--- /dev/null
+From e8e94ed6285428ab780cd7b0df4622f71eceb39e Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Tue, 2 Jun 2015 22:03:28 +0000
+Subject: ARM: dts: mx23: fix iio-hwmon support
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+commit e8e94ed6285428ab780cd7b0df4622f71eceb39e upstream.
+
+In order to get iio-hwmon support, the lradc must be declared as an
+iio provider. So fix this issue by adding the #io-channel-cells property.
+
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Fixes: bd798f9c7b30 ("ARM: dts: mxs: Add iio-hwmon to mx23 soc")
+Reviewed-by: Marek Vasut <marex@denx.de>
+Reviewed-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/imx23.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/boot/dts/imx23.dtsi
++++ b/arch/arm/boot/dts/imx23.dtsi
+@@ -435,6 +435,7 @@
+ interrupts = <36 37 38 39 40 41 42 43 44>;
+ status = "disabled";
+ clocks = <&clks 26>;
++ #io-channel-cells = <1>;
+ };
+
+ spdif@80054000 {
--- /dev/null
+From 64ad6c488975d7516230cf7849190a991fd615ae Mon Sep 17 00:00:00 2001
+From: Omar Sandoval <osandov@osandov.com>
+Date: Tue, 2 Jun 2015 17:31:00 -0700
+Subject: Btrfs: don't invalidate root dentry when subvolume deletion fails
+
+From: Omar Sandoval <osandov@osandov.com>
+
+commit 64ad6c488975d7516230cf7849190a991fd615ae upstream.
+
+Since commit bafc9b754f75 ("vfs: More precise tests in d_invalidate"),
+mounted subvolumes can be deleted because d_invalidate() won't fail.
+However, we run into problems when we attempt to delete the default
+subvolume while it is mounted as the root filesystem:
+
+ # btrfs subvol list /
+ ID 257 gen 306 top level 5 path rootvol
+ ID 267 gen 334 top level 5 path snap1
+ # btrfs subvol get-default /
+ ID 267 gen 334 top level 5 path snap1
+ # btrfs inspect-internal rootid /
+ 267
+ # mount -o subvol=/ /dev/vda1 /mnt
+ # btrfs subvol del /mnt/snap1
+ Delete subvolume (no-commit): '/mnt/snap1'
+ ERROR: cannot delete '/mnt/snap1' - Operation not permitted
+ # findmnt /
+ findmnt: can't read /proc/mounts: No such file or directory
+ # ls /proc
+ #
+
+Markus reported that this same scenario simply led to a kernel oops.
+
+This happens because in btrfs_ioctl_snap_destroy(), we call
+d_invalidate() before we check may_destroy_subvol(), which means that we
+detach the submounts and drop the dentry before erroring out. Instead,
+we should only invalidate the dentry once the deletion has succeeded.
+Additionally, the shrink_dcache_sb() isn't necessary; d_invalidate()
+will prune the dcache for the deleted subvolume.
+
+Fixes: bafc9b754f75 ("vfs: More precise tests in d_invalidate")
+Reported-by: Markus Schauler <mschauler@gmail.com>
+Signed-off-by: Omar Sandoval <osandov@osandov.com>
+Signed-off-by: Chris Mason <clm@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/btrfs/ioctl.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -2413,8 +2413,6 @@ static noinline int btrfs_ioctl_snap_des
+ goto out_unlock_inode;
+ }
+
+- d_invalidate(dentry);
+-
+ down_write(&root->fs_info->subvol_sem);
+
+ err = may_destroy_subvol(dest);
+@@ -2508,7 +2506,7 @@ out_up_write:
+ out_unlock_inode:
+ mutex_unlock(&inode->i_mutex);
+ if (!err) {
+- shrink_dcache_sb(root->fs_info->sb);
++ d_invalidate(dentry);
+ btrfs_invalidate_inodes(dest);
+ d_delete(dentry);
+ ASSERT(dest->send_in_progress == 0);
--- /dev/null
+From 9136291f1dbc1d4d1cacd2840fb35f4f3ce16c46 Mon Sep 17 00:00:00 2001
+From: Lior Amsalem <alior@marvell.com>
+Date: Tue, 26 May 2015 15:07:32 +0200
+Subject: dmaengine: mv_xor: bug fix for racing condition in descriptors cleanup
+
+From: Lior Amsalem <alior@marvell.com>
+
+commit 9136291f1dbc1d4d1cacd2840fb35f4f3ce16c46 upstream.
