From: Greg Kroah-Hartman Date: Mon, 5 Jun 2017 12:48:11 +0000 (+0200) Subject: 4.4-stable patches X-Git-Tag: v3.18.56~21 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0e8ef7e66494cc95fdf39f1d989c7ac84f2994b1;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: alsa-hda-apply-stac_9200_dell_m22-quirk-for-dell-latitude-d430.patch drm-gma500-psb-actually-use-vbt-mode-when-it-is-found.patch drm-radeon-ci-disable-mclk-switching-for-high-refresh-rates-v2.patch drm-radeon-unbreak-hpd-handling-for-r600.patch hid-wacom-have-wacom_tpc_irq-guard-against-possible-null-dereference.patch pcmcia-remove-left-over-z-format.patch scsi-mpt3sas-force-request-partial-completion-alignment.patch slub-memcg-cure-the-brainless-abuse-of-sysfs-attributes.patch x86-pat-fix-xorg-regression-on-cpus-that-don-t-support-pat.patch --- diff --git a/queue-4.4/alsa-hda-apply-stac_9200_dell_m22-quirk-for-dell-latitude-d430.patch b/queue-4.4/alsa-hda-apply-stac_9200_dell_m22-quirk-for-dell-latitude-d430.patch new file mode 100644 index 00000000000..d4af6d1997f --- /dev/null +++ b/queue-4.4/alsa-hda-apply-stac_9200_dell_m22-quirk-for-dell-latitude-d430.patch @@ -0,0 +1,34 @@ +From 1fc2e41f7af4572b07190f9dec28396b418e9a36 Mon Sep 17 00:00:00 2001 +From: Alexander Tsoy +Date: Mon, 22 May 2017 20:58:11 +0300 +Subject: ALSA: hda - apply STAC_9200_DELL_M22 quirk for Dell Latitude D430 + +From: Alexander Tsoy + +commit 1fc2e41f7af4572b07190f9dec28396b418e9a36 upstream. + +This model is actually called 92XXM2-8 in Windows driver. But since pin +configs for M22 and M28 are identical, just reuse M22 quirk. + +Fixes external microphone (tested) and probably docking station ports +(not tested). + +Signed-off-by: Alexander Tsoy +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_sigmatel.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -1537,6 +1537,8 @@ static const struct snd_pci_quirk stac92 + "Dell Inspiron 1501", STAC_9200_DELL_M26), + SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01f6, + "unknown Dell", STAC_9200_DELL_M26), ++ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0201, ++ "Dell Latitude D430", STAC_9200_DELL_M22), + /* Panasonic */ + SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-74", STAC_9200_PANASONIC), + /* Gateway machines needs EAPD to be set on resume */ diff --git a/queue-4.4/drm-gma500-psb-actually-use-vbt-mode-when-it-is-found.patch b/queue-4.4/drm-gma500-psb-actually-use-vbt-mode-when-it-is-found.patch new file mode 100644 index 00000000000..121598ba83a --- /dev/null +++ b/queue-4.4/drm-gma500-psb-actually-use-vbt-mode-when-it-is-found.patch @@ -0,0 +1,64 @@ +From 82bc9a42cf854fdf63155759c0aa790bd1f361b0 Mon Sep 17 00:00:00 2001 +From: Patrik Jakobsson +Date: Tue, 18 Apr 2017 13:43:32 +0200 +Subject: drm/gma500/psb: Actually use VBT mode when it is found + +From: Patrik Jakobsson + +commit 82bc9a42cf854fdf63155759c0aa790bd1f361b0 upstream. + +With LVDS we were incorrectly picking the pre-programmed mode instead of +the prefered mode provided by VBT. Make sure we pick the VBT mode if +one is provided. It is likely that the mode read-out code is still wrong +but this patch fixes the immediate problem on most machines. + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=78562 +Signed-off-by: Patrik Jakobsson +Link: http://patchwork.freedesktop.org/patch/msgid/20170418114332.12183-1-patrik.r.jakobsson@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/gma500/psb_intel_lvds.