From: Greg Kroah-Hartman Date: Tue, 4 Oct 2016 15:04:20 +0000 (+0200) Subject: 4.7-stable patches X-Git-Tag: v4.8.1~31 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=353de59812941a4a54df7e0f2ced06c44ec6101a;p=thirdparty%2Fkernel%2Fstable-queue.git 4.7-stable patches added patches: drivers-perf-arm_pmu-fix-leak-in-error-path.patch i2c-mux-demux-pinctrl-run-properly-with-multiple-instances.patch i40e-avoid-null-pointer-dereference.patch mwifiex-illegal-assignment.patch perf-core-use-this_cpu_ptr-when-stopping-aux-events.patch pinctrl-flag-strict-is-a-field-in-struct-pinmux_ops.patch pinctrl-uniphier-fix-.pin_dbg_show-callback.patch rcuperf-don-t-treat-gp_exp-mis-setting-as-a-warn.patch --- diff --git a/queue-4.7/drivers-perf-arm_pmu-fix-leak-in-error-path.patch b/queue-4.7/drivers-perf-arm_pmu-fix-leak-in-error-path.patch new file mode 100644 index 00000000000..61a021f2375 --- /dev/null +++ b/queue-4.7/drivers-perf-arm_pmu-fix-leak-in-error-path.patch @@ -0,0 +1,33 @@ +From 753246840d012ae34ea80a1d40bc1546c62fb957 Mon Sep 17 00:00:00 2001 +From: Stefan Wahren +Date: Sat, 27 Aug 2016 16:19:49 +0000 +Subject: drivers/perf: arm_pmu: Fix leak in error path + +From: Stefan Wahren + +commit 753246840d012ae34ea80a1d40bc1546c62fb957 upstream. + +In case of a IRQ type mismatch in of_pmu_irq_cfg() the +device node for interrupt affinity isn't freed. So fix this +issue by calling of_node_put(). + +Signed-off-by: Stefan Wahren +Fixes: fa8ad7889d83 ("arm: perf: factor arm_pmu core out to drivers") +Signed-off-by: Will Deacon +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/perf/arm_pmu.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/perf/arm_pmu.c ++++ b/drivers/perf/arm_pmu.c +@@ -921,6 +921,7 @@ static int of_pmu_irq_cfg(struct arm_pmu + if (i > 0 && spi != using_spi) { + pr_err("PPI/SPI IRQ type mismatch for %s!\n", + dn->name); ++ of_node_put(dn); + kfree(irqs); + return -EINVAL; + } diff --git a/queue-4.7/i2c-mux-demux-pinctrl-run-properly-with-multiple-instances.patch b/queue-4.7/i2c-mux-demux-pinctrl-run-properly-with-multiple-instances.patch new file mode 100644 index 00000000000..d5e72820ada --- /dev/null +++ b/queue-4.7/i2c-mux-demux-pinctrl-run-properly-with-multiple-instances.patch @@ -0,0 +1,66 @@ +From e35478eac030990e23a56bf11dc074c5a069124a Mon Sep 17 00:00:00 2001 +From: Wolfram Sang +Date: Tue, 23 Aug 2016 17:28:03 +0200 +Subject: i2c: mux: demux-pinctrl: run properly with multiple instances + +From: Wolfram Sang + +commit e35478eac030990e23a56bf11dc074c5a069124a upstream. + +We can't use a static property for all the changesets, so we now create +dynamic ones for each changeset. + +Signed-off-by: Wolfram Sang +Fixes: 50a5ba87690814 ("i2c: mux: demux-pinctrl: add driver") +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/muxes/i2c-demux-pinctrl.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c ++++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c +@@ -37,8 +37,6 @@ struct i2c_demux_pinctrl_priv { + struct i2c_demux_pinctrl_chan chan[]; + }; + +-static struct property status_okay = { .name = "status", .length = 3, .value = "ok" }; +- + static int i2c_demux_master_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num) + { + struct i2c_demux_pinctrl_priv *priv = adap->algo_data; +@@ -192,6 +190,7 @@ static int i2c_demux_pinctrl_probe(struc + { + struct device_node *np = pdev->dev.of_node; + struct i2c_demux_pinctrl_priv *priv; ++ struct property *props; + int num_chan, i, j, err; + + num_chan = of_count_phandle_with_args(np, "i2c-parent", NULL); +@@ -202,7 +201,10 @@ static int i2c_demux_pinctrl_probe(struc + + priv = devm_kzalloc(&pdev->dev, sizeof(*priv) + + num_chan * sizeof(struct i2c_demux_pinctrl_chan), GFP_KERNEL); +- if (!priv) ++ ++ props = devm_kcalloc(&pdev->dev, num_chan, sizeof(*props), GFP_KERNEL); ++ ++ if (!priv || !props) + return -ENOMEM; + + err = of_property_read_string(np, "i2c-bus-name", &priv->bus_name); +@@ -220,8 +222,12 @@ static int i2c_demux_pinctrl_probe(struc + } + priv->chan[i].parent_np = adap_np; + ++ props[i].name = devm_kstrdup(&pdev->dev, "status", GFP_KERNEL); ++ props[i].value = devm_kstrdup(&pdev->dev, "ok", GFP_KERNEL); ++ props[i].length = 3; ++ + of_changeset_init(&priv->chan[i].chgset); +- of_changeset_update_property(&priv->chan[i].chgset, adap_np, &status_okay); ++ of_changeset_update_property(&priv->chan[i].chgset, adap_np, &props[i]); + } + + priv->num_chan = num_chan; diff --git a/queue-4.7/i40e-avoid-null-pointer-dereference.patch b/queue-4.7/i40e-avoid-null-pointer-dereference.patch new file mode 100644 index 00000000000..02fd4c5110f --- /dev/null +++ b/queue-4.7/i40e-avoid-null-pointer-dereference.patch @@ -0,0 +1,42 @@ +From cd956722167ba4fdba9c1ce3eed251b04ea2e10f Mon Sep 17 00:00:00 2001 +From: Heinrich Schuchardt +Date: Tue, 17 May 2016 22:41:33 +0200 +Subject: i40e: avoid null pointer dereference + +From: Heinrich Schuchardt + +commit cd956722167ba4fdba9c1ce3eed251b04ea2e10f upstream. + +In function i40e_debug_aq parameter desc is assumed to be +possibly NULL. Do not dereference it before checking the +value. + +Fixes: f905dd62be88 ("i40e/i40evf: add max buf len to aq debug print helper") +Signed-off-by: Heinrich Schuchardt +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/intel/i40e/i40e_common.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_common.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_common.c +@@ -297,13 +297,15 @@ void i40e_debug_aq(struct i40e_hw *hw, e + void *buffer, u16 buf_len) + { + struct i40e_aq_desc *aq_desc = (struct i40e_aq_desc *)desc; +- u16 len = le16_to_cpu(aq_desc->datalen); ++ u16 len; + u8 *buf = (u8 *)buffer; + u16 i = 0; + + if ((!(mask & hw->debug_mask)) || (desc == NULL)) + return; + ++ len = le16_to_cpu(aq_desc->datalen); ++ + i40e_debug(hw, mask, + "AQ CMD: opcode 0x%04X, flags 0x%04X, datalen 0x%04X, retval 0x%04X\n", + le16_to_cpu(aq_desc->opcode), diff --git a/queue-4.7/mwifiex-illegal-assignment.patch b/queue-4.7/mwifiex-illegal-assignment.patch new file mode 100644 index 00000000000..959f0c8875e --- /dev/null +++ b/queue-4.7/mwifiex-illegal-assignment.patch @@ -0,0 +1,32 @@ +From 3fdbda446fbcd7fb750179c01338e81cf04e46c7 Mon Sep 17 00:00:00 2001 +From: Heinrich Schuchardt +Date: Wed, 18 May 2016 01:01:58 +0200 +Subject: mwifiex: illegal assignment + +From: Heinrich Schuchardt + +commit 3fdbda446fbcd7fb750179c01338e81cf04e46c7 upstream. + +Variable adapter is incorrectly initialized. + +Fixes: bf00dc22bc7a ("mwifiex: AMSDU Rx frame handling in AP mode") +Signed-off-by: Heinrich Schuchardt +Acked-by: Amitkumar Karwar +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/marvell/mwifiex/uap_txrx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c ++++ b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c +@@ -272,7 +272,7 @@ int mwifiex_handle_uap_rx_forward(struct + int mwifiex_uap_recv_packet(struct mwifiex_private *priv, + struct sk_buff *skb) + { +- struct mwifiex_adapter *adapter = adapter; ++ struct mwifiex_adapter *adapter = priv->adapter; + struct mwifiex_sta_node *src_node; + struct ethhdr *p_ethhdr; + struct sk_buff *skb_uap; diff --git a/queue-4.7/perf-core-use-this_cpu_ptr-when-stopping-aux-events.patch b/queue-4.7/perf-core-use-this_cpu_ptr-when-stopping-aux-events.patch new file mode 100644 index 