From: Greg Kroah-Hartman Date: Sun, 10 Apr 2016 01:05:12 +0000 (-0700) Subject: 4.5-stable patches X-Git-Tag: v4.5.1~20 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ea3d643ce0ddd40f2e7da71684d6063815116177;p=thirdparty%2Fkernel%2Fstable-queue.git 4.5-stable patches added patches: alsa-hda-add-new-gpu-codec-id-0x10de0082-to-snd-hda.patch alsa-hda-apply-reboot-d3-fix-for-cx20724-codec-too.patch alsa-hda-don-t-handle-eld-notify-from-invalid-port.patch alsa-hda-fix-forgotten-hdmi-monitor_present-update.patch alsa-hda-fix-missing-eld-update-at-unplugging.patch alsa-hda-fix-spurious-kernel-warning-on-baytrail-hdmi.patch alsa-hda-fix-the-mic-mute-button-and-led-problem-for-a-lenovo-aio.patch alsa-hda-fix-unconditional-gpio-toggle-via-automute.patch alsa-hda-fix-unexpected-resume-through-regmap-code-path.patch alsa-hda-limit-i915-hdmi-binding-only-for-hsw-and-later.patch alsa-hda-really-restrict-i915-notifier-to-hsw.patch alsa-hda-workaround-for-unbalanced-i915-power-refcount-by-concurrent-probe.patch alsa-intel8x0-add-clock-quirk-entry-for-ad1981b-on-ibm-thinkpad-x41.patch alsa-pcm-avoid-bug-string-for-warnings-again.patch arm64-update-pte_rdonly-in-set_pte_at-for-prot_none-permission.patch bcache-cleaned-up-error-handling-around-register_cache.patch bcache-fix-cache_set_flush-null-pointer-dereference-on-oom.patch bcache-fix-race-of-writeback-thread-starting-before-complete-initialization.patch bluetooth-add-new-ar3012-id-0489-e095.patch bluetooth-fix-potential-buffer-overflow-with-add-advertising.patch brd-fix-discard-request-processing.patch cgroup-ignore-css_sets-associated-with-dead-cgroups-during-migration.patch drivers-firmware-broadcom-bcm47xx_nvram.c-fix-incorrect-__ioread32_copy.patch gpio-pca953x-fix-pca953x_gpio_set_multiple-on-64-bit.patch ia64-define-ioremap_uc.patch ib-srpt-simplify-srpt_handle_tsk_mgmt.patch jbd2-fix-fs-corruption-possibility-in-jbd2_journal_destroy-on-umount-path.patch mm-memcontrol-reclaim-and-oom-kill-when-shrinking-memory.max-below-usage.patch mm-memcontrol-reclaim-when-shrinking-memory.high-below-usage.patch tools-hv-use-include-uapi-with-__exported_headers__.patch watchdog-don-t-run-proc_watchdog_update-if-new-value-is-same-as-old.patch watchdog-rc32434_wdt-fix-ioctl-error-handling.patch --- diff --git a/queue-4.5/alsa-hda-add-new-gpu-codec-id-0x10de0082-to-snd-hda.patch b/queue-4.5/alsa-hda-add-new-gpu-codec-id-0x10de0082-to-snd-hda.patch new file mode 100644 index 00000000000..8d8aca2b170 --- /dev/null +++ b/queue-4.5/alsa-hda-add-new-gpu-codec-id-0x10de0082-to-snd-hda.patch @@ -0,0 +1,32 @@ +From 2d369c748c2ecc2a012ee85412a04007e67913ec Mon Sep 17 00:00:00 2001 +From: Aaron Plattner +Date: Sun, 13 Mar 2016 13:58:57 -0700 +Subject: ALSA: hda - Add new GPU codec ID 0x10de0082 to snd-hda + +From: Aaron Plattner + +commit 2d369c748c2ecc2a012ee85412a04007e67913ec upstream. + +Vendor ID 0x10de0082 is used by a yet-to-be-named GPU chip. + +This chip also has the 2-ch audio swapping bug, so patch_nvhdmi is +appropriate here. + +Signed-off-by: Aaron Plattner +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_hdmi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -3663,6 +3663,7 @@ HDA_CODEC_ENTRY(0x10de0070, "GPU 70 HDMI + HDA_CODEC_ENTRY(0x10de0071, "GPU 71 HDMI/DP", patch_nvhdmi), + HDA_CODEC_ENTRY(0x10de0072, "GPU 72 HDMI/DP", patch_nvhdmi), + HDA_CODEC_ENTRY(0x10de007d, "GPU 7d HDMI/DP", patch_nvhdmi), ++HDA_CODEC_ENTRY(0x10de0082, "GPU 82 HDMI/DP", patch_nvhdmi), + HDA_CODEC_ENTRY(0x10de0083, "GPU 83 HDMI/DP", patch_nvhdmi), + HDA_CODEC_ENTRY(0x10de8001, "MCP73 HDMI", patch_nvhdmi_2ch), + HDA_CODEC_ENTRY(0x11069f80, "VX900 HDMI/DP", patch_via_hdmi), diff --git a/queue-4.5/alsa-hda-apply-reboot-d3-fix-for-cx20724-codec-too.patch b/queue-4.5/alsa-hda-apply-reboot-d3-fix-for-cx20724-codec-too.patch new file mode 100644 index 00000000000..876e7bffc06 --- /dev/null +++ b/queue-4.5/alsa-hda-apply-reboot-d3-fix-for-cx20724-codec-too.patch @@ -0,0 +1,37 @@ +From 56dc66ff1c6d71f9a38c4a7c000b72b921fe4c89 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 10 Mar 2016 11:33:43 +0100 +Subject: ALSA: hda - Apply reboot D3 fix for CX20724 codec, too + +From: Takashi Iwai + +commit 56dc66ff1c6d71f9a38c4a7c000b72b921fe4c89 upstream. + +Just like CX20722, CX7024 codec also requires the power down at reboot +in order to reduce the noise at reboot/shutdown. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=113511 +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_conexant.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -204,8 +204,13 @@ static void cx_auto_reboot_notify(struct + { + struct conexant_spec *spec = codec->spec; + +- if (codec->core.vendor_id != 0x14f150f2) ++ switch (codec->core.vendor_id) { ++ case 0x14f150f2: /* CX20722 */ ++ case 0x14f150f4: /* CX20724 */ ++ break; ++ default: + return; ++ } + + /* Turn the CX20722 codec into D3 to avoid spurious noises + from the internal speaker during (and after) reboot */ diff --git a/queue-4.5/alsa-hda-don-t-handle-eld-notify-from-invalid-port.patch b/queue-4.5/alsa-hda-don-t-handle-eld-notify-from-invalid-port.patch new file mode 100644 index 00000000000..c9f5af8886c --- /dev/null +++ b/queue-4.5/alsa-hda-don-t-handle-eld-notify-from-invalid-port.patch @@ -0,0 +1,39 @@ +From 4f8e4f3537cafc4de128e6bfdf83baa78bc60eb1 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 10 Mar 2016 12:02:49 +0100 +Subject: ALSA: hda - Don't handle ELD notify from invalid port + +From: Takashi Iwai + +commit 4f8e4f3537cafc4de128e6bfdf83baa78bc60eb1 upstream. + +The current Intel HDMI codec driver supports only three fixed ports +from port B to port D. However, i915 driver may assign a DP on other +ports, e.g. port A, when no eDP is used. This incompatibility is +caught later at pin_nid_to_pin_index() and results in a warning +message like "HDMI: pin nid 4 not registered" at each time. + +This patch filters out such invalid events beforehand, so that the +kernel won't be too grumbling. + +Reported-by: Stefan Assmann +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_hdmi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -2432,6 +2432,10 @@ static void intel_pin_eld_notify(void *a + struct hda_codec *codec = audio_ptr; + int pin_nid = port + 0x04; + ++ /* we assume only from port-B to port-D */ ++ if (port < 1 || port > 3) ++ return; ++ + /* skip notification during system suspend (but not in runtime PM); + * the state will be updated at resume + */ diff --git a/queue-4.5/alsa-hda-fix-forgotten-hdmi-monitor_present-update.patch b/queue-4.5/alsa-hda-fix-forgotten-hdmi-monitor_present-update.patch new file mode 100644 index 00000000000..5994cb8e251 --- /dev/null +++ b/queue-4.5/alsa-hda-fix-forgotten-hdmi-monitor_present-update.patch @@ -0,0 +1,31 @@ +From bd48128539ab89986b24ad08ecd3e027dd1993a1 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 18 Mar 2016 18:01:53 +0100 +Subject: ALSA: hda - Fix forgotten HDMI monitor_present update + +From: Takashi Iwai + +commit bd48128539ab89986b24ad08ecd3e027dd1993a1 upstream. + +We forgot to copy monitor_present value when updating the ELD +information. This won't change the ELD retrieval and the jack +notification behavior, but appears only in the proc output. In that +sense, it's no fatal error, but a bug is a bug is a bug. + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_hdmi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -1566,6 +1566,7 @@ static void update_eld(struct hda_codec + eld->eld_size) != 0) + eld_changed = true; + ++ pin_eld->monitor_present = eld->monitor_present; + pin_eld->eld_valid = eld->eld_valid; + pin_eld->eld_size = eld->eld_size; + if (eld->eld_valid) diff --git a/queue-4.5/alsa-hda-fix-missing-eld-update-at-unplugging.patch b/queue-4.5/alsa-hda-fix-missing-eld-update-at-unplugging.patch new file mode 100644 index 00000000000..683b5545229 --- /dev/null +++ b/queue-4.5/alsa-hda-fix-missing-eld-update-at-unplugging.patch @@ -0,0 +1,39 @@ +From c64c1437afb14ebc900e40910f31ffb20bf652ad Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 21 Mar 2016 16:07:30 +0100 +Subject: ALSA: hda - Fix missing ELD update at unplugging + +From: Takashi Iwai + +commit c64c1437afb14ebc900e40910f31ffb20bf652ad upstream. + +i915 get_eld ops may return an error when no encoder is connected, and +currently we regard the error as fatal and skip the whole ELD +handling. This ended up with the missing ELD update at unplugging. + +This patch fixes the issue by treating the error as the unplugged +state, instead of skipping the rest. + +Reported-by: Libin Yang +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_hdmi.