From: Greg Kroah-Hartman Date: Fri, 6 Nov 2015 06:26:01 +0000 (-0800) Subject: 4.2-stable patches X-Git-Tag: v3.10.93~22 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a31307db0109b4961fe083bf39517fd93006e3b9;p=thirdparty%2Fkernel%2Fstable-queue.git 4.2-stable patches added patches: block-don-t-release-bdi-while-request_queue-has-live-references.patch clkdev-fix-clk_add_alias-with-a-null-alias-device-name.patch dm-btree-fix-leak-of-bufio-backed-block-in-btree_split_beneath-error-path.patch dm-btree-remove-fix-a-bug-when-rebalancing-nodes-after-removal.patch dm-cache-the-clean_shutdown-flag-was-not-being-set.patch fbcon-initialize-blink-interval-before-calling-fb_set_par.patch i2c-mv64xxx-really-allow-i2c-offloading.patch module-fix-locking-in-symbol_put_addr.patch nvme-fix-32-bit-build-warning.patch revert-serial-8250_dma-don-t-bother-dma-with-small-transfers.patch usb-qcserial-add-sierra-wireless-mc74xx-em74xx.patch xen-blkfront-check-for-null-drvdata-in-blkback_changed-xenbusstateclosing.patch xhci-add-spurious-wakeup-quirk-for-lynxpoint-lp-controllers.patch xhci-handle-no-ping-response-error-properly.patch --- diff --git a/queue-4.2/block-don-t-release-bdi-while-request_queue-has-live-references.patch b/queue-4.2/block-don-t-release-bdi-while-request_queue-has-live-references.patch new file mode 100644 index 00000000000..9b10c4515c4 --- /dev/null +++ b/queue-4.2/block-don-t-release-bdi-while-request_queue-has-live-references.patch @@ -0,0 +1,133 @@ +From b02176f30cd30acccd3b633ab7d9aed8b5da52ff Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Tue, 8 Sep 2015 12:20:22 -0400 +Subject: block: don't release bdi while request_queue has live references + +From: Tejun Heo + +commit b02176f30cd30acccd3b633ab7d9aed8b5da52ff upstream. + +bdi's are initialized in two steps, bdi_init() and bdi_register(), but +destroyed in a single step by bdi_destroy() which, for a bdi embedded +in a request_queue, is called during blk_cleanup_queue() which makes +the queue invisible and starts the draining of remaining usages. + +A request_queue's user can access the congestion state of the embedded +bdi as long as it holds a reference to the queue. As such, it may +access the congested state of a queue which finished +blk_cleanup_queue() but hasn't reached blk_release_queue() yet. +Because the congested state was embedded in backing_dev_info which in +turn is embedded in request_queue, accessing the congested state after +bdi_destroy() was called was fine. The bdi was destroyed but the +memory region for the congested state remained accessible till the +queue got released. + +a13f35e87140 ("writeback: don't embed root bdi_writeback_congested in +bdi_writeback") changed the situation. Now, the root congested state +which is expected to be pinned while request_queue remains accessible +is separately reference counted and the base ref is put during +bdi_destroy(). This means that the root congested state may go away +prematurely while the queue is between bdi_dstroy() and +blk_cleanup_queue(), which was detected by Andrey's KASAN tests. + +The root cause of this problem is that bdi doesn't distinguish the two +steps of destruction, unregistration and release, and now the root +congested state actually requires a separate release step. To fix the +issue, this patch separates out bdi_unregister() and bdi_exit() from +bdi_destroy(). bdi_unregister() is called from blk_cleanup_queue() +and bdi_exit() from blk_release_queue(). bdi_destroy() is now just a +simple wrapper calling the two steps back-to-back. + +While at it, the prototype of bdi_destroy() is moved right below +bdi_setup_and_register() so that the counterpart operations are +located together. + +Signed-off-by: Tejun Heo +Fixes: a13f35e87140 ("writeback: don't embed root bdi_writeback_congested in bdi_writeback") +Reported-and-tested-by: Andrey Konovalov +Link: http://lkml.kernel.org/g/CAAeHK+zUJ74Zn17=rOyxacHU18SgCfC6bsYW=6kCY5GXJBwGfQ@mail.gmail.com +Reviewed-by: Jan Kara +Reviewed-by: Jeff Moyer +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/blk-core.c | 2 +- + block/blk-sysfs.c | 1 + + include/linux/backing-dev.h | 6 +++++- + mm/backing-dev.c | 12 +++++++++++- + 4 files changed, 18 insertions(+), 3 deletions(-) + +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -578,7 +578,7 @@ void blk_cleanup_queue(struct request_qu + q->queue_lock = &q->__queue_lock; + spin_unlock_irq(lock); + +- bdi_destroy(&q->backing_dev_info); ++ bdi_unregister(&q->backing_dev_info); + + /* @q is and will stay empty, shutdown and put */ + blk_put_queue(q); +--- a/block/blk-sysfs.c ++++ b/block/blk-sysfs.c +@@ -502,6 +502,7 @@ static void blk_release_queue(struct kob + struct request_queue *q = + container_of(kobj, struct request_queue, kobj); + ++ bdi_exit(&q->backing_dev_info); + blkcg_exit_queue(q); + + if (q->elevator) { +--- a/include/linux/backing-dev.h ++++ b/include/linux/backing-dev.h +@@ -18,13 +18,17 @@ + #include + + int __must_check bdi_init(struct backing_dev_info *bdi); +-void bdi_destroy(struct backing_dev_info *bdi); ++void bdi_exit(struct backing_dev_info *bdi); + + __printf(3, 4) + int bdi_register(struct backing_dev_info *bdi, struct device *parent, + const char *fmt, ...); + int bdi_register_dev(struct backing_dev_info *bdi, dev_t dev); ++void bdi_unregister(struct backing_dev_info *bdi); ++ + int __must_check bdi_setup_and_register(struct backing_dev_info *, char *); ++void bdi_destroy(struct backing_dev_info *bdi); ++ + void wb_start_writeback(struct bdi_writeback *wb, long nr_pages, + bool range_cyclic, enum wb_reason reason); + void wb_start_background_writeback(struct bdi_writeback *wb); +--- a/mm/backing-dev.c ++++ b/mm/backing-dev.c +@@ -823,7 +823,7 @@ static void bdi_remove_from_list(struct + synchronize_rcu_expedited(); + } + +-void bdi_destroy(struct backing_dev_info *bdi) ++void bdi_unregister(struct backing_dev_info *bdi) + { + /* make sure nobody finds us on the bdi_list anymore */ + bdi_remove_from_list(bdi); +@@ -835,9 +835,19 @@ void bdi_destroy(struct backing_dev_info + device_unregister(bdi->dev); + bdi->dev = NULL; + } ++} + ++void bdi_exit(struct backing_dev_info *bdi) ++{ ++ WARN_ON_ONCE(bdi->dev); + wb_exit(&bdi->wb); + } ++ ++void bdi_destroy(struct backing_dev_info *bdi) ++{ ++ bdi_unregister(bdi); ++ bdi_exit(bdi); ++} + EXPORT_SYMBOL(bdi_destroy); + + /* diff --git a/queue-4.2/clkdev-fix-clk_add_alias-with-a-null-alias-device-name.patch b/queue-4.2/clkdev-fix-clk_add_alias-with-a-null-alias-device-name.patch new file mode 100644 index 00000000000..3b65c269253 --- /dev/null +++ b/queue-4.2/clkdev-fix-clk_add_alias-with-a-null-alias-device-name.patch @@ -0,0 +1,35 @@ +From 625faa6a720d26fc0db9e20b48dc0dfe4c8d8ddf Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Tue, 20 Oct 2015 11:49:44 +0100 +Subject: clkdev: fix clk_add_alias() with a NULL alias device name + +From: Russell King + +commit 625faa6a720d26fc0db9e20b48dc0dfe4c8d8ddf upstream. + +clk_add_alias() was not correctly handling the case where alias_dev_name +was NULL: rather than producing an entry with a NULL dev_id pointer, +it would produce a device name of (null). Fix this. + +Fixes: 2568999835d7 ("clkdev: add clkdev_create() helper") +Reported-by: Aaro Koskinen +Tested-by: Aaro Koskinen +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/clkdev.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/clk/clkdev.c ++++ b/drivers/clk/clkdev.c +@@ -333,7 +333,8 @@ int clk_add_alias(const char *alias, con + if (IS_ERR(r)) + return PTR_ERR(r); + +- l = clkdev_create(r, alias, "%s", alias_dev_name); ++ l = clkdev_create(r, alias, alias_dev_name ? "%s" : NULL, ++ alias_dev_name); + clk_put(r); + + return l ? 