From: Greg Kroah-Hartman Date: Sun, 10 Apr 2016 01:02:41 +0000 (-0700) Subject: 4.4-stable patches X-Git-Tag: v4.5.1~23 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=bf491e1099b89a223bb007259dbaab76a7978cb4;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: alsa-hda-apply-reboot-d3-fix-for-cx20724-codec-too.patch alsa-hda-don-t-handle-eld-notify-from-invalid-port.patch alsa-hda-fix-the-mic-mute-button-and-led-problem-for-a-lenovo-aio.patch alsa-hda-fix-unconditional-gpio-toggle-via-automute.patch alsa-intel8x0-add-clock-quirk-entry-for-ad1981b-on-ibm-thinkpad-x41.patch alsa-pcm-avoid-bug-string-for-warnings-again.patch bcache-cleaned-up-error-handling-around-register_cache.patch bcache-fix-cache_set_flush-null-pointer-dereference-on-oom.patch bcache-fix-race-of-writeback-thread-starting-before-complete-initialization.patch brd-fix-discard-request-processing.patch ia64-define-ioremap_uc.patch ib-srpt-simplify-srpt_handle_tsk_mgmt.patch jbd2-fix-fs-corruption-possibility-in-jbd2_journal_destroy-on-umount-path.patch mm-memcontrol-reclaim-and-oom-kill-when-shrinking-memory.max-below-usage.patch mm-memcontrol-reclaim-when-shrinking-memory.high-below-usage.patch tools-hv-use-include-uapi-with-__exported_headers__.patch watchdog-don-t-run-proc_watchdog_update-if-new-value-is-same-as-old.patch watchdog-rc32434_wdt-fix-ioctl-error-handling.patch --- diff --git a/queue-4.4/alsa-hda-apply-reboot-d3-fix-for-cx20724-codec-too.patch b/queue-4.4/alsa-hda-apply-reboot-d3-fix-for-cx20724-codec-too.patch new file mode 100644 index 00000000000..876e7bffc06 --- /dev/null +++ b/queue-4.4/alsa-hda-apply-reboot-d3-fix-for-cx20724-codec-too.patch @@ -0,0 +1,37 @@ +From 56dc66ff1c6d71f9a38c4a7c000b72b921fe4c89 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 10 Mar 2016 11:33:43 +0100 +Subject: ALSA: hda - Apply reboot D3 fix for CX20724 codec, too + +From: Takashi Iwai + +commit 56dc66ff1c6d71f9a38c4a7c000b72b921fe4c89 upstream. + +Just like CX20722, CX7024 codec also requires the power down at reboot +in order to reduce the noise at reboot/shutdown. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=113511 +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_conexant.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -204,8 +204,13 @@ static void cx_auto_reboot_notify(struct + { + struct conexant_spec *spec = codec->spec; + +- if (codec->core.vendor_id != 0x14f150f2) ++ switch (codec->core.vendor_id) { ++ case 0x14f150f2: /* CX20722 */ ++ case 0x14f150f4: /* CX20724 */ ++ break; ++ default: + return; ++ } + + /* Turn the CX20722 codec into D3 to avoid spurious noises + from the internal speaker during (and after) reboot */ diff --git a/queue-4.4/alsa-hda-don-t-handle-eld-notify-from-invalid-port.patch b/queue-4.4/alsa-hda-don-t-handle-eld-notify-from-invalid-port.patch new file mode 100644 index 00000000000..4a027439ff2 --- /dev/null +++ b/queue-4.4/alsa-hda-don-t-handle-eld-notify-from-invalid-port.patch @@ -0,0 +1,39 @@ +From 4f8e4f3537cafc4de128e6bfdf83baa78bc60eb1 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 10 Mar 2016 12:02:49 +0100 +Subject: ALSA: hda - Don't handle ELD notify from invalid port + +From: Takashi Iwai + +commit 4f8e4f3537cafc4de128e6bfdf83baa78bc60eb1 upstream. + +The current Intel HDMI codec driver supports only three fixed ports +from port B to port D. However, i915 driver may assign a DP on other +ports, e.g. port A, when no eDP is used. This incompatibility is +caught later at pin_nid_to_pin_index() and results in a warning +message like "HDMI: pin nid 4 not registered" at each time. + +This patch filters out such invalid events beforehand, so that the +kernel won't be too grumbling. + +Reported-by: Stefan Assmann +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_hdmi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -2353,6 +2353,10 @@ static void intel_pin_eld_notify(void *a + struct hda_codec *codec = audio_ptr; + int pin_nid = port + 0x04; + ++ /* we assume only from port-B to port-D */ ++ if (port < 1 || port > 3) ++ return; ++ + /* skip notification during system suspend (but not in runtime PM); + * the state will be updated at resume + */ diff --git a/queue-4.4/alsa-hda-fix-the-mic-mute-button-and-led-problem-for-a-lenovo-aio.patch b/queue-4.4/alsa-hda-fix-the-mic-mute-button-and-led-problem-for-a-lenovo-aio.patch new file mode 100644 index 00000000000..2ed8fdb6bce --- /dev/null +++ b/queue-4.4/alsa-hda-fix-the-mic-mute-button-and-led-problem-for-a-lenovo-aio.patch @@ -0,0 +1,32 @@ +From 6ef2f68fa38bf415830f67903d87180d933e0f47 Mon Sep 17 00:00:00 2001 +From: Hui Wang +Date: Fri, 11 Mar 2016 12:04:02 +0800 +Subject: ALSA: hda - fix the mic mute button and led problem for a Lenovo AIO + +From: Hui Wang + +commit 6ef2f68fa38bf415830f67903d87180d933e0f47 upstream. + +This Lenovo ThinkCentre AIO also uses Line2 as mic mute button and +uses GPIO2 to control the mic mute led, so applying this quirk can +make both the button and led