From: Greg Kroah-Hartman Date: Thu, 17 Nov 2016 09:04:39 +0000 (+0100) Subject: 4.8-stable patches X-Git-Tag: v4.4.33~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c13f04591368861fe33ffba9438c33a70bc1cfae;p=thirdparty%2Fkernel%2Fstable-queue.git 4.8-stable patches added patches: acpi-apei-fix-incorrect-return-value-of-ghes_proc.patch acpi-pci-irq-assign-isa-irq-directly-during-early-boot-stages.patch acpi-pci-pci_link-include-pirq_penalty_pci_using-for-isa-irqs.patch acpi-pci-pci_link-penalize-sci-correctly.patch asoc-intel-skylake-always-acquire-runtime-pm-ref-on-unload.patch asoc-sun4i-codec-return-error-code-instead-of-null-when-create_card-fails.patch batman-adv-fix-splat-on-disabling-an-interface.patch batman-adv-modify-neigh_list-only-with-rcu-list-functions.patch gpio-mvebu-use-irq_domain_add_linear.patch gpio-of-fix-gpio-drivers-with-multiple-gpio_chip-for-a-single-node.patch hwrng-core-don-t-use-a-stack-buffer-in-add_early_randomness.patch i40e-fix-call-of-ndo_dflt_bridge_getlink.patch lib-genalloc.c-start-search-from-start-of-chunk.patch libceph-fix-legacy-layout-decode-with-pool-0.patch memcg-prevent-memcg-caches-to-be-both-off_slab-objfreelist_slab.patch mmc-mxs-initialize-the-spinlock-prior-to-using-it.patch mmc-sdhci-msm-fix-error-return-code-in-sdhci_msm_probe.patch nfsv4.1-work-around-wmaybe-uninitialized-warning.patch pinctrl-iproc-fix-iproc-and-nsp-gpio-support.patch rtc-pcf2123-add-missing-error-code-assignment-before-test.patch s390-dumpstack-restore-reliable-indicator-for-call-traces.patch --- diff --git a/queue-4.8/acpi-apei-fix-incorrect-return-value-of-ghes_proc.patch b/queue-4.8/acpi-apei-fix-incorrect-return-value-of-ghes_proc.patch new file mode 100644 index 00000000000..c9e8c4ae33e --- /dev/null +++ b/queue-4.8/acpi-apei-fix-incorrect-return-value-of-ghes_proc.patch @@ -0,0 +1,36 @@ +From 806487a8fc8f385af75ed261e9ab658fc845e633 Mon Sep 17 00:00:00 2001 +From: Punit Agrawal +Date: Tue, 18 Oct 2016 17:07:19 +0100 +Subject: ACPI / APEI: Fix incorrect return value of ghes_proc() + +From: Punit Agrawal + +commit 806487a8fc8f385af75ed261e9ab658fc845e633 upstream. + +Although ghes_proc() tests for errors while reading the error status, +it always return success (0). Fix this by propagating the return +value. + +Fixes: d334a49113a4a33 (ACPI, APEI, Generic Hardware Error Source memory error support) +Signed-of-by: Punit Agrawal +Tested-by: Tyler Baicar +Reviewed-by: Borislav Petkov +[ rjw: Subject ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/apei/ghes.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/acpi/apei/ghes.c ++++ b/drivers/acpi/apei/ghes.c +@@ -662,7 +662,7 @@ static int ghes_proc(struct ghes *ghes) + ghes_do_proc(ghes, ghes->estatus); + out: + ghes_clear_estatus(ghes); +- return 0; ++ return rc; + } + + static void ghes_add_timer(struct ghes *ghes) diff --git a/queue-4.8/acpi-pci-irq-assign-isa-irq-directly-during-early-boot-stages.patch b/queue-4.8/acpi-pci-irq-assign-isa-irq-directly-during-early-boot-stages.patch new file mode 100644 index 00000000000..00cf87402b1 --- /dev/null +++ b/queue-4.8/acpi-pci-irq-assign-isa-irq-directly-during-early-boot-stages.patch @@ -0,0 +1,51 @@ +From eeaed4bb5a35591470b545590bb2f26dbe7653a2 Mon Sep 17 00:00:00 2001 +From: Sinan Kaya +Date: Mon, 24 Oct 2016 00:31:30 -0400 +Subject: ACPI/PCI/IRQ: assign ISA IRQ directly during early boot stages + +From: Sinan Kaya + +commit eeaed4bb5a35591470b545590bb2f26dbe7653a2 upstream. + +We do not want to store the SCI penalty in the acpi_isa_irq_penalty[] +table because acpi_isa_irq_penalty[] only holds ISA IRQ penalties and +there's no guarantee that the SCI is an ISA IRQ. We add in the SCI +penalty as a special case in acpi_irq_get_penalty(). + +But if we called acpi_penalize_isa_irq() or acpi_irq_penalty_update() +for an SCI that happened to be an ISA IRQ, they stored the SCI +penalty (part of the acpi_irq_get_penalty() return value) in +acpi_isa_irq_penalty[]. Subsequent calls to acpi_irq_get_penalty() +returned a penalty that included *two* SCI penalties. + +Fixes: 103544d86976 (ACPI,PCI,IRQ: reduce resource requirements) +Signed-off-by: Sinan Kaya +Acked-by: Bjorn Helgaas +Tested-by: Jonathan Liu +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/pci_link.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/acpi/pci_link.c ++++ b/drivers/acpi/pci_link.c +@@ -849,7 +849,7 @@ static int __init acpi_irq_penalty_updat + continue; + + if (used) +- new_penalty = acpi_irq_get_penalty(irq) + ++ new_penalty = acpi_isa_irq_penalty[irq] + + PIRQ_PENALTY_ISA_USED; + else + new_penalty = 0; +@@ -871,7 +871,7 @@ static int __init acpi_irq_penalty_updat + void acpi_penalize_isa_irq(int irq, int active) + { + if ((irq >= 0) && (irq < ARRAY_SIZE(acpi_isa_irq_penalty))) +- acpi_isa_irq_penalty[irq] = acpi_irq_get_penalty(irq) + ++ acpi_isa_irq_penalty[irq] += + (active ? PIRQ_PENALTY_ISA_USED : PIRQ_PENALTY_PCI_USING); + } + diff --git a/queue-4.8/acpi-pci-pci_link-include-pirq_penalty_pci_using-for-isa-irqs.patch b/queue-4.8/acpi-pci-pci_link-include-pirq_penalty_pci_using-for-isa-irqs.patch new file mode 100644 index 00000000000..e1ec254fbbe --- /dev/null +++ b/queue-4.8/acpi-pci-pci_link-include-pirq_penalty_pci_using-for-isa-irqs.patch @@ -0,0 +1,43 @@ +From 98756f5319c64c883caa910dce702d9edefe7810 Mon Sep 17 00:00:00 2001 +From: Sinan Kaya +Date: Mon, 24 Oct 2016 00:31:32 -0400 +Subject: ACPI/PCI: pci_link: Include PIRQ_PENALTY_PCI_USING for ISA IRQs + +From: Sinan Kaya + +commit 98756f5319c64c883caa910dce702d9edefe7810 upstream. + +Commit 103544d86976 ("ACPI,PCI,IRQ: reduce resource requirements") +replaced the addition of PIRQ_PENALTY_PCI_USING in acpi_pci_link_allocate() +with an addition in acpi_irq_pci_sharing_penalty(), but f7eca374f000 +("ACPI,PCI,IRQ: separate ISA penalty calculation") removed the use +of acpi_irq_pci_sharing_penalty() for ISA IRQs. + +Therefore, PIRQ_PENALTY_PCI_USING is missing from ISA IRQs used by +interrupt links. Include that penalty by adding it in the +acpi_pci_link_allocate() path. + +Fixes: f7eca374f000 (ACPI,PCI,IRQ: separate ISA penalty calculation) +Signed-off-by: Sinan Kaya +Acked-by: Bjorn Helgaas +Tested-by: Jonathan Liu +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/pci_link.