0 : -ENODEV; diff --git a/queue-4.2/dm-btree-fix-leak-of-bufio-backed-block-in-btree_split_beneath-error-path.patch b/queue-4.2/dm-btree-fix-leak-of-bufio-backed-block-in-btree_split_beneath-error-path.patch new file mode 100644 index 00000000000..d5b06be10fa --- /dev/null +++ b/queue-4.2/dm-btree-fix-leak-of-bufio-backed-block-in-btree_split_beneath-error-path.patch @@ -0,0 +1,36 @@ +From 4dcb8b57df3593dcb20481d9d6cf79d1dc1534be Mon Sep 17 00:00:00 2001 +From: Mike Snitzer +Date: Thu, 22 Oct 2015 10:56:40 -0400 +Subject: dm btree: fix leak of bufio-backed block in btree_split_beneath error path + +From: Mike Snitzer + +commit 4dcb8b57df3593dcb20481d9d6cf79d1dc1534be upstream. + +btree_split_beneath()'s error path had an outstanding FIXME that speaks +directly to the potential for _not_ cleaning up a previously allocated +bufio-backed block. + +Fix this by releasing the previously allocated bufio block using +unlock_block(). + +Reported-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Acked-by: Joe Thornber +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/persistent-data/dm-btree.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/persistent-data/dm-btree.c ++++ b/drivers/md/persistent-data/dm-btree.c +@@ -523,7 +523,7 @@ static int btree_split_beneath(struct sh + + r = new_block(s->info, &right); + if (r < 0) { +- /* FIXME: put left */ ++ unlock_block(s->info, left); + return r; + } + diff --git a/queue-4.2/dm-btree-remove-fix-a-bug-when-rebalancing-nodes-after-removal.patch b/queue-4.2/dm-btree-remove-fix-a-bug-when-rebalancing-nodes-after-removal.patch new file mode 100644 index 00000000000..51a96561906 --- /dev/null +++ b/queue-4.2/dm-btree-remove-fix-a-bug-when-rebalancing-nodes-after-removal.patch @@ -0,0 +1,76 @@ +From 2871c69e025e8bc507651d5a9cf81a8a7da9d24b Mon Sep 17 00:00:00 2001 +From: Joe Thornber +Date: Wed, 21 Oct 2015 18:36:49 +0100 +Subject: dm btree remove: fix a bug when rebalancing nodes after removal + +From: Joe Thornber + +commit 2871c69e025e8bc507651d5a9cf81a8a7da9d24b upstream. + +Commit 4c7e309340ff ("dm btree remove: fix bug in redistribute3") wasn't +a complete fix for redistribute3(). + +The redistribute3 function takes 3 btree nodes and shares out the entries +evenly between them. If the three nodes in total contained +(MAX_ENTRIES * 3) - 1 entries between them then this was erroneously getting +rebalanced as (MAX_ENTRIES - 1) on the left and right, and (MAX_ENTRIES + 1) in +the center. + +Fix this issue by being more careful about calculating the target number +of entries for the left and right nodes. + +Unit tested in userspace using this program: +https://github.com/jthornber/redistribute3-test/blob/master/redistribute3_t.c + +Signed-off-by: Joe Thornber +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/persistent-data/dm-btree-remove.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +--- a/drivers/md/persistent-data/dm-btree-remove.c ++++ b/drivers/md/persistent-data/dm-btree-remove.c +@@ -301,11 +301,16 @@ static void redistribute3(struct dm_btre + { + int s; + uint32_t max_entries = le32_to_cpu(left->header.max_entries); +- unsigned target = (nr_left + nr_center + nr_right) / 3; +- BUG_ON(target > max_entries); ++ unsigned total = nr_left + nr_center + nr_right; ++ unsigned target_right = total / 3; ++ unsigned remainder = (target_right * 3) != total; ++ unsigned target_left = target_right + remainder; ++ ++ BUG_ON(target_left > max_entries); ++ BUG_ON(target_right > max_entries); + + if (nr_left < nr_right) { +- s = nr_left - target; ++ s = nr_left - target_left; + + if (s < 0 && nr_center < -s) { + /* not enough in central node */ +@@ -316,10 +321,10 @@ static void redistribute3(struct dm_btre + } else + shift(left, center, s); + +- shift(center, right, target - nr_right); ++ shift(center, right, target_right - nr_right); + + } else { +- s = target - nr_right; ++ s = target_right - nr_right; + if (s > 0 && nr_center < s) { + /* not enough in central node */ + shift(center, right, nr_center); +@@ -329,7 +334,7 @@ static void redistribute3(struct dm_btre + } else + shift(center, right, s); + +- shift(left, center, nr_left - target); ++ shift(left, center, nr_left - target_left); + } + + *key_ptr(parent, c->index) = center->keys[0]; diff --git a/queue-4.2/dm-cache-the-clean_shutdown-flag-was-not-being-set.patch b/queue-4.2/dm-cache-the-clean_shutdown-flag-was-not-being-set.patch new file mode 100644 index 00000000000..5dedeceef94 --- /dev/null +++ b/queue-4.2/dm-cache-the-clean_shutdown-flag-was-not-being-set.patch @@ -0,0 +1,54 @@ +From 