--- /dev/null
+From ab949d519601880fd46e8bc1445d6a453bf2dc09 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 2 Jan 2017 11:37:04 +0100
+Subject: ALSA: hda - Fix deadlock of controller device lock at unbinding
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit ab949d519601880fd46e8bc1445d6a453bf2dc09 upstream.
+
+Imre Deak reported a deadlock of HD-audio driver at unbinding while
+it's still in probing. Since we probe the codecs asynchronously in a
+work, the codec driver probe may still be kicked off while the
+controller itself is being unbound. And, azx_remove() tries to
+process all pending tasks via cancel_work_sync() for fixing the other
+races (see commit [0b8c82190c12: ALSA: hda - Cancel probe work instead
+of flush at remove]), now we may meet a bizarre deadlock:
+
+Unbind snd_hda_intel via sysfs:
+ device_release_driver() ->
+ device_lock(snd_hda_intel) ->
+ azx_remove() ->
+ cancel_work_sync(azx_probe_work)
+
+azx_probe_work():
+ codec driver probe() ->
+ __driver_attach() ->
+ device_lock(snd_hda_intel)
+
+This deadlock is caused by the fact that both device_release_driver()
+and driver_probe_device() take both the device and its parent locks at
+the same time. The codec device sets the controller device as its
+parent, and this lock is taken before the probe() callback is called,
+while the controller remove() callback gets called also with the same
+lock.
+
+In this patch, as an ugly workaround, we unlock the controller device
+temporarily during cancel_work_sync() call. The race against another
+bind call should be still suppressed by the parent's device lock.
+
+Reported-by: Imre Deak <imre.deak@intel.com>
+Fixes: 0b8c82190c12 ("ALSA: hda - Cancel probe work instead of flush at remove")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_intel.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2155,7 +2155,20 @@ static void azx_remove(struct pci_dev *p
+ /* cancel the pending probing work */
+ chip = card->private_data;
+ hda = container_of(chip, struct hda_intel, chip);
++ /* FIXME: below is an ugly workaround.
++ * Both device_release_driver() and driver_probe_device()
++ * take *both* the device's and its parent's lock before
++ * calling the remove() and probe() callbacks. The codec
++ * probe takes the locks of both the codec itself and its
++ * parent, i.e. the PCI controller dev. Meanwhile, when
++ * the PCI controller is unbound, it takes its lock, too
++ * ==> ouch, a deadlock!
++ * As a workaround, we unlock temporarily here the controller
++ * device during cancel_work_sync() call.
++ */
++ device_unlock(&pci->dev);
+ cancel_work_sync(&hda->probe_work);
++ device_lock(&pci->dev);
+
+ snd_card_free(card);
+ }
mips-r2-on-r6-multu-maddu-msubu-emulation-bugfix.patch
brcmfmac-ensure-pointer-correctly-set-if-skb-data-location-changes.patch
brcmfmac-make-skb-header-writable-before-use.patch
+staging-lustre-llite-move-root_squash-from-sysfs-to-debugfs.patch
+staging-wlan-ng-add-missing-byte-order-conversion.patch
+staging-emxx_udc-remove-incorrect-__init-annotations.patch
+staging-lustre-mdc-make-it_open-take-lookup-bits-lock.patch
+alsa-hda-fix-deadlock-of-controller-device-lock-at-unbinding.patch
+sparc64-fix-fault-handling-in-ngbzero.s-and-genbzero.s.patch
--- /dev/null
+From 3c7f62212018b904ae17f5636ead18a4dca3a88f Mon Sep 17 00:00:00 2001
+From: Dave Aldridge <david.j.aldridge@oracle.com>
+Date: Tue, 9 May 2017 02:57:35 -0600
+Subject: sparc64: fix fault handling in NGbzero.S and GENbzero.S
+
+From: Dave Aldridge <david.j.aldridge@oracle.com>
+
+commit 3c7f62212018b904ae17f5636ead18a4dca3a88f upstream.
