PCI_QUIRK(0x17aa, 0x3112, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
+ SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),
--- /dev/null
+From 9f1bc2c4c58fcb2d86e0e26437dc8f3a18ac3276 Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Thu, 16 Feb 2017 15:26:54 +0800
+Subject: ALSA: hda/realtek - Cannot adjust speaker's volume on a Dell AIO
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+commit 9f1bc2c4c58fcb2d86e0e26437dc8f3a18ac3276 upstream.
+
+The issue is the same as "dd9aa335c880 ALSA: hda/realtek - Can't adjust
+speaker's volume on a Dell AIO", the output requires to connect to a node
+with Amp-out capability.
+
+Applying the same fixup "ALC298_FIXUP_SPK_VOLUME" can fix the issue.
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6065,6 +6065,12 @@ static const struct snd_hda_pin_quirk al
+ SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC298_STANDARD_PINS,
+ {0x17, 0x90170150}),
++ SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_SPK_VOLUME,
++ {0x12, 0xb7a60140},
++ {0x13, 0xb7a60150},
++ {0x17, 0x90170110},
++ {0x1a, 0x03011020},
++ {0x21, 0x03211030}),
+ {}
+ };
+
--- /dev/null
+From f3ac9f737603da80c2da3e84b89e74429836bb6d Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 28 Feb 2017 22:15:51 +0100
+Subject: ALSA: seq: Fix link corruption by event error handling
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit f3ac9f737603da80c2da3e84b89e74429836bb6d upstream.
+
+The sequencer FIFO management has a bug that may lead to a corruption
+(shortage) of the cell linked list. When a sequencer client faces an
+error at the event delivery, it tries to put back the dequeued cell.
+When the first queue was put back, this forgot the tail pointer
+tracking, and the link will be screwed up.
+
+Although there is no memory corruption, the sequencer client may stall
+forever at exit while flushing the pending FIFO cells in
+snd_seq_pool_done(), as spotted by syzkaller.
+
+This patch addresses the missing tail pointer tracking at
+snd_seq_fifo_cell_putback(). Also the patch makes sure to clear the
+cell->enxt pointer at snd_seq_fifo_event_in() for avoiding a similar
+mess-up of the FIFO linked list.
+
+Reported-by: Dmitry Vyukov <dvyukov@google.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/seq/seq_fifo.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/core/seq/seq_fifo.c
++++ b/sound/core/seq/seq_fifo.c
+@@ -135,6 +135,7 @@ int snd_seq_fifo_event_in(struct snd_seq
+ f->tail = cell;
+ if (f->head == NULL)
+ f->head = cell;
++ cell->next = NULL;
+ f->cells++;
+ spin_unlock_irqrestore(&f->lock, flags);
+
+@@ -214,6 +215,8 @@ void snd_seq_fifo_cell_putback(struct sn
+ spin_lock_irqsave(&f->lock, flags);
+ cell->next = f->head;
+ f->head = cell;
++ if (!f->tail)
++ f->tail = cell;
+ f->cells++;
+ spin_unlock_irqrestore(&f->lock, flags);
+ }
--- /dev/null
+From 71321eb3f2d0df4e6c327e0b936eec4458a12054 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 28 Feb 2017 14:49:07 +0100
+Subject: ALSA: timer: Reject user params with too small ticks
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 71321eb3f2d0df4e6c327e0b936eec4458a12054 upstream.
+
+When a user sets a too small ticks with a fine-grained timer like
+hrtimer, the kernel tries to fire up the timer irq too frequently.
+This may lead to the condensed locks, eventually the kernel spinlock
+lockup with warnings.
+
+For avoiding such a situation, we define a lower limit of the
+resolution, namely 1ms. When the user passes a too small tick value
+that results in less than that, the kernel returns -EINVAL now.
+
+Reported-by: Dmitry Vyukov <dvyukov@google.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/timer.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -1702,9 +1702,21 @@ static int snd_timer_user_params(struct
+ return -EBADFD;
+ if (copy_from_user(¶ms, _params, sizeof(params)))
+ return -EFAULT;
+- if (!(t->hw.flags & SNDRV_TIMER_HW_SLAVE) && params.ticks < 1) {
+- err = -EINVAL;
+- goto _end;
++ if (!(t->hw.flags & SNDRV_TIMER_HW_SLAVE)) {
++ u64 resolution;
++
++ if (params.ticks < 1) {
++ err = -EINVAL;
++ goto _end;
++ }
++
++ /* Don't allow resolution less than 1ms */
++ resolution = snd_timer_resolution(tu->timeri);
++ resolution *= params.ticks;
++ if (resolution < 1000000) {
++ err = -EINVAL;
++ goto _end;
++ }
+ }
+ if (params.queue_size > 0 &&
+ (params.queue_size < 32 || params.queue_size > 1024)) {
--- /dev/null
+From e3f0a4017c2143b4b813df6a93e8cf79e3f76936 Mon Sep 17 00:00:00 2001
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Date: Tue, 25 Oct 2016 11:37:58 +0200
+Subject: ARM: at91: define LPDDR types
+
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+
+commit e3f0a4017c2143b4b813df6a93e8cf79e3f76936 upstream.