+
+This patch fixes a bug in the XOR driver where the cleanup function can be
+called and free descriptors that never been processed by the engine (which
+result in data errors).
+
+The cleanup function will free descriptors based on the ownership bit in
+the descriptors.
+
+Fixes: ff7b04796d98 ("dmaengine: DMA engine driver for Marvell XOR engine")
+Signed-off-by: Lior Amsalem <alior@marvell.com>
+Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Reviewed-by: Ofer Heifetz <oferh@marvell.com>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/mv_xor.c | 74 ++++++++++++++++++++++++++++++++-------------------
+ drivers/dma/mv_xor.h | 1
+ 2 files changed, 48 insertions(+), 27 deletions(-)
+
+--- a/drivers/dma/mv_xor.c
++++ b/drivers/dma/mv_xor.c
+@@ -273,7 +273,8 @@ static void mv_xor_slot_cleanup(struct m
+ dma_cookie_t cookie = 0;
+ int busy = mv_chan_is_busy(mv_chan);
+ u32 current_desc = mv_chan_get_current_desc(mv_chan);
+- int seen_current = 0;
++ int current_cleaned = 0;
++ struct mv_xor_desc *hw_desc;
+
+ dev_dbg(mv_chan_to_devp(mv_chan), "%s %d\n", __func__, __LINE__);
+ dev_dbg(mv_chan_to_devp(mv_chan), "current_desc %x\n", current_desc);
+@@ -285,38 +286,57 @@ static void mv_xor_slot_cleanup(struct m
+
+ list_for_each_entry_safe(iter, _iter, &mv_chan->chain,
+ chain_node) {
+- prefetch(_iter);
+- prefetch(&_iter->async_tx);
+
+- /* do not advance past the current descriptor loaded into the
+- * hardware channel, subsequent descriptors are either in
+- * process or have not been submitted
+- */
+- if (seen_current)
+- break;
+-
+- /* stop the search if we reach the current descriptor and the
+- * channel is busy
+- */
+- if (iter->async_tx.phys == current_desc) {
+- seen_current = 1;
+- if (busy)
++ /* clean finished descriptors */
++ hw_desc = iter->hw_desc;
++ if (hw_desc->status & XOR_DESC_SUCCESS) {
++ cookie = mv_xor_run_tx_complete_actions(iter, mv_chan,
++ cookie);
++
++ /* done processing desc, clean slot */
++ mv_xor_clean_slot(iter, mv_chan);
++
++ /* break if we did cleaned the current */
++ if (iter->async_tx.phys == current_desc) {
++ current_cleaned = 1;
+ break;
++ }
++ } else {
++ if (iter->async_tx.phys == current_desc) {
++ current_cleaned = 0;
++ break;
++ }
+ }
+-
+- cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, cookie);
+-
+- if (mv_xor_clean_slot(iter, mv_chan))
+- break;
+ }
+
+ if ((busy == 0) && !list_empty(&mv_chan->chain)) {
+- struct mv_xor_desc_slot *chain_head;
+- chain_head = list_entry(mv_chan->chain.next,
+- struct mv_xor_desc_slot,
+- chain_node);
+-
+- mv_xor_start_new_chain(mv_chan, chain_head);
++ if (current_cleaned) {
++ /*
++ * current descriptor cleaned and removed, run
++ * from list head
++ */
++ iter = list_entry(mv_chan->chain.next,
++ struct mv_xor_desc_slot,
++ chain_node);
++ mv_xor_start_new_chain(mv_chan, iter);
++ } else {
++ if (!list_is_last(&iter->chain_node, &mv_chan->chain)) {
++ /*
++ * descriptors are still waiting after
++ * current, trigger them
++ */
++ iter = list_entry(iter->chain_node.next,
++ struct mv_xor_desc_slot,
++ chain_node);
++ mv_xor_start_new_chain(mv_chan, iter);
++ } else {
++ /*
++ * some descriptors are still waiting
++ * to be cleaned
++ */
++ tasklet_schedule(&mv_chan->irq_tasklet);
++ }
++ }
+ }
+
+ if (cookie > 0)
+--- a/drivers/dma/mv_xor.h
++++ b/drivers/dma/mv_xor.h
+@@ -31,6 +31,7 @@
+ #define XOR_OPERATION_MODE_XOR 0
+ #define XOR_OPERATION_MODE_MEMCPY 2
+ #define XOR_DESCRIPTOR_SWAP BIT(14)
++#define XOR_DESC_SUCCESS 0x40000000
+
+ #define XOR_DESC_DMA_OWNED BIT(31)
+ #define XOR_DESC_EOD_INT_EN BIT(31)
--- /dev/null
+From 347d7e45bd09ce09cbc30d5cea9de377eb22f55c Mon Sep 17 00:00:00 2001
+From: "Stevens, Nick" <Nick.Stevens@digi.com>
+Date: Wed, 1 Jul 2015 16:07:41 +0000
+Subject: hwmon: (mcp3021) Fix broken output scaling
+
+From: "Stevens, Nick" <Nick.Stevens@digi.com>
+
+commit 347d7e45bd09ce09cbc30d5cea9de377eb22f55c upstream.