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -1670,11 +1670,10 @@ static void sync_eld_via_acomp(struct hd + int size; + + mutex_lock(&per_pin->lock); ++ eld->monitor_present = false; + size = snd_hdac_acomp_get_eld(&codec->bus->core, per_pin->pin_nid, + &eld->monitor_present, eld->eld_buffer, + ELD_MAX_SIZE); +- if (size < 0) +- goto unlock; + if (size > 0) { + size = min(size, ELD_MAX_SIZE); + if (snd_hdmi_parse_eld(codec, &eld->info, diff --git a/queue-4.5/alsa-hda-fix-spurious-kernel-warning-on-baytrail-hdmi.patch b/queue-4.5/alsa-hda-fix-spurious-kernel-warning-on-baytrail-hdmi.patch new file mode 100644 index 00000000000..027a69c938a --- /dev/null +++ b/queue-4.5/alsa-hda-fix-spurious-kernel-warning-on-baytrail-hdmi.patch @@ -0,0 +1,44 @@ +From 93a9ff151754fbdf951b1b993bcf96453f6e36b3 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 18 Mar 2016 19:45:13 +0100 +Subject: ALSA: hda - Fix spurious kernel WARNING on Baytrail HDMI +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Takashi Iwai + +commit 93a9ff151754fbdf951b1b993bcf96453f6e36b3 upstream. + +snd_hdac_sync_audio_rate() call is mandatory only for HSW and later +models, but we call the function unconditionally blindly assuming that +the function doesn't do anything harmful. But since recently, the +function checks the validity of the passed pin NID, and eventually +spews the warning if an unexpected pin is passed. This is seen on old +chips like Baytrail. + +The fix is to limit the call of this function again only for the chips +with the proper binding. This can be identified by the same flag as +the eld notifier. + +Reported-by: Ville Syrjälä +Tested-by: Ville Syrjälä +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_hdmi.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -1873,7 +1873,8 @@ static int generic_hdmi_playback_pcm_pre + + /* Call sync_audio_rate to set the N/CTS/M manually if necessary */ + /* Todo: add DP1.2 MST audio support later */ +- snd_hdac_sync_audio_rate(&codec->bus->core, pin_nid, runtime->rate); ++ if (codec_has_acomp(codec)) ++ snd_hdac_sync_audio_rate(&codec->bus->core, pin_nid, runtime->rate); + + non_pcm = check_non_pcm_per_cvt(codec, cvt_nid); + mutex_lock(&per_pin->lock); diff --git a/queue-4.5/alsa-hda-fix-the-mic-mute-button-and-led-problem-for-a-lenovo-aio.patch b/queue-4.5/alsa-hda-fix-the-mic-mute-button-and-led-problem-for-a-lenovo-aio.patch new file mode 100644 index 00000000000..3438b93f72b --- /dev/null +++ b/queue-4.5/alsa-hda-fix-the-mic-mute-button-and-led-problem-for-a-lenovo-aio.patch @@ -0,0 +1,32 @@ +From 6ef2f68fa38bf415830f67903d87180d933e0f47 Mon Sep 17 00:00:00 2001 +From: Hui Wang +Date: Fri, 11 Mar 2016 12:04:02 +0800 +Subject: ALSA: hda - fix the mic mute button and led problem for a Lenovo AIO + +From: Hui Wang + +commit 6ef2f68fa38bf415830f67903d87180d933e0f47 upstream. + +This Lenovo ThinkCentre AIO also uses Line2 as mic mute button and +uses GPIO2 to control the mic mute led, so applying this quirk can +make both the button and led work. + +BugLink: https://bugs.launchpad.net/bugs/1555912 +Signed-off-by: Hui Wang +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5556,6 +5556,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK), + SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE), + SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), ++ SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), + SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC), + SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP), diff --git a/queue-4.5/alsa-hda-fix-unconditional-gpio-toggle-via-automute.patch b/queue-4.5/alsa-hda-fix-unconditional-gpio-toggle-via-automute.patch new file mode 100644 index 00000000000..ca8886c5bc2 --- /dev/null +++ b/queue-4.5/alsa-hda-fix-unconditional-gpio-toggle-via-automute.patch @@ -0,0 +1,44 @@ +From 1f7c6658962fa1260c1658d681bd6bb0c746b99a Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 15 Mar 2016 16:44:55 +0100 +Subject: ALSA: hda - Fix unconditional GPIO toggle via automute + +From: Takashi Iwai + +commit 1f7c6658962fa1260c1658d681bd6bb0c746b99a upstream. + +Cirrus HD-audio driver may adjust GPIO pins for EAPD dynamically +depending on the jack plug state. This works fine for the auto-mute +mode where the speaker gets muted upon the HP jack plug. OTOH, when +the auto-mute mode is off, this turns off the EAPD unexpectedly +depending on the jack state, which results in the silent speaker +output. + +This patch fixes the silent speaker output issue by setting GPIO bits +constantly when the auto-mute mode is off. + +Reported-and-tested-by: moosotc@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_cirrus.