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +--- a/drivers/gpu/drm/gma500/psb_intel_lvds.c ++++ b/drivers/gpu/drm/gma500/psb_intel_lvds.c +@@ -783,20 +783,23 @@ void psb_intel_lvds_init(struct drm_devi + if (scan->type & DRM_MODE_TYPE_PREFERRED) { + mode_dev->panel_fixed_mode = + drm_mode_duplicate(dev, scan); ++ DRM_DEBUG_KMS("Using mode from DDC\n"); + goto out; /* FIXME: check for quirks */ + } + } + + /* Failed to get EDID, what about VBT? do we need this? */ +- if (mode_dev->vbt_mode) ++ if (dev_priv->lfp_lvds_vbt_mode) { + mode_dev->panel_fixed_mode = +- drm_mode_duplicate(dev, mode_dev->vbt_mode); ++ drm_mode_duplicate(dev, dev_priv->lfp_lvds_vbt_mode); + +- if (!mode_dev->panel_fixed_mode) +- if (dev_priv->lfp_lvds_vbt_mode) +- mode_dev->panel_fixed_mode = +- drm_mode_duplicate(dev, +- dev_priv->lfp_lvds_vbt_mode); ++ if (mode_dev->panel_fixed_mode) { ++ mode_dev->panel_fixed_mode->type |= ++ DRM_MODE_TYPE_PREFERRED; ++ DRM_DEBUG_KMS("Using mode from VBT\n"); ++ goto out; ++ } ++ } + + /* + * If we didn't get EDID, try checking if the panel is already turned +@@ -813,6 +816,7 @@ void psb_intel_lvds_init(struct drm_devi + if (mode_dev->panel_fixed_mode) { + mode_dev->panel_fixed_mode->type |= + DRM_MODE_TYPE_PREFERRED; ++ DRM_DEBUG_KMS("Using pre-programmed mode\n"); + goto out; /* FIXME: check for quirks */ + } + } diff --git a/queue-4.4/drm-radeon-ci-disable-mclk-switching-for-high-refresh-rates-v2.patch b/queue-4.4/drm-radeon-ci-disable-mclk-switching-for-high-refresh-rates-v2.patch new file mode 100644 index 00000000000..378ec5dc293 --- /dev/null +++ b/queue-4.4/drm-radeon-ci-disable-mclk-switching-for-high-refresh-rates-v2.patch @@ -0,0 +1,42 @@ +From 58d7e3e427db1bd68f33025519a9468140280a75 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Thu, 11 May 2017 13:14:14 -0400 +Subject: drm/radeon/ci: disable mclk switching for high refresh rates (v2) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +commit 58d7e3e427db1bd68f33025519a9468140280a75 upstream. + +Even if the vblank period would allow it, it still seems to +be problematic on some cards. + +v2: fix logic inversion (Nils) + +bug: https://bugs.freedesktop.org/show_bug.cgi?id=96868 + +Acked-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/ci_dpm.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/gpu/drm/radeon/ci_dpm.c ++++ b/drivers/gpu/drm/radeon/ci_dpm.c +@@ -776,6 +776,12 @@ bool ci_dpm_vblank_too_short(struct rade + u32 vblank_time = r600_dpm_get_vblank_time(rdev); + u32 switch_limit = pi->mem_gddr5 ? 