+
+The mcp3021 scaling code is dividing the VDD (full-scale) value in
+millivolts by the A2D resolution to obtain the scaling factor. When VDD
+is 3300mV (the standard value) and the resolution is 12-bit (4096
+divisions), the result is a scale factor of 3300/4096, which is always
+one. Effectively, the raw A2D reading is always being returned because
+no scaling is applied.
+
+This patch fixes the issue and simplifies the register-to-volts
+calculation, removing the unneeded "output_scale" struct member.
+
+Signed-off-by: Nick Stevens <Nick.Stevens@digi.com>
+[Guenter Roeck: Dropped unnecessary value check]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/mcp3021.c | 14 +-------------
+ 1 file changed, 1 insertion(+), 13 deletions(-)
+
+--- a/drivers/hwmon/mcp3021.c
++++ b/drivers/hwmon/mcp3021.c
+@@ -31,14 +31,11 @@
+ /* output format */
+ #define MCP3021_SAR_SHIFT 2
+ #define MCP3021_SAR_MASK 0x3ff
+-
+ #define MCP3021_OUTPUT_RES 10 /* 10-bit resolution */
+-#define MCP3021_OUTPUT_SCALE 4
+
+ #define MCP3221_SAR_SHIFT 0
+ #define MCP3221_SAR_MASK 0xfff
+ #define MCP3221_OUTPUT_RES 12 /* 12-bit resolution */
+-#define MCP3221_OUTPUT_SCALE 1
+
+ enum chips {
+ mcp3021,
+@@ -54,7 +51,6 @@ struct mcp3021_data {
+ u16 sar_shift;
+ u16 sar_mask;
+ u8 output_res;
+- u8 output_scale;
+ };
+
+ static int mcp3021_read16(struct i2c_client *client)
+@@ -84,13 +80,7 @@ static int mcp3021_read16(struct i2c_cli
+
+ static inline u16 volts_from_reg(struct mcp3021_data *data, u16 val)
+ {
+- if (val == 0)
+- return 0;
+-
+- val = val * data->output_scale - data->output_scale / 2;
+-
+- return val * DIV_ROUND_CLOSEST(data->vdd,
+- (1 << data->output_res) * data->output_scale);
++ return DIV_ROUND_CLOSEST(data->vdd * val, 1 << data->output_res);
+ }
+
+ static ssize_t show_in_input(struct device *dev, struct device_attribute *attr,
+@@ -132,14 +122,12 @@ static int mcp3021_probe(struct i2c_clie
+ data->sar_shift = MCP3021_SAR_SHIFT;
+ data->sar_mask = MCP3021_SAR_MASK;
+ data->output_res = MCP3021_OUTPUT_RES;
+- data->output_scale = MCP3021_OUTPUT_SCALE;
+ break;
+
+ case mcp3221:
+ data->sar_shift = MCP3221_SAR_SHIFT;
+ data->sar_mask = MCP3221_SAR_MASK;
+ data->output_res = MCP3221_OUTPUT_RES;
+- data->output_scale = MCP3221_OUTPUT_SCALE;
+ break;
+ }
+
--- /dev/null
+From 56172d81a9bc37a69b95dd627b8d48135c9c7b31 Mon Sep 17 00:00:00 2001
+From: Constantine Shulyupin <const@ctera.com>
+Date: Fri, 26 Jun 2015 17:47:44 +0300
+Subject: hwmon: (nct7802) fix visibility of temp3
+
+From: Constantine Shulyupin <const@ctera.com>
+
+commit 56172d81a9bc37a69b95dd627b8d48135c9c7b31 upstream.