+
+The Atmel MPDDR controller support LPDDR2 and LPDDR3 memories, add their
+types.
+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Signed-off-by: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/soc/at91/at91sam9_ddrsdr.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/include/soc/at91/at91sam9_ddrsdr.h
++++ b/include/soc/at91/at91sam9_ddrsdr.h
+@@ -81,6 +81,7 @@
+ #define AT91_DDRSDRC_LPCB_POWER_DOWN 2
+ #define AT91_DDRSDRC_LPCB_DEEP_POWER_DOWN 3
+ #define AT91_DDRSDRC_CLKFR (1 << 2) /* Clock Frozen */
++#define AT91_DDRSDRC_LPDDR2_PWOFF (1 << 3) /* LPDDR Power Off */
+ #define AT91_DDRSDRC_PASR (7 << 4) /* Partial Array Self Refresh */
+ #define AT91_DDRSDRC_TCSR (3 << 8) /* Temperature Compensated Self Refresh */
+ #define AT91_DDRSDRC_DS (3 << 10) /* Drive Strength */
+@@ -96,7 +97,9 @@
+ #define AT91_DDRSDRC_MD_SDR 0
+ #define AT91_DDRSDRC_MD_LOW_POWER_SDR 1
+ #define AT91_DDRSDRC_MD_LOW_POWER_DDR 3
++#define AT91_DDRSDRC_MD_LPDDR3 5
+ #define AT91_DDRSDRC_MD_DDR2 6 /* [SAM9 Only] */
++#define AT91_DDRSDRC_MD_LPDDR2 7
+ #define AT91_DDRSDRC_DBW (1 << 4) /* Data Bus Width */
+ #define AT91_DDRSDRC_DBW_32BITS (0 << 4)
+ #define AT91_DDRSDRC_DBW_16BITS (1 << 4)
--- /dev/null
+From 78162d48466d23c45a784034630c5928af631e3d Mon Sep 17 00:00:00 2001
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Date: Thu, 19 Jan 2017 23:05:39 +0100
+Subject: ARM: dts: at91: Enable DMA on sama5d2_xplained console
+
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+
+commit 78162d48466d23c45a784034630c5928af631e3d upstream.
+
+Enable DMA on uart1 to get a more reliable console.
+
+Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/at91-sama5d2_xplained.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm/boot/dts/at91-sama5d2_xplained.dts
++++ b/arch/arm/boot/dts/at91-sama5d2_xplained.dts
+@@ -148,6 +148,8 @@
+ uart1: serial@f8020000 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_uart1_default>;
++ atmel,use-dma-rx;
++ atmel,use-dma-tx;
+ status = "okay";
+ };
+
--- /dev/null
+From ef8d02d4a2c36f7a93e74c95a9c419353b310117 Mon Sep 17 00:00:00 2001
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Date: Thu, 19 Jan 2017 01:46:58 +0100
+Subject: ARM: dts: at91: Enable DMA on sama5d4_xplained console
+
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+
+commit ef8d02d4a2c36f7a93e74c95a9c419353b310117 upstream.
+
+Enable DMA on usart3 to get a more reliable console. This is especially
+useful for automation and kernelci were a kernel with PROVE_LOCKING enabled
+is quite susceptible to character loss, resulting in tests failure.
+
+Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/at91-sama5d4_xplained.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts
++++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
+@@ -110,6 +110,8 @@
+ };
+
+ usart3: serial@fc00c000 {
++ atmel,use-dma-rx;
++ atmel,use-dma-tx;
+ status = "okay";
+ };
+
--- /dev/null
+From 9c25702cee1405099f982894c865c163de7909a8 Mon Sep 17 00:00:00 2001
+From: Pavel Shilovsky <pshilov@microsoft.com>
+Date: Thu, 19 Jan 2017 13:53:15 -0800
+Subject: CIFS: Fix splice read for non-cached files
+
+From: Pavel Shilovsky <pshilov@microsoft.com>
+
+commit 9c25702cee1405099f982894c865c163de7909a8 upstream.