3201ac452e84a8a368197d648c9b7011e061804a Mon Sep 17 00:00:00 2001 +From: Joe Thornber +Date: Thu, 22 Oct 2015 18:10:55 +0100 +Subject: dm cache: the CLEAN_SHUTDOWN flag was not being set + +From: Joe Thornber + +commit 3201ac452e84a8a368197d648c9b7011e061804a upstream. + +If the CLEAN_SHUTDOWN flag is not set when a cache is loaded then all cache +blocks are marked as dirty and a full writeback occurs. + +__commit_transaction() is responsible for setting/clearing +CLEAN_SHUTDOWN (based the flags_mutator that is passed in). + +Fix this issue, of the cache's on-disk flags being wrong, by making sure +__commit_transaction() does not reset the flags after the mutator has +altered the flags in preparation for them being serialized to disk. + +before: + +sb_flags = mutator(le32_to_cpu(disk_super->flags)); +disk_super->flags = cpu_to_le32(sb_flags); +disk_super->flags = cpu_to_le32(cmd->flags); + +after: + +disk_super->flags = cpu_to_le32(cmd->flags); +sb_flags = mutator(le32_to_cpu(disk_super->flags)); +disk_super->flags = cpu_to_le32(sb_flags); + +Reported-by: Bogdan Vasiliev +Signed-off-by: Joe Thornber +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-cache-metadata.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/dm-cache-metadata.c ++++ b/drivers/md/dm-cache-metadata.c +@@ -634,10 +634,10 @@ static int __commit_transaction(struct d + + disk_super = dm_block_data(sblock); + ++ disk_super->flags = cpu_to_le32(cmd->flags); + if (mutator) + update_flags(disk_super, mutator); + +- disk_super->flags = cpu_to_le32(cmd->flags); + disk_super->mapping_root = cpu_to_le64(cmd->root); + disk_super->hint_root = cpu_to_le64(cmd->hint_root); + disk_super->discard_root = cpu_to_le64(cmd->discard_root); diff --git a/queue-4.2/fbcon-initialize-blink-interval-before-calling-fb_set_par.patch b/queue-4.2/fbcon-initialize-blink-interval-before-calling-fb_set_par.patch new file mode 100644 index 00000000000..633c23947c0 --- /dev/null +++ b/queue-4.2/fbcon-initialize-blink-interval-before-calling-fb_set_par.patch @@ -0,0 +1,34 @@ +From f235f664a8afabccf863a5dee4777d2d7b676fda Mon Sep 17 00:00:00 2001 +From: Scot Doyle +Date: Fri, 9 Oct 2015 15:08:10 +0000 +Subject: fbcon: initialize blink interval before calling fb_set_par + +From: Scot Doyle + +commit f235f664a8afabccf863a5dee4777d2d7b676fda upstream. + +Since commit 27a4c827c34ac4256a190cc9d24607f953c1c459 + fbcon: use the cursor blink interval provided by vt + +a PPC64LE kernel fails to boot when fbcon_add_cursor_timer uses an +uninitialized ops->cur_blink_jiffies. Prevent by initializing +in fbcon_init before the call to info->fbops->fb_set_par. + +Reported-and-tested-by: Alistair Popple +Signed-off-by: Scot Doyle +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/console/fbcon.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/video/console/fbcon.c ++++ b/drivers/video/console/fbcon.c +@@ -1093,6 +1093,7 @@ static void fbcon_init(struct vc_data *v + con_copy_unimap(vc, svc); + + ops = info->fbcon_par; ++ ops->cur_blink_jiffies = msecs_to_jiffies(vc->vc_cur_blink_ms); + p->con_rotate = initial_rotation; + set_blitting_type(vc, info); + diff --git a/queue-4.2/i2c-mv64xxx-really-allow-i2c-offloading.patch b/queue-4.2/i2c-mv64xxx-really-allow-i2c-offloading.patch new file mode 100644 index 00000000000..64e952a6c9b --- /dev/null +++ b/queue-4.2/i2c-mv64xxx-really-allow-i2c-offloading.patch @@ -0,0 +1,40 @@ +From 0729a04977d497cf66234fd7f900ddcec3ef1c52 Mon Sep 17 00:00:00 2001 +From: Hezi Shahmoon +Date: Tue, 20 Oct 2015 16:32:24 +0200 +Subject: i2c: mv64xxx: really allow I2C offloading + +From: Hezi Shahmoon + +commit 0729a04977d497cf66234fd7f900ddcec3ef1c52 upstream. + +Commit 00d8689b85a7 ("i2c: mv64xxx: rework offload support to fix +several problems") completely reworked the offload support, but left a +debugging-related "return false" at the beginning of the +mv64xxx_i2c_can_offload() function. This has the unfortunate consequence +that offloading is in fact never used, which wasn't really the +intention. + +This commit fixes that problem by removing the bogus "return false". + +Fixes: 00d8689b85a7 ("i2c: mv64xxx: rework offload support to fix several problems") +Signed-off-by: Hezi Shahmoon +[Thomas: reworked commit log and title.] +Signed-off-by: Thomas Petazzoni +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-mv64xxx.