450 : 300; + ++ /* disable mclk switching if the refresh is >120Hz, even if the ++ * blanking period would allow it ++ */ ++ if (r600_dpm_get_vrefresh(rdev) > 120) ++ return true; ++ + if (vblank_time < switch_limit) + return true; + else diff --git a/queue-4.4/drm-radeon-unbreak-hpd-handling-for-r600.patch b/queue-4.4/drm-radeon-unbreak-hpd-handling-for-r600.patch new file mode 100644 index 00000000000..46227747146 --- /dev/null +++ b/queue-4.4/drm-radeon-unbreak-hpd-handling-for-r600.patch @@ -0,0 +1,103 @@ +From 3d18e33735a02b1a90aecf14410bf3edbfd4d3dc Mon Sep 17 00:00:00 2001 +From: Lyude +Date: Thu, 11 May 2017 19:31:12 -0400 +Subject: drm/radeon: Unbreak HPD handling for r600+ +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lyude + +commit 3d18e33735a02b1a90aecf14410bf3edbfd4d3dc upstream. + +We end up reading the interrupt register for HPD5, and then writing it +to HPD6 which on systems without anything using HPD5 results in +permanently disabling hotplug on one of the display outputs after the +first time we acknowledge a hotplug interrupt from the GPU. + +This code is really bad. But for now, let's just fix this. I will +hopefully have a large patch series to refactor all of this soon. + +Reviewed-by: Christian König +Signed-off-by: Lyude +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/cik.c | 4 ++-- + drivers/gpu/drm/radeon/evergreen.c | 4 ++-- + drivers/gpu/drm/radeon/r600.c | 2 +- + drivers/gpu/drm/radeon/si.c | 4 ++-- + 4 files changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/gpu/drm/radeon/cik.c ++++ b/drivers/gpu/drm/radeon/cik.c +@@ -7762,7 +7762,7 @@ static inline void cik_irq_ack(struct ra + WREG32(DC_HPD5_INT_CONTROL, tmp); + } + if (rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_INTERRUPT) { +- tmp = RREG32(DC_HPD5_INT_CONTROL); ++ tmp = RREG32(DC_HPD6_INT_CONTROL); + tmp |= DC_HPDx_INT_ACK; + WREG32(DC_HPD6_INT_CONTROL, tmp); + } +@@ -7792,7 +7792,7 @@ static inline void cik_irq_ack(struct ra + WREG32(DC_HPD5_INT_CONTROL, tmp); + } + if (rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) { +- tmp = RREG32(DC_HPD5_INT_CONTROL); ++ tmp = RREG32(DC_HPD6_INT_CONTROL); + tmp |= DC_HPDx_RX_INT_ACK; + WREG32(DC_HPD6_INT_CONTROL, tmp); + } +--- a/drivers/gpu/drm/radeon/evergreen.c ++++ b/drivers/gpu/drm/radeon/evergreen.c +@@ -4924,7 +4924,7 @@ static void evergreen_irq_ack(struct rad + WREG32(DC_HPD5_INT_CONTROL, tmp); + } + if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT) { +- tmp = RREG32(DC_HPD5_INT_CONTROL); ++ tmp = RREG32(DC_HPD6_INT_CONTROL); + tmp |= DC_HPDx_INT_ACK; + WREG32(DC_HPD6_INT_CONTROL, tmp); + } +@@ -4955,7 +4955,7 @@ static void evergreen_irq_ack(struct rad + WREG32(DC_HPD5_INT_CONTROL, tmp); + } + if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) { +- tmp = RREG32(DC_HPD5_INT_CONTROL); ++ tmp = RREG32(DC_HPD6_INT_CONTROL); + tmp |= DC_HPDx_RX_INT_ACK; + WREG32(DC_HPD6_INT_CONTROL, tmp); + } +--- a/drivers/gpu/drm/radeon/r600.c ++++ b/drivers/gpu/drm/radeon/r600.c +@@ -3945,7 +3945,7 @@ static void r600_irq_ack(struct radeon_d + WREG32(DC_HPD5_INT_CONTROL, tmp); + } + if (rdev->irq.stat_regs.r600.disp_int_cont2 & DC_HPD6_INTERRUPT) { +- tmp = RREG32(DC_HPD5_INT_CONTROL); ++ tmp = RREG32(DC_HPD6_INT_CONTROL); + tmp |= DC_HPDx_INT_ACK; + WREG32(DC_HPD6_INT_CONTROL, tmp); + } +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -6335,7 +6335,7 @@ static inline void si_irq_ack(struct rad + WREG32(DC_HPD5_INT_CONTROL, tmp); + } + if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT) { +- tmp = RREG32(DC_HPD5_INT_CONTROL); ++ tmp = RREG32(DC_HPD6_INT_CONTROL); + tmp |= DC_HPDx_INT_ACK; + WREG32(DC_HPD6_INT_CONTROL, tmp); + } +@@ -6366,7 +6366,7 @@ static inline void si_irq_ack(struct rad + WREG32(DC_HPD5_INT_CONTROL, tmp); + } + if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) { +- tmp = RREG32(DC_HPD5_INT_CONTROL); ++ tmp = RREG32(DC_HPD6_INT_CONTROL); + tmp |= DC_HPDx_RX_INT_ACK; + WREG32(DC_HPD6_INT_CONTROL, tmp); + } diff --git a/queue-4.4/hid-wacom-have-wacom_tpc_irq-guard-against-possible-null-dereference.patch b/queue-4.4/hid-wacom-have-wacom_tpc_irq-guard-against-possible-null-dereference.patch new file mode 100644 index 00000000000..81b26bad324 --- /dev/null +++ b/queue-4.4/hid-wacom-have-wacom_tpc_irq-guard-against-possible-null-dereference.patch @@ -0,0 +1,99 @@ +From 2ac97f0f6654da14312d125005c77a6010e0ea38 Mon Sep 17 00:00:00 2001 +From: Jason Gerecke +Date: Tue, 25 Apr 2017 11:29:56 -0700 +Subject: HID: wacom: Have wacom_tpc_irq guard against possible NULL dereference + +From: Jason Gerecke + +commit 2ac97f0f6654da14312d125005c77a6010e0ea38 upstream. + +The following Smatch complaint was generated in response to commit +2a6cdbd ("HID: wacom: Introduce new 'touch_input' device"): + + drivers/hid/wacom_wac.c:1586 wacom_tpc_irq() + error: we previously assumed 'wacom->touch_input' could be null (see line 1577) + +The 'touch_input' and 'pen_input' variables point to the 'struct input_dev' +used for relaying touch and pen events to userspace, respectively. If a +device does not have a touch interface or pen interface, the associated +input variable is NULL. The 'wacom_tpc_irq()' function is responsible for +forwarding input reports to a more-specific IRQ handler function. An +unknown report could theoretically be mistaken as e.g. a touch report +on a device which does not have a touch interface. This can be prevented +by only calling the pen/touch functions are called when the pen/touch +pointers are valid. + +Fixes: 2a6cdbd ("HID: wacom: Introduce new 'touch_input' device") +Signed-off-by: Jason Gerecke +Reviewed-by: Ping Cheng +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/wacom_wac.c | 47 ++++++++++++++++++++++++----------------------- + 1 file changed, 24 insertions(+), 23 deletions(-) + +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -1440,37 +1440,38 @@ static int wacom_tpc_irq(struct wacom_wa + { + unsigned char *data = wacom->data; + +- if (wacom->pen_input) ++ if (wacom->pen_input) { + dev_dbg(wacom->pen_input->dev.parent, + "%s: received report #%d\n", __func__, data[0]); +- else if (wacom->touch_input) ++ ++ if (len == WACOM_PKGLEN_PENABLED || ++ data[0] == WACOM_REPORT_PENABLED) ++ return wacom_tpc_pen(wacom); ++ } ++ else if (wacom->touch_input) { + dev_dbg(wacom->touch_input->dev.parent, + "%s: received report #%d\n", __func__, data[0]); + +- switch (len) { +- case WACOM_PKGLEN_TPC1FG: +- return wacom_tpc_single_touch(wacom, len); +- +- case WACOM_PKGLEN_TPC2FG: +- return wacom_tpc_mt_touch(wacom); +- +- case WACOM_PKGLEN_PENABLED: +- return wacom_tpc_pen(wacom); +- +- default: +- switch (data[0]) { +- case WACOM_REPORT_TPC1FG: +- case WACOM_REPORT_TPCHID: +- case WACOM_REPORT_TPCST: +- case WACOM_REPORT_TPC1FGE: ++ switch (len) { ++ case WACOM_PKGLEN_TPC1FG: + return wacom_tpc_single_touch(wacom, len); + +- case WACOM_REPORT_TPCMT: +- case WACOM_REPORT_TPCMT2: +- return wacom_mt_touch(wacom); ++ case WACOM_PKGLEN_TPC2FG: ++ return wacom_tpc_mt_touch(wacom); + +- case WACOM_REPORT_PENABLED: +- return wacom_tpc_pen(wacom); ++ default: ++ switch (data[0]) { ++ case WACOM_REPORT_TPC1FG: ++ case WACOM_REPORT_TPCHID: ++ case WACOM_REPORT_TPCST: ++ case WACOM_REPORT_TPC1FGE: ++ return wacom_tpc_single_touch(wacom, len); ++ ++ case WACOM_REPORT_TPCMT: ++ case WACOM_REPORT_TPCMT2: ++ return wacom_mt_touch(wacom); ++ ++ } + } + } + diff --git a/queue-4.4/pcmcia-remove-left-over-z-format.patch b/queue-4.4/pcmcia-remove-left-over-z-format.patch new file mode 100644 index 00000000000..5f8c82a002b --- /dev/null +++ b/queue-4.4/pcmcia-remove-left-over-z-format.patch @@ -0,0 +1,56 @@ +From ff5a20169b98d84ad8d7f99f27c5ebbb008204d6 Mon Sep 17 00:00:00 2001 +From: Nicolas Iooss +Date: Fri, 2 Jun 2017 14:46:28 -0700 +Subject: pcmcia: remove left-over %Z format + +From: Nicolas Iooss + +commit ff5a20169b98d84ad8d7f99f27c5ebbb008204d6 upstream. + +Commit 5b5e0928f742 ("lib/vsprintf.c: remove %Z support") removed some +usages of format %Z but forgot "%.2Zx". This makes clang 4.0 reports a +-Wformat-extra-args warning because it does not know about %Z. + +Replace %Z with %z. + +Link: http://lkml.kernel.org/r/20170520090946.22562-1-nicolas.iooss_linux@m4x.org +Signed-off-by: Nicolas Iooss +Cc: Harald Welte +Cc: Alexey Dobriyan +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/pcmcia/cm4040_cs.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/char/pcmcia/cm4040_cs.c ++++ b/drivers/char/pcmcia/cm4040_cs.c +@@ -374,7 +374,7 @@ static ssize_t cm4040_write(struct file + + rc = write_sync_reg(SCR_HOST_TO_READER_START, dev); + if (rc <= 0) { +- DEBUGP(5, dev, "write_sync_reg c=%.2Zx\n", rc); ++ DEBUGP(5, dev, "write_sync_reg c=%.2zx\n", rc); + DEBUGP(2, dev, "<- cm4040_write (failed)\n"); + if (rc == -ERESTARTSYS) + return rc; +@@ -387,7 +387,7 @@ static ssize_t cm4040_write(struct file + for (i = 0; i < bytes_to_write; i++) { + rc = wait_for_bulk_out_ready(dev); + if (rc <= 0) { +- DEBUGP(5, dev, "wait_for_bulk_out_ready rc=%.2Zx\n", ++ DEBUGP(5, dev, "wait_for_bulk_out_ready rc=%.2zx\n", + rc); + DEBUGP(2, dev, "<- cm4040_write (failed)\n"); + if (rc == -ERESTARTSYS) +@@ -403,7 +403,7 @@ static ssize_t cm4040_write(struct file + rc = write_sync_reg(SCR_HOST_TO_READER_DONE, dev); + + if (rc <= 0) { +- DEBUGP(5, dev, "write_sync_reg c=%.2Zx\n", rc); ++ DEBUGP(5, dev, "write_sync_reg c=%.2zx\n", rc); + DEBUGP(2, dev, "<- cm4040_write (failed)\n"); + if (rc == -ERESTARTSYS) + return rc; diff --git a/queue-4.4/scsi-mpt3sas-force-request-partial-completion-alignment.patch b/queue-4.4/scsi-mpt3sas-force-request-partial-completion-alignment.patch new file mode 100644 index 00000000000..e1f55b9f5be --- /dev/null +++ b/queue-4.4/scsi-mpt3sas-force-request-partial-completion-alignment.patch @@ -0,0 +1,65 @@ +From f2e767bb5d6ee0d988cb7d4e54b0b21175802b6b Mon Sep 17 00:00:00 2001 +From: Ram Pai +Date: Thu, 26 Jan 2017 16:37:01 -0200 +Subject: scsi: mpt3sas: Force request partial completion alignment + +From: Ram Pai + +commit f2e767bb5d6ee0d988cb7d4e54b0b21175802b6b upstream. + +The firmware or device, possibly under a heavy I/O load, can return on a +partial unaligned boundary. Scsi-ml expects these requests to be +completed on an alignment boundary. Scsi-ml blindly requeues the I/O +without checking the alignment boundary of the I/O request for the +remaining bytes. This leads to errors, since devices cannot perform +non-aligned read/write operations. + +This patch fixes the issue in the driver. It aligns unaligned +completions of FS requests, by truncating them to the nearest alignment +boundary. + +[mkp: simplified if statement] + +Reported-by: Mauricio Faria De Oliveira +Signed-off-by: Guilherme G. Piccoli +Signed-off-by: Ram Pai +Acked-by: Sreekanth Reddy +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/mpt3sas/mpt3sas_scsih.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +@@ -4452,6 +4452,7 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *i + struct MPT3SAS_DEVICE *sas_device_priv_data; + u32 response_code = 0; + unsigned long flags; ++ unsigned int sector_sz; + + mpi_reply = mpt3sas_base_get_reply_virt_addr(ioc, reply); + scmd = _scsih_scsi_lookup_get_clear(ioc, smid); +@@ -4510,6 +4511,20 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *i + } + + xfer_cnt = le32_to_cpu(mpi_reply->TransferCount); ++ ++ /* In case of bogus fw or device, we could end up having ++ * unaligned partial completion. We can force alignment here, ++ * then scsi-ml does not need to handle this misbehavior. ++ */ ++ sector_sz = scmd->device->sector_size; ++ if (unlikely(scmd->request->cmd_type == REQ_TYPE_FS && sector_sz && ++ xfer_cnt % sector_sz)) { ++ sdev_printk(KERN_INFO, scmd->device, ++ "unaligned partial completion avoided (xfer_cnt=%u, sector_sz=%u)\n", ++ xfer_cnt, sector_sz); ++ xfer_cnt = round_down(xfer_cnt, sector_sz); ++ } ++ + scsi_set_resid(scmd, scsi_bufflen(scmd) - xfer_cnt); + if (ioc_status & MPI2_IOCSTATUS_FLAG_LOG_INFO_AVAILABLE) + log_info = le32_to_cpu(mpi_reply->IOCLogInfo); diff --git a/queue-4.4/series b/queue-4.4/series index e64ea404303..ef60db6793d 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -26,3 +26,12 @@ net-phy-marvell-limit-errata-to-88m1101.patch vlan-fix-tcp-checksum-offloads-in-q-in-q-vlans.patch i2c-i2c-tiny-usb-fix-buffer-not-being-dma-capable.patch mmc-sdhci-iproc-suppress-spurious-interrupt-with-multiblock-read.patch +hid-wacom-have-wacom_tpc_irq-guard-against-possible-null-dereference.patch +scsi-mpt3sas-force-request-partial-completion-alignment.patch +drm-radeon-ci-disable-mclk-switching-for-high-refresh-rates-v2.patch +drm-radeon-unbreak-hpd-handling-for-r600.patch +pcmcia-remove-left-over-z-format.patch +alsa-hda-apply-stac_9200_dell_m22-quirk-for-dell-latitude-d430.patch +x86-pat-fix-xorg-regression-on-cpus-that-don-t-support-pat.patch +slub-memcg-cure-the-brainless-abuse-of-sysfs-attributes.patch +drm-gma500-psb-actually-use-vbt-mode-when-it-is-found.patch diff --git a/queue-4.4/slub-memcg-cure-the-brainless-abuse-of-sysfs-attributes.patch b/queue-4.4/slub-memcg-cure-the-brainless-abuse-of-sysfs-attributes.patch new file mode 100644 index 00000000000..77bdd76ab65 --- /dev/null +++ b/queue-4.4/slub-memcg-cure-the-brainless-abuse-of-sysfs-attributes.patch @@ -0,0 +1,89 @@ +From 478fe3037b2278d276d4cd9cd0ab06c4cb2e9b32 Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Fri, 2 Jun 2017 14:46:25 -0700 +Subject: slub/memcg: cure the brainless abuse of sysfs attributes + +From: Thomas Gleixner + +commit 478fe3037b2278d276d4cd9cd0ab06c4cb2e9b32 upstream. + +memcg_propagate_slab_attrs() abuses the sysfs attribute file functions +to propagate settings from the root kmem_cache to a newly created +kmem_cache. It does that with: + + attr->show(root, buf); + attr->store(new, buf, strlen(bug); + +Aside of being a lazy and absurd hackery this is broken because it does +not check the return value of the show() function. + +Some of the show() functions return 0 w/o touching the buffer. That +means in such a case the store function is called with the stale content +of the previous show(). That causes nonsense like invoking +kmem_cache_shrink() on a newly created kmem_cache. In the worst case it +would cause handing in an uninitialized buffer. + +This should be rewritten proper by adding a propagate() callback to +those slub_attributes which must be propagated and avoid that insane +conversion to and from ASCII, but that's too large for a hot fix. + +Check at least the return value of the show() function, so calling +store() with stale content is prevented. + +Steven said: + "It can cause a deadlock with get_online_cpus() that has been uncovered + by recent cpu hotplug and lockdep changes that Thomas and Peter have + been doing. + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(cpu_hotplug.lock); + lock(slab_mutex); + lock(cpu_hotplug.lock); + lock(slab_mutex); + + *** DEADLOCK ***" + +Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1705201244540.2255@nanos +Signed-off-by: Thomas Gleixner +Reported-by: Steven Rostedt +Acked-by: David Rientjes +Cc: Johannes Weiner +Cc: Michal Hocko +Cc: Peter Zijlstra +Cc: Christoph Lameter +Cc: Pekka Enberg +Cc: Joonsoo Kim +Cc: Christoph Hellwig +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/slub.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -5261,6 +5261,7 @@ static void memcg_propagate_slab_attrs(s + char mbuf[64]; + char *buf; + struct slab_attribute *attr = to_slab_attr(slab_attrs[i]); ++ ssize_t len; + + if (!attr || !attr->store || !attr->show) + continue; +@@ -5285,8 +5286,9 @@ static void memcg_propagate_slab_attrs(s + buf = buffer; + } + +- attr->show(root_cache, buf); +- attr->store(s, buf, strlen(buf)); ++ len = attr->show(root_cache, buf); ++ if (len > 0) ++ attr->store(s, buf, len); + } + + if (buffer) diff --git a/queue-4.4/x86-pat-fix-xorg-regression-on-cpus-that-don-t-support-pat.patch b/queue-4.4/x86-pat-fix-xorg-regression-on-cpus-that-don-t-support-pat.patch new file mode 100644 