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/acpi/pci_link.c ++++ b/drivers/acpi/pci_link.c +@@ -608,6 +608,10 @@ static int acpi_pci_link_allocate(struct + acpi_device_bid(link->device)); + return -ENODEV; + } else { ++ if (link->irq.active < ACPI_MAX_ISA_IRQS) ++ acpi_isa_irq_penalty[link->irq.active] += ++ PIRQ_PENALTY_PCI_USING; ++ + printk(KERN_WARNING PREFIX "%s [%s] enabled at IRQ %d\n", + acpi_device_name(link->device), + acpi_device_bid(link->device), link->irq.active); diff --git a/queue-4.8/acpi-pci-pci_link-penalize-sci-correctly.patch b/queue-4.8/acpi-pci-pci_link-penalize-sci-correctly.patch new file mode 100644 index 00000000000..d69aa4f0481 --- /dev/null +++ b/queue-4.8/acpi-pci-pci_link-penalize-sci-correctly.patch @@ -0,0 +1,123 @@ +From f1caa61df2a3dc4c58316295c5dc5edba4c68d85 Mon Sep 17 00:00:00 2001 +From: Sinan Kaya +Date: Mon, 24 Oct 2016 00:31:31 -0400 +Subject: ACPI/PCI: pci_link: penalize SCI correctly + +From: Sinan Kaya + +commit f1caa61df2a3dc4c58316295c5dc5edba4c68d85 upstream. + +Ondrej reported that IRQs stopped working in v4.7 on several +platforms. A typical scenario, from Ondrej's VT82C694X/694X, is: + +ACPI: Using PIC for interrupt routing +ACPI: PCI Interrupt Link [LNKA] (IRQs 1 3 4 5 6 7 10 *11 12 14 15) +ACPI: No IRQ available for PCI Interrupt Link [LNKA] +8139too 0000:00:0f.0: PCI INT A: no GSI + +We're using PIC routing, so acpi_irq_balance == 0, and LNKA is already +active at IRQ 11. In that case, acpi_pci_link_allocate() only tries +to use the active IRQ (IRQ 11) which also happens to be the SCI. + +We should penalize the SCI by PIRQ_PENALTY_PCI_USING, but +irq_get_trigger_type(11) returns something other than +IRQ_TYPE_LEVEL_LOW, so we penalize it by PIRQ_PENALTY_ISA_ALWAYS +instead, which makes acpi_pci_link_allocate() assume the IRQ isn't +available and give up. + +Add acpi_penalize_sci_irq() so platforms can tell us the SCI IRQ, +trigger, and polarity directly and we don't have to depend on +irq_get_trigger_type(). + +Fixes: 103544d86976 (ACPI,PCI,IRQ: reduce resource requirements) +Link: http://lkml.kernel.org/r/201609251512.05657.linux@rainbow-software.org +Reported-by: Ondrej Zary +Acked-by: Bjorn Helgaas +Signed-off-by: Sinan Kaya +Tested-by: Jonathan Liu +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/acpi/boot.c | 1 + + drivers/acpi/pci_link.c | 30 +++++++++++++++--------------- + include/linux/acpi.h | 1 + + 3 files changed, 17 insertions(+), 15 deletions(-) + +--- a/arch/x86/kernel/acpi/boot.c ++++ b/arch/x86/kernel/acpi/boot.c +@@ -453,6 +453,7 @@ static void __init acpi_sci_ioapic_setup + polarity = acpi_sci_flags & ACPI_MADT_POLARITY_MASK; + + mp_override_legacy_irq(bus_irq, polarity, trigger, gsi); ++ acpi_penalize_sci_irq(bus_irq, trigger, polarity); + + /* + * stash over-ride to indicate we've been here +--- a/drivers/acpi/pci_link.c ++++ b/drivers/acpi/pci_link.c +@@ -87,6 +87,7 @@ struct acpi_pci_link { + + static LIST_HEAD(acpi_link_list); + static DEFINE_MUTEX(acpi_link_lock); ++static int sci_irq = -1, sci_penalty; + + /* -------------------------------------------------------------------------- + PCI Link Device Management +@@ -496,25 +497,13 @@ static int acpi_irq_get_penalty(int irq) + { + int penalty = 0; + +- /* +- * Penalize IRQ used by ACPI SCI. If ACPI SCI pin attributes conflict +- * with PCI IRQ attributes, mark ACPI SCI as ISA_ALWAYS so it won't be +- * use for PCI IRQs. +- */ +- if (irq == acpi_gbl_FADT.sci_interrupt) { +- u32 type = irq_get_trigger_type(irq) & IRQ_TYPE_SENSE_MASK; +- +- if (type != IRQ_TYPE_LEVEL_LOW) +- penalty += PIRQ_PENALTY_ISA_ALWAYS; +- else +- penalty += PIRQ_PENALTY_PCI_USING; +- } ++ if (irq == sci_irq) ++ penalty += sci_penalty; + + if (irq < ACPI_MAX_ISA_IRQS) + return penalty + acpi_isa_irq_penalty[irq]; + +- penalty += acpi_irq_pci_sharing_penalty(irq); +- return penalty; ++ return penalty + acpi_irq_pci_sharing_penalty(irq); + } + + int __init acpi_irq_penalty_init(void) +@@ -881,6 +870,17 @@ bool acpi_isa_irq_available(int irq) + acpi_irq_get_penalty(irq) < PIRQ_PENALTY_ISA_ALWAYS); + } + ++void acpi_penalize_sci_irq(int irq, int trigger, int polarity) ++{ ++ sci_irq = irq; ++ ++ if (trigger == ACPI_MADT_TRIGGER_LEVEL && ++ polarity == ACPI_MADT_POLARITY_ACTIVE_LOW) ++ sci_penalty = PIRQ_PENALTY_PCI_USING; ++ else ++ sci_penalty = PIRQ_PENALTY_ISA_ALWAYS; ++} ++ + /* + * Over-ride default table to reserve additional IRQs for use by ISA + * e.g. acpi_irq_isa=5 +--- a/include/linux/acpi.h ++++ b/include/linux/acpi.h +@@ -318,6 +318,7 @@ struct pci_dev; + int acpi_pci_irq_enable (struct pci_dev *dev); + void acpi_penalize_isa_irq(int irq, int active); + bool acpi_isa_irq_available(int irq); ++void acpi_penalize_sci_irq(int irq, int trigger, int polarity); + void acpi_pci_irq_disable (struct pci_dev *dev); + + extern int ec_read(u8 addr, u8 *val); diff --git a/queue-4.8/asoc-intel-skylake-always-acquire-runtime-pm-ref-on-unload.patch b/queue-4.8/asoc-intel-skylake-always-acquire-runtime-pm-ref-on-unload.patch new file mode 100644 index 00000000000..6438b8f151d --- /dev/null +++ b/queue-4.8/asoc-intel-skylake-always-acquire-runtime-pm-ref-on-unload.patch @@ -0,0 +1,36 @@ +From 6d13f62d931ba638e54ba56f3a7dd3080ffb485a Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Thu, 20 Oct 2016 12:26:16 +0200 +Subject: ASoC: Intel: Skylake: Always acquire runtime pm ref on unload + +From: Lukas Wunner + +commit 6d13f62d931ba638e54ba56f3a7dd3080ffb485a upstream. + +skl_probe() releases a runtime pm ref unconditionally wheras +skl_remove() acquires one only if the device is wakeup capable. +Thus if the device is not wakeup capable, unloading and reloading +the module will result in the refcount being decreased below 0. +Fix it. + +Fixes: d8c2dab8381d ("ASoC: Intel: Add Skylake HDA audio driver") +Signed-off-by: Lukas Wunner +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/intel/skylake/skl.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/sound/soc/intel/skylake/skl.c ++++ b/sound/soc/intel/skylake/skl.c +@@ -785,8 +785,7 @@ static void skl_remove(struct pci_dev *p + + release_firmware(skl->tplg); + +- if (pci_dev_run_wake(pci)) +- pm_runtime_get_noresume(&pci->dev); ++ pm_runtime_get_noresume(&pci->dev); + + /* codec removal, invoke bus_device_remove */ + snd_hdac_ext_bus_device_remove(ebus); diff --git a/queue-4.8/asoc-sun4i-codec-return-error-code-instead-of-null-when-create_card-fails.patch b/queue-4.8/asoc-sun4i-codec-return-error-code-instead-of-null-when-create_card-fails.patch new file mode 100644 index 00000000000..279f536262a --- /dev/null +++ b/queue-4.8/asoc-sun4i-codec-return-error-code-instead-of-null-when-create_card-fails.patch @@ -0,0 +1,54 @@ +From 85915b63ad8b796848f431b66c9ba5e356e722e5 Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Mon, 31 Oct 2016 14:42:09 +0800 +Subject: ASoC: sun4i-codec: return error code instead of NULL when create_card fails + +From: Chen-Yu Tsai + +commit 85915b63ad8b796848f431b66c9ba5e356e722e5 upstream. + +When sun4i_codec_create_card fails, we do not assign a proper error +code to the return value. The return value would be 0 from the previous +function call, or we would have bailed out sooner. This would confuse +the driver core into thinking the device probe succeeded, when in fact +it didn't, leaving various devres based resources lingering. + +Make the create_card function pass back a meaningful error code, and +assign it to the return value. + +Fixes: 45fb6b6f2aa3 ("ASoC: sunxi: add support for the on-chip codec on + early Allwinner SoCs") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/sunxi/sun4i-codec.