+
+Excerpt from datasheet:
+7.2.32 Mode Selection Register
+RTD3_MD : 00=Closed , 01=Reserved , 10=Thermistor mode , 11=Voltage sense
+
+Show temp3 only in Thermistor mode
+
+Signed-off-by: Constantine Shulyupin <const@MakeLinux.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/nct7802.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/nct7802.c
++++ b/drivers/hwmon/nct7802.c
+@@ -547,7 +547,7 @@ static umode_t nct7802_temp_is_visible(s
+ if (index >= 9 && index < 18 &&
+ (reg & 0x0c) != 0x04 && (reg & 0x0c) != 0x08) /* RD2 */
+ return 0;
+- if (index >= 18 && index < 27 && (reg & 0x30) != 0x10) /* RD3 */
++ if (index >= 18 && index < 27 && (reg & 0x30) != 0x20) /* RD3 */
+ return 0;
+ if (index >= 27 && index < 35) /* local */
+ return attr->mode;
--- /dev/null
+From bd6919228d7e1867ae9e24ab27e3e4a366c87d21 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Thu, 25 Jun 2015 17:01:40 +1000
+Subject: md: clear mddev->private when it has been freed.
+
+From: NeilBrown <neilb@suse.de>
+
+commit bd6919228d7e1867ae9e24ab27e3e4a366c87d21 upstream.
+
+If ->private is set when ->run is called, it is assumed to be
+a 'config' prepared as part of 'reshape'.
+
+So it is important when we free that config, that we also clear ->private.
+This is not often a problem as the mddev will normally be discarded
+shortly after the config us freed.
+However if an 'assemble' races with a final close, the assemble can use
+the old mddev which has a stale ->private. This leads to any of
+various sorts of crashes.
+
+So clear ->private after calling ->free().
+
+Reported-by: Nate Clark <nate@neworld.us>
+Fixes: afa0f557cb15 ("md: rename ->stop to ->free")
+Signed-off-by: NeilBrown <neilb@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/md.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -5159,6 +5159,7 @@ int md_run(struct mddev *mddev)
+ mddev_detach(mddev);
+ if (mddev->private)
+ pers->free(mddev, mddev->private);
++ mddev->private = NULL;
+ module_put(pers->owner);
+ bitmap_destroy(mddev);
+ return err;
+@@ -5294,6 +5295,7 @@ static void md_clean(struct mddev *mddev
+ mddev->changed = 0;
+ mddev->degraded = 0;
+ mddev->safemode = 0;
++ mddev->private = NULL;
+ mddev->merge_check_needed = 0;
+ mddev->bitmap_info.offset = 0;
+ mddev->bitmap_info.default_offset = 0;
+@@ -5366,6 +5368,7 @@ static void __md_stop(struct mddev *mdde
+ mddev->pers = NULL;
+ spin_unlock(&mddev->lock);
+ pers->free(mddev, mddev->private);
++ mddev->private = NULL;
+ if (pers->sync_request && mddev->to_remove == NULL)
+ mddev->to_remove = &md_redundancy_group;
+ module_put(pers->owner);
--- /dev/null
+From 4e023612325a9034a542bfab79f78b1fe5ebb841 Mon Sep 17 00:00:00 2001
+From: Firo Yang <firogm@gmail.com>
+Date: Thu, 11 Jun 2015 09:41:10 +0800
+Subject: md: fix a build warning
+
+From: Firo Yang <firogm@gmail.com>
+
+commit 4e023612325a9034a542bfab79f78b1fe5ebb841 upstream.