work. + +BugLink: https://bugs.launchpad.net/bugs/1555912 +Signed-off-by: Hui Wang +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5529,6 +5529,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK), + SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE), + SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), ++ SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), + SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC), + SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP), diff --git a/queue-4.4/alsa-hda-fix-unconditional-gpio-toggle-via-automute.patch b/queue-4.4/alsa-hda-fix-unconditional-gpio-toggle-via-automute.patch new file mode 100644 index 00000000000..ca8886c5bc2 --- /dev/null +++ b/queue-4.4/alsa-hda-fix-unconditional-gpio-toggle-via-automute.patch @@ -0,0 +1,44 @@ +From 1f7c6658962fa1260c1658d681bd6bb0c746b99a Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 15 Mar 2016 16:44:55 +0100 +Subject: ALSA: hda - Fix unconditional GPIO toggle via automute + +From: Takashi Iwai + +commit 1f7c6658962fa1260c1658d681bd6bb0c746b99a upstream. + +Cirrus HD-audio driver may adjust GPIO pins for EAPD dynamically +depending on the jack plug state. This works fine for the auto-mute +mode where the speaker gets muted upon the HP jack plug. OTOH, when +the auto-mute mode is off, this turns off the EAPD unexpectedly +depending on the jack state, which results in the silent speaker +output. + +This patch fixes the silent speaker output issue by setting GPIO bits +constantly when the auto-mute mode is off. + +Reported-and-tested-by: moosotc@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_cirrus.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/sound/pci/hda/patch_cirrus.c ++++ b/sound/pci/hda/patch_cirrus.c +@@ -174,8 +174,12 @@ static void cs_automute(struct hda_codec + snd_hda_gen_update_outputs(codec); + + if (spec->gpio_eapd_hp || spec->gpio_eapd_speaker) { +- spec->gpio_data = spec->gen.hp_jack_present ? +- spec->gpio_eapd_hp : spec->gpio_eapd_speaker; ++ if (spec->gen.automute_speaker) ++ spec->gpio_data = spec->gen.hp_jack_present ? ++ spec->gpio_eapd_hp : spec->gpio_eapd_speaker; ++ else ++ spec->gpio_data = ++ spec->gpio_eapd_hp | spec->gpio_eapd_speaker; + snd_hda_codec_write(codec, 0x01, 0, + AC_VERB_SET_GPIO_DATA, spec->gpio_data); + } diff --git a/queue-4.4/alsa-intel8x0-add-clock-quirk-entry-for-ad1981b-on-ibm-thinkpad-x41.patch b/queue-4.4/alsa-intel8x0-add-clock-quirk-entry-for-ad1981b-on-ibm-thinkpad-x41.patch new file mode 100644 index 00000000000..aa124e1216b --- /dev/null +++ b/queue-4.4/alsa-intel8x0-add-clock-quirk-entry-for-ad1981b-on-ibm-thinkpad-x41.patch @@ -0,0 +1,31 @@ +From 4061db03dd71d195b9973ee466f6ed32f6a3fc16 Mon Sep 17 00:00:00 2001 +From: "Vittorio Gambaletta (VittGam)" +Date: Sun, 13 Mar 2016 22:19:34 +0100 +Subject: ALSA: intel8x0: Add clock quirk entry for AD1981B on IBM ThinkPad X41. + +From: Vittorio Gambaletta (VittGam) + +commit 4061db03dd71d195b9973ee466f6ed32f6a3fc16 upstream. + +The clock measurement on the AC'97 audio card found in the IBM ThinkPad X41 +will often fail, so add a quirk entry to fix it. + +Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=441087 +Signed-off-by: Vittorio Gambaletta +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/intel8x0.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/intel8x0.c ++++ b/sound/pci/intel8x0.c +@@ -2879,6 +2879,7 @@ static void intel8x0_measure_ac97_clock( + + static struct snd_pci_quirk intel8x0_clock_list[] = { + SND_PCI_QUIRK(0x0e11, 0x008a, "AD1885", 41000), ++ SND_PCI_QUIRK(0x1014, 0x0581, "AD1981B", 48000), + SND_PCI_QUIRK(0x1028, 0x00be, "AD1885", 44100), + SND_PCI_QUIRK(0x1028, 0x0177, "AD1980", 48000), + SND_PCI_QUIRK(0x1028, 0x01ad, "AD1981B", 48000), diff --git a/queue-4.4/alsa-pcm-avoid-bug-string-for-warnings-again.patch b/queue-4.4/alsa-pcm-avoid-bug-string-for-warnings-again.patch new file mode 100644 index 00000000000..6e70da1454c --- /dev/null +++ b/queue-4.4/alsa-pcm-avoid-bug-string-for-warnings-again.patch @@ -0,0 +1,35 @@ +From 0ab1ace856205d10cbc1924b2d931c01ffd216a6 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 10 Mar 2016 20:56:20 +0100 +Subject: ALSA: pcm: Avoid "BUG:" string for warnings again + +From: Takashi Iwai + +commit 0ab1ace856205d10cbc1924b2d931c01ffd216a6 upstream. + +The commit [d507941beb1e: ALSA: pcm: Correct PCM BUG error message] +made the warning prefix back to "BUG:" due to its previous wrong +prefix. But a kernel message containing "BUG:" seems taken as an Oops +message wrongly by some brain-dead daemons, and it annoys users in the +end. Instead of teaching daemons, change the string again to a more +reasonable one. + +Fixes: 507941beb1e ('ALSA: pcm: Correct PCM BUG error message') +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/pcm_lib.