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/sound/soc/sunxi/sun4i-codec.c ++++ b/sound/soc/sunxi/sun4i-codec.c +@@ -738,11 +738,11 @@ static struct snd_soc_card *sun4i_codec_ + + card = devm_kzalloc(dev, sizeof(*card), GFP_KERNEL); + if (!card) +- return NULL; ++ return ERR_PTR(-ENOMEM); + + card->dai_link = sun4i_codec_create_link(dev, &card->num_links); + if (!card->dai_link) +- return NULL; ++ return ERR_PTR(-ENOMEM); + + card->dev = dev; + card->name = "sun4i-codec"; +@@ -842,7 +842,8 @@ static int sun4i_codec_probe(struct plat + } + + card = sun4i_codec_create_card(&pdev->dev); +- if (!card) { ++ if (IS_ERR(card)) { ++ ret = PTR_ERR(card); + dev_err(&pdev->dev, "Failed to create our card\n"); + goto err_unregister_codec; + } diff --git a/queue-4.8/batman-adv-fix-splat-on-disabling-an-interface.patch b/queue-4.8/batman-adv-fix-splat-on-disabling-an-interface.patch new file mode 100644 index 00000000000..392e5139e86 --- /dev/null +++ b/queue-4.8/batman-adv-fix-splat-on-disabling-an-interface.patch @@ -0,0 +1,80 @@ +From 9799c50372b23ed774791bdb87d700f1286ee8a9 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Linus=20L=C3=BCssing?= +Date: Thu, 6 Oct 2016 01:43:08 +0200 +Subject: batman-adv: fix splat on disabling an interface +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Linus Lüssing + +commit 9799c50372b23ed774791bdb87d700f1286ee8a9 upstream. + +As long as there is still a reference for a hard interface held, there might +still be a forwarding packet relying on its attributes. + +Therefore avoid setting hard_iface->soft_iface to NULL when disabling a hard +interface. + +This fixes the following, potential splat: + + batman_adv: bat0: Interface deactivated: eth1 + batman_adv: bat0: Removing interface: eth1 + cgroup: new mount options do not match the existing superblock, will be ignored + batman_adv: bat0: Interface deactivated: eth3 + batman_adv: bat0: Removing interface: eth3 + ------------[ cut here ]------------ + WARNING: CPU: 3 PID: 1986 at ./net/batman-adv/bat_iv_ogm.c:549 batadv_iv_send_outstanding_bat_ogm_packet+0x145/0x643 [batman_adv] + Modules linked in: batman_adv(O-) <...> + CPU: 3 PID: 1986 Comm: kworker/u8:2 Tainted: G W O 4.6.0-rc6+ #1 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014 + Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet [batman_adv] + 0000000000000000 ffff88001d93bca0 ffffffff8126c26b 0000000000000000 + 0000000000000000 ffff88001d93bcf0 ffffffff81051615 ffff88001f19f818 + 000002251d93bd68 0000000000000046 ffff88001dc04a00 ffff88001becbe48 + Call Trace: + [] dump_stack+0x67/0x90 + [] __warn+0xc7/0xe5 + [] warn_slowpath_null+0x18/0x1a + [] batadv_iv_send_outstanding_bat_ogm_packet+0x145/0x643 [batman_adv] + [] ? __lock_is_held+0x32/0x54 + [] process_one_work+0x2a8/0x4f5 + [] ? process_one_work+0x15c/0x4f5 + [] worker_thread+0x1d5/0x2c0 + [] ? process_scheduled_works+0x2e/0x2e + [] ? process_scheduled_works+0x2e/0x2e + [] kthread+0xc0/0xc8 + [] ret_from_fork+0x22/0x40 + [] ? __init_kthread_worker+0x55/0x55 + ---[ end trace 647f9f325123dc05 ]--- + +What happened here is, that there was still a forw_packet (here: a BATMAN IV +OGM) in the queue of eth3 with the forw_packet->if_incoming set to eth1 and the +forw_packet->if_outgoing set to eth3. + +When eth3 is to be deactivated and removed, then this thread waits for the +forw_packet queued on eth3 to finish. Because eth1 was deactivated and removed +earlier and by that had forw_packet->if_incoming->soft_iface, set to NULL, the +splat when trying to send/flush the OGM on eth3 occures. + +Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") +Signed-off-by: Linus Lüssing +[sven@narfation.org: Reduced size of Oops message] +Signed-off-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Greg Kroah-Hartman + +--- + net/batman-adv/hard-interface.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/net/batman-adv/hard-interface.c ++++ b/net/batman-adv/hard-interface.c +@@ -617,7 +617,6 @@ void batadv_hardif_disable_interface(str + batadv_softif_destroy_sysfs(hard_iface->soft_iface); + } + +- hard_iface->soft_iface = NULL; + batadv_hardif_put(hard_iface); + + out: diff --git a/queue-4.8/batman-adv-modify-neigh_list-only-with-rcu-list-functions.patch b/queue-4.8/batman-adv-modify-neigh_list-only-with-rcu-list-functions.patch new file mode 100644 index 00000000000..62182f388f4 --- /dev/null +++ b/queue-4.8/batman-adv-modify-neigh_list-only-with-rcu-list-functions.patch @@ -0,0 +1,39 @@ +From 9ca488dd53088d4fcc97258aeeccf21f63b7da1e Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Thu, 29 Sep 2016 17:22:58 +0200 +Subject: batman-adv: Modify neigh_list only with rcu-list functions +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sven Eckelmann + +commit 9ca488dd53088d4fcc97258aeeccf21f63b7da1e upstream. + +The batadv_hard_iface::neigh_list is accessed via rcu based primitives. +Thus all operations done on it have to fulfill the requirements by RCU. So +using non-RCU mechanisms like hlist_add_head is not allowed because it +misses the barriers required to protect concurrent readers when accessing +the data behind the pointer. + +Fixes: cef63419f7db ("batman-adv: add list of unique single hop neighbors per hard-interface") +Signed-off-by: Sven Eckelmann +Acked-by: Linus Lüssing +Signed-off-by: Simon Wunderlich +Signed-off-by: Greg Kroah-Hartman + +--- + net/batman-adv/originator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/batman-adv/originator.c ++++ b/net/batman-adv/originator.c +@@ -537,7 +537,7 @@ batadv_hardif_neigh_create(struct batadv + if (bat_priv->algo_ops->neigh.hardif_init) + bat_priv->algo_ops->neigh.hardif_init(hardif_neigh); + +- hlist_add_head(&hardif_neigh->list, &hard_iface->neigh_list); ++ hlist_add_head_rcu(&hardif_neigh->list, &hard_iface->neigh_list); + + out: + spin_unlock_bh(&hard_iface->neigh_list_lock); diff --git a/queue-4.8/gpio-mvebu-use-irq_domain_add_linear.patch b/queue-4.8/gpio-mvebu-use-irq_domain_add_linear.patch new file mode 100644 index 00000000000..0a1e655ac0b --- /dev/null +++ b/queue-4.8/gpio-mvebu-use-irq_domain_add_linear.patch @@ -0,0 +1,214 @@ +From 812d47889a8e418d7bea9bec383581a34c19183e Mon Sep 17 00:00:00 2001 +From: Jason Gunthorpe +Date: Wed, 19 Oct 2016 15:03:41 -0600 +Subject: gpio/mvebu: Use irq_domain_add_linear + +From: Jason Gunthorpe + +commit 812d47889a8e418d7bea9bec383581a34c19183e upstream. + +This fixes the irq allocation in this driver to not print: + irq: Cannot allocate irq_descs @ IRQ34, assuming pre-allocated + irq: Cannot allocate irq_descs @ IRQ66, assuming pre-allocated + +Which happens because the driver already called irq_alloc_descs() +and