00000000000..49fdfe5698c --- /dev/null +++ b/queue-4.7/perf-core-use-this_cpu_ptr-when-stopping-aux-events.patch @@ -0,0 +1,76 @@ +From 8b6a3fe8fab97716990a3abde1a01fb5a34552a3 Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Wed, 24 Aug 2016 10:07:14 +0100 +Subject: perf/core: Use this_cpu_ptr() when stopping AUX events + +From: Will Deacon + +commit 8b6a3fe8fab97716990a3abde1a01fb5a34552a3 upstream. + +When tearing down an AUX buf for an event via perf_mmap_close(), +__perf_event_output_stop() is called on the event's CPU to ensure that +trace generation is halted before the process of unmapping and +freeing the buffer pages begins. + +The callback is performed via cpu_function_call(), which ensures that it +runs with interrupts disabled and is therefore not preemptible. +Unfortunately, the current code grabs the per-cpu context pointer using +get_cpu_ptr(), which unnecessarily disables preemption and doesn't pair +the call with put_cpu_ptr(), leading to a preempt_count() imbalance and +a BUG when freeing the AUX buffer later on: + + WARNING: CPU: 1 PID: 2249 at kernel/events/ring_buffer.c:539 __rb_free_aux+0x10c/0x120 + Modules linked in: + [...] + Call Trace: + [] dump_stack+0x4f/0x72 + [] __warn+0xc6/0xe0 + [] warn_slowpath_null+0x18/0x20 + [] __rb_free_aux+0x10c/0x120 + [] rb_free_aux+0x13/0x20 + [] perf_mmap_close+0x29e/0x2f0 + [] ? perf_iterate_ctx+0xe0/0xe0 + [] remove_vma+0x25/0x60 + [] exit_mmap+0x106/0x140 + [] mmput+0x1c/0xd0 + [] do_exit+0x253/0xbf0 + [] do_group_exit+0x3e/0xb0 + [] get_signal+0x249/0x640 + [] do_signal+0x23/0x640 + [] ? _raw_write_unlock_irq+0x12/0x30 + [] ? _raw_spin_unlock_irq+0x9/0x10 + [] ? __schedule+0x2c6/0x710 + [] exit_to_usermode_loop+0x74/0x90 + [] prepare_exit_to_usermode+0x26/0x30 + [] retint_user+0x8/0x10 + +This patch uses this_cpu_ptr() instead of get_cpu_ptr(), since preemption is +already disabled by the caller. + +Signed-off-by: Will Deacon +Reviewed-by: Alexander Shishkin +Cc: Arnaldo Carvalho de Melo +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Vince Weaver +Fixes: 95ff4ca26c49 ("perf/core: Free AUX pages in unmap path") +Link: http://lkml.kernel.org/r/20160824091905.GA16944@arm.com +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/events/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -6064,7 +6064,7 @@ static int __perf_pmu_output_stop(void * + { + struct perf_event *event = info; + struct pmu *pmu = event->pmu; +- struct perf_cpu_context *cpuctx = get_cpu_ptr(pmu->pmu_cpu_context); ++ struct perf_cpu_context *cpuctx = this_cpu_ptr(pmu->pmu_cpu_context); + struct remote_output ro = { + .rb = event->rb, + }; diff --git a/queue-4.7/pinctrl-flag-strict-is-a-field-in-struct-pinmux_ops.patch b/queue-4.7/pinctrl-flag-strict-is-a-field-in-struct-pinmux_ops.patch new file mode 100644 index 00000000000..189f3931687 --- /dev/null +++ b/queue-4.7/pinctrl-flag-strict-is-a-field-in-struct-pinmux_ops.patch @@ -0,0 +1,32 @@ +From 7440926ed9623dceca3310c5f437d06c859dc02b Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Tue, 21 Jun 2016 01:40:48 +0300 +Subject: pinctrl: Flag strict is a field in struct pinmux_ops + +From: Andy Shevchenko + +commit 7440926ed9623dceca3310c5f437d06c859dc02b upstream. + +Documentation incorrectly refers to struct pinctrl_desc, where no such flag is +available. Replace the name of the struct. + +Fixes: commit 8c4c2016345f ("pinctrl: move strict option to pinmux_ops") +Signed-off-by: Andy Shevchenko +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/pinctrl.txt | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/Documentation/pinctrl.txt ++++ b/Documentation/pinctrl.txt +@@ -831,7 +831,7 @@ separate