+
+Warning like this:
+
+drivers/md/md.c: In function "update_array_info":
+drivers/md/md.c:6394:26: warning: logical not is only applied
+to the left hand side of comparison [-Wlogical-not-parentheses]
+ !mddev->persistent != info->not_persistent||
+
+Fix it as Neil Brown said:
+mddev->persistent != !info->not_persistent ||
+
+Signed-off-by: Firo Yang <firogm@gmail.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/md.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -6380,7 +6380,7 @@ static int update_array_info(struct mdde
+ mddev->ctime != info->ctime ||
+ mddev->level != info->level ||
+ /* mddev->layout != info->layout || */
+- !mddev->persistent != info->not_persistent||
++ mddev->persistent != !info->not_persistent ||
+ mddev->chunk_sectors != info->chunk_size >> 9 ||
+ /* ignore bottom 8 bits of state, and allow SB_BITMAP_PRESENT to change */
+ ((state^info->state) & 0xfffffe00)
--- /dev/null
+From d3b178adb3a3adf54ecf77758138b654c3ee7f09 Mon Sep 17 00:00:00 2001
+From: Goldwyn Rodrigues <rgoldwyn@suse.com>
+Date: Wed, 22 Jul 2015 12:09:17 -0500
+Subject: md: Skip cluster setup for dm-raid
+
+From: Goldwyn Rodrigues <rgoldwyn@suse.com>
+
+commit d3b178adb3a3adf54ecf77758138b654c3ee7f09 upstream.
+
+There is a bug that the bitmap superblock isn't initialised properly for
+dm-raid, so a new field can have garbage in new fields.
+(dm-raid does initialisation in the kernel - md initialised the
+ superblock in mdadm).
+
+This means that for dm-raid we cannot currently trust the new ->nodes
+field. So:
+ - use __GFP_ZERO to initialise the superblock properly for all new
+ arrays
+ - initialise all fields in bitmap_info in bitmap_new_disk_sb
+ - ignore ->nodes for dm arrays (yes, this is a hack)
+
+This bug exposes dm-raid to bug in the (still experimental) md-cluster
+code, so it is suitable for -stable. It does cause crashes.
+
+References: https://bugzilla.kernel.org/show_bug.cgi?id=100491
+Signed-off-By: Goldwyn Rodrigues <rgoldwyn@suse.com>
+Signed-off-by: NeilBrown <neilb@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/bitmap.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/drivers/md/bitmap.c
++++ b/drivers/md/bitmap.c
+@@ -494,7 +494,7 @@ static int bitmap_new_disk_sb(struct bit
+ bitmap_super_t *sb;
+ unsigned long chunksize, daemon_sleep, write_behind;
+
+- bitmap->storage.sb_page = alloc_page(GFP_KERNEL);
++ bitmap->storage.sb_page = alloc_page(GFP_KERNEL | __GFP_ZERO);
+ if (bitmap->storage.sb_page == NULL)
+ return -ENOMEM;
+ bitmap->storage.sb_page->index = 0;
+@@ -541,6 +541,7 @@ static int bitmap_new_disk_sb(struct bit
+ sb->state = cpu_to_le32(bitmap->flags);
+ bitmap->events_cleared = bitmap->mddev->events;
+ sb->events_cleared = cpu_to_le64(bitmap->mddev->events);
++ bitmap->mddev->bitmap_info.nodes = 0;
+
+ kunmap_atomic(sb);
+
+@@ -611,8 +612,16 @@ re_read:
+ daemon_sleep = le32_to_cpu(sb->daemon_sleep) * HZ;
+ write_behind = le32_to_cpu(sb->write_behind);
+ sectors_reserved = le32_to_cpu(sb->sectors_reserved);
+- nodes = le32_to_cpu(sb->nodes);
+- strlcpy(bitmap->mddev->bitmap_info.cluster_name, sb->cluster_name, 64);
++ /* XXX: This is a hack to ensure that we don't use clustering
++ * in case:
++ * - dm-raid is in use and
++ * - the nodes written in bitmap_sb is erroneous.
++ */
++ if (!bitmap->mddev->sync_super) {
++ nodes = le32_to_cpu(sb->nodes);
++ strlcpy(bitmap->mddev->bitmap_info.cluster_name,
++ sb->cluster_name, 64);
++ }
+
+ /* verify that the bitmap-specific fields are valid */
+ if (sb->magic != cpu_to_le32(BITMAP_MAGIC))
--- /dev/null
+From 9a8c0fa861e4db60409b4dda254cef5e17e4d43c Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Thu, 25 Jun 2015 17:06:40 +1000
+Subject: md: unlock mddev_lock on an error path.
+
+From: NeilBrown <neilb@suse.de>
+
+commit 9a8c0fa861e4db60409b4dda254cef5e17e4d43c upstream.
+
+This error path retuns while still holding the lock - bad.
+
+Fixes: 6791875e2e53 ("md: make reconfig_mutex optional for writes to md sysfs files.")