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/sound/pci/hda/patch_cirrus.c ++++ b/sound/pci/hda/patch_cirrus.c +@@ -174,8 +174,12 @@ static void cs_automute(struct hda_codec + snd_hda_gen_update_outputs(codec); + + if (spec->gpio_eapd_hp || spec->gpio_eapd_speaker) { +- spec->gpio_data = spec->gen.hp_jack_present ? +- spec->gpio_eapd_hp : spec->gpio_eapd_speaker; ++ if (spec->gen.automute_speaker) ++ spec->gpio_data = spec->gen.hp_jack_present ? ++ spec->gpio_eapd_hp : spec->gpio_eapd_speaker; ++ else ++ spec->gpio_data = ++ spec->gpio_eapd_hp | spec->gpio_eapd_speaker; + snd_hda_codec_write(codec, 0x01, 0, + AC_VERB_SET_GPIO_DATA, spec->gpio_data); + } diff --git a/queue-4.5/alsa-hda-fix-unexpected-resume-through-regmap-code-path.patch b/queue-4.5/alsa-hda-fix-unexpected-resume-through-regmap-code-path.patch new file mode 100644 index 00000000000..b3bb873acab --- /dev/null +++ b/queue-4.5/alsa-hda-fix-unexpected-resume-through-regmap-code-path.patch @@ -0,0 +1,205 @@ +From fc4f000bf8c0cbf38f44de6bd5e225574e572ed4 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 4 Mar 2016 11:34:18 +0100 +Subject: ALSA: hda - Fix unexpected resume through regmap code path + +From: Takashi Iwai + +commit fc4f000bf8c0cbf38f44de6bd5e225574e572ed4 upstream. + +HD-audio driver has a mechanism to trigger the runtime resume +automatically at accessing the verbs. This auto-resume, however, +causes the mutex deadlock when invoked from the regmap handler since +the regmap keeps the mutex while auto-resuming. For avoiding that, +there is some tricky check in the HDA regmap handler to return -EAGAIN +error to back-off when the codec is powered down. Then the caller of +regmap r/w will retry after properly turning on the codec power. + +This works in most cases, but there seems a slight race between the +codec power check and the actual on-demand auto-resume trigger. This +resulted in the lockdep splat, eventually leading to a real deadlock. + +This patch tries to address the race window by getting the runtime PM +refcount at the check time using pm_runtime_get_if_in_use(). With +this call, we can keep the power on only when the codec has been +already turned on, and back off if not. + +For keeping the code consistency, the code touching the runtime PM is +stored in hdac_device.c although it's used only locally in +hdac_regmap.c. + +Reported-by: Jiri Slaby +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + include/sound/hdaudio.h | 2 + + sound/hda/hdac_device.c | 16 +++++++++++ + sound/hda/hdac_regmap.c | 69 ++++++++++++++++++++++++++++++++---------------- + 3 files changed, 64 insertions(+), 23 deletions(-) + +--- a/include/sound/hdaudio.h ++++ b/include/sound/hdaudio.h +@@ -168,11 +168,13 @@ int snd_hdac_power_up(struct hdac_device + int snd_hdac_power_down(struct hdac_device *codec); + int snd_hdac_power_up_pm(struct hdac_device *codec); + int snd_hdac_power_down_pm(struct hdac_device *codec); ++int snd_hdac_keep_power_up(struct hdac_device *codec); + #else + static inline int snd_hdac_power_up(struct hdac_device *codec) { return 0; } + static inline int snd_hdac_power_down(struct hdac_device *codec) { return 0; } + static inline int snd_hdac_power_up_pm(struct hdac_device *codec) { return 0; } + static inline int snd_hdac_power_down_pm(struct hdac_device *codec) { return 0; } ++static inline int snd_hdac_keep_power_up(struct hdac_device *codec) { return 0; } + #endif + + /* +--- a/sound/hda/hdac_device.c ++++ b/sound/hda/hdac_device.c +@@ -611,6 +611,22 @@ int snd_hdac_power_up_pm(struct hdac_dev + } + EXPORT_SYMBOL_GPL(snd_hdac_power_up_pm); + ++/* like snd_hdac_power_up_pm(), but only increment the pm count when ++ * already powered up. Returns -1 if not powered up, 1 if incremented ++ * or 0 if unchanged. Only used in hdac_regmap.c ++ */ ++int snd_hdac_keep_power_up(struct hdac_device *codec) ++{ ++ if (!atomic_inc_not_zero(&codec->in_pm)) { ++ int ret = pm_runtime_get_if_in_use(&codec->dev); ++ if (!ret) ++ return -1; ++ if (ret < 0) ++ return 0; ++ } ++ return 1; ++} ++ + /** + * snd_hdac_power_down_pm - power down the codec + * @codec: the codec object +--- a/sound/hda/hdac_regmap.c ++++ b/sound/hda/hdac_regmap.c +@@ -21,13 +21,16 @@ + #include + #include + +-#ifdef CONFIG_PM +-#define codec_is_running(codec) \ +- (atomic_read(&(codec)->in_pm) || \ +- !pm_runtime_suspended(&(codec)->dev)) +-#else +-#define codec_is_running(codec) true +-#endif ++static int codec_pm_lock(struct hdac_device *codec) ++{ ++ return snd_hdac_keep_power_up(codec); ++} ++ ++static void codec_pm_unlock(struct hdac_device *codec, int lock) ++{ ++ if (lock == 1) ++ snd_hdac_power_down_pm(codec); ++} + + #define get_verb(reg) (((reg) >> 8) & 0xfff) + +@@ -238,20 +241,28 @@ static int hda_reg_read(void *context, u + struct hdac_device *codec = context; + int verb = get_verb(reg); + int err; ++ int pm_lock = 0; + +- if (!codec_is_running(codec) && verb != AC_VERB_GET_POWER_STATE) +- return -EAGAIN; ++ if (verb != AC_VERB_GET_POWER_STATE) { ++ pm_lock = codec_pm_lock(codec); ++ if (pm_lock < 0) ++ return -EAGAIN; ++ } + reg |= (codec->addr << 28); +- if (is_stereo_amp_verb(reg)) +- return hda_reg_read_stereo_amp(codec, reg, val); +- if (verb == AC_VERB_GET_PROC_COEF) +- return hda_reg_read_coef(codec, reg, val); ++ if (is_stereo_amp_verb(reg)) { ++ err = hda_reg_read_stereo_amp(codec, reg, val); ++ goto out; ++ } ++ if (verb == AC_VERB_GET_PROC_COEF) { ++ err = hda_reg_read_coef(codec, reg, val); ++ goto out; ++ } + if ((verb & 0x700) == AC_VERB_SET_AMP_GAIN_MUTE) + reg &= ~AC_AMP_FAKE_MUTE; + + err = snd_hdac_exec_verb(codec, reg, 0, val); + if (err < 0) +- return err; ++ goto out; + /* special handling for asymmetric reads */ + if (verb == AC_VERB_GET_POWER_STATE) { + if (*val & AC_PWRST_ERROR) +@@ -259,7 +270,9 @@ static int hda_reg_read(void *context, u + else /* take only the actual state */ + *val = (*val >> 4) & 0x0f; + } +- return 0; ++ out: ++ codec_pm_unlock(codec, pm_lock); ++ return err; + } + + static int hda_reg_write(void *context, unsigned int reg, unsigned int val) +@@ -267,6 +280,7 @@ static int hda_reg_write(void *context, + struct hdac_device *codec = context; + unsigned int verb; + int i, bytes, err; ++ int pm_lock = 0; + + if (codec->caps_overwriting) + return 0; +@@ -275,14 +289,21 @@ static int hda_reg_write(void *context, + reg |= (codec->addr << 28); + verb = get_verb(reg); + +- if (!codec_is_running(codec) && verb != AC_VERB_SET_POWER_STATE) +- return codec->lazy_cache ? 0 : -EAGAIN; ++ if (verb != AC_VERB_SET_POWER_STATE) { ++ pm_lock = codec_pm_lock(codec); ++ if (pm_lock < 0) ++ return codec->lazy_cache ? 0 : -EAGAIN; ++ } + +- if (is_stereo_amp_verb(reg)) +- return hda_reg_write_stereo_amp(codec, reg, val); ++ if (is_stereo_amp_verb(reg)) { ++ err = hda_reg_write_stereo_amp(codec, reg, val); ++ goto out; ++ } + +- if (verb == AC_VERB_SET_PROC_COEF) +- return hda_reg_write_coef(codec, reg, val); ++ if (verb == AC_VERB_SET_PROC_COEF) { ++ err = hda_reg_write_coef(codec, reg, val); ++ goto out; ++ } + + switch (verb & 0xf00) { + case AC_VERB_SET_AMP_GAIN_MUTE: +@@ -319,10 +340,12 @@ static int hda_reg_write(void *context, + reg |= (verb + i) << 8 | ((val >> (8 * i)) & 0xff); + err = snd_hdac_exec_verb(codec, reg, 0, NULL); + if (err < 0) +- return err; ++ goto out; + } + +- return 0; ++ out: ++ codec_pm_unlock(codec, pm_lock); ++ return err; + } + + static const struct regmap_config hda_regmap_cfg = { diff --git a/queue-4.5/alsa-hda-limit-i915-hdmi-binding-only-for-hsw-and-later.patch b/queue-4.5/alsa-hda-limit-i915-hdmi-binding-only-for-hsw-and-later.patch new file mode 100644 index 00000000000..537acb8c759 --- /dev/null +++ b/queue-4.5/alsa-hda-limit-i915-hdmi-binding-only-for-hsw-and-later.patch @@ -0,0 +1,43 @@ +From b62232d429fa8b1dcf5d8503aa5a5397a03e646a Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 15 Mar 2016 18:15:26 +0100 +Subject: ALSA: hda - Limit i915 HDMI binding only for HSW and later +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Takashi Iwai + +commit b62232d429fa8b1dcf5d8503aa5a5397a03e646a upstream. + +It turned out that the pre-HSW Intel chips are incompatible with the +naive assumption we had -- the fixed mapping between the port and the +HD-audio widget. This may result in the bad access, as captured by +the recent patch to add a WARN_ON() for the port mapping check. + +As a quick workaround, disable the i915 audio component binding for +all pre-Haswell models. + +Reported-by: Ville Syrjälä +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_hdmi.