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/i2c/busses/i2c-mv64xxx.c ++++ b/drivers/i2c/busses/i2c-mv64xxx.c +@@ -669,8 +669,6 @@ mv64xxx_i2c_can_offload(struct mv64xxx_i + struct i2c_msg *msgs = drv_data->msgs; + int num = drv_data->num_msgs; + +- return false; +- + if (!drv_data->offload_enabled) + return false; + diff --git a/queue-4.2/module-fix-locking-in-symbol_put_addr.patch b/queue-4.2/module-fix-locking-in-symbol_put_addr.patch new file mode 100644 index 00000000000..afc06c3335d --- /dev/null +++ b/queue-4.2/module-fix-locking-in-symbol_put_addr.patch @@ -0,0 +1,63 @@ +From 275d7d44d802ef271a42dc87ac091a495ba72fc5 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Thu, 20 Aug 2015 10:34:59 +0930 +Subject: module: Fix locking in symbol_put_addr() + +From: Peter Zijlstra + +commit 275d7d44d802ef271a42dc87ac091a495ba72fc5 upstream. + +Poma (on the way to another bug) reported an assertion triggering: + + [] module_assert_mutex_or_preempt+0x49/0x90 + [] __module_address+0x32/0x150 + [] __module_text_address+0x16/0x70 + [] symbol_put_addr+0x29/0x40 + [] dvb_frontend_detach+0x7d/0x90 [dvb_core] + +Laura Abbott produced a patch which lead us to +inspect symbol_put_addr(). This function has a comment claiming it +doesn't need to disable preemption around the module lookup +because it holds a reference to the module it wants to find, which +therefore cannot go away. + +This is wrong (and a false optimization too, preempt_disable() is really +rather cheap, and I doubt any of this is on uber critical paths, +otherwise it would've retained a pointer to the actual module anyway and +avoided the second lookup). + +While its true that the module cannot go away while we hold a reference +on it, the data structure we do the lookup in very much _CAN_ change +while we do the lookup. Therefore fix the comment and add the +required preempt_disable(). + +Reported-by: poma +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Rusty Russell +Fixes: a6e6abd575fc ("module: remove module_text_address()") +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/module.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -1063,11 +1063,15 @@ void symbol_put_addr(void *addr) + if (core_kernel_text(a)) + return; + +- /* module_text_address is safe here: we're supposed to have reference +- * to module from symbol_get, so it can't go away. */ ++ /* ++ * Even though we hold a reference on the module; we still need to ++ * disable preemption in order to safely traverse the data structure. ++ */ ++ preempt_disable(); + modaddr = __module_text_address(a); + BUG_ON(!modaddr); + module_put(modaddr); ++ preempt_enable(); + } + EXPORT_SYMBOL_GPL(symbol_put_addr); + diff --git a/queue-4.2/nvme-fix-32-bit-build-warning.patch b/queue-4.2/nvme-fix-32-bit-build-warning.patch new file mode 100644 index 00000000000..9d1c1585721 --- /dev/null +++ b/queue-4.2/nvme-fix-32-bit-build-warning.patch @@ -0,0 +1,65 @@ +From 835da3f99d329b1160a1f7fc82c7ac81163d63d0 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Tue, 6 Oct 2015 22:29:48 +0200 +Subject: nvme: fix 32-bit build warning + +From: Arnd Bergmann + +commit 835da3f99d329b1160a1f7fc82c7ac81163d63d0 upstream. + +Compiling the nvme driver on 32-bit warns about a cast from a __u64 +variable to a pointer: + +drivers/block/nvme-core.c: In function 'nvme_submit_io': +drivers/block/nvme-core.c:1847:4: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] + (void __user *)io.addr, length, NULL, 0); + +The cast here is intentional and safe, so we can shut up the +gcc warning by adding an intermediate cast to 'uintptr_t'. + +I had previously submitted a patch to fix this problem in the +nvme driver, but it was accepted on the same day that two new +warnings got added. + +For clarification, I also change the third instance of this cast +to use uintptr_t