+Signed-off-by: NeilBrown <neilb@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/md.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -4005,8 +4005,10 @@ new_dev_store(struct mddev *mddev, const
+ else
+ rdev = md_import_device(dev, -1, -1);
+
+- if (IS_ERR(rdev))
++ if (IS_ERR(rdev)) {
++ mddev_unlock(mddev);
+ return PTR_ERR(rdev);
++ }
+ err = bind_rdev_to_array(rdev, mddev);
+ out:
+ if (err)
ima-add-support-for-new-euid-policy-condition.patch
ima-extend-mask-policy-matching-support.patch
ima-update-builtin-policies.patch
+tracing-filter-do-not-warn-on-operand-count-going-below-zero.patch
+tracing-filter-do-not-allow-infix-to-exceed-end-of-string.patch
+tracing-fix-typo-from-static-inlin-to-static-inline.patch
+tracing-have-branch-tracer-use-recursive-field-of-task-struct.patch
+tracing-fix-sample-output-of-dynamic-arrays.patch
+dmaengine-mv_xor-bug-fix-for-racing-condition-in-descriptors-cleanup.patch
+md-clear-mddev-private-when-it-has-been-freed.patch
+md-unlock-mddev_lock-on-an-error-path.patch
+md-skip-cluster-setup-for-dm-raid.patch
+hwmon-mcp3021-fix-broken-output-scaling.patch
+hwmon-nct7802-fix-visibility-of-temp3.patch
+arm-dts-mx23-fix-iio-hwmon-support.patch
+btrfs-don-t-invalidate-root-dentry-when-subvolume-deletion-fails.patch
+md-fix-a-build-warning.patch
--- /dev/null
+From 6b88f44e161b9ee2a803e5b2b1fbcf4e20e8b980 Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+Date: Thu, 25 Jun 2015 18:10:09 -0400
+Subject: tracing/filter: Do not allow infix to exceed end of string
+
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+
+commit 6b88f44e161b9ee2a803e5b2b1fbcf4e20e8b980 upstream.
+
+While debugging a WARN_ON() for filtering, I found that it is possible
+for the filter string to be referenced after its end. With the filter:
+
+ # echo '>' > /sys/kernel/debug/events/ext4/ext4_truncate_exit/filter
+
+The filter_parse() function can call infix_get_op() which calls
+infix_advance() that updates the infix filter pointers for the cnt
+and tail without checking if the filter is already at the end, which
+will put the cnt to zero and the tail beyond the end. The loop then calls
+infix_next() that has
+
+ ps->infix.cnt--;
+ return ps->infix.string[ps->infix.tail++];
+
+The cnt will now be below zero, and the tail that is returned is
+already passed the end of the filter string. So far the allocation
+of the filter string usually has some buffer that is zeroed out, but
+if the filter string is of the exact size of the allocated buffer
+there's no guarantee that the charater after the nul terminating
+character will be zero.
+
+Luckily, only root can write to the filter.
+
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/trace_events_filter.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -1056,6 +1056,9 @@ static void parse_init(struct filter_par
+
+ static char infix_next(struct filter_parse_state *ps)
+ {
++ if (!ps->infix.cnt)
++ return 0;
++
+ ps->infix.cnt--;
+
+ return ps->infix.string[ps->infix.tail++];
+@@ -1071,6 +1074,9 @@ static char infix_peek(struct filter_par
+
+ static void infix_advance(struct filter_parse_state *ps)
+ {
++ if (!ps->infix.cnt)
++ return;
++
+ ps->infix.cnt--;
+ ps->infix.tail++;
+ }
--- /dev/null
+From b4875bbe7e68f139bd3383828ae8e994a0df6d28 Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+Date: Thu, 25 Jun 2015 18:02:29 -0400
+Subject: tracing/filter: Do not WARN on operand count going below zero
+
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+
+commit b4875bbe7e68f139bd3383828ae8e994a0df6d28 upstream.
+
+When testing the fix for the trace filter, I could not come up with
+a scenario where the operand count goes below zero, so I added a
+WARN_ON_ONCE(cnt < 0) to the logic. But there is legitimate case
+that it can happen (although the filter would be wrong).