+
+Currently we call copy_page_to_iter() for uncached reading into a pipe.
+This is wrong because it treats pages as VFS cache pages and copies references
+rather than actual data. When we are trying to read from the pipe we end up
+calling page_cache_pipe_buf_confirm() which returns -ENODATA. This error
+is translated into 0 which is returned to a user.
+
+This issue is reproduced by running xfs-tests suite (generic test #249)
+against mount points with "cache=none". Fix it by mapping pages manually
+and calling copy_to_iter() that copies data into the pipe.
+
+Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/file.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -2884,7 +2884,15 @@ cifs_readdata_to_iov(struct cifs_readdat
+ for (i = 0; i < rdata->nr_pages; i++) {
+ struct page *page = rdata->pages[i];
+ size_t copy = min_t(size_t, remaining, PAGE_SIZE);
+- size_t written = copy_page_to_iter(page, 0, copy, iter);
++ size_t written;
++
++ if (unlikely(iter->type & ITER_PIPE)) {
++ void *addr = kmap_atomic(page);
++
++ written = copy_to_iter(addr, copy, iter);
++ kunmap_atomic(addr);
++ } else
++ written = copy_page_to_iter(page, 0, copy, iter);
+ remaining -= written;
+ if (written < copy && iov_iter_count(iter) > 0)
+ break;
--- /dev/null
+From 4474f4c40a9c607c7317e686b23619b7b768004f Mon Sep 17 00:00:00 2001
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+Date: Mon, 16 Jan 2017 18:00:00 +0000
+Subject: coresight: STM: Balance enable/disable
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+commit 4474f4c40a9c607c7317e686b23619b7b768004f upstream.
+
+The stm is automatically enabled when an application sets the policy
+via ->link() call back by using coresight_enable(), which keeps the
+refcount of the current users of the STM. However, the unlink() callback
+issues stm_disable() directly, which leaves the STM turned off, without
+the coresight layer knowing about it. This prevents any further uses
+of the STM hardware as the coresight layer still thinks the STM is
+turned on and doesn't enable the hardware when required. Even manually
+enabling the STM via sysfs can't really enable the hw.
+
+e.g,
+
+ $ echo 1 > $CS_DEVS/$ETR/enable_sink
+ $ mkdir -p $CONFIG_FS/stp-policy/$source.0/stm_test/
+ $ echo 32768 65535 > $CONFIG_FS/stp-policy/$source.0/stm_test/channels
+ $ echo 64 > $CS_DEVS/$source/traceid
+ $ ./stm_app
+ Sending 64000 byte blocks of pattern 0 at 0us intervals
+ Success to map channel(32768~32783) to 0xffffa95fa000
+ Sending on channel 32768
+ $ dd if=/dev/$ETR of=~/trace.bin.1
+ 597+1 records in
+ 597+1 records out
+ 305920 bytes (306 kB) copied, 0.399952 s, 765 kB/s
+ $ ./stm_app
+ Sending 64000 byte blocks of pattern 0 at 0us intervals
+ Success to map channel(32768~32783) to 0xffff7e9e2000
+ Sending on channel 32768
+ $ dd if=/dev/$ETR of=~/trace.bin.2
+ 0+0 records in
+ 0+0 records out
+ 0 bytes (0 B) copied, 0.0232083 s, 0.0 kB/s
+
+ Note that we don't get any data from the ETR for the second session.
+
+ Also dmesg shows :
+
+ [ 77.520458] coresight-tmc 20800000.etr: TMC-ETR enabled
+ [ 77.537097] coresight-replicator etr_replicator@20890000: REPLICATOR enabled
+ [ 77.558828] coresight-replicator main_replicator@208a0000: REPLICATOR enabled
+ [ 77.581068] coresight-funnel 208c0000.main_funnel: FUNNEL inport 0 enabled
+ [ 77.602217] coresight-tmc 20840000.etf: TMC-ETF enabled
+ [ 77.618422] coresight-stm 20860000.stm: STM tracing enabled
+ [ 139.554252] coresight-stm 20860000.stm: STM tracing disabled
+ # End of first tracing session
+ [ 146.351135] coresight-tmc 20800000.etr: TMC read start
+ [ 146.514486] coresight-tmc 20800000.etr: TMC read end
+ # Note that the STM is not turned on via stm_generic_link()->coresight_enable()
+ # and hence none of the components are turned on.
+ [ 152.479080] coresight-tmc 20800000.etr: TMC read start
+ [ 152.542632] coresight-tmc 20800000.etr: TMC read end
+
+This patch fixes the problem by balancing the unlink operation by using
+the coresight_disable(), keeping the coresight layer in sync with the
+hardware state and thus allowing normal usage of the STM component.