so the change to use irq_domain_add_simple resulted in calling +irq_alloc_descs() twice. + +Modernize the irq allocation in this driver to use the +irq_domain_add_linear flow directly and eliminate the use of +irq_domain_add_simple/legacy + +Fixes: ce931f571b6d ("gpio/mvebu: convert to use irq_domain_add_simple()") +Signed-off-by: Jason Gunthorpe +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpio/gpio-mvebu.c | 92 +++++++++++++++++++++------------------------- + 1 file changed, 43 insertions(+), 49 deletions(-) + +--- a/drivers/gpio/gpio-mvebu.c ++++ b/drivers/gpio/gpio-mvebu.c +@@ -293,10 +293,10 @@ static void mvebu_gpio_irq_ack(struct ir + { + struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d); + struct mvebu_gpio_chip *mvchip = gc->private; +- u32 mask = ~(1 << (d->irq - gc->irq_base)); ++ u32 mask = d->mask; + + irq_gc_lock(gc); +- writel_relaxed(mask, mvebu_gpioreg_edge_cause(mvchip)); ++ writel_relaxed(~mask, mvebu_gpioreg_edge_cause(mvchip)); + irq_gc_unlock(gc); + } + +@@ -305,7 +305,7 @@ static void mvebu_gpio_edge_irq_mask(str + struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d); + struct mvebu_gpio_chip *mvchip = gc->private; + struct irq_chip_type *ct = irq_data_get_chip_type(d); +- u32 mask = 1 << (d->irq - gc->irq_base); ++ u32 mask = d->mask; + + irq_gc_lock(gc); + ct->mask_cache_priv &= ~mask; +@@ -319,8 +319,7 @@ static void mvebu_gpio_edge_irq_unmask(s + struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d); + struct mvebu_gpio_chip *mvchip = gc->private; + struct irq_chip_type *ct = irq_data_get_chip_type(d); +- +- u32 mask = 1 << (d->irq - gc->irq_base); ++ u32 mask = d->mask; + + irq_gc_lock(gc); + ct->mask_cache_priv |= mask; +@@ -333,8 +332,7 @@ static void mvebu_gpio_level_irq_mask(st + struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d); + struct mvebu_gpio_chip *mvchip = gc->private; + struct irq_chip_type *ct = irq_data_get_chip_type(d); +- +- u32 mask = 1 << (d->irq - gc->irq_base); ++ u32 mask = d->mask; + + irq_gc_lock(gc); + ct->mask_cache_priv &= ~mask; +@@ -347,8 +345,7 @@ static void mvebu_gpio_level_irq_unmask( + struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d); + struct mvebu_gpio_chip *mvchip = gc->private; + struct irq_chip_type *ct = irq_data_get_chip_type(d); +- +- u32 mask = 1 << (d->irq - gc->irq_base); ++ u32 mask = d->mask; + + irq_gc_lock(gc); + ct->mask_cache_priv |= mask; +@@ -462,7 +459,7 @@ static void mvebu_gpio_irq_handler(struc + for (i = 0; i < mvchip->chip.ngpio; i++) { + int irq; + +- irq = mvchip->irqbase + i; ++ irq = irq_find_mapping(mvchip->domain, i); + + if (!(cause & (1 << i))) + continue; +@@ -655,6 +652,7 @@ static int mvebu_gpio_probe(struct platf + struct irq_chip_type *ct; + struct clk *clk; + unsigned int ngpios; ++ bool have_irqs; + int soc_variant; + int i, cpu, id; + int err; +@@ -665,6 +663,9 @@ static int mvebu_gpio_probe(struct platf + else + soc_variant = MVEBU_GPIO_SOC_VARIANT_ORION; + ++ /* Some gpio controllers do not provide irq support */ ++ have_irqs = of_irq_count(np) != 0; ++ + mvchip = devm_kzalloc(&pdev->dev, sizeof(struct mvebu_gpio_chip), + GFP_KERNEL); + if (!mvchip) +@@ -697,7 +698,8 @@ static int mvebu_gpio_probe(struct platf + mvchip->chip.get = mvebu_gpio_get; + mvchip->chip.direction_output = mvebu_gpio_direction_output; + mvchip->chip.set = mvebu_gpio_set; +- mvchip->chip.to_irq = mvebu_gpio_to_irq; ++ if (have_irqs) ++ mvchip->chip.to_irq = mvebu_gpio_to_irq; + mvchip->chip.base = id * MVEBU_MAX_GPIO_PER_BANK; + mvchip->chip.ngpio = ngpios; + mvchip->chip.can_sleep = false; +@@ -758,34 +760,30 @@ static int mvebu_gpio_probe(struct platf + devm_gpiochip_add_data(&pdev->dev, &mvchip->chip, mvchip); + + /* Some gpio controllers do not provide irq support */ +- if (!of_irq_count(np)) ++ if (!have_irqs) + return 0; + +- /* Setup the interrupt handlers. Each chip can have up to 4 +- * interrupt handlers, with each handler dealing with 8 GPIO +- * pins. */ +- for (i = 0; i < 4; i++) { +- int irq = platform_get_irq(pdev, i); +- +- if (irq < 0) +- continue; +- irq_set_chained_handler_and_data(irq, mvebu_gpio_irq_handler, +- mvchip); +- } +- +- mvchip->irqbase = irq_alloc_descs(-1, 0, ngpios, -1); +- if (mvchip->irqbase < 0) { +- dev_err(&pdev->dev, "no irqs\n"); +- return mvchip->irqbase; ++ mvchip->domain = ++ irq_domain_add_linear(np, ngpios, &irq_generic_chip_ops, NULL); ++ if (!mvchip->domain) { ++ dev_err(&pdev->dev, "couldn't allocate irq domain %s (DT).\n", ++ mvchip->chip.label); ++ return -ENODEV; + } + +- gc = irq_alloc_generic_chip("mvebu_gpio_irq", 2, mvchip->irqbase, +- mvchip->membase, handle_level_irq); +- if (!gc) { +- dev_err(&pdev->dev, "Cannot allocate generic irq_chip\n"); +- return -ENOMEM; ++ err = irq_alloc_domain_generic_chips( ++ mvchip->domain, ngpios, 2, np->name, handle_level_irq, ++ IRQ_NOREQUEST | IRQ_NOPROBE | IRQ_LEVEL, 0, 0); ++ if (err) { ++ dev_err(&pdev->dev, "couldn't allocate irq chips %s (DT).\n", ++ mvchip->chip.label); ++ goto err_domain; + } + ++ /* NOTE: The common accessors cannot be used because of the percpu ++ * access to the mask registers ++ */ ++ gc = irq_get_domain_generic_chip(mvchip->domain, 0); + gc->private = mvchip; + ct = &gc->chip_types[0]; + ct->type = IRQ_TYPE_LEVEL_HIGH | IRQ_TYPE_LEVEL_LOW; +@@ -803,27 +801,23 @@ static int mvebu_gpio_probe(struct platf + ct->handler = handle_edge_irq; + ct->chip.name = mvchip->chip.label; + +- irq_setup_generic_chip(gc, IRQ_MSK(ngpios), 0, +- IRQ_NOREQUEST, IRQ_LEVEL | IRQ_NOPROBE); ++ /* Setup the interrupt handlers. Each chip can have up to 4 ++ * interrupt handlers, with each handler dealing with 8 GPIO ++ * pins. ++ */ ++ for (i = 0; i < 4; i++) { ++ int irq = platform_get_irq(pdev, i); + +- /* Setup irq domain on top of the generic chip. */ +- mvchip->domain = irq_domain_add_simple(np, mvchip->chip.ngpio, +- mvchip->irqbase, +- &irq_domain_simple_ops, +- mvchip); +- if (!mvchip->domain) { +- dev_err(&pdev->dev, "couldn't allocate irq domain %s (DT).