+
+ # echo '>' > /sys/kernel/debug/events/ext4/ext4_truncate_exit/filter
+
+That is, a single operation without any operands will hit the path
+where the WARN_ON_ONCE() can trigger. Although this is harmless,
+and the filter is reported as a error. But instead of spitting out
+a warning to the kernel dmesg, just fail nicely and report it via
+the proper channels.
+
+Link: http://lkml.kernel.org/r/558C6082.90608@oracle.com
+
+Reported-by: Vince Weaver <vincent.weaver@maine.edu>
+Reported-by: Sasha Levin <sasha.levin@oracle.com>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/trace_events_filter.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -1385,7 +1385,9 @@ static int check_preds(struct filter_par
+ if (elt->op != OP_NOT)
+ cnt--;
+ n_normal_preds++;
+- WARN_ON_ONCE(cnt < 0);
++ /* all ops should have operands */
++ if (cnt < 0)
++ break;
+ }
+
+ if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
--- /dev/null
+From d6726c8145290bef950ae2538ea6ae1d96a1944b Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+Date: Fri, 17 Jul 2015 14:03:26 -0400
+Subject: tracing: Fix sample output of dynamic arrays
+
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+
+commit d6726c8145290bef950ae2538ea6ae1d96a1944b upstream.
+
+He Kuang noticed that the trace event samples for arrays was broken:
+
+"The output result of trace_foo_bar event in traceevent samples is
+ wrong. This problem can be reproduced as following:
+
+ (Build kernel with SAMPLE_TRACE_EVENTS=m)
+
+ $ insmod trace-events-sample.ko
+
+ $ echo 1 > /sys/kernel/debug/tracing/events/sample-trace/foo_bar/enable
+
+ $ cat /sys/kernel/debug/tracing/trace
+
+ event-sample-980 [000] .... 43.649559: foo_bar: foo hello 21 0x15
+ BIT1|BIT3|0x10 {0x1,0x6f6f6e53,0xff007970,0xffffffff} Snoopy
+ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+ The array length is not right, should be {0x1}.
+ (ffffffff,ffffffff)
+
+ event-sample-980 [000] .... 44.653827: foo_bar: foo hello 22 0x16
+ BIT2|BIT3|0x10
+ {0x1,0x2,0x646e6147,0x666c61,0xffffffff,0xffffffff,0x750aeffe,0x7}
+ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+ The array length is not right, should be {0x1,0x2}.
+ Gandalf (ffffffff,ffffffff)"
+
+This was caused by an update to have __print_array()'s second parameter
+be the count of items in the array and not the size of the array.
+
+As there is already users of __print_array(), it can not change. But
+the sample code can and we can also improve on the documentation about
+__print_array() and __get_dynamic_array_len().
+
+Link: http://lkml.kernel.org/r/1436839171-31527-2-git-send-email-hekuang@huawei.com
+
+Fixes: ac01ce1410fc2 ("tracing: Make ftrace_print_array_seq compute buf_len")
+Reported-by: He Kuang <hekuang@huawei.com>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ samples/trace_events/trace-events-sample.h | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/samples/trace_events/trace-events-sample.h
++++ b/samples/trace_events/trace-events-sample.h
+@@ -168,7 +168,10 @@
+ *
+ * For __dynamic_array(int, foo, bar) use __get_dynamic_array(foo)
+ * Use __get_dynamic_array_len(foo) to get the length of the array
+- * saved.
++ * saved. Note, __get_dynamic_array_len() returns the total allocated
++ * length of the dynamic array; __print_array() expects the second
++ * parameter to be the number of elements. To get that, the array length
++ * needs to be divided by the element size.
+ *
+ * For __string(foo, bar) use __get_str(foo)
+ *
+@@ -288,7 +291,7 @@ TRACE_EVENT(foo_bar,
+ * This prints out the array that is defined by __array in a nice format.
+ */
+ __print_array(__get_dynamic_array(list),
+- __get_dynamic_array_len(list),
++ __get_dynamic_array_len(list) / sizeof(int),
+ sizeof(int)),
+ __get_str(str), __get_bitmask(cpus))
+ );
--- /dev/null
+From cc9e4bde03f2b4cfba52406c021364cbd2a4a0f3 Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+Date: Thu, 25 Jun 2015 18:19:37 -0400
+Subject: tracing: Fix typo from "static inlin" to "static inline"
+
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+
+commit cc9e4bde03f2b4cfba52406c021364cbd2a4a0f3 upstream.