+
+Fixes: commit 237483aa5cf43 ("coresight: stm: adding driver for CoreSight STM component")
+Cc: Pratik Patel <pratikp@codeaurora.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Reviewed-by: Chunyan Zhang <zhang.chunyan@linaro.org>
+Reported-by: Robert Walker <robert.walker@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/coresight/coresight-stm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwtracing/coresight/coresight-stm.c
++++ b/drivers/hwtracing/coresight/coresight-stm.c
+@@ -356,7 +356,7 @@ static void stm_generic_unlink(struct st
+ if (!drvdata || !drvdata->csdev)
+ return;
+
+- stm_disable(drvdata->csdev, NULL);
++ coresight_disable(drvdata->csdev);
+ }
+
+ static phys_addr_t
--- /dev/null
+From 4c7b8ca1ae5ed9e27014732c8a918ba11a86cf09 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Wed, 8 Feb 2017 14:07:42 -0800
+Subject: hwmon: (it87) Do not overwrite bit 2..6 of pwm control registers
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 4c7b8ca1ae5ed9e27014732c8a918ba11a86cf09 upstream.
+
+In IT8620E, after setting pwm control to manual, it was observed that
+pwm values for fan 4..6 have reversed results (writing 0 results in fans
+running at full speed, writing 255 results in fans turned off).
+
+With the new PWM control, pwm polarity for pwm control 4..6 is specified
+in its pwm control registers. Those registers are overwritten when setting
+the pwm mode or the temperature mapping. Do not touch bit 2..6 of pwm
+control registers on register writes to fix the problem.
+
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/it87.c | 37 ++++++++++++++++++++++++-------------
+ 1 file changed, 24 insertions(+), 13 deletions(-)
+
+--- a/drivers/hwmon/it87.c
++++ b/drivers/hwmon/it87.c
+@@ -1300,25 +1300,35 @@ static ssize_t set_pwm_enable(struct dev
+ it87_write_value(data, IT87_REG_FAN_MAIN_CTRL,
+ data->fan_main_ctrl);
+ } else {
++ u8 ctrl;
++
+ /* No on/off mode, set maximum pwm value */
+ data->pwm_duty[nr] = pwm_to_reg(data, 0xff);
+ it87_write_value(data, IT87_REG_PWM_DUTY[nr],
+ data->pwm_duty[nr]);
+ /* and set manual mode */
+- data->pwm_ctrl[nr] = has_newer_autopwm(data) ?
+- data->pwm_temp_map[nr] :
+- data->pwm_duty[nr];
+- it87_write_value(data, IT87_REG_PWM[nr],
+- data->pwm_ctrl[nr]);
++ if (has_newer_autopwm(data)) {
++ ctrl = (data->pwm_ctrl[nr] & 0x7c) |
++ data->pwm_temp_map[nr];
++ } else {
++ ctrl = data->pwm_duty[nr];
++ }
++ data->pwm_ctrl[nr] = ctrl;
++ it87_write_value(data, IT87_REG_PWM[nr], ctrl);
+ }
+ } else {
+- if (val == 1) /* Manual mode */
+- data->pwm_ctrl[nr] = has_newer_autopwm(data) ?
+- data->pwm_temp_map[nr] :
+- data->pwm_duty[nr];
+- else /* Automatic mode */
+- data->pwm_ctrl[nr] = 0x80 | data->pwm_temp_map[nr];
+- it87_write_value(data, IT87_REG_PWM[nr], data->pwm_ctrl[nr]);
++ u8 ctrl;
++
++ if (has_newer_autopwm(data)) {
++ ctrl = (data->pwm_ctrl[nr] & 0x7c) |
++ data->pwm_temp_map[nr];
++ if (val != 1)
++ ctrl |= 0x80;
++ } else {
++ ctrl = (val == 1 ? data->pwm_duty[nr] : 0x80);
++ }
++ data->pwm_ctrl[nr] = ctrl;
++ it87_write_value(data, IT87_REG_PWM[nr], ctrl);
+
+ if (data->type != it8603 && nr < 3) {
+ /* set SmartGuardian mode */
+@@ -1462,7 +1472,8 @@ static ssize_t set_pwm_temp_map(struct d
+ * otherwise, just store it for later use.