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/core/pcm_lib.c ++++ b/sound/core/pcm_lib.c +@@ -322,7 +322,7 @@ static int snd_pcm_update_hw_ptr0(struct + char name[16]; + snd_pcm_debug_name(substream, name, sizeof(name)); + pcm_err(substream->pcm, +- "BUG: %s, pos = %ld, buffer size = %ld, period size = %ld\n", ++ "invalid position: %s, pos = %ld, buffer size = %ld, period size = %ld\n", + name, pos, runtime->buffer_size, + runtime->period_size); + } diff --git a/queue-4.4/bcache-cleaned-up-error-handling-around-register_cache.patch b/queue-4.4/bcache-cleaned-up-error-handling-around-register_cache.patch new file mode 100644 index 00000000000..fefe75b7c66 --- /dev/null +++ b/queue-4.4/bcache-cleaned-up-error-handling-around-register_cache.patch @@ -0,0 +1,112 @@ +From 9b299728ed777428b3908ac72ace5f8f84b97789 Mon Sep 17 00:00:00 2001 +From: Eric Wheeler +Date: Fri, 26 Feb 2016 14:33:56 -0800 +Subject: bcache: cleaned up error handling around register_cache() + +From: Eric Wheeler + +commit 9b299728ed777428b3908ac72ace5f8f84b97789 upstream. + +Fix null pointer dereference by changing register_cache() to return an int +instead of being void. This allows it to return -ENOMEM or -ENODEV and +enables upper layers to handle the OOM case without NULL pointer issues. + +See this thread: + http://thread.gmane.org/gmane.linux.kernel.bcache.devel/3521 + +Fixes this error: + gargamel:/sys/block/md5/bcache# echo /dev/sdh2 > /sys/fs/bcache/register + + bcache: register_cache() error opening sdh2: cannot allocate memory + BUG: unable to handle kernel NULL pointer dereference at 00000000000009b8 + IP: [] cache_set_flush+0x102/0x15c [bcache] + PGD 120dff067 PUD 1119a3067 PMD 0 + Oops: 0000 [#1] SMP + Modules linked in: veth ip6table_filter ip6_tables + (...) + CPU: 4 PID: 3371 Comm: kworker/4:3 Not tainted 4.4.2-amd64-i915-volpreempt-20160213bc1 #3 + Hardware name: System manufacturer System Product Name/P8H67-M PRO, BIOS 3904 04/27/2013 + Workqueue: events cache_set_flush [bcache] + task: ffff88020d5dc280 ti: ffff88020b6f8000 task.ti: ffff88020b6f8000 + RIP: 0010:[] [] cache_set_flush+0x102/0x15c [bcache] + +Signed-off-by: Eric Wheeler +Tested-by: Marc MERLIN +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/bcache/super.c | 34 ++++++++++++++++++++++------------ + 1 file changed, 22 insertions(+), 12 deletions(-) + +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -1828,11 +1828,12 @@ static int cache_alloc(struct cache_sb * + return 0; + } + +-static void register_cache(struct cache_sb *sb, struct page *sb_page, ++static int register_cache(struct cache_sb *sb, struct page *sb_page, + struct block_device *bdev, struct cache *ca) + { + char name[BDEVNAME_SIZE]; +- const char *err = "cannot allocate memory"; ++ const char *err = NULL; ++ int ret = 0; + + memcpy(&ca->sb, sb, sizeof(struct cache_sb)); + ca->bdev = bdev; +@@ -1847,27 +1848,35 @@ static void register_cache(struct cache_ + if (blk_queue_discard(bdev_get_queue(ca->bdev))) + ca->discard = CACHE_DISCARD(&ca->sb); + +- if (cache_alloc(sb, ca) != 0) ++ ret = cache_alloc(sb, ca); ++ if (ret != 0) + goto err; + +- err = "error creating kobject"; +- if (kobject_add(&ca->kobj, &part_to_dev(bdev->bd_part)->kobj, "bcache")) +- goto err; ++ if (kobject_add(&ca->kobj, &part_to_dev(bdev->bd_part)->kobj, "bcache")) { ++ err = "error calling kobject_add"; ++ ret = -ENOMEM; ++ goto out; ++ } + + mutex_lock(&bch_register_lock); + err = register_cache_set(ca); + mutex_unlock(&bch_register_lock); + +- if (err) +- goto err; ++ if (err) { ++ ret = -ENODEV; ++ goto out; ++ } + + pr_info("registered cache device %s", bdevname(bdev, name)); ++ + out: + kobject_put(&ca->kobj); +- return; ++ + err: +- pr_notice("error opening %s: %s", bdevname(bdev, name), err); +- goto out; ++ if (err) ++ pr_notice("error opening %s: %s", bdevname(bdev, name), err); ++ ++ return ret; + } + + /* Global interfaces/init */ +@@ -1965,7 +1974,8 @@ static ssize_t register_bcache(struct ko + if (!ca) + goto err_close; + +- register_cache(sb, sb_page, bdev, ca); ++ if (register_cache(sb, sb_page, bdev, ca) != 0) ++ goto err_close; + } + out: + if (sb_page) diff --git a/queue-4.4/bcache-fix-cache_set_flush-null-pointer-dereference-on-oom.patch b/queue-4.4/bcache-fix-cache_set_flush-null-pointer-dereference-on-oom.patch new file mode 100644 index 00000000000..6d99caa2333 --- /dev/null +++ b/queue-4.4/bcache-fix-cache_set_flush-null-pointer-dereference-on-oom.patch @@ -0,0 +1,34 @@ +From f8b11260a445169989d01df75d35af0f56178f95 Mon Sep 17 00:00:00 2001 +From: Eric Wheeler +Date: Mon, 7 Mar 2016 15:17:50 -0800 +Subject: bcache: fix cache_set_flush() NULL pointer dereference on OOM + +From: Eric Wheeler + +commit f8b11260a445169989d01df75d35af0f56178f95 upstream. + +When bch_cache_set_alloc() fails to kzalloc the cache_set, the +asyncronous closure handling tries to dereference a cache_set that +hadn't yet been allocated inside of cache_set_flush() which is called +by __cache_set_unregister() during cleanup. This appears to happen only +during an OOM condition on bcache_register. + +Signed-off-by: Eric Wheeler +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/bcache/super.