\n", +- mvchip->chip.label); +- err = -ENODEV; +- goto err_generic_chip; ++ if (irq < 0) ++ continue; ++ irq_set_chained_handler_and_data(irq, mvebu_gpio_irq_handler, ++ mvchip); + } + + return 0; + +-err_generic_chip: +- irq_remove_generic_chip(gc, IRQ_MSK(ngpios), IRQ_NOREQUEST, +- IRQ_LEVEL | IRQ_NOPROBE); +- kfree(gc); ++err_domain: ++ irq_domain_remove(mvchip->domain); + + return err; + } diff --git a/queue-4.8/gpio-of-fix-gpio-drivers-with-multiple-gpio_chip-for-a-single-node.patch b/queue-4.8/gpio-of-fix-gpio-drivers-with-multiple-gpio_chip-for-a-single-node.patch new file mode 100644 index 00000000000..15aceaa6bdb --- /dev/null +++ b/queue-4.8/gpio-of-fix-gpio-drivers-with-multiple-gpio_chip-for-a-single-node.patch @@ -0,0 +1,75 @@ +From c7e9d39831a31682285cc31ddf7dd06c0fe59138 Mon Sep 17 00:00:00 2001 +From: Masahiro Yamada +Date: Tue, 25 Oct 2016 10:47:44 +0900 +Subject: gpio: of: fix GPIO drivers with multiple gpio_chip for a single node + +From: Masahiro Yamada + +commit c7e9d39831a31682285cc31ddf7dd06c0fe59138 upstream. + +Sylvain Lemieux reports the LPC32xx GPIO driver is broken since +commit 762c2e46c059 ("gpio: of: remove of_gpiochip_and_xlate() and +struct gg_data"). Probably, gpio-etraxfs.c and gpio-davinci.c are +broken too. + +Those drivers register multiple gpio_chip that are associated to a +single OF node, and their own .of_xlate() checks if the passed +gpio_chip is valid. + +Now, the problem is of_find_gpiochip_by_node() returns the first +gpio_chip found to match the given node. So, .of_xlate() fails, +except for the first GPIO bank. + +Reverting the commit could be a solution, but I do not want to go +back to the mess of struct gg_data. Another solution here is to +take the match by a node pointer and the success of .of_xlate(). +It is a bit clumsy to call .of_xlate twice; for gpio_chip matching +and for really getting the gpio_desc index. Perhaps, our long-term +goal might be to convert the drivers to single chip registration, +but this commit will solve the problem until then. + +Fixes: 762c2e46c059 ("gpio: of: remove of_gpiochip_and_xlate() and struct gg_data") +Signed-off-by: Masahiro Yamada +Reported-by: Sylvain Lemieux +Tested-by: David Lechner +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpio/gpiolib-of.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/drivers/gpio/gpiolib-of.c ++++ b/drivers/gpio/gpiolib-of.c +@@ -26,14 +26,18 @@ + + #include "gpiolib.h" + +-static int of_gpiochip_match_node(struct gpio_chip *chip, void *data) ++static int of_gpiochip_match_node_and_xlate(struct gpio_chip *chip, void *data) + { +- return chip->gpiodev->dev.of_node == data; ++ struct of_phandle_args *gpiospec = data; ++ ++ return chip->gpiodev->dev.of_node == gpiospec->np && ++ chip->of_xlate(chip, gpiospec, NULL) >= 0; + } + +-static struct gpio_chip *of_find_gpiochip_by_node(struct device_node *np) ++static struct gpio_chip *of_find_gpiochip_by_xlate( ++ struct of_phandle_args *gpiospec) + { +- return gpiochip_find(np, of_gpiochip_match_node); ++ return gpiochip_find(gpiospec, of_gpiochip_match_node_and_xlate); + } + + static struct gpio_desc *of_xlate_and_get_gpiod_flags(struct gpio_chip *chip, +@@ -79,7 +83,7 @@ struct gpio_desc *of_get_named_gpiod_fla + return ERR_PTR(ret); + } + +- chip = of_find_gpiochip_by_node(gpiospec.np); ++ chip = of_find_gpiochip_by_xlate(&gpiospec); + if (!chip) { + desc = ERR_PTR(-EPROBE_DEFER); + goto out; diff --git a/queue-4.8/hwrng-core-don-t-use-a-stack-buffer-in-add_early_randomness.patch b/queue-4.8/hwrng-core-don-t-use-a-stack-buffer-in-add_early_randomness.patch new file mode 100644 index 00000000000..a57c9fd7fcc --- /dev/null +++ b/queue-4.8/hwrng-core-don-t-use-a-stack-buffer-in-add_early_randomness.patch @@ -0,0 +1,44 @@ +From 6d4952d9d9d4dc2bb9c0255d95a09405a1e958f7 Mon Sep 17 00:00:00 2001 +From: Andrew Lutomirski +Date: Mon, 17 Oct 2016 10:06:27 -0700 +Subject: hwrng: core - Don't use a stack buffer in add_early_randomness() + +From: Andrew Lutomirski + +commit 6d4952d9d9d4dc2bb9c0255d95a09405a1e958f7 upstream. + +hw_random carefully avoids using a stack buffer except in +add_early_randomness(). This causes a crash in virtio_rng if +CONFIG_VMAP_STACK=y. + +Reported-by: Matt Mullins +Tested-by: Matt Mullins +Fixes: d3cc7996473a ("hwrng: fetch randomness only after device init") +Signed-off-by: Andy Lutomirski +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/hw_random/core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/char/hw_random/core.c ++++ b/drivers/char/hw_random/core.c +@@ -84,14 +84,14 @@ static size_t rng_buffer_size(void) + + static void add_early_randomness(struct hwrng *rng) + { +- unsigned char bytes[16]; + int bytes_read; ++ size_t size = min_t(size_t, 16, rng_buffer_size()); + + mutex_lock(&reading_mutex); +- bytes_read = rng_get_data(rng, bytes, sizeof(bytes), 1); ++ bytes_read = rng_get_data(rng, rng_buffer, size, 1); + mutex_unlock(&reading_mutex); + if (bytes_read > 0) +- add_device_randomness(bytes, bytes_read); ++ add_device_randomness(rng_buffer, bytes_read); + } + + static inline void cleanup_rng(struct kref *kref) diff --git a/queue-4.8/i40e-fix-call-of-ndo_dflt_bridge_getlink.patch b/queue-4.8/i40e-fix-call-of-ndo_dflt_bridge_getlink.patch new file mode 100644 index 00000000000..2770efc27da --- /dev/null +++ b/queue-4.8/i40e-fix-call-of-ndo_dflt_bridge_getlink.patch @@ -0,0 +1,39 @@ +From 599b076d15ee3ead7af20fc907079df00b2d59a0 Mon Sep 17 00:00:00 2001 +From: Huaibin Wang +Date: Mon, 26 Sep 2016 09:51:18 +0200 +Subject: i40e: fix call of ndo_dflt_bridge_getlink() + +From: Huaibin Wang + +commit 599b076d15ee3ead7af20fc907079df00b2d59a0 upstream. + +Order of arguments is wrong. +The wrong code has been introduced by commit 7d4f8d871ab1, but is compiled +only since commit 9df70b66418e. + +Note that this may break netlink dumps. + +Fixes: 9df70b66418e ("i40e: Remove incorrect #ifdef's") +Fixes: 7d4f8d871ab1 ("switchdev; add VLAN support for port's bridge_getlink") +CC: Carolyn Wyborny +Signed-off-by: Huaibin Wang +Signed-off-by: Nicolas Dichtel +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -9001,7 +9001,7 @@ static int i40e_ndo_bridge_getlink(struc + return 0; + + return ndo_dflt_bridge_getlink(skb, pid, seq, dev, veb->bridge_mode, +- nlflags, 0, 0, filter_mask, NULL); ++ 0, 0, nlflags, filter_mask, NULL); + } + + /* Hardware supports L4 tunnel length of 128B (=2^7) which includes diff --git a/queue-4.8/lib-genalloc.c-start-search-from-start-of-chunk.patch b/queue-4.8/lib-genalloc.c-start-search-from-start-of-chunk.patch new file mode 100644 index 00000000000..28f81a10857 --- /dev/null +++ b/queue-4.8/lib-genalloc.c-start-search-from-start-of-chunk.patch @@ -0,0 +1,69 @@ +From 62e931fac45b17c2a42549389879411572f75804 Mon Sep 17 00:00:00 2001 +From: Daniel Mentz +Date: Thu, 27 Oct 2016 17:46:59 -0700 +Subject: lib/genalloc.c: start search from start of chunk + +From: Daniel Mentz + +commit 62e931fac45b17c2a42549389879411572f75804 upstream. + +gen_pool_alloc_algo() iterates over the chunks of a pool trying to find +a contiguous block of memory that satisfies the allocation request. + +The shortcut + + if (size > atomic_read(&chunk->avail)) + continue; + +makes the loop skip over chunks that do not have enough bytes left to +fulfill the request. There are two situations, though, where an +allocation might still fail: + +(1) The available memory is not contiguous, i.e. the request cannot + be fulfilled due to external fragmentation. + +(2) A race condition. Another thread runs the same code concurrently + and is quicker to grab the available memory. + +In those situations, the loop calls pool->algo() to search the entire +chunk, and pool->algo() returns