+
+When any of the functions contained in NGbzero.S and GENbzero.S
+vector through *bzero_from_clear_user, we may end up taking a
+fault when executing one of the store alternate address space
+instructions. If this happens, the exception handler does not
+restore the %asi register.
+
+This commit fixes the issue by introducing a new exception
+handler that ensures the %asi register is restored when
+a fault is handled.
+
+Orabug: 25577560
+
+Signed-off-by: Dave Aldridge <david.j.aldridge@oracle.com>
+Reviewed-by: Rob Gardner <rob.gardner@oracle.com>
+Reviewed-by: Babu Moger <babu.moger@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/sparc/kernel/head_64.S | 6 ++++++
+ arch/sparc/lib/GENbzero.S | 2 +-
+ arch/sparc/lib/NGbzero.S | 2 +-
+ 3 files changed, 8 insertions(+), 2 deletions(-)
+
+--- a/arch/sparc/kernel/head_64.S
++++ b/arch/sparc/kernel/head_64.S
+@@ -935,3 +935,9 @@ ENTRY(__retl_o1)
+ retl
+ mov %o1, %o0
+ ENDPROC(__retl_o1)
++
++ENTRY(__retl_o1_asi)
++ wr %o5, 0x0, %asi
++ retl
++ mov %o1, %o0
++ENDPROC(__retl_o1_asi)
+--- a/arch/sparc/lib/GENbzero.S
++++ b/arch/sparc/lib/GENbzero.S
+@@ -8,7 +8,7 @@
+ 98: x,y; \
+ .section __ex_table,"a";\
+ .align 4; \
+- .word 98b, __retl_o1; \
++ .word 98b, __retl_o1_asi;\
+ .text; \
+ .align 4;
+
+--- a/arch/sparc/lib/NGbzero.S
++++ b/arch/sparc/lib/NGbzero.S
+@@ -8,7 +8,7 @@
+ 98: x,y; \
+ .section __ex_table,"a";\
+ .align 4; \
+- .word 98b, __retl_o1; \
++ .word 98b, __retl_o1_asi;\
+ .text; \
+ .align 4;
+
--- /dev/null
+From 4f3445067d5f78fb8d1970b02610f85c2f377ea4 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 16 Dec 2016 10:09:39 +0100
+Subject: staging: emxx_udc: remove incorrect __init annotations
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 4f3445067d5f78fb8d1970b02610f85c2f377ea4 upstream.
+
+The probe function is not marked __init, but some other functions
+are. This leads to a warning on older compilers (e.g. gcc-4.3),
+and can cause executing freed memory when built with those
+compilers:
+
+WARNING: drivers/staging/emxx_udc/emxx_udc.o(.text+0x2d78): Section mismatch in reference from the function nbu2ss_drv_probe() to the function .init.text:nbu2ss_drv_contest_init()
+
+This removes the annotations.
+
+Fixes: 33aa8d45a4fe ("staging: emxx_udc: Add Emma Mobile USB Gadget driver")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/emxx_udc/emxx_udc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/emxx_udc/emxx_udc.c
++++ b/drivers/staging/emxx_udc/emxx_udc.c
+@@ -3160,7 +3160,7 @@ static const struct {
+ };
+
+ /*-------------------------------------------------------------------------*/
+-static void __init nbu2ss_drv_ep_init(struct nbu2ss_udc *udc)
++static void nbu2ss_drv_ep_init(struct nbu2ss_udc *udc)
+ {
+ int i;
+
+@@ -3191,7 +3191,7 @@ static void __init nbu2ss_drv_ep_init(st
+
+ /*-------------------------------------------------------------------------*/
+ /* platform_driver */
+-static int __init nbu2ss_drv_contest_init(
++static int nbu2ss_drv_contest_init(
+ struct platform_device *pdev,
+ struct nbu2ss_udc *udc)
+ {
--- /dev/null
+From 4c13990e35b9f053857d4ad83bf0f58e612ec414 Mon Sep 17 00:00:00 2001
+From: Oleg Drokin <green@linuxhacker.ru>
+Date: Wed, 7 Dec 2016 17:41:27 -0500
+Subject: staging/lustre/llite: move root_squash from sysfs to debugfs
+
+From: Oleg Drokin <green@linuxhacker.ru>
+
+commit 4c13990e35b9f053857d4ad83bf0f58e612ec414 upstream.