instead of unsigned long now. + +Signed-off-by: Arnd Bergmann +Fixes: d29ec8241c10e ("nvme: submit internal commands through the block layer") +Reviewed-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/nvme-core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/block/nvme-core.c ++++ b/drivers/block/nvme-core.c +@@ -1764,7 +1764,7 @@ static int nvme_submit_io(struct nvme_ns + + length = (io.nblocks + 1) << ns->lba_shift; + meta_len = (io.nblocks + 1) * ns->ms; +- metadata = (void __user *)(unsigned long)io.metadata; ++ metadata = (void __user *)(uintptr_t)io.metadata; + write = io.opcode & 1; + + if (ns->ext) { +@@ -1804,7 +1804,7 @@ static int nvme_submit_io(struct nvme_ns + c.rw.metadata = cpu_to_le64(meta_dma); + + status = __nvme_submit_sync_cmd(ns->queue, &c, NULL, +- (void __user *)io.addr, length, NULL, 0); ++ (void __user *)(uintptr_t)io.addr, length, NULL, 0); + unmap: + if (meta) { + if (status == NVME_SC_SUCCESS && !write) { +@@ -1846,7 +1846,7 @@ static int nvme_user_cmd(struct nvme_dev + timeout = msecs_to_jiffies(cmd.timeout_ms); + + status = __nvme_submit_sync_cmd(ns ? ns->queue : dev->admin_q, &c, +- NULL, (void __user *)cmd.addr, cmd.data_len, ++ NULL, (void __user *)(uintptr_t)cmd.addr, cmd.data_len, + &cmd.result, timeout); + if (status >= 0) { + if (put_user(cmd.result, &ucmd->result)) diff --git a/queue-4.2/revert-serial-8250_dma-don-t-bother-dma-with-small-transfers.patch b/queue-4.2/revert-serial-8250_dma-don-t-bother-dma-with-small-transfers.patch new file mode 100644 index 00000000000..8d70e728840 --- /dev/null +++ b/queue-4.2/revert-serial-8250_dma-don-t-bother-dma-with-small-transfers.patch @@ -0,0 +1,44 @@ +From f967fc8f165fadb72166f2bd4785094b3ca21307 Mon Sep 17 00:00:00 2001 +From: Frederic Danis +Date: Fri, 9 Oct 2015 17:14:56 +0200 +Subject: Revert "serial: 8250_dma: don't bother DMA with small transfers" + +From: Frederic Danis + +commit f967fc8f165fadb72166f2bd4785094b3ca21307 upstream. + +This reverts commit 9119fba0cfeda6d415c9f068df66838a104b87cb. + +This commit prevents from sending "big" file using Bluetooth. +When sending a lot of data quickly through the Bluetooth interface, and +after a variable amount of data sent, transfer fails with error: + kernel: [ 415.247453] Bluetooth: hci0 hardware error 0x00 + +Found on T100TA. + +After reverting this commit, send works fine for any file size. + +Signed-off-by: Frederic Danis +Fixes: 9119fba0cfed (serial: 8250_dma: don't bother DMA with small transfers) +Reviewed-by: Heikki Krogerus +Acked-by: Andy Shevchenko +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/8250/8250_dma.c | 4 ---- + 1 file changed, 4 deletions(-) + +--- a/drivers/tty/serial/8250/8250_dma.c ++++ b/drivers/tty/serial/8250/8250_dma.c +@@ -80,10 +80,6 @@ int serial8250_tx_dma(struct uart_8250_p + return 0; + + dma->tx_size = CIRC_CNT_TO_END(xmit->head, xmit->tail, UART_XMIT_SIZE); +- if (dma->tx_size < p->port.fifosize) { +- ret = -EINVAL; +- goto err; +- } + + desc = dmaengine_prep_slave_single(dma->txchan, + dma->tx_addr + xmit->tail, diff --git a/queue-4.2/series b/queue-4.2/series index 614f5b6230f..80044336fcc 100644 --- a/queue-4.2/series +++ b/queue-4.2/series @@ -63,3 +63,17 @@ arm-8445-1-fix-vdsomunge-not-to-depend-on-glibc-specific-byteswap.h.patch arm-8449-1-fix-bug-in-vdsomunge-swab32-macro.patch revert-arm64-unwind-fix-pc-calculation.patch arm64-kernel-fix-tcr_el1.t0sz-restore-on-systems-with-extended-idmap.patch +block-don-t-release-bdi-while-request_queue-has-live-references.patch +dm-btree-remove-fix-a-bug-when-rebalancing-nodes-after-removal.patch +dm-cache-the-clean_shutdown-flag-was-not-being-set.patch +dm-btree-fix-leak-of-bufio-backed-block-in-btree_split_beneath-error-path.patch +nvme-fix-32-bit-build-warning.patch +revert-serial-8250_dma-don-t-bother-dma-with-small-transfers.patch +usb-qcserial-add-sierra-wireless-mc74xx-em74xx.patch +i2c-mv64xxx-really-allow-i2c-offloading.patch +clkdev-fix-clk_add_alias-with-a-null-alias-device-name.patch +fbcon-initialize-blink-interval-before-calling-fb_set_par.patch +xhci-handle-no-ping-response-error-properly.patch +xhci-add-spurious-wakeup-quirk-for-lynxpoint-lp-controllers.patch +xen-blkfront-check-for-null-drvdata-in-blkback_changed-xenbusstateclosing.patch +module-fix-locking-in-symbol_put_addr.patch diff --git a/queue-4.2/usb-qcserial-add-sierra-wireless-mc74xx-em74xx.patch b/queue-4.2/usb-qcserial-add-sierra-wireless-mc74xx-em74xx.patch new file mode 100644 index 00000000000..80495ad8b15 --- /dev/null +++ b/queue-4.2/usb-qcserial-add-sierra-wireless-mc74xx-em74xx.patch @@ -0,0 +1,33 @@ +From f504ab1888026d15b5be8f9c262bf4ae9cacd177 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= +Date: Thu, 22 Oct 2015 14:24:24 +0200 +Subject: USB: qcserial: add Sierra Wireless MC74xx/EM74xx +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= + +commit f504ab1888026d15b5be8f9c262bf4ae9cacd177 upstream. + +New device IDs shamelessly lifted from the vendor driver. + +Signed-off-by: Bjørn Mork +Acked-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/qcserial.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -153,6 +153,8 @@ static const struct usb_device_id id_tab + {DEVICE_SWI(0x1199, 0x9056)}, /* Sierra Wireless Modem */ + {DEVICE_SWI(0x1199, 0x9060)}, /* Sierra Wireless Modem */ + {DEVICE_SWI(0x1199, 0x9061)}, /* Sierra Wireless Modem */ ++ {DEVICE_SWI(0x1199, 0x9070)}, /* Sierra Wireless MC74xx/EM74xx */ ++ {DEVICE_SWI(0x1199, 0x9071)}, /* Sierra Wireless MC74xx/EM74xx */ + {DEVICE_SWI(0x413c, 0x81a2)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */ + {DEVICE_SWI(0x413c, 0x81a3)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */ + {DEVICE_SWI(0x413c, 0x81a4)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */ diff --git a/queue-4.2/xen-blkfront-check-for-null-drvdata-in-blkback_changed-xenbusstateclosing.patch b/queue-4.2/xen-blkfront-check-for-null-drvdata-in-blkback_changed-xenbusstateclosing.patch new file mode 100644 index 00000000000..47b5ec3f50f --- /dev/null +++ b/queue-4.2/xen-blkfront-check-for-null-drvdata-in-blkback_changed-xenbusstateclosing.patch @@ -0,0 +1,35 @@ +From a54c8f0f2d7df525ff997e2afe71866a1a013064 Mon Sep 17 00:00:00 2001 +From: Cathy Avery +Date: Fri, 2 Oct 2015 09:35:01 -0400 +Subject: xen-blkfront: check for null drvdata in blkback_changed (XenbusStateClosing) + +From: Cathy Avery + +commit a54c8f0f2d7df525ff997e2afe71866a1a013064 upstream. + +xen-blkfront will crash if the check to talk_to_blkback() +in blkback_changed()(XenbusStateInitWait) returns an error. +The driver data is freed and info is set to NULL. Later during +the close process via talk_to_blkback's call to xenbus_dev_fatal() +the null pointer is passed to and dereference in blkfront_closing. + +Signed-off-by: Cathy Avery +Signed-off-by: Konrad Rzeszutek Wilk +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/xen-blkfront.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/block/xen-blkfront.c ++++ b/drivers/block/xen-blkfront.c +@@ -1984,7 +1984,8 @@ static void blkback_changed(struct xenbu + break; + /* Missed the backend's Closing state -- fallthrough */ + case XenbusStateClosing: +- blkfront_closing(info); ++ if (info) ++ blkfront_closing(info); + break; + } + } diff --git a/queue-4.2/xhci-add-spurious-wakeup-quirk-for-lynxpoint-lp-controllers.patch b/queue-4.2/xhci-add-spurious-wakeup-quirk-for-lynxpoint-lp-controllers.patch new file mode 100644 index 00000000000..4a976a5a203 --- /dev/null +++ b/queue-4.2/xhci-add-spurious-wakeup-quirk-for-lynxpoint-lp-controllers.patch @@ -0,0 +1,60 @@ +From fd7cd061adcf5f7503515ba52b6a724642a839c8 Mon Sep 17 00:00:00 2001 +From: Laura Abbott +Date: Mon, 12 Oct 2015 11:30:13 +0300 +Subject: xhci: Add spurious wakeup quirk for LynxPoint-LP controllers + +From: Laura Abbott + +commit fd7cd061adcf5f7503515ba52b6a724642a839c8 upstream. + +We received several reports of systems rebooting and powering on +after an attempted shutdown. Testing showed that setting +XHCI_SPURIOUS_WAKEUP quirk in addition to the XHCI_SPURIOUS_REBOOT +quirk allowed the system to shutdown as expected for LynxPoint-LP +xHCI controllers. Set the quirk back. + +Note that the