+
+The trace.h header when called without CONFIG_EVENT_TRACING enabled
+(seldom done), will not compile because of a typo in the protocol
+of trace_event_enum_update().
+
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/trace.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/trace/trace.h
++++ b/kernel/trace/trace.h
+@@ -1312,7 +1312,7 @@ void trace_event_init(void);
+ void trace_event_enum_update(struct trace_enum_map **map, int len);
+ #else
+ static inline void __init trace_event_init(void) { }
+-static inlin void trace_event_enum_update(struct trace_enum_map **map, int len) { }
++static inline void trace_event_enum_update(struct trace_enum_map **map, int len) { }
+ #endif
+
+ extern struct trace_iterator *tracepoint_print_iter;
--- /dev/null
+From 6224beb12e190ff11f3c7d4bf50cb2922878f600 Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+Date: Tue, 7 Jul 2015 15:05:03 -0400
+Subject: tracing: Have branch tracer use recursive field of task struct
+
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+
+commit 6224beb12e190ff11f3c7d4bf50cb2922878f600 upstream.
+
+Fengguang Wu's tests triggered a bug in the branch tracer's start up
+test when CONFIG_DEBUG_PREEMPT set. This was because that config
+adds some debug logic in the per cpu field, which calls back into
+the branch tracer.
+
+The branch tracer has its own recursive checks, but uses a per cpu
+variable to implement it. If retrieving the per cpu variable calls
+back into the branch tracer, you can see how things will break.
+
+Instead of using a per cpu variable, use the trace_recursion field
+of the current task struct. Simply set a bit when entering the
+branch tracing and clear it when leaving. If the bit is set on
+entry, just don't do the tracing.
+
+There's also the case with lockdep, as the local_irq_save() called
+before the recursion can also trigger code that can call back into
+the function. Changing that to a raw_local_irq_save() will protect
+that as well.
+
+This prevents the recursion and the inevitable crash that follows.
+
+Link: http://lkml.kernel.org/r/20150630141803.GA28071@wfg-t540p.sh.intel.com
+
+Reported-by: Fengguang Wu <fengguang.wu@intel.com>
+Tested-by: Fengguang Wu <fengguang.wu@intel.com>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/trace.h | 1 +
+ kernel/trace/trace_branch.c | 17 ++++++++++-------
+ 2 files changed, 11 insertions(+), 7 deletions(-)
+
+--- a/kernel/trace/trace.h
++++ b/kernel/trace/trace.h
+@@ -444,6 +444,7 @@ enum {
+
+ TRACE_CONTROL_BIT,
+
++ TRACE_BRANCH_BIT,
+ /*
+ * Abuse of the trace_recursion.
+ * As we need a way to maintain state if we are tracing the function
+--- a/kernel/trace/trace_branch.c
++++ b/kernel/trace/trace_branch.c
+@@ -36,9 +36,12 @@ probe_likely_condition(struct ftrace_bra
+ struct trace_branch *entry;
+ struct ring_buffer *buffer;
+ unsigned long flags;
+- int cpu, pc;
++ int pc;
+ const char *p;
+
++ if (current->trace_recursion & TRACE_BRANCH_BIT)
++ return;
++
+ /*
+ * I would love to save just the ftrace_likely_data pointer, but
+ * this code can also be used by modules. Ugly things can happen
+@@ -49,10 +52,10 @@ probe_likely_condition(struct ftrace_bra
+ if (unlikely(!tr))
+ return;
+
+- local_irq_save(flags);
+- cpu = raw_smp_processor_id();
+- data = per_cpu_ptr(tr->trace_buffer.data, cpu);
+- if (atomic_inc_return(&data->disabled) != 1)
++ raw_local_irq_save(flags);
++ current->trace_recursion |= TRACE_BRANCH_BIT;
++ data = this_cpu_ptr(tr->trace_buffer.data);
++ if (atomic_read(&data->disabled))
+ goto out;
+
+ pc = preempt_count();
+@@ -81,8 +84,8 @@ probe_likely_condition(struct ftrace_bra
+ __buffer_unlock_commit(buffer, event);
+
+ out:
+- atomic_dec(&data->disabled);
+- local_irq_restore(flags);
++ current->trace_recursion &= ~TRACE_BRANCH_BIT;
++ raw_local_irq_restore(flags);
+ }
+
+ static inline
projects / thirdparty / kernel / stable-queue.git / commitdiff