memory range only intended for + range dealing with pin config and pin multiplexing get placed into a + different memory range and a separate section of the data sheet. + +-A flag "strict" in struct pinctrl_desc is available to check and deny ++A flag "strict" in struct pinmux_ops is available to check and deny + simultaneous access to the same pin from GPIO and pin multiplexing + consumers on hardware of this type. The pinctrl driver should set this flag + accordingly. diff --git a/queue-4.7/pinctrl-uniphier-fix-.pin_dbg_show-callback.patch b/queue-4.7/pinctrl-uniphier-fix-.pin_dbg_show-callback.patch new file mode 100644 index 00000000000..1416f00713b --- /dev/null +++ b/queue-4.7/pinctrl-uniphier-fix-.pin_dbg_show-callback.patch @@ -0,0 +1,35 @@ +From 10ef8277ec658bf6619da9b3fd65c2db7353c2a4 Mon Sep 17 00:00:00 2001 +From: Masahiro Yamada +Date: Tue, 31 May 2016 15:30:10 +0900 +Subject: pinctrl: uniphier: fix .pin_dbg_show() callback + +From: Masahiro Yamada + +commit 10ef8277ec658bf6619da9b3fd65c2db7353c2a4 upstream. + +Without this, reading the "pins" in the debugfs causes kernel BUG. + +Fixes: 6e9088920258 ("pinctrl: UniPhier: add UniPhier pinctrl core support") +Signed-off-by: Masahiro Yamada +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pinctrl/uniphier/pinctrl-uniphier-core.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c ++++ b/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c +@@ -73,6 +73,12 @@ static void uniphier_pctl_pin_dbg_show(s + case UNIPHIER_PIN_PULL_DOWN: + pull_dir = "DOWN"; + break; ++ case UNIPHIER_PIN_PULL_UP_FIXED: ++ pull_dir = "UP(FIXED)"; ++ break; ++ case UNIPHIER_PIN_PULL_DOWN_FIXED: ++ pull_dir = "DOWN(FIXED)"; ++ break; + case UNIPHIER_PIN_PULL_NONE: + pull_dir = "NONE"; + break; diff --git a/queue-4.7/rcuperf-don-t-treat-gp_exp-mis-setting-as-a-warn.patch b/queue-4.7/rcuperf-don-t-treat-gp_exp-mis-setting-as-a-warn.patch new file mode 100644 index 00000000000..2e047ac9c97 --- /dev/null +++ b/queue-4.7/rcuperf-don-t-treat-gp_exp-mis-setting-as-a-warn.patch @@ -0,0 +1,77 @@ +From af06d4f74a7d2132c805339bfd5ab771b5706f42 Mon Sep 17 00:00:00 2001 +From: Boqun Feng +Date: Wed, 25 May 2016 09:25:33 +0800 +Subject: rcuperf: Don't treat gp_exp mis-setting as a WARN + +From: Boqun Feng + +commit af06d4f74a7d2132c805339bfd5ab771b5706f42 upstream. + +0day found a boot warning triggered in rcu_perf_writer() on !SMP kernel: + + WARN_ON(rcu_gp_is_normal() && gp_exp); + +, the root cause of which is trying to measure expedited grace +periods(by setting gp_exp to true by default) when all the grace periods +are normal(TINY RCU only has normal grace periods). + +However, such a mis-setting would only result in failing to measure the +performance for a specific kind of grace periods, therefore using a +WARN_ON to check this is a little overkilling. We could handle this +inside rcuperf module via some error messages to tell users about the +mis-settings. + +Therefore this patch removes the WARN_ON in rcu_perf_writer() and +handles those checkings in rcu_perf_init() with plain if() code. + +Moreover, this patch changes the default value of gp_exp to 1) align +with rcutorture tests and 2) make the default setting work for all RCU +implementations by default. + +Suggested-by: Paul E. McKenney +Signed-off-by: Boqun Feng +Fixes: http://lkml.kernel.org/r/57411b10.mFvG0+AgcrMXGtcj%fengguang.wu@intel.com +Signed-off-by: Paul E. McKenney +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/rcu/rcuperf.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +--- a/kernel/rcu/rcuperf.c ++++ b/kernel/rcu/rcuperf.c +@@ -58,7 +58,7 @@ MODULE_AUTHOR("Paul E. McKenney