+
+root_squash control got accidentally moved to sysfs instead of
+debugfs, and the write side of it was also broken expecting a
+userspace buffer.
+It contains both uid and gid values in a single file, so debugfs
+is a clear place for it.
+
+Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
+Fixes: c948390f10ccc "fix inconsistencies of root squash feature"
+Signed-off-by: Oleg Drokin <green@linuxhacker.ru>
+Reviewed-by: James Simmons <jsimmons@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/lustre/lustre/llite/lproc_llite.c | 27 ++++++++++++----------
+ 1 file changed, 15 insertions(+), 12 deletions(-)
+
+--- a/drivers/staging/lustre/lustre/llite/lproc_llite.c
++++ b/drivers/staging/lustre/lustre/llite/lproc_llite.c
+@@ -924,27 +924,29 @@ static ssize_t ll_unstable_stats_seq_wri
+ }
+ LPROC_SEQ_FOPS(ll_unstable_stats);
+
+-static ssize_t root_squash_show(struct kobject *kobj, struct attribute *attr,
+- char *buf)
++static int ll_root_squash_seq_show(struct seq_file *m, void *v)
+ {
+- struct ll_sb_info *sbi = container_of(kobj, struct ll_sb_info,
+- ll_kobj);
++ struct super_block *sb = m->private;
++ struct ll_sb_info *sbi = ll_s2sbi(sb);
+ struct root_squash_info *squash = &sbi->ll_squash;
+
+- return sprintf(buf, "%u:%u\n", squash->rsi_uid, squash->rsi_gid);
++ seq_printf(m, "%u:%u\n", squash->rsi_uid, squash->rsi_gid);
++ return 0;
+ }
+
+-static ssize_t root_squash_store(struct kobject *kobj, struct attribute *attr,
+- const char *buffer, size_t count)
++static ssize_t ll_root_squash_seq_write(struct file *file,
++ const char __user *buffer,
++ size_t count, loff_t *off)
+ {
+- struct ll_sb_info *sbi = container_of(kobj, struct ll_sb_info,
+- ll_kobj);
++ struct seq_file *m = file->private_data;
++ struct super_block *sb = m->private;
++ struct ll_sb_info *sbi = ll_s2sbi(sb);
+ struct root_squash_info *squash = &sbi->ll_squash;
+
+ return lprocfs_wr_root_squash(buffer, count, squash,
+- ll_get_fsname(sbi->ll_sb, NULL, 0));
++ ll_get_fsname(sb, NULL, 0));
+ }
+-LUSTRE_RW_ATTR(root_squash);
++LPROC_SEQ_FOPS(ll_root_squash);
+
+ static int ll_nosquash_nids_seq_show(struct seq_file *m, void *v)
+ {
+@@ -997,6 +999,8 @@ static struct lprocfs_vars lprocfs_llite
+ { "statahead_stats", &ll_statahead_stats_fops, NULL, 0 },
+ { "unstable_stats", &ll_unstable_stats_fops, NULL },
+ { "sbi_flags", &ll_sbi_flags_fops, NULL, 0 },
++ { .name = "root_squash",
++ .fops = &ll_root_squash_fops },
+ { .name = "nosquash_nids",
+ .fops = &ll_nosquash_nids_fops },
+ { NULL }
+@@ -1027,7 +1031,6 @@ static struct attribute *llite_attrs[] =
+ &lustre_attr_max_easize.attr,
+ &lustre_attr_default_easize.attr,
+ &lustre_attr_xattr_cache.attr,
+- &lustre_attr_root_squash.attr,
+ NULL,
+ };
+
--- /dev/null
+From 26d2bf1e71525f4c0f644820c30d1344633159e2 Mon Sep 17 00:00:00 2001
+From: Patrick Farrell <paf@cray.com>
+Date: Sat, 28 Jan 2017 19:05:14 -0500
+Subject: staging: lustre: mdc: Make IT_OPEN take lookup bits lock
+
+From: Patrick Farrell <paf@cray.com>
+
+commit 26d2bf1e71525f4c0f644820c30d1344633159e2 upstream.