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -2460,9 +2460,10 @@ static int patch_generic_hdmi(struct hda + codec->spec = spec; + hdmi_array_init(spec, 4); + +- /* Try to bind with i915 for any Intel codecs (if not done yet) */ ++ /* Try to bind with i915 for Intel HSW+ codecs (if not done yet) */ + if (!codec_has_acomp(codec) && +- (codec->core.vendor_id >> 16) == 0x8086) ++ (codec->core.vendor_id >> 16) == 0x8086 && ++ is_haswell_plus(codec)) + if (!snd_hdac_i915_init(&codec->bus->core)) + spec->i915_bound = true; + diff --git a/queue-4.5/alsa-hda-really-restrict-i915-notifier-to-hsw.patch b/queue-4.5/alsa-hda-really-restrict-i915-notifier-to-hsw.patch new file mode 100644 index 00000000000..a97f7f860ca --- /dev/null +++ b/queue-4.5/alsa-hda-really-restrict-i915-notifier-to-hsw.patch @@ -0,0 +1,78 @@ +From 691be973c0621255abb31572a98e35c57be70212 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 18 Mar 2016 15:10:08 +0100 +Subject: ALSA: hda - Really restrict i915 notifier to HSW+ +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Takashi Iwai + +commit 691be973c0621255abb31572a98e35c57be70212 upstream. + +The commit [b62232d429fa: ALSA: hda - Limit i915 HDMI binding only for +HSW and later] tried to limit the usage of i915 audio notifier to the +recent Intel models and switch to the old method on pre-Haswell +models. However, it assumed that the i915 component binding hasn't +been done on such models, and the assumption was wrong: namely, +Baytrail had already the i915 component binding due to powerwell +control. Thus, the workaround wasn't applied to Baytrail. + +For fixing this properly, this patch introduces a new flag indicating +the usage of audio notifier and codec_has_acomp() refers to this flag +instead of checking the existence of audio component. + +Reported-by: Ville Syrjälä +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_hdmi.c | 24 +++++++++++++++++------- + 1 file changed, 17 insertions(+), 7 deletions(-) + +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -152,13 +152,17 @@ struct hdmi_spec { + struct hda_pcm_stream pcm_playback; + + /* i915/powerwell (Haswell+/Valleyview+) specific */ ++ bool use_acomp_notifier; /* use i915 eld_notify callback for hotplug */ + struct i915_audio_component_audio_ops i915_audio_ops; + bool i915_bound; /* was i915 bound in this driver? */ + }; + + #ifdef CONFIG_SND_HDA_I915 +-#define codec_has_acomp(codec) \ +- ((codec)->bus->core.audio_component != NULL) ++static inline bool codec_has_acomp(struct hda_codec *codec) ++{ ++ struct hdmi_spec *spec = codec->spec; ++ return spec->use_acomp_notifier; ++} + #else + #define codec_has_acomp(codec) false + #endif +@@ -2461,12 +2465,18 @@ static int patch_generic_hdmi(struct hda + codec->spec = spec; + hdmi_array_init(spec, 4); + ++#ifdef CONFIG_SND_HDA_I915 + /* Try to bind with i915 for Intel HSW+ codecs (if not done yet) */ +- if (!codec_has_acomp(codec) && +- (codec->core.vendor_id >> 16) == 0x8086 && +- is_haswell_plus(codec)) +- if (!snd_hdac_i915_init(&codec->bus->core)) +- spec->i915_bound = true; ++ if ((codec->core.vendor_id >> 16) == 0x8086 && ++ is_haswell_plus(codec)) { ++ if (!codec->bus->core.audio_component) ++ if (!snd_hdac_i915_init(&codec->bus->core)) ++ spec->i915_bound = true; ++ /* use i915 audio component notifier for hotplug */ ++ if (codec->bus->core.audio_component) ++ spec->use_acomp_notifier = true; ++ } ++#endif + + if (is_haswell_plus(codec)) { + intel_haswell_enable_all_pins(codec, true); diff --git a/queue-4.5/alsa-hda-workaround-for-unbalanced-i915-power-refcount-by-concurrent-probe.patch