+ */
+ if (data->pwm_ctrl[nr] & 0x80) {
+- data->pwm_ctrl[nr] = 0x80 | data->pwm_temp_map[nr];
++ data->pwm_ctrl[nr] = (data->pwm_ctrl[nr] & 0xfc) |
++ data->pwm_temp_map[nr];
+ it87_write_value(data, IT87_REG_PWM[nr], data->pwm_ctrl[nr]);
+ }
+ mutex_unlock(&data->update_lock);
--- /dev/null
+From 82dbe987b70042b340f851bdc969a971081e5f02 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Wed, 8 Feb 2017 14:02:59 -0800
+Subject: hwmon: (it87) Ensure that pwm control cache is current before updating values
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 82dbe987b70042b340f851bdc969a971081e5f02 upstream.
+
+If sensor attributes were never read, the pwm control data has not been
+initiialized, which can cause wrong driver behavior. Ensure that cached
+data is current before acting on it.
+
+Reported-by: Kevin Folz <kfolz@evertz.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/it87.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/hwmon/it87.c
++++ b/drivers/hwmon/it87.c
+@@ -1354,6 +1354,7 @@ static ssize_t set_pwm(struct device *de
+ return -EINVAL;
+
+ mutex_lock(&data->update_lock);
++ it87_update_pwm_ctrl(data, nr);
+ if (has_newer_autopwm(data)) {
+ /*
+ * If we are in automatic mode, the PWM duty cycle register
+@@ -1466,6 +1467,7 @@ static ssize_t set_pwm_temp_map(struct d
+ }
+
+ mutex_lock(&data->update_lock);
++ it87_update_pwm_ctrl(data, nr);
+ data->pwm_temp_map[nr] = reg;
+ /*
+ * If we are in automatic mode, write the temp mapping immediately;
--- /dev/null
+From aaa59306b0b7e0ca4ba92cc04c5db101cbb1c096 Mon Sep 17 00:00:00 2001
+From: CQ Tang <cq.tang@intel.com>
+Date: Mon, 30 Jan 2017 09:39:52 -0800
+Subject: iommu/vt-d: Fix some macros that are incorrectly specified in intel-iommu
+
+From: CQ Tang <cq.tang@intel.com>
+
+commit aaa59306b0b7e0ca4ba92cc04c5db101cbb1c096 upstream.
+
+Some of the macros are incorrect with wrong bit-shifts resulting in picking
+the incorrect invalidation granularity. Incorrect Source-ID in extended
+devtlb invalidation caused device side errors.
+
+To: Joerg Roedel <joro@8bytes.org>
+To: David Woodhouse <dwmw2@infradead.org>
+Cc: iommu@lists.linux-foundation.org
+Cc: linux-kernel@vger.kernel.org
+Cc: CQ Tang <cq.tang@intel.com>
+Cc: Ashok Raj <ashok.raj@intel.com>
+
+Fixes: 2f26e0a9 ("iommu/vt-d: Add basic SVM PASID support")
+Signed-off-by: CQ Tang <cq.tang@intel.com>
+Signed-off-by: Ashok Raj <ashok.raj@intel.com>
+Tested-by: CQ Tang <cq.tang@intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/intel-iommu.h | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/include/linux/intel-iommu.h
++++ b/include/linux/intel-iommu.h
+@@ -153,8 +153,8 @@ static inline void dmar_writeq(void __io
+ #define DMA_TLB_GLOBAL_FLUSH (((u64)1) << 60)
+ #define DMA_TLB_DSI_FLUSH (((u64)2) << 60)
+ #define DMA_TLB_PSI_FLUSH (((u64)3) << 60)
+-#define DMA_TLB_IIRG(type) ((type >> 60) & 7)
+-#define DMA_TLB_IAIG(val) (((val) >> 57) & 7)
++#define DMA_TLB_IIRG(type) ((type >> 60) & 3)
++#define DMA_TLB_IAIG(val) (((val) >> 57) & 3)
+ #define DMA_TLB_READ_DRAIN (((u64)1) << 49)