index 00000000000..2e3a0ef0e09 --- /dev/null +++ b/queue-4.4/x86-pat-fix-xorg-regression-on-cpus-that-don-t-support-pat.patch @@ -0,0 +1,96 @@ +From cbed27cdf0e3f7ea3b2259e86b9e34df02be3fe4 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Tue, 18 Apr 2017 15:07:11 -0400 +Subject: x86/PAT: Fix Xorg regression on CPUs that don't support PAT + +From: Mikulas Patocka + +commit cbed27cdf0e3f7ea3b2259e86b9e34df02be3fe4 upstream. + +In the file arch/x86/mm/pat.c, there's a '__pat_enabled' variable. The +variable is set to 1 by default and the function pat_init() sets +__pat_enabled to 0 if the CPU doesn't support PAT. + +However, on AMD K6-3 CPUs, the processor initialization code never calls +pat_init() and so __pat_enabled stays 1 and the function pat_enabled() +returns true, even though the K6-3 CPU doesn't support PAT. + +The result of this bug is that a kernel warning is produced when attempting to +start the Xserver and the Xserver doesn't start (fork() returns ENOMEM). +Another symptom of this bug is that the framebuffer driver doesn't set the +K6-3 MTRR registers: + + x86/PAT: Xorg:3891 map pfn expected mapping type uncached-minus for [mem 0xe4000000-0xe5ffffff], got write-combining + ------------[ cut here ]------------ + WARNING: CPU: 0 PID: 3891 at arch/x86/mm/pat.c:1020 untrack_pfn+0x5c/0x9f + ... + x86/PAT: Xorg:3891 map pfn expected mapping type uncached-minus for [mem 0xe4000000-0xe5ffffff], got write-combining + +To fix the bug change pat_enabled() so that it returns true only if PAT +initialization was actually done. + +Also, I changed boot_cpu_has(X86_FEATURE_PAT) to +this_cpu_has(X86_FEATURE_PAT) in pat_ap_init(), so that we check the PAT +feature on the processor that is being initialized. + +Signed-off-by: Mikulas Patocka +Cc: Andrew Morton +Cc: Andy Lutomirski +Cc: Borislav Petkov +Cc: Brian Gerst +Cc: Denys Vlasenko +Cc: H. Peter Anvin +Cc: Josh Poimboeuf +Cc: Linus Torvalds +Cc: Luis R. Rodriguez +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Toshi Kani +Link: http://lkml.kernel.org/r/alpine.LRH.2.02.1704181501450.26399@file01.intranet.prod.int.rdu2.redhat.com +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/mm/pat.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/arch/x86/mm/pat.c ++++ b/arch/x86/mm/pat.c +@@ -64,9 +64,11 @@ static int __init nopat(char *str) + } + early_param("nopat", nopat); + ++static bool __read_mostly __pat_initialized = false; ++ + bool pat_enabled(void) + { +- return !!__pat_enabled; ++ return __pat_initialized; + } + EXPORT_SYMBOL_GPL(pat_enabled); + +@@ -224,13 +226,14 @@ static void pat_bsp_init(u64 pat) + } + + wrmsrl(MSR_IA32_CR_PAT, pat); ++ __pat_initialized = true; + + __init_cache_modes(pat); + } + + static void pat_ap_init(u64 pat) + { +- if (!boot_cpu_has(X86_FEATURE_PAT)) { ++ if (!this_cpu_has(X86_FEATURE_PAT)) { + /* + * If this happens we are on a secondary CPU, but switched to + * PAT on the boot CPU. We have no way to undo PAT. +@@ -305,7 +308,7 @@ void pat_init(void) + u64 pat; + struct cpuinfo_x86 *c = &boot_cpu_data; + +- if (!pat_enabled()) { ++ if (!__pat_enabled) { + init_cache_modes(); + return; + }