b/queue-4.5/alsa-hda-workaround-for-unbalanced-i915-power-refcount-by-concurrent-probe.patch new file mode 100644 index 00000000000..39711cd1f93 --- /dev/null +++ b/queue-4.5/alsa-hda-workaround-for-unbalanced-i915-power-refcount-by-concurrent-probe.patch @@ -0,0 +1,72 @@ +From 7169701ad3f9fadd7413b354ae317e67c0b37389 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sat, 19 Mar 2016 10:40:21 +0100 +Subject: ALSA: hda - Workaround for unbalanced i915 power refcount by concurrent probe +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Takashi Iwai + +commit 7169701ad3f9fadd7413b354ae317e67c0b37389 upstream. + +The recent addition of on-demand i915 audio component binding in the +codec driver seems leading to the unbalanced i915 power refcount, +according to Intel CI tests. Typically, it gets a kernel WARNING +like: + WARNING: CPU: 3 PID: 173 at sound/hda/hdac_i915.c:91 snd_hdac_display_power+0xf1/0x110 [snd_hda_core]() + Call Trace: + [] dump_stack+0x67/0x92 + [] warn_slowpath_common+0x81/0xc0 + [] warn_slowpath_null+0x15/0x20 + [] snd_hdac_display_power+0xf1/0x110 [snd_hda_core] + [] azx_intel_link_power+0xd/0x10 [snd_hda_intel] + [] azx_link_power+0x1a/0x30 [snd_hda_codec] + [] snd_hdac_link_power+0x29/0x40 [snd_hda_core] + [] hda_codec_runtime_suspend+0x76/0xa0 [snd_hda_codec] + ..... + +The scenario is like below: +- HD-audio driver and i915 driver are probed concurrently at the + (almost) same time; HDA bus tries to bind with i915, but it fails + because i915 initialization is still being processed. +- Later on, HD-audio probes the HDMI codec, where it again tries to + bind with i915. At this time, it succeeds. +- At finishing the probe of HDA, it decreases the refcount as if it + were already bound at the bus probe, since the component is bound + now. This triggers a kernel WARNING due to the unbalance. + +As a workaround, in this patch, we just disable the on-demand i915 +component binding in the codec driver. This essentially reverts back +to the state of 4.4 kernel. + +We know that this is no real solution, but it's a minimalistic simple +change that can be applied to 4.5.x kernel as stable. + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=94566 +Reported-by: Ville Syrjälä +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_hdmi.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -2470,9 +2470,15 @@ static int patch_generic_hdmi(struct hda + /* Try to bind with i915 for Intel HSW+ codecs (if not done yet) */ + if ((codec->core.vendor_id >> 16) == 0x8086 && + is_haswell_plus(codec)) { ++#if 0 ++ /* on-demand binding leads to an unbalanced refcount when ++ * both i915 and hda drivers are probed concurrently; ++ * disabled temporarily for now ++ */ + if (!codec->bus->core.audio_component) + if (!snd_hdac_i915_init(&codec->bus->core)) + spec->i915_bound = true; ++#endif + /* use i915 audio component notifier for hotplug */ + if (codec->bus->core.audio_component) + spec->use_acomp_notifier = true; diff --git a/queue-4.5/alsa-intel8x0-add-clock-quirk-entry-for-ad1981b-on-ibm-thinkpad-x41.patch b/queue-4.5/alsa-intel8x0-add-clock-quirk-entry-for-ad1981b-on-ibm-thinkpad-x41.patch new file mode 100644 index 00000000000..aa124e1216b --- /dev/null +++ b/queue-4.5/alsa-intel8x0-add-clock-quirk-entry-for-ad1981b-on-ibm-thinkpad-x41.patch @@ -0,0 +1,31 @@ +From 4061db03dd71d195b9973ee466f6ed32f6a3fc16 Mon Sep 17 00:00:00 2001 +From: "Vittorio Gambaletta (VittGam)" +Date: Sun, 13 Mar 2016 22:19:34 +0100 +Subject: ALSA: intel8x0: Add clock quirk entry for AD1981B on IBM ThinkPad X41. + +From: Vittorio Gambaletta (VittGam) + +commit 4061db03dd71d195b9973ee466f6ed32f6a3fc16 upstream. + +The clock measurement on the AC'97 audio card found in the IBM ThinkPad X41 +will often fail, so add a quirk entry to fix it. + +Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=441087 +Signed-off-by: Vittorio Gambaletta +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/intel8x0.