+ #define DMA_TLB_WRITE_DRAIN (((u64)1) << 48)
+ #define DMA_TLB_DID(id) (((u64)((id) & 0xffff)) << 32)
+@@ -164,9 +164,9 @@ static inline void dmar_writeq(void __io
+
+ /* INVALID_DESC */
+ #define DMA_CCMD_INVL_GRANU_OFFSET 61
+-#define DMA_ID_TLB_GLOBAL_FLUSH (((u64)1) << 3)
+-#define DMA_ID_TLB_DSI_FLUSH (((u64)2) << 3)
+-#define DMA_ID_TLB_PSI_FLUSH (((u64)3) << 3)
++#define DMA_ID_TLB_GLOBAL_FLUSH (((u64)1) << 4)
++#define DMA_ID_TLB_DSI_FLUSH (((u64)2) << 4)
++#define DMA_ID_TLB_PSI_FLUSH (((u64)3) << 4)
+ #define DMA_ID_TLB_READ_DRAIN (((u64)1) << 7)
+ #define DMA_ID_TLB_WRITE_DRAIN (((u64)1) << 6)
+ #define DMA_ID_TLB_DID(id) (((u64)((id & 0xffff) << 16)))
+@@ -316,8 +316,8 @@ enum {
+ #define QI_DEV_EIOTLB_SIZE (((u64)1) << 11)
+ #define QI_DEV_EIOTLB_GLOB(g) ((u64)g)
+ #define QI_DEV_EIOTLB_PASID(p) (((u64)p) << 32)
+-#define QI_DEV_EIOTLB_SID(sid) ((u64)((sid) & 0xffff) << 32)
+-#define QI_DEV_EIOTLB_QDEP(qd) (((qd) & 0x1f) << 16)
++#define QI_DEV_EIOTLB_SID(sid) ((u64)((sid) & 0xffff) << 16)
++#define QI_DEV_EIOTLB_QDEP(qd) ((u64)((qd) & 0x1f) << 4)
+ #define QI_DEV_EIOTLB_MAX_INVS 32
+
+ #define QI_PGRP_IDX(idx) (((u64)(idx)) << 55)
--- /dev/null
+From 21e722c4c8377b5bc82ad058fed12165af739c1b Mon Sep 17 00:00:00 2001
+From: Ashok Raj <ashok.raj@intel.com>
+Date: Mon, 30 Jan 2017 09:39:53 -0800
+Subject: iommu/vt-d: Tylersburg isoch identity map check is done too late.
+
+From: Ashok Raj <ashok.raj@intel.com>
+
+commit 21e722c4c8377b5bc82ad058fed12165af739c1b upstream.
+
+The check to set identity map for tylersburg is done too late. It needs
+to be done before the check for identity_map domain is done.
+
+To: Joerg Roedel <joro@8bytes.org>
+To: David Woodhouse <dwmw2@infradead.org>
+Cc: iommu@lists.linux-foundation.org
+Cc: linux-kernel@vger.kernel.org
+Cc: Ashok Raj <ashok.raj@intel.com>
+
+Fixes: 86080ccc22 ("iommu/vt-d: Allocate si_domain in init_dmars()")
+Signed-off-by: Ashok Raj <ashok.raj@intel.com>
+Reported-by: Yunhong Jiang <yunhong.jiang@intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/intel-iommu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -3325,13 +3325,14 @@ static int __init init_dmars(void)
+ iommu_identity_mapping |= IDENTMAP_GFX;
+ #endif
+
++ check_tylersburg_isoch();
++
+ if (iommu_identity_mapping) {
+ ret = si_domain_init(hw_pass_through);
+ if (ret)
+ goto free_iommu;
+ }
+
+- check_tylersburg_isoch();
+
+ /*
+ * If we copied translations from a previous kernel in the kdump
--- /dev/null
+From e42a46b6f52473661ad192f76a128a68fe301df4 Mon Sep 17 00:00:00 2001
+From: Leonard Crestez <leonard.crestez@nxp.com>
+Date: Tue, 14 Feb 2017 17:31:03 +0200
+Subject: regulator: Fix regulator_summary for deviceless consumers
+
+From: Leonard Crestez <leonard.crestez@nxp.com>
+
+commit e42a46b6f52473661ad192f76a128a68fe301df4 upstream.
+
+It is allowed to call regulator_get with a NULL dev argument
+(_regulator_get explicitly checks for it) but this causes an error later
+when printing /sys/kernel/debug/regulator_summary.
+
+Fix this by explicitly handling "deviceless" consumers in the debugfs code.