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -1373,6 +1373,9 @@ static void cache_set_flush(struct closu + struct btree *b; + unsigned i; + ++ if (!c) ++ closure_return(cl); ++ + bch_cache_accounting_destroy(&c->accounting); + + kobject_put(&c->internal); diff --git a/queue-4.4/bcache-fix-race-of-writeback-thread-starting-before-complete-initialization.patch b/queue-4.4/bcache-fix-race-of-writeback-thread-starting-before-complete-initialization.patch new file mode 100644 index 00000000000..7c0f9d3e56a --- /dev/null +++ b/queue-4.4/bcache-fix-race-of-writeback-thread-starting-before-complete-initialization.patch @@ -0,0 +1,53 @@ +From 07cc6ef8edc47f8b4fc1e276d31127a0a5863d4d Mon Sep 17 00:00:00 2001 +From: Eric Wheeler +Date: Fri, 26 Feb 2016 14:39:06 -0800 +Subject: bcache: fix race of writeback thread starting before complete initialization + +From: Eric Wheeler + +commit 07cc6ef8edc47f8b4fc1e276d31127a0a5863d4d upstream. + +The bch_writeback_thread might BUG_ON in read_dirty() if +dc->sb==BDEV_STATE_DIRTY and bch_sectors_dirty_init has not yet completed +its related initialization. This patch downs the dc->writeback_lock until +after initialization is complete, thus preventing bch_writeback_thread +from proceeding prematurely. + +See this thread: + http://thread.gmane.org/gmane.linux.kernel.bcache.devel/3453 + +Signed-off-by: Eric Wheeler +Tested-by: Marc MERLIN +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/bcache/super.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -1015,8 +1015,12 @@ int bch_cached_dev_attach(struct cached_ + */ + atomic_set(&dc->count, 1); + +- if (bch_cached_dev_writeback_start(dc)) ++ /* Block writeback thread, but spawn it */ ++ down_write(&dc->writeback_lock); ++ if (bch_cached_dev_writeback_start(dc)) { ++ up_write(&dc->writeback_lock); + return -ENOMEM; ++ } + + if (BDEV_STATE(&dc->sb) == BDEV_STATE_DIRTY) { + bch_sectors_dirty_init(dc); +@@ -1028,6 +1032,9 @@ int bch_cached_dev_attach(struct cached_ + bch_cached_dev_run(dc); + bcache_device_link(&dc->disk, c, "bdev"); + ++ /* Allow the writeback thread to proceed */ ++ up_write(&dc->writeback_lock); ++ + pr_info("Caching %s as %s on set %pU", + bdevname(dc->bdev, buf), dc->disk.disk->disk_name, + dc->disk.c->sb.set_uuid); diff --git a/queue-4.4/brd-fix-discard-request-processing.patch b/queue-4.4/brd-fix-discard-request-processing.patch new file mode 100644 index 00000000000..76d88431b31 --- /dev/null +++ b/queue-4.4/brd-fix-discard-request-processing.patch @@ -0,0 +1,36 @@ +From 5e4298be45e83ecdffaabb370eea9396889b07f1 Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Tue, 15 Dec 2015 16:38:22 +0100 +Subject: brd: Fix discard request processing + +From: Bart Van Assche + +commit 5e4298be45e83ecdffaabb370eea9396889b07f1 upstream. + +Avoid that discard requests with size => PAGE_SIZE fail with +-EIO. Refuse discard requests if the discard size is not a +multiple of the page size. + +Fixes: 2dbe54957636 ("brd: Refuse improperly aligned discard requests") +Signed-off-by: Bart Van Assche +Reviewed-by: Jan Kara +Cc: Christoph Hellwig +Cc: Robert Elliot +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/brd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/block/brd.c ++++ b/drivers/block/brd.c +@@ -338,7 +338,7 @@ static blk_qc_t brd_make_request(struct + + if (unlikely(bio->bi_rw & REQ_DISCARD)) { + if (sector & ((PAGE_SIZE >> SECTOR_SHIFT) - 1) || +- bio->bi_iter.bi_size & PAGE_MASK) ++ bio->bi_iter.bi_size & ~PAGE_MASK) + goto io_error; + discard_from_brd(brd, sector, bio->bi_iter.bi_size); + goto out; diff --git a/queue-4.4/ia64-define-ioremap_uc.patch b/queue-4.4/ia64-define-ioremap_uc.patch new file mode 100644 index 00000000000..916a3569819 --- /dev/null +++ b/queue-4.4/ia64-define-ioremap_uc.patch @@ -0,0 +1,37 @@ +From b0f84ac352762ed02d7ea9f284942a8cab7f9077 Mon Sep 17 00:00:00 2001 +From: "Luis R. Rodriguez" +Date: Thu, 17 Mar 2016 14:17:16 -0700 +Subject: ia64: define ioremap_uc() + +From: Luis R. Rodriguez + +commit b0f84ac352762ed02d7ea9f284942a8cab7f9077 upstream. + +All architectures now need ioremap_uc(), ia64 seems defines this already +through its ioremap_nocache() and it already ensures it *only* uses UC. + +This is needed since v4.3 to complete an allyesconfig compile on ia64, +there were others archs that needed this, and this one seems to have +fallen through the cracks. + +Signed-off-by: Luis R. Rodriguez +Reported-by: kbuild test robot +Acked-by: Tony Luck +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/ia64/include/asm/io.