+
+An earlier commit accidentally changed handling of IT_OPEN,
+making it take the MDS_INODELOCK_UPDATE bits lock instead of
+MDS_INODELOCK_LOOKUP. This does not cause any known bugs.
+
+Signed-off-by: Patrick Farrell <paf@cray.com>
+Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-8842
+Reviewed-on: https://review.whamcloud.com/23797
+Fixes: 70a251f68dea ("staging: lustre: obd: decruft md_enqueue() and md_intent_lock()"
+Reviewed-by: John L. Hammond <john.hammond@intel.com>
+Reviewed-by: Lai Siyao <lai.siyao@intel.com>
+Reviewed-by: Oleg Drokin <oleg.drokin@intel.com>
+Signed-off-by: James Simmons <jsimmons@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/lustre/lustre/mdc/mdc_locks.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/lustre/lustre/mdc/mdc_locks.c
++++ b/drivers/staging/lustre/lustre/mdc/mdc_locks.c
+@@ -721,7 +721,7 @@ int mdc_enqueue(struct obd_export *exp,
+ LASSERT(!policy);
+
+ saved_flags |= LDLM_FL_HAS_INTENT;
+- if (it->it_op & (IT_OPEN | IT_UNLINK | IT_GETATTR | IT_READDIR))
++ if (it->it_op & (IT_UNLINK | IT_GETATTR | IT_READDIR))
+ policy = &update_policy;
+ else if (it->it_op & IT_LAYOUT)
+ policy = &layout_policy;
--- /dev/null
+From 2c474b8579e9b67ff72b2bcefce9f53c7f4469d4 Mon Sep 17 00:00:00 2001
+From: Igor Pylypiv <igor.pylypiv@gmail.com>
+Date: Mon, 30 Jan 2017 21:39:54 -0800
+Subject: staging: wlan-ng: add missing byte order conversion
+
+From: Igor Pylypiv <igor.pylypiv@gmail.com>
+
+commit 2c474b8579e9b67ff72b2bcefce9f53c7f4469d4 upstream.
+
+Conversion macros le16_to_cpu was removed and that caused new sparse warning
+
+sparse output:
+drivers/staging/wlan-ng/p80211netdev.c:241:44: warning: incorrect type in argument 2 (different base types)
+drivers/staging/wlan-ng/p80211netdev.c:241:44: expected unsigned short [unsigned] [usertype] fc
+drivers/staging/wlan-ng/p80211netdev.c:241:44: got restricted __le16 [usertype] fc
+
+Fixes: 7ad82572348c ("staging:wlan-ng:Fix sparse warning")
+Signed-off-by: Igor Pylypiv <igor.pylypiv@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/wlan-ng/p80211netdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/wlan-ng/p80211netdev.c
++++ b/drivers/staging/wlan-ng/p80211netdev.c
+@@ -232,7 +232,7 @@ static int p80211_convert_to_ether(struc
+ struct p80211_hdr_a3 *hdr;
+
+ hdr = (struct p80211_hdr_a3 *)skb->data;
+- if (p80211_rx_typedrop(wlandev, hdr->fc))
++ if (p80211_rx_typedrop(wlandev, le16_to_cpu(hdr->fc)))
+ return CONV_TO_ETHER_SKIPPED;
+
+ /* perform mcast filtering: allow my local address through but reject
projects / thirdparty / kernel / stable-queue.git / commitdiff