+
+Signed-off-by: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/core.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -4357,12 +4357,13 @@ static void regulator_summary_show_subtr
+ seq_puts(s, "\n");
+
+ list_for_each_entry(consumer, &rdev->consumer_list, list) {
+- if (consumer->dev->class == ®ulator_class)
++ if (consumer->dev && consumer->dev->class == ®ulator_class)
+ continue;
+
+ seq_printf(s, "%*s%-*s ",
+ (level + 1) * 3 + 1, "",
+- 30 - (level + 1) * 3, dev_name(consumer->dev));
++ 30 - (level + 1) * 3,
++ consumer->dev ? dev_name(consumer->dev) : "deviceless");
+
+ switch (rdev->desc->type) {
+ case REGULATOR_VOLTAGE:
media-properly-pass-through-media-entity-types-in-entity-enumeration.patch
ext4-fix-deadlock-between-inline_data-and-ext4_expand_extra_isize_ea.patch
spi-s3c64xx-fix-inconsistency-between-binding-and-driver.patch
+arm-at91-define-lpddr-types.patch
+arm-dts-at91-enable-dma-on-sama5d4_xplained-console.patch
+arm-dts-at91-enable-dma-on-sama5d2_xplained-console.patch
+alsa-hda-realtek-cannot-adjust-speaker-s-volume-on-a-dell-aio.patch
+alsa-hda-fix-lewisburg-audio-issue.patch
+alsa-timer-reject-user-params-with-too-small-ticks.patch
+alsa-ctxfi-fallback-dma-mask-to-32bit.patch
+alsa-seq-fix-link-corruption-by-event-error-handling.patch
+alsa-hda-add-subwoofer-support-for-dell-inspiron-17-7000-gaming.patch
+alsa-hda-fix-micmute-hotkey-problem-for-a-lenovo-aio-machine.patch
+hwmon-it87-do-not-overwrite-bit-2..6-of-pwm-control-registers.patch
+hwmon-it87-ensure-that-pwm-control-cache-is-current-before-updating-values.patch
+staging-greybus-loopback-fix-broken-udelay.patch
+staging-lustre-lnet-fix-allocation-size-for-sv_cpt_data.patch
+staging-rtl-fix-possible-null-pointer-dereference.patch
+coresight-stm-balance-enable-disable.patch
+regulator-fix-regulator_summary-for-deviceless-consumers.patch
+tpm_tis-fix-the-error-handling-of-init_tis.patch
+iommu-vt-d-fix-some-macros-that-are-incorrectly-specified-in-intel-iommu.patch
+iommu-vt-d-tylersburg-isoch-identity-map-check-is-done-too-late.patch
+cifs-fix-splice-read-for-non-cached-files.patch
--- /dev/null
+From 33b8807a6fe10d0e675e0704444373a6fad93188 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 26 Jan 2017 12:37:32 +0100
+Subject: staging: greybus: loopback: fix broken udelay
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 33b8807a6fe10d0e675e0704444373a6fad93188 upstream.
+
+The loopback driver allows the user to set a minimum delay of up to one
+second to be inserted between test iterations (i.e. request
+submissions). The delay is currently specified in microseconds and is
+implemented using udelay.
+
+Busy looping for long periods is not just anti-social; udelay must not
+be used for delays longer than a few milliseconds due to the risk of
+integer overflow.
+
+Replace the broken udelay with a usleep_range with a 100 us range for
+short delays (< 20 ms) and otherwise revert to using msleep.
+
+Fixes: b36f04fa9417 ("greybus: loopback: Convert thread delay to microseconds")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/greybus/loopback.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/greybus/loopback.c
++++ b/drivers/staging/greybus/loopback.c
+@@ -1051,8 +1051,13 @@ static int gb_loopback_fn(void *data)
+ gb_loopback_calculate_stats(gb, !!error);
+ }
+ gb->send_count++;
+- if (us_wait)
+- udelay(us_wait);
++
++ if (us_wait) {
++ if (us_wait < 20000)
++ usleep_range(us_wait, us_wait + 100);
++ else
++ msleep(us_wait / 1000);
++ }
+ }
+
+ gb_pm_runtime_put_autosuspend(bundle);
--- /dev/null
+From dc7ffefdcc28a45214aa707fdc3df6a5e611ba09 Mon Sep 17 00:00:00 2001
+From: Oleg Drokin <green@linuxhacker.ru>
+Date: Sun, 19 Feb 2017 16:35:59 -0500
+Subject: staging/lustre/lnet: Fix allocation size for sv_cpt_data
+
+From: Oleg Drokin <green@linuxhacker.ru>
+
+commit dc7ffefdcc28a45214aa707fdc3df6a5e611ba09 upstream.
+
+This is unbreaking another of those "stealth" janitor
+patches that got in and subtly broke some things.
+
+sv_cpt_data is a pointer to pointer, so need to
+dereference it twice to allocate the correct structure size.
+
+Fixes: 9899cb68c6c2 ("Staging: lustre: rpc: Use sizeof type *pointer instead of sizeof type.")