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/ia64/include/asm/io.h ++++ b/arch/ia64/include/asm/io.h +@@ -436,6 +436,7 @@ static inline void __iomem * ioremap_cac + return ioremap(phys_addr, size); + } + #define ioremap_cache ioremap_cache ++#define ioremap_uc ioremap_nocache + + + /* diff --git a/queue-4.4/ib-srpt-simplify-srpt_handle_tsk_mgmt.patch b/queue-4.4/ib-srpt-simplify-srpt_handle_tsk_mgmt.patch new file mode 100644 index 00000000000..ef2e5a75c2a --- /dev/null +++ b/queue-4.4/ib-srpt-simplify-srpt_handle_tsk_mgmt.patch @@ -0,0 +1,122 @@ +From 51093254bf879bc9ce96590400a87897c7498463 Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Thu, 11 Feb 2016 11:03:09 -0800 +Subject: IB/srpt: Simplify srpt_handle_tsk_mgmt() + +From: Bart Van Assche + +commit 51093254bf879bc9ce96590400a87897c7498463 upstream. + +Let the target core check task existence instead of the SRP target +driver. Additionally, let the target core check the validity of the +task management request instead of the ib_srpt driver. + +This patch fixes the following kernel crash: + +BUG: unable to handle kernel NULL pointer dereference at 0000000000000001 +IP: [] srpt_handle_new_iu+0x6d7/0x790 [ib_srpt] +Oops: 0002 [#1] SMP +Call Trace: + [] srpt_process_completion+0xde/0x570 [ib_srpt] + [] srpt_compl_thread+0x13f/0x160 [ib_srpt] + [] kthread+0xcf/0xe0 + [] ret_from_fork+0x7c/0xb0 + +Signed-off-by: Bart Van Assche +Fixes: 3e4f574857ee ("ib_srpt: Convert TMR path to target_submit_tmr") +Tested-by: Alex Estrin +Reviewed-by: Christoph Hellwig +Cc: Nicholas Bellinger +Cc: Sagi Grimberg +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/ulp/srpt/ib_srpt.c | 59 ---------------------------------- + 1 file changed, 1 insertion(+), 58 deletions(-) + +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -1737,47 +1737,6 @@ send_sense: + return -1; + } + +-/** +- * srpt_rx_mgmt_fn_tag() - Process a task management function by tag. +- * @ch: RDMA channel of the task management request. +- * @fn: Task management function to perform. +- * @req_tag: Tag of the SRP task management request. +- * @mgmt_ioctx: I/O context of the task management request. +- * +- * Returns zero if the target core will process the task management +- * request asynchronously. +- * +- * Note: It is assumed that the initiator serializes tag-based task management +- * requests. +- */ +-static int srpt_rx_mgmt_fn_tag(struct srpt_send_ioctx *ioctx, u64 tag) +-{ +- struct srpt_device *sdev; +- struct srpt_rdma_ch *ch; +- struct srpt_send_ioctx *target; +- int ret, i; +- +- ret = -EINVAL; +- ch = ioctx->ch; +- BUG_ON(!ch); +- BUG_ON(!ch->sport); +- sdev = ch->sport->sdev; +- BUG_ON(!sdev); +- spin_lock_irq(&sdev->spinlock); +- for (i = 0; i < ch->rq_size; ++i) { +- target = ch->ioctx_ring[i]; +- if (target->cmd.se_lun == ioctx->cmd.se_lun && +- target->cmd.tag == tag && +- srpt_get_cmd_state(target) != SRPT_STATE_DONE) { +- ret = 0; +- /* now let the target core abort &target->cmd; */ +- break; +- } +- } +- spin_unlock_irq(&sdev->spinlock); +- return ret; +-} +- + static int srp_tmr_to_tcm(int fn) + { + switch (fn) { +@@ -1812,7 +1771,6 @@ static void srpt_handle_tsk_mgmt(struct + struct se_cmd *cmd; + struct se_session *sess = ch->sess; + uint64_t unpacked_lun; +- uint32_t tag = 0; + int tcm_tmr; + int rc; + +@@ -1828,25 +1786,10 @@ static void srpt_handle_tsk_mgmt(struct + srpt_set_cmd_state(send_ioctx, SRPT_STATE_MGMT); + send_ioctx->cmd.tag = srp_tsk->tag; + tcm_tmr = srp_tmr_to_tcm(srp_tsk->tsk_mgmt_func); +- if (tcm_tmr < 0) { +- send_ioctx->cmd.se_tmr_req->response = +- TMR_TASK_MGMT_FUNCTION_NOT_SUPPORTED; +- goto fail; +- } + unpacked_lun = srpt_unpack_lun((uint8_t *)&srp_tsk->lun, + sizeof(srp_tsk->lun)); +- +- if (srp_tsk->tsk_mgmt_func == SRP_TSK_ABORT_TASK) { +- rc = srpt_rx_mgmt_fn_tag(send_ioctx, srp_tsk->task_tag); +- if (rc < 0) { +- send_ioctx->cmd.se_tmr_req->response = +- TMR_TASK_DOES_NOT_EXIST; +- goto fail; +- } +- tag = srp_tsk->task_tag; +- } + rc = target_submit_tmr(&send_ioctx->cmd, sess, NULL, unpacked_lun, +- srp_tsk, tcm_tmr, GFP_KERNEL, tag, ++ srp_tsk, tcm_tmr, GFP_KERNEL, srp_tsk->task_tag, + TARGET_SCF_ACK_KREF); + if (rc != 0) { + send_ioctx->cmd.se_tmr_req->response = TMR_FUNCTION_REJECTED; diff --git a/queue-4.4/jbd2-fix-fs-corruption-possibility-in-jbd2_journal_destroy-on-umount-path.patch b/queue-4.4/jbd2-fix-fs-corruption-possibility-in-jbd2_journal_destroy-on-umount-path.patch new file mode 100644 index 00000000000..eb63c6a127d --- /dev/null +++ b/queue-4.4/jbd2-fix-fs-corruption-possibility-in-jbd2_journal_destroy-on-umount-path.patch @@ -0,0 +1,124 @@ +From c0a2ad9b50dd80eeccd73d9ff962234590d5ec93 Mon Sep 17 00:00:00 2001 +From: OGAWA Hirofumi +Date: Wed, 9 Mar 2016 23:47:25 -0500 +Subject: jbd2: fix FS corruption possibility in jbd2_journal_destroy() on umount path + +From: OGAWA Hirofumi + +commit c0a2ad9b50dd80eeccd73d9ff962234590d5ec93 upstream. + +On umount path, jbd2_journal_destroy() writes latest transaction ID +(->j_tail_sequence) to be used at next mount. + +The bug is that ->j_tail_sequence is not holding latest transaction ID +in some cases. So, at next mount, there is chance to conflict with +remaining (not overwritten yet) transactions. + + mount (id=10) + write transaction (id=11) + write transaction (id=12) + umount (id=10) <= the bug doesn't write latest