some value that is >= end_bit to +indicate that the search failed. This return value is then assigned to +start_bit. The variables start_bit and end_bit describe the range that +should be searched, and this range should be reset for every chunk that +is searched. Today, the code fails to reset start_bit to 0. As a +result, prefixes of subsequent chunks are ignored. Memory allocations +might fail even though there is plenty of room left in these prefixes of +those other chunks. + +Fixes: 7f184275aa30 ("lib, Make gen_pool memory allocator lockless") +Link: http://lkml.kernel.org/r/1477420604-28918-1-git-send-email-danielmentz@google.com +Signed-off-by: Daniel Mentz +Reviewed-by: Mathieu Desnoyers +Acked-by: Will Deacon +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + lib/genalloc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/lib/genalloc.c ++++ b/lib/genalloc.c +@@ -292,7 +292,7 @@ unsigned long gen_pool_alloc_algo(struct + struct gen_pool_chunk *chunk; + unsigned long addr = 0; + int order = pool->min_alloc_order; +- int nbits, start_bit = 0, end_bit, remain; ++ int nbits, start_bit, end_bit, remain; + + #ifndef CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG + BUG_ON(in_nmi()); +@@ -307,6 +307,7 @@ unsigned long gen_pool_alloc_algo(struct + if (size > atomic_read(&chunk->avail)) + continue; + ++ start_bit = 0; + end_bit = chunk_size(chunk) >> order; + retry: + start_bit = algo(chunk->bits, end_bit, start_bit, diff --git a/queue-4.8/libceph-fix-legacy-layout-decode-with-pool-0.patch b/queue-4.8/libceph-fix-legacy-layout-decode-with-pool-0.patch new file mode 100644 index 00000000000..ae211ed19fb --- /dev/null +++ b/queue-4.8/libceph-fix-legacy-layout-decode-with-pool-0.patch @@ -0,0 +1,37 @@ +From 3890dce1d3a8b9fe3bc36de99496792e468cd079 Mon Sep 17 00:00:00 2001 +From: "Yan, Zheng" +Date: Wed, 9 Nov 2016 16:42:48 +0800 +Subject: libceph: fix legacy layout decode with pool 0 + +From: Yan, Zheng + +commit 3890dce1d3a8b9fe3bc36de99496792e468cd079 upstream. + +If your data pool was pool 0, ceph_file_layout_from_legacy() +transform that to -1 unconditionally, which broke upgrades. +We only want do that for a fully zeroed ceph_file_layout, +so that it still maps to a file_layout_t. If any fields +are set, though, we trust the fl_pgpool to be a valid pool. + +Fixes: 7627151ea30bc ("libceph: define new ceph_file_layout structure") +Link: http://tracker.ceph.com/issues/17825 +Signed-off-by: Yan, Zheng +Signed-off-by: Ilya Dryomov +Signed-off-by: Greg Kroah-Hartman + +--- + net/ceph/ceph_fs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/ceph/ceph_fs.c ++++ b/net/ceph/ceph_fs.c +@@ -34,7 +34,8 @@ void ceph_file_layout_from_legacy(struct + fl->stripe_count = le32_to_cpu(legacy->fl_stripe_count); + fl->object_size = le32_to_cpu(legacy->fl_object_size); + fl->pool_id = le32_to_cpu(legacy->fl_pg_pool); +- if (fl->pool_id == 0) ++ if (fl->pool_id == 0 && fl->stripe_unit == 0 && ++ fl->stripe_count == 0 && fl->object_size == 0) + fl->pool_id = -1; + } + EXPORT_SYMBOL(ceph_file_layout_from_legacy); diff --git a/queue-4.8/memcg-prevent-memcg-caches-to-be-both-off_slab-objfreelist_slab.patch b/queue-4.8/memcg-prevent-memcg-caches-to-be-both-off_slab-objfreelist_slab.patch new file mode 100644 index 00000000000..cf07c1e2a5c --- /dev/null +++ b/queue-4.8/memcg-prevent-memcg-caches-to-be-both-off_slab-objfreelist_slab.patch @@ -0,0 +1,59 @@ +From f773e36de3d77c4000ca914c9d146f55f2fd51e8 Mon Sep 17 00:00:00 2001 +From: Greg Thelen +Date: Thu, 10 Nov 2016 10:46:41 -0800 +Subject: memcg: prevent memcg caches to be both OFF_SLAB & OBJFREELIST_SLAB + +From: Greg Thelen + +commit f773e36de3d77c4000ca914c9d146f55f2fd51e8 upstream. + +While testing OBJFREELIST_SLAB integration with pagealloc, we found a +bug where kmem_cache(sys) would be created with both CFLGS_OFF_SLAB & +CFLGS_OBJFREELIST_SLAB. When it happened, critical allocations needed +for loading drivers or creating new caches will fail. + +The original kmem_cache is created early making OFF_SLAB not possible. +When kmem_cache(sys) is created, OFF_SLAB is possible and if pagealloc +is enabled it will try to enable it first under certain conditions. +Given kmem_cache(sys) reuses the original flag, you can have both flags +at the same time resulting in allocation failures and odd behaviors. + +This fix discards allocator specific flags from memcg before calling +create_cache. + +The bug exists since 4.6-rc1 and affects testing debug pagealloc +configurations. + +Fixes: b03a017bebc4 ("mm/slab: introduce new slab management type, OBJFREELIST_SLAB") +Link: http://lkml.kernel.org/r/1478553075-120242-1-git-send-email-thgarnie@google.com +Signed-off-by: Greg Thelen +Signed-off-by: Thomas Garnier +Tested-by: Thomas Garnier +Acked-by: Christoph Lameter +Cc: Pekka Enberg +Cc: David Rientjes +Cc: Joonsoo Kim +Cc: Vladimir Davydov +Cc: Michal Hocko +Cc: Johannes Weiner +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/slab_common.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/mm/slab_common.c ++++ b/mm/slab_common.c +@@ -533,8 +533,8 @@ void memcg_create_kmem_cache(struct mem_ + + s = create_cache(cache_name, root_cache->object_size, + root_cache->size, root_cache->align, +- root_cache->flags, root_cache->ctor, +- memcg, root_cache); ++ root_cache->flags & CACHE_CREATE_MASK, ++ root_cache->ctor, memcg, root_cache); + /* + * If we could not create a memcg cache, do not complain, because + * that's not critical at all as we can always proceed with the root diff --git a/queue-4.8/mmc-mxs-initialize-the-spinlock-prior-to-using-it.patch b/queue-4.8/mmc-mxs-initialize-the-spinlock-prior-to-using-it.patch new file mode 100644 index 00000000000..3484e0cb21d --- /dev/null +++ b/queue-4.8/mmc-mxs-initialize-the-spinlock-prior-to-using-it.patch @@ -0,0 +1,44 @@ +From f91346e8b5f46aaf12f1df26e87140584ffd1b3f Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Sat, 5 Nov 2016 17:45:07 -0200 +Subject: mmc: mxs: Initialize the spinlock prior to using it + +From: Fabio Estevam + +commit f91346e8b5f46aaf12f1df26e87140584ffd1b3f upstream. + +An interrupt may occur right after devm_request_irq() is called and +prior to the spinlock initialization, leading to a kernel oops, +as the interrupt handler uses the spinlock. + +In order to prevent this problem, move the spinlock initialization +prior to requesting the interrupts. + +Fixes: e4243f13d10e (mmc: mxs-mmc: add mmc host driver for i.MX23/28) +Signed-off-by: Fabio Estevam +Reviewed-by: Marek Vasut +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/mxs-mmc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/mmc/host/mxs-mmc.c ++++ b/drivers/mmc/host/mxs-mmc.c +@@ -661,13 +661,13 @@ static int mxs_mmc_probe(struct platform + + platform_set_drvdata(pdev, mmc); + ++ spin_lock_init(&host->lock); ++ + ret = devm_request_irq(&pdev->dev, irq_err, mxs_mmc_irq_handler, 0, + dev_name(&pdev->dev), host); + if (ret) + goto out_free_dma; + +- spin_lock_init(&host->lock); +- + ret = mmc_add_host(mmc); + if (ret) + goto out_free_dma; diff --git a/queue-4.8/mmc-sdhci-msm-fix-error-return-code-in-sdhci_msm_probe.patch b/queue-4.8/mmc-sdhci-msm-fix-error-return-code-in-sdhci_msm_probe.patch new file mode 100644 index 00000000000..d91911871ec --- /dev/null +++ b/queue-4.8/mmc-sdhci-msm-fix-error-return-code-in-sdhci_msm_probe.patch @@ -0,0 +1,33 @@ +From d1f63f0c81c22ba705fcd149a1fcec37b734d818 Mon Sep 17 00:00:00 2001 +From: Wei Yongjun +Date: Wed, 26 Oct 2016 15:04:41 +0000 +Subject: mmc: sdhci-msm: Fix error return code in sdhci_msm_probe() + +From: Wei Yongjun + +commit d1f63f0c81c22ba705fcd149a1fcec37b734d818 upstream. + +Fix to return a negative error code from the platform_get_irq_byname() +error handling case instead of 0, as done elsewhere in this function. + +Fixes: ad81d3871004 ("mmc: sdhci-msm: Add support for UHS cards") +Signed-off-by: Wei Yongjun +Acked-by: Adrian Hunter +Acked-by: Georgi Djakov +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci-msm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/mmc/host/sdhci-msm.c ++++ b/drivers/mmc/host/sdhci-msm.c +@@ -647,6 +647,7 @@ static int sdhci_msm_probe(struct platfo + if (msm_host->pwr_irq < 0) { + dev_err(&pdev->dev, "Get pwr_irq failed (%d)\n", + msm_host->pwr_irq); ++ ret = msm_host->pwr_irq; + goto clk_disable; + } + diff --git a/queue-4.8/nfsv4.1-work-around-wmaybe-uninitialized-warning.patch b/queue-4.8/nfsv4.1-work-around-wmaybe-uninitialized-warning.patch new file mode 100644 index 00000000000..6e229213b84 --- /dev/null +++ b/queue-4.8/nfsv4.1-work-around-wmaybe-uninitialized-warning.patch @@ -0,0 +1,54 @@ +From 68a564006a21ae59c7c51b4359e2e8efa42ae4af Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Tue, 18 Oct 2016 00:05:35 +0200 +Subject: NFSv4.1: work around -Wmaybe-uninitialized warning + +From: Arnd Bergmann + +commit 68a564006a21ae59c7c51b4359e2e8efa42ae4af upstream. + +A bugfix introduced a harmless gcc warning in nfs4_slot_seqid_in_use +if we enable -Wmaybe-uninitialized again: + +fs/nfs/nfs4session.c:203:54: error: 'cur_seq' may be used uninitialized in this function [-Werror=maybe-uninitialized] + +gcc is not smart enough to conclude that the IS_ERR/PTR_ERR pair +results in a nonzero return value here. Using PTR_ERR_OR_ZERO() +instead makes this clear to the compiler. + +The warning originally did not appear in v4.8 as it was globally +disabled, but the bugfix that introduced the warning got backported +to stable kernels which again enable it, and this is now the only +warning in the v4.7 builds. + +Fixes: e09c978aae5b ("NFSv4.1: Fix Oopsable condition in server callback races") +Signed-off-by: Arnd Bergmann +Cc: Trond Myklebust +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/nfs4session.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/fs/nfs/nfs4session.c ++++ b/fs/nfs/nfs4session.c +@@ -178,12 +178,14 @@ static int nfs4_slot_get_seqid(struct nf + __must_hold(&tbl->slot_tbl_lock) + { + struct nfs4_slot *slot; ++ int ret; + + slot = nfs4_lookup_slot(tbl, slotid); +- if (IS_ERR(slot)) +- return PTR_ERR(slot); +- *seq_nr = slot->seq_nr; +- return 0; ++ ret = PTR_ERR_OR_ZERO(slot); ++ if (!ret) ++ *seq_nr = slot->seq_nr; ++ ++ return ret; + } + + /* diff --git a/queue-4.8/pinctrl-iproc-fix-iproc-and-nsp-gpio-support.patch b/queue-4.8/pinctrl-iproc-fix-iproc-and-nsp-gpio-support.patch new file mode 100644 index 00000000000..1f7b7eaf571 --- /dev/null +++ b/queue-4.8/pinctrl-iproc-fix-iproc-and-nsp-gpio-support.patch @@ -0,0 +1,49 @@ +From 091c531b09c151c2d712a8f347009ca3698a2467 Mon Sep 17 00:00:00 2001 +From: Ray Jui +Date: Mon, 17 Oct 2016 18:41:41 -0700 +Subject: pinctrl: iproc: Fix iProc and NSP GPIO support + +From: Ray Jui + +commit 091c531b09c151c2d712a8f347009ca3698a2467 upstream. + +Since commit 44a7185c2ae6 ("of/platform: Add common method to populate +default bus"), ARM64 platform devices are populated at the +arch_initcall_sync level; as a result, the platform_driver_probe calls +in both the iProc and NSP GPIO drivers fail with -ENODEV since by that +time the platform device was not yet registered. + +Replace platform_driver_probe with platform_driver_register, that allow +the device to be register later + +Fixes: 44a7185c2ae6 ("of/platform: Add common method to populate default bus") +Signed-off-by: Ray Jui +Tested-by: Eric Anholt +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pinctrl/bcm/pinctrl-iproc-gpio.c | 2 +- + drivers/pinctrl/bcm/pinctrl-nsp-gpio.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c ++++ b/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c +@@ -844,6 +844,6 @@ static struct platform_driver iproc_gpio + + static int __init iproc_gpio_init(void) + { +- return platform_driver_probe(&iproc_gpio_driver, iproc_gpio_probe); ++ return platform_driver_register(&iproc_gpio_driver); + } + arch_initcall_sync(iproc_gpio_init); +--- a/drivers/pinctrl/bcm/pinctrl-nsp-gpio.c ++++ b/drivers/pinctrl/bcm/pinctrl-nsp-gpio.c +@@ -741,6 +741,6 @@ static struct platform_driver nsp_gpio_d + + static int __init nsp_gpio_init(void) + { +- return platform_driver_probe(&nsp_gpio_driver, nsp_gpio_probe); ++ return platform_driver_register(&nsp_gpio_driver); + } + arch_initcall_sync(nsp_gpio_init); diff --git a/queue-4.8/rtc-pcf2123-add-missing-error-code-assignment-before-test.patch b/queue-4.8/rtc-pcf2123-add-missing-error-code-assignment-before-test.patch new file mode 100644 index 00000000000..062808f68b1 --- /dev/null +++ b/queue-4.8/rtc-pcf2123-add-missing-error-code-assignment-before-test.patch @@ -0,0 +1,44 @@ +From 83ab7dad06b74e390c2ce0e7b5136daf286e1f5e Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Tue, 9 Aug 2016 13:58:27 +0200 +Subject: rtc: pcf2123: Add missing error code assignment before test + +From: Christophe JAILLET + +commit 83ab7dad06b74e390c2ce0e7b5136daf286e1f5e upstream. + +It is likely that checking the result of 'pcf2123_write_reg' is expected +here. +Also fix a small style issue. The '{' at the beginning of the function +is misplaced. + +Fixes: 809b453b76e15 ("rtc: pcf2123: clean up writes to the rtc chip") +Signed-off-by: Christophe JAILLET +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/rtc/rtc-pcf2123.