quirk was originally introduced for LynxPoint and +LynxPoint-LP just for this same reason. See: + +commit 638298dc66ea ("xhci: Fix spurious wakeups after S5 on Haswell") + +It was later limited to only concern HP machines as it caused +regression on some machines, see both bug and commit: + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=66171 +commit 6962d914f317 ("xhci: Limit the spurious wakeup fix only to HP machines") + +Later it was discovered that the powering on after shutdown +was limited to LynxPoint-LP (Haswell-ULT) and that some non-LP HP +machine suffered from spontaneous resume from S3 (which should +not be related to the SPURIOUS_WAKEUP quirk at all). An attempt +to fix this then removed the SPURIOUS_WAKEUP flag usage completely. + +commit b45abacde3d5 ("xhci: no switching back on non-ULT Haswell") + +Current understanding is that LynxPoint-LP (Haswell ULT) machines +need the SPURIOUS_WAKEUP quirk, otherwise they will restart, and +plain Lynxpoint (Haswell) machines may _not_ have the quirk +set otherwise they again will restart. + +Signed-off-by: Laura Abbott +Cc: Takashi Iwai +Cc: Oliver Neukum +[Added more history to commit message -Mathias] +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-pci.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -147,6 +147,7 @@ static void xhci_pci_quirks(struct devic + if (pdev->vendor == PCI_VENDOR_ID_INTEL && + pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) { + xhci->quirks |= XHCI_SPURIOUS_REBOOT; ++ xhci->quirks |= XHCI_SPURIOUS_WAKEUP; + } + if (pdev->vendor == PCI_VENDOR_ID_INTEL && + (pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI || diff --git a/queue-4.2/xhci-handle-no-ping-response-error-properly.patch b/queue-4.2/xhci-handle-no-ping-response-error-properly.patch new file mode 100644 index 00000000000..78368aefb4c --- /dev/null +++ b/queue-4.2/xhci-handle-no-ping-response-error-properly.patch @@ -0,0 +1,76 @@ +From 3b4739b8951d650becbcd855d7d6f18ac98a9a85 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Mon, 12 Oct 2015 11:30:12 +0300 +Subject: xhci: handle no ping response error properly + +From: Mathias Nyman + +commit 3b4739b8951d650becbcd855d7d6f18ac98a9a85 upstream. + +If a host fails to wake up a isochronous SuperSpeed device from U1/U2 +in time for a isoch transfer it will generate a "No ping response error" +Host will then move to the next transfer descriptor. + +Handle this case in the same way as missed service errors, tag the +current TD as skipped and handle it on the next transfer event. + +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-ring.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -2239,6 +2239,7 @@ static int handle_tx_event(struct xhci_h + u32 trb_comp_code; + int ret = 0; + int td_num = 0; ++ bool handling_skipped_tds = false; + + slot_id = TRB_TO_SLOT_ID(le32_to_cpu(event->flags)); + xdev = xhci->devs[slot_id]; +@@ -2372,6 +2373,10 @@ static int handle_tx_event(struct xhci_h + ep->skip = true; + xhci_dbg(xhci, "Miss service interval error, set skip flag\n"); + goto cleanup; ++ case COMP_PING_ERR: ++ ep->skip = true; ++ xhci_dbg(xhci, "No Ping response error, Skip one Isoc TD\n"); ++ goto cleanup; + default: + if (xhci_is_vendor_info_code(xhci, trb_comp_code)) { + status = 0; +@@ -2508,13 +2513,18 @@ static int handle_tx_event(struct xhci_h + ep, &status); + + cleanup: ++ ++ ++ handling_skipped_tds = ep->skip && ++ trb_comp_code != COMP_MISSED_INT && ++ trb_comp_code != COMP_PING_ERR; ++ + /* +- * Do not update event ring dequeue pointer if ep->skip is set. +- * Will roll back to continue process missed tds. ++ * Do not update event ring dequeue pointer if we're in a loop ++ * processing missed tds. + */ +- if (trb_comp_code == COMP_MISSED_INT || !ep->skip) { ++ if (!handling_skipped_tds) + inc_deq(xhci, xhci->event_ring); +- } + + if (ret) { + urb = td->urb; +@@ -2549,7 +2559,7 @@ cleanup: + * Process them as short transfer until reach the td pointed by + * the event. + */ +- } while (ep->skip && trb_comp_code != COMP_MISSED_INT); ++ } while (handling_skipped_tds); + + return 0; + }