ID + + mount (id=10) + write transaction (id=11) + crash + + mount + [recovery process] + transaction (id=11) + transaction (id=12) <= valid transaction ID, but old commit + must not replay + +Like above, this bug become the cause of recovery failure, or FS +corruption. + +So why ->j_tail_sequence doesn't point latest ID? + +Because if checkpoint transactions was reclaimed by memory pressure +(i.e. bdev_try_to_free_page()), then ->j_tail_sequence is not updated. +(And another case is, __jbd2_journal_clean_checkpoint_list() is called +with empty transaction.) + +So in above cases, ->j_tail_sequence is not pointing latest +transaction ID at umount path. Plus, REQ_FLUSH for checkpoint is not +done too. + +So, to fix this problem with minimum changes, this patch updates +->j_tail_sequence, and issue REQ_FLUSH. (With more complex changes, +some optimizations would be possible to avoid unnecessary REQ_FLUSH +for example though.) + +BTW, + + journal->j_tail_sequence = + ++journal->j_transaction_sequence; + +Increment of ->j_transaction_sequence seems to be unnecessary, but +ext3 does this. + +Signed-off-by: OGAWA Hirofumi +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jbd2/journal.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -1408,11 +1408,12 @@ out: + /** + * jbd2_mark_journal_empty() - Mark on disk journal as empty. + * @journal: The journal to update. ++ * @write_op: With which operation should we write the journal sb + * + * Update a journal's dynamic superblock fields to show that journal is empty. + * Write updated superblock to disk waiting for IO to complete. + */ +-static void jbd2_mark_journal_empty(journal_t *journal) ++static void jbd2_mark_journal_empty(journal_t *journal, int write_op) + { + journal_superblock_t *sb = journal->j_superblock; + +@@ -1430,7 +1431,7 @@ static void jbd2_mark_journal_empty(jour + sb->s_start = cpu_to_be32(0); + read_unlock(&journal->j_state_lock); + +- jbd2_write_superblock(journal, WRITE_FUA); ++ jbd2_write_superblock(journal, write_op); + + /* Log is no longer empty */ + write_lock(&journal->j_state_lock); +@@ -1716,7 +1717,13 @@ int jbd2_journal_destroy(journal_t *jour + if (journal->j_sb_buffer) { + if (!is_journal_aborted(journal)) { + mutex_lock(&journal->j_checkpoint_mutex); +- jbd2_mark_journal_empty(journal); ++ ++ write_lock(&journal->j_state_lock); ++ journal->j_tail_sequence = ++ ++journal->j_transaction_sequence; ++ write_unlock(&journal->j_state_lock); ++ ++ jbd2_mark_journal_empty(journal, WRITE_FLUSH_FUA); + mutex_unlock(&journal->j_checkpoint_mutex); + } else + err = -EIO; +@@ -1975,7 +1982,7 @@ int jbd2_journal_flush(journal_t *journa + * the magic code for a fully-recovered superblock. Any future + * commits of data to the journal will restore the current + * s_start value. */ +- jbd2_mark_journal_empty(journal); ++ jbd2_mark_journal_empty(journal, WRITE_FUA); + mutex_unlock(&journal->j_checkpoint_mutex); + write_lock(&journal->j_state_lock); + J_ASSERT(!journal->j_running_transaction); +@@ -2021,7 +2028,7 @@ int jbd2_journal_wipe(journal_t *journal + if (write) { + /* Lock to make assertions happy... */ + mutex_lock(&journal->j_checkpoint_mutex); +- jbd2_mark_journal_empty(journal); ++ jbd2_mark_journal_empty(journal, WRITE_FUA); + mutex_unlock(&journal->j_checkpoint_mutex); + } + diff --git a/queue-4.4/mm-memcontrol-reclaim-and-oom-kill-when-shrinking-memory.max-below-usage.patch b/queue-4.4/mm-memcontrol-reclaim-and-oom-kill-when-shrinking-memory.max-below-usage.patch new file mode 100644 index 00000000000..581b4d18a9b --- /dev/null +++ b/queue-4.4/mm-memcontrol-reclaim-and-oom-kill-when-shrinking-memory.max-below-usage.patch @@ -0,0 +1,104 @@ +From b6e6edcfa40561e9c8abe5eecf1c96f8e5fd9c6f Mon Sep 17 00:00:00 2001 +From: Johannes Weiner +Date: Thu, 17 Mar 2016 14:20:28 -0700 +Subject: mm: memcontrol: reclaim and OOM kill when shrinking memory.max below usage + +From: Johannes Weiner + +commit b6e6edcfa40561e9c8abe5eecf1c96f8e5fd9c6f upstream. + +Setting the original memory.limit_in_bytes hardlimit is subject to a +race condition when the desired value is below the current usage. The +code tries a few times to first reclaim and then see if the usage has +dropped to where we would like it to be, but there is no locking, and +the workload is free to continue making new charges up to the old limit. +Thus, attempting to shrink a workload relies on pure luck and hope that +the workload happens to cooperate. + +To fix this in the cgroup2 memory.max knob, do it the other way round: +set the limit first, then try enforcement. And if reclaim is not able +to succeed, trigger OOM kills in the group. Keep going until the new +limit is met, we run out of OOM victims and there's only unreclaimable +memory left, or the task writing to memory.max is killed. This allows +users to shrink groups reliably, and the behavior is consistent with +what happens when new charges are attempted in excess of memory.max. + +Signed-off-by: Johannes Weiner +Acked-by: Michal Hocko +Cc: Vladimir Davydov +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/memcontrol.c | 38 ++++++++++++++++++++++++++++++++++---- + 1 file changed, 34 insertions(+), 4 deletions(-) + +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -1332,7 +1332,7 @@ static unsigned long mem_cgroup_get_limi + return limit; + } + +-static void mem_cgroup_out_of_memory(struct mem_cgroup *memcg, gfp_t gfp_mask, ++static bool mem_cgroup_out_of_memory(struct mem_cgroup *memcg, gfp_t gfp_mask, + int order) + { + struct oom_control oc = { +@@ -1410,6 +1410,7 @@ static void mem_cgroup_out_of_memory(str + } + unlock: + mutex_unlock(&oom_lock); ++ return chosen; + } + + #if MAX_NUMNODES > 1 +@@ -5158,6 +5159,8 @@ static ssize_t memory_max_write(struct k + char *buf, size_t nbytes, loff_t off) + { + struct mem_cgroup *memcg = mem_cgroup_from_css(of_css(of)); ++ unsigned int nr_reclaims = MEM_CGROUP_RECLAIM_RETRIES; ++ bool drained = false; + unsigned long max; + int err; + +@@ -5166,9 +5169,36 @@ static ssize_t memory_max_write(struct k + if (err) + return err; + +- err = mem_cgroup_resize_limit(memcg, max); +- if (err) +- return err; ++ xchg(&memcg->memory.limit, max); ++ ++ for (;;) { ++ unsigned long nr_pages = page_counter_read(&memcg->memory); ++ ++ if (nr_pages <= max) ++ break; ++ ++ if (signal_pending(current)) { ++ err = -EINTR; ++ break; ++ } ++ ++ if (!drained) { ++ drain_all_stock(memcg); ++ drained = true; ++ continue; ++ } ++ ++ if (nr_reclaims) { ++ if (!try_to_free_mem_cgroup_pages(memcg, nr_pages - max, ++ GFP_KERNEL, true)) ++ nr_reclaims--; ++ continue; ++ } ++ ++ mem_cgroup_events(memcg, MEMCG_OOM, 1); ++ if (!mem_cgroup_out_of_memory(memcg, GFP_KERNEL, 0)) ++ break; ++ } + + memcg_wb_domain_size_changed(memcg); + return nbytes; diff --git a/queue-4.4/mm-memcontrol-reclaim-when-shrinking-memory.high-below-usage.patch b/queue-4.4/mm-memcontrol-reclaim-when-shrinking-memory.high-below-usage.patch new file mode 100644 index 00000000000..38f40673538 --- /dev/null +++ b/queue-4.4/mm-memcontrol-reclaim-when-shrinking-memory.high-below-usage.patch @@ -0,0 +1,50 @@ +From 588083bb37a3cea8533c392370a554417c8f29cb Mon Sep 17 00:00:00 2001 +From: Johannes Weiner +Date: Thu, 17 Mar 2016 14:20:25 -0700 +Subject: mm: memcontrol: reclaim when shrinking memory.high below usage + +From: Johannes Weiner + +commit 588083bb37a3cea8533c392370a554417c8f29cb upstream. + +When setting memory.high below usage, nothing happens until the next +charge comes along, and then it will only reclaim its own charge and not +the now potentially huge excess of the new memory.high. This can cause +groups to stay in excess of their memory.high indefinitely. + +To fix that, when shrinking memory.high, kick off a reclaim cycle that +goes after the delta. + +Signed-off-by: Johannes Weiner +Acked-by: Michal Hocko +Cc: Vladimir Davydov +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/memcontrol.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -5121,6 +5121,7 @@ static ssize_t memory_high_write(struct + char *buf, size_t nbytes, loff_t off) + { + struct mem_cgroup *memcg = mem_cgroup_from_css(of_css(of)); ++ unsigned long nr_pages; + unsigned long high; + int err; + +@@ -5131,6 +5132,11 @@ static ssize_t memory_high_write(struct + + memcg->high = high; + ++ nr_pages = page_counter_read(&memcg->memory); ++ if (nr_pages > high) ++ try_to_free_mem_cgroup_pages(memcg, nr_pages - high, ++ GFP_KERNEL, true); ++ + memcg_wb_domain_size_changed(memcg); + return nbytes; + } diff --git a/queue-4.4/series b/queue-4.4/series index 9899e1e580d..2ace8bcbc06 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -109,3 +109,21 @@ mtip32xx-handle-safe-removal-during-io.patch mtip32xx-handle-ftl-rebuild-failure-state-during-device-initialization.patch mtip32xx-implement-timeout-handler.patch mtip32xx-cleanup-queued-requests-after-surprise-removal.patch +alsa-hda-apply-reboot-d3-fix-for-cx20724-codec-too.patch +alsa-pcm-avoid-bug-string-for-warnings-again.patch +alsa-intel8x0-add-clock-quirk-entry-for-ad1981b-on-ibm-thinkpad-x41.patch +alsa-hda-don-t-handle-eld-notify-from-invalid-port.patch +alsa-hda-fix-the-mic-mute-button-and-led-problem-for-a-lenovo-aio.patch +alsa-hda-fix-unconditional-gpio-toggle-via-automute.patch +tools-hv-use-include-uapi-with-__exported_headers__.patch +jbd2-fix-fs-corruption-possibility-in-jbd2_journal_destroy-on-umount-path.patch +brd-fix-discard-request-processing.patch +ib-srpt-simplify-srpt_handle_tsk_mgmt.patch +bcache-cleaned-up-error-handling-around-register_cache.patch +bcache-fix-race-of-writeback-thread-starting-before-complete-initialization.patch +bcache-fix-cache_set_flush-null-pointer-dereference-on-oom.patch +mm-memcontrol-reclaim-when-shrinking-memory.high-below-usage.patch +mm-memcontrol-reclaim-and-oom-kill-when-shrinking-memory.max-below-usage.patch +ia64-define-ioremap_uc.patch +watchdog-don-t-run-proc_watchdog_update-if-new-value-is-same-as-old.patch +watchdog-rc32434_wdt-fix-ioctl-error-handling.patch diff --git a/queue-4.4/tools-hv-use-include-uapi-with-__exported_headers__.patch b/queue-4.4/tools-hv-use-include-uapi-with-__exported_headers__.patch new file mode 100644 index 00000000000..37887ef8bb8 --- /dev/null +++ b/queue-4.4/tools-hv-use-include-uapi-with-__exported_headers__.patch @@ -0,0 +1,32 @@ +From 50fe6dd10069e7c062e27f29606f6e91ea979399 Mon Sep 17 00:00:00 2001 +From: Kamal Mostafa +Date: Wed, 27 Jan 2016 22:29:33 -0800 +Subject: tools/hv: Use include/uapi with __EXPORTED_HEADERS__ + +From: Kamal Mostafa + +commit 50fe6dd10069e7c062e27f29606f6e91ea979399 upstream. + +Use the local uapi headers to keep in sync with "recently" added #define's +(e.g. VSS_OP_REGISTER1). + +Fixes: 3eb2094c59e8 ("Adding makefile for tools/hv") +Signed-off-by: Kamal Mostafa +Signed-off-by: K. Y. Srinivasan +Signed-off-by: Greg Kroah-Hartman + +--- + tools/hv/Makefile | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/tools/hv/Makefile ++++ b/tools/hv/Makefile +@@ -5,6 +5,8 @@ PTHREAD_LIBS = -lpthread + WARNINGS = -Wall -Wextra + CFLAGS = $(WARNINGS) -g $(PTHREAD_LIBS) $(shell getconf LFS_CFLAGS) + ++CFLAGS += -D__EXPORTED_HEADERS__ -I../../include/uapi -I../../include ++ + all: hv_kvp_daemon hv_vss_daemon hv_fcopy_daemon + %: %.c + $(CC) $(CFLAGS) -o $@ $^ diff --git a/queue-4.4/watchdog-don-t-run-proc_watchdog_update-if-new-value-is-same-as-old.patch b/queue-4.4/watchdog-don-t-run-proc_watchdog_update-if-new-value-is-same-as-old.patch new file mode 100644 index 00000000000..9e5a133025a --- /dev/null +++ b/queue-4.4/watchdog-don-t-run-proc_watchdog_update-if-new-value-is-same-as-old.patch @@ -0,0 +1,66 @@ +From a1ee1932aa6bea0bb074f5e3ced112664e4637ed Mon Sep 17 00:00:00 2001 +From: Joshua Hunt +Date: Thu, 17 Mar 2016 14:17:23 -0700 +Subject: watchdog: don't run proc_watchdog_update if new value is same as old + +From: Joshua Hunt + +commit a1ee1932aa6bea0bb074f5e3ced112664e4637ed upstream. + +While working on a script to restore all sysctl params before a series of +tests I found that writing any value into the +/proc/sys/kernel/{nmi_watchdog,soft_watchdog,watchdog,watchdog_thresh} +causes them to call proc_watchdog_update(). + + NMI watchdog: enabled on all CPUs, permanently consumes one hw-PMU counter. + NMI watchdog: enabled on all CPUs, permanently consumes one hw-PMU counter. + NMI watchdog: enabled on all CPUs, permanently consumes one hw-PMU counter. + NMI watchdog: enabled on all CPUs, permanently consumes one hw-PMU counter. + +There doesn't appear to be a reason for doing this work every time a write +occurs, so only do it when the values change. + +Signed-off-by: Josh Hunt +Acked-by: Don Zickus +Reviewed-by: Aaron Tomlin +Cc: Ulrich Obergfell +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/watchdog.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/kernel/watchdog.c ++++ b/kernel/watchdog.c +@@ -907,6 +907,9 @@ static int proc_watchdog_common(int whic + * both lockup detectors are disabled if proc_watchdog_update() + * returns an error. + */ ++ if (old == new) ++ goto out; ++ + err = proc_watchdog_update(); + } + out: +@@ -951,7 +954,7 @@ int proc_soft_watchdog(struct ctl_table + int proc_watchdog_thresh(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos) + { +- int err, old; ++ int err, old, new; + + get_online_cpus(); + mutex_lock(&watchdog_proc_mutex); +@@ -971,6 +974,10 @@ int proc_watchdog_thresh(struct ctl_tabl + /* + * Update the sample period. Restore on failure. + */ ++ new = ACCESS_ONCE(watchdog_thresh); ++ if (old == new) ++ goto out; ++ + set_sample_period(); + err = proc_watchdog_update(); + if (err) { diff --git a/queue-4.4/watchdog-rc32434_wdt-fix-ioctl-error-handling.patch b/queue-4.4/watchdog-rc32434_wdt-fix-ioctl-error-handling.patch new file mode 100644 index 00000000000..c171b8f1f88 --- /dev/null +++ b/queue-4.4/watchdog-rc32434_wdt-fix-ioctl-error-handling.patch @@ -0,0 +1,38 @@ +From 10e7ac22cdd4d211cef99afcb9371b70cb175be6 Mon Sep 17 00:00:00 2001 +From: "Michael S. Tsirkin" +Date: Sun, 28 Feb 2016 17:44:09 +0200 +Subject: watchdog: rc32434_wdt: fix ioctl error handling + +From: Michael S. Tsirkin + +commit 10e7ac22cdd4d211cef99afcb9371b70cb175be6 upstream. + +Calling return copy_to_user(...) in an ioctl will not do the right thing +if there's a pagefault: copy_to_user returns the number of bytes not +copied in this case. + +Fix up watchdog/rc32434_wdt to do + return copy_to_user(...)) ? -EFAULT : 0; + +instead. + +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/watchdog/rc32434_wdt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/watchdog/rc32434_wdt.c ++++ b/drivers/watchdog/rc32434_wdt.c +@@ -237,7 +237,7 @@ static long rc32434_wdt_ioctl(struct fil + return -EINVAL; + /* Fall through */ + case WDIOC_GETTIMEOUT: +- return copy_to_user(argp, &timeout, sizeof(int)); ++ return copy_to_user(argp, &timeout, sizeof(int)) ? -EFAULT : 0; + default: + return -ENOTTY; + }