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/rtc/rtc-pcf2123.c ++++ b/drivers/rtc/rtc-pcf2123.c +@@ -182,7 +182,8 @@ static ssize_t pcf2123_show(struct devic + } + + static ssize_t pcf2123_store(struct device *dev, struct device_attribute *attr, +- const char *buffer, size_t count) { ++ const char *buffer, size_t count) ++{ + struct pcf2123_sysfs_reg *r; + unsigned long reg; + unsigned long val; +@@ -199,7 +200,7 @@ static ssize_t pcf2123_store(struct devi + if (ret) + return ret; + +- pcf2123_write_reg(dev, reg, val); ++ ret = pcf2123_write_reg(dev, reg, val); + if (ret < 0) + return -EIO; + return count; diff --git a/queue-4.8/s390-dumpstack-restore-reliable-indicator-for-call-traces.patch b/queue-4.8/s390-dumpstack-restore-reliable-indicator-for-call-traces.patch new file mode 100644 index 00000000000..edbcca50cec --- /dev/null +++ b/queue-4.8/s390-dumpstack-restore-reliable-indicator-for-call-traces.patch @@ -0,0 +1,148 @@ +From d0208639dbc6fe97a25054df44faa2d19aca9380 Mon Sep 17 00:00:00 2001 +From: Heiko Carstens +Date: Mon, 17 Oct 2016 11:08:31 +0200 +Subject: s390/dumpstack: restore reliable indicator for call traces + +From: Heiko Carstens + +commit d0208639dbc6fe97a25054df44faa2d19aca9380 upstream. + +Before merging all different stack tracers the call traces printed had +an indicator if an entry can be considered reliable or not. +Unreliable entries were put in braces, reliable not. Currently all +lines contain these extra braces. + +This patch restores the old behaviour by adding an extra "reliable" +parameter to the callback functions. Only show_trace makes currently +use of it. + +Before: +[ 0.804751] Call Trace: +[ 0.804753] ([<000000000017d0e0>] try_to_wake_up+0x318/0x5e0) +[ 0.804756] ([<0000000000161d64>] create_worker+0x174/0x1c0) + +After: +[ 0.804751] Call Trace: +[ 0.804753] ([<000000000017d0e0>] try_to_wake_up+0x318/0x5e0) +[ 0.804756] [<0000000000161d64>] create_worker+0x174/0x1c0 + +Fixes: 758d39ebd3d5 ("s390/dumpstack: merge all four stack tracers") +Signed-off-by: Heiko Carstens +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/include/asm/processor.h | 2 +- + arch/s390/kernel/dumpstack.c | 17 +++++++++++------ + arch/s390/kernel/perf_event.c | 2 +- + arch/s390/kernel/stacktrace.c | 4 ++-- + arch/s390/oprofile/init.c | 2 +- + 5 files changed, 16 insertions(+), 11 deletions(-) + +--- a/arch/s390/include/asm/processor.h ++++ b/arch/s390/include/asm/processor.h +@@ -192,7 +192,7 @@ struct task_struct; + struct mm_struct; + struct seq_file; + +-typedef int (*dump_trace_func_t)(void *data, unsigned long address); ++typedef int (*dump_trace_func_t)(void *data, unsigned long address, int reliable); + void dump_trace(dump_trace_func_t func, void *data, + struct task_struct *task, unsigned long sp); + +--- a/arch/s390/kernel/dumpstack.c ++++ b/arch/s390/kernel/dumpstack.c +@@ -38,10 +38,10 @@ __dump_trace(dump_trace_func_t func, voi + if (sp < low || sp > high - sizeof(*sf)) + return sp; + sf = (struct stack_frame *) sp; ++ if (func(data, sf->gprs[8], 0)) ++ return sp; + /* Follow the backchain. */ + while (1) { +- if (func(data, sf->gprs[8])) +- return sp; + low = sp; + sp = sf->back_chain; + if (!sp) +@@ -49,6 +49,8 @@ __dump_trace(dump_trace_func_t func, voi + if (sp <= low || sp > high - sizeof(*sf)) + return sp; + sf = (struct stack_frame *) sp; ++ if (func(data, sf->gprs[8], 1)) ++ return sp; + } + /* Zero backchain detected, check for interrupt frame. */ + sp = (unsigned long) (sf + 1); +@@ -56,7 +58,7 @@ __dump_trace(dump_trace_func_t func, voi + return sp; + regs = (struct pt_regs *) sp; + if (!user_mode(regs)) { +- if (func(data, regs->psw.addr)) ++ if (func(data, regs->psw.addr, 1)) + return sp; + } + low = sp; +@@ -90,7 +92,7 @@ struct return_address_data { + int depth; + }; + +-static int __return_address(void *data, unsigned long address) ++static int __return_address(void *data, unsigned long address, int reliable) + { + struct return_address_data *rd = data; + +@@ -109,9 +111,12 @@ unsigned long return_address(int depth) + } + EXPORT_SYMBOL_GPL(return_address); + +-static int show_address(void *data, unsigned long address) ++static int show_address(void *data, unsigned long address, int reliable) + { +- printk("([<%016lx>] %pSR)\n", address, (void *)address); ++ if (reliable) ++ printk(" [<%016lx>] %pSR \n", address, (void *)address); ++ else ++ printk("([<%016lx>] %pSR)\n", address, (void *)address); + return 0; + } + +--- a/arch/s390/kernel/perf_event.c ++++ b/arch/s390/kernel/perf_event.c +@@ -222,7 +222,7 @@ static int __init service_level_perf_reg + } + arch_initcall(service_level_perf_register); + +-static int __perf_callchain_kernel(void *data, unsigned long address) ++static int __perf_callchain_kernel(void *data, unsigned long address, int reliable) + { + struct perf_callchain_entry_ctx *entry = data; + +--- a/arch/s390/kernel/stacktrace.c ++++ b/arch/s390/kernel/stacktrace.c +@@ -27,12 +27,12 @@ static int __save_address(void *data, un + return 1; + } + +-static int save_address(void *data, unsigned long address) ++static int save_address(void *data, unsigned long address, int reliable) + { + return __save_address(data, address, 0); + } + +-static int save_address_nosched(void *data, unsigned long address) ++static int save_address_nosched(void *data, unsigned long address, int reliable) + { + return __save_address(data, address, 1); + } +--- a/arch/s390/oprofile/init.c ++++ b/arch/s390/oprofile/init.c +@@ -13,7 +13,7 @@ + #include + #include + +-static int __s390_backtrace(void *data, unsigned long address) ++static int __s390_backtrace(void *data, unsigned long address, int reliable) + { + unsigned int *depth = data; + diff --git a/queue-4.8/series b/queue-4.8/series index 083a5fb50de..ce119666517 100644 --- a/queue-4.8/series +++ b/queue-4.8/series @@ -65,3 +65,24 @@ nvme-delete-created-io-queues-on-reset.patch revert-clocksource-drivers-timer_sun5i-replace-code-by-clocksource_mmio_init.patch x86-build-fix-build-with-older-gcc-versions.patch clk-samsung-clk-exynos-audss-fix-module-autoload.patch +rtc-pcf2123-add-missing-error-code-assignment-before-test.patch +s390-dumpstack-restore-reliable-indicator-for-call-traces.patch +lib-genalloc.c-start-search-from-start-of-chunk.patch +hwrng-core-don-t-use-a-stack-buffer-in-add_early_randomness.patch +i40e-fix-call-of-ndo_dflt_bridge_getlink.patch +mmc-sdhci-msm-fix-error-return-code-in-sdhci_msm_probe.patch +acpi-apei-fix-incorrect-return-value-of-ghes_proc.patch +acpi-pci-irq-assign-isa-irq-directly-during-early-boot-stages.patch +acpi-pci-pci_link-penalize-sci-correctly.patch +acpi-pci-pci_link-include-pirq_penalty_pci_using-for-isa-irqs.patch +batman-adv-fix-splat-on-disabling-an-interface.patch +batman-adv-modify-neigh_list-only-with-rcu-list-functions.patch +gpio-mvebu-use-irq_domain_add_linear.patch +gpio-of-fix-gpio-drivers-with-multiple-gpio_chip-for-a-single-node.patch +asoc-intel-skylake-always-acquire-runtime-pm-ref-on-unload.patch +asoc-sun4i-codec-return-error-code-instead-of-null-when-create_card-fails.patch +pinctrl-iproc-fix-iproc-and-nsp-gpio-support.patch +mmc-mxs-initialize-the-spinlock-prior-to-using-it.patch +memcg-prevent-memcg-caches-to-be-both-off_slab-objfreelist_slab.patch +libceph-fix-legacy-layout-decode-with-pool-0.patch +nfsv4.1-work-around-wmaybe-uninitialized-warning.patch