+CC: Sandhya Bankar <bankarsandhya512@gmail.com>
+Signed-off-by: Oleg Drokin <green@linuxhacker.ru>
+Reviewed-by: James Simmons <jsimmons@infradead.org>
+Reviewed-by: Doug Oucharek <doug.s.oucharek@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/lustre/lnet/selftest/rpc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/lustre/lnet/selftest/rpc.c
++++ b/drivers/staging/lustre/lnet/selftest/rpc.c
+@@ -252,7 +252,7 @@ srpc_service_init(struct srpc_service *s
+ svc->sv_shuttingdown = 0;
+
+ svc->sv_cpt_data = cfs_percpt_alloc(lnet_cpt_table(),
+- sizeof(*svc->sv_cpt_data));
++ sizeof(**svc->sv_cpt_data));
+ if (!svc->sv_cpt_data)
+ return -ENOMEM;
+
--- /dev/null
+From 6e017006022abfea5d2466cad936065f45763ad1 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Wed, 11 Jan 2017 15:53:08 +0100
+Subject: staging: rtl: fix possible NULL pointer dereference
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 6e017006022abfea5d2466cad936065f45763ad1 upstream.
+
+gcc-7 detects that wlanhdr_to_ethhdr() in two drivers calls memcpy() with
+a destination argument that an earlier function call may have set to NULL:
+
+staging/rtl8188eu/core/rtw_recv.c: In function 'wlanhdr_to_ethhdr':
+staging/rtl8188eu/core/rtw_recv.c:1318:2: warning: argument 1 null where non-null expected [-Wnonnull]
+staging/rtl8712/rtl871x_recv.c: In function 'r8712_wlanhdr_to_ethhdr':
+staging/rtl8712/rtl871x_recv.c:649:2: warning: argument 1 null where non-null expected [-Wnonnull]
+
+I'm fixing this by adding a NULL pointer check and returning failure
+from the function, which is hopefully already handled properly.
+
+This seems to date back to when the drivers were originally added,
+so backporting the fix to stable seems appropriate. There are other
+related realtek drivers in the kernel, but none of them contain a
+function with a similar name or produce this warning.
+
+Fixes: 1cc18a22b96b ("staging: r8188eu: Add files for new driver - part 5")
+Fixes: 2865d42c78a9 ("staging: r8712u: Add the new driver to the mainline kernel")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/rtl8188eu/core/rtw_recv.c | 3 +++
+ drivers/staging/rtl8712/rtl871x_recv.c | 7 ++++++-
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/rtl8188eu/core/rtw_recv.c
++++ b/drivers/staging/rtl8188eu/core/rtw_recv.c
+@@ -1383,6 +1383,9 @@ static int wlanhdr_to_ethhdr(struct recv
+ ptr = recvframe_pull(precvframe, (rmv_len-sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0)));
+ }
+
++ if (!ptr)
++ return _FAIL;
++
+ memcpy(ptr, pattrib->dst, ETH_ALEN);
+ memcpy(ptr+ETH_ALEN, pattrib->src, ETH_ALEN);
+
+--- a/drivers/staging/rtl8712/rtl871x_recv.c
++++ b/drivers/staging/rtl8712/rtl871x_recv.c
+@@ -643,11 +643,16 @@ sint r8712_wlanhdr_to_ethhdr(union recv_
+ /* append rx status for mp test packets */
+ ptr = recvframe_pull(precvframe, (rmv_len -
+ sizeof(struct ethhdr) + 2) - 24);
++ if (!ptr)
++ return _FAIL;
+ memcpy(ptr, get_rxmem(precvframe), 24);
+ ptr += 24;
+- } else
++ } else {
+ ptr = recvframe_pull(precvframe, (rmv_len -
+ sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0)));
++ if (!ptr)
++ return _FAIL;
++ }
+
+ memcpy(ptr, pattrib->dst, ETH_ALEN);
+ memcpy(ptr + ETH_ALEN, pattrib->src, ETH_ALEN);
--- /dev/null
+From 5939eaf4f9d432586dd2cdeea778506471e8088e Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <weiyongjun1@huawei.com>
+Date: Tue, 7 Feb 2017 15:51:47 +0000
+Subject: tpm_tis: fix the error handling of init_tis()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+commit 5939eaf4f9d432586dd2cdeea778506471e8088e upstream.
+
+Add the missing platform_driver_unregister() and remove the duplicate
+platform_device_unregister(force_pdev) in the error handling case.
+
+Fixes: 00194826e6be ("tpm_tis: Clean up the force=1 module parameter")
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Reviewed-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/tpm/tpm_tis.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/char/tpm/tpm_tis.c
++++ b/drivers/char/tpm/tpm_tis.c
+@@ -421,7 +421,7 @@ err_pnp:
+ acpi_bus_unregister_driver(&tis_acpi_driver);
+ err_acpi:
+ #endif
+- platform_device_unregister(force_pdev);
++ platform_driver_unregister(&tis_drv);
+ err_platform:
+ if (force_pdev)
+ platform_device_unregister(force_pdev);
projects / thirdparty / kernel / stable-queue.git / commitdiff