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/intel8x0.c ++++ b/sound/pci/intel8x0.c +@@ -2879,6 +2879,7 @@ static void intel8x0_measure_ac97_clock( + + static struct snd_pci_quirk intel8x0_clock_list[] = { + SND_PCI_QUIRK(0x0e11, 0x008a, "AD1885", 41000), ++ SND_PCI_QUIRK(0x1014, 0x0581, "AD1981B", 48000), + SND_PCI_QUIRK(0x1028, 0x00be, "AD1885", 44100), + SND_PCI_QUIRK(0x1028, 0x0177, "AD1980", 48000), + SND_PCI_QUIRK(0x1028, 0x01ad, "AD1981B", 48000), diff --git a/queue-4.5/alsa-pcm-avoid-bug-string-for-warnings-again.patch b/queue-4.5/alsa-pcm-avoid-bug-string-for-warnings-again.patch new file mode 100644 index 00000000000..6e70da1454c --- /dev/null +++ b/queue-4.5/alsa-pcm-avoid-bug-string-for-warnings-again.patch @@ -0,0 +1,35 @@ +From 0ab1ace856205d10cbc1924b2d931c01ffd216a6 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 10 Mar 2016 20:56:20 +0100 +Subject: ALSA: pcm: Avoid "BUG:" string for warnings again + +From: Takashi Iwai + +commit 0ab1ace856205d10cbc1924b2d931c01ffd216a6 upstream. + +The commit [d507941beb1e: ALSA: pcm: Correct PCM BUG error message] +made the warning prefix back to "BUG:" due to its previous wrong +prefix. But a kernel message containing "BUG:" seems taken as an Oops +message wrongly by some brain-dead daemons, and it annoys users in the +end. Instead of teaching daemons, change the string again to a more +reasonable one. + +Fixes: 507941beb1e ('ALSA: pcm: Correct PCM BUG error message') +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/pcm_lib.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/core/pcm_lib.c ++++ b/sound/core/pcm_lib.c +@@ -322,7 +322,7 @@ static int snd_pcm_update_hw_ptr0(struct + char name[16]; + snd_pcm_debug_name(substream, name, sizeof(name)); + pcm_err(substream->pcm, +- "BUG: %s, pos = %ld, buffer size = %ld, period size = %ld\n", ++ "invalid position: %s, pos = %ld, buffer size = %ld, period size = %ld\n", + name, pos, runtime->buffer_size, + runtime->period_size); + } diff --git a/queue-4.5/arm64-update-pte_rdonly-in-set_pte_at-for-prot_none-permission.patch b/queue-4.5/arm64-update-pte_rdonly-in-set_pte_at-for-prot_none-permission.patch new file mode 100644 index 00000000000..3b6a0b2e715 --- /dev/null +++ b/queue-4.5/arm64-update-pte_rdonly-in-set_pte_at-for-prot_none-permission.patch @@ -0,0 +1,57 @@ +From fdc69e7df3cb24f18a93192641786e5b7ecd1dfe Mon Sep 17 00:00:00 2001 +From: Catalin Marinas +Date: Wed, 9 Mar 2016 16:31:29 +0000 +Subject: arm64: Update PTE_RDONLY in set_pte_at() for PROT_NONE permission + +From: Catalin Marinas + +commit fdc69e7df3cb24f18a93192641786e5b7ecd1dfe upstream. + +The set_pte_at() function must update the hardware PTE_RDONLY bit +depending on the state of the PTE_WRITE and PTE_DIRTY bits of the given +entry value. However, it currently only performs this for pte_valid() +entries, ignoring PTE_PROT_NONE. The side-effect is that PROT_NONE +mappings would not have the PTE_RDONLY bit set. Without +CONFIG_ARM64_HW_AFDBM, this is not an issue since such PROT_NONE pages +are not accessible anyway. + +With commit 2f4b829c625e ("arm64: Add support for hardware updates of +the access and dirty pte bits"), the ptep_set_wrprotect() function was +re-written to cope with automatic hardware updates of the dirty state. +As an optimisation, only PTE_RDONLY is checked to assess the "dirty" +status. Since set_pte_at() does not set this bit for PROT_NONE mappings, +such pages may be considered "dirty" as a result of +ptep_set_wrprotect(). + +This patch updates the pte_valid() check to pte_present() in +set_pte_at(). It also adds PTE_PROT_NONE to the swap entry bits comment. + +Fixes: 2f4b829c625e ("arm64: Add support for hardware updates of the access and dirty pte bits") +Signed-off-by: Catalin Marinas +Reported-by: Ganapatrao Kulkarni +Tested-by: Ganapatrao Kulkarni +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/include/asm/pgtable.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/arm64/include/asm/pgtable.h ++++ b/arch/arm64/include/asm/pgtable.h +@@ -279,7 +279,7 @@ extern void __sync_icache_dcache(pte_t p + static inline void set_pte_at(struct mm_struct *mm, unsigned long addr, + pte_t *ptep, pte_t pte) + { +- if (pte_valid(pte)) { ++ if (pte_present(pte)) { + if (pte_sw_dirty(pte) && pte_write(pte)) + pte_val(pte) &= ~PTE_RDONLY; + else +@@ -649,6 +649,7 @@ extern pgd_t idmap_pg_dir[PTRS_PER_PGD]; + * bits 0-1: present (must be zero) + * bits 2-7: swap type + * bits 8-57: swap offset ++ * bit 58: PTE_PROT_NONE (must be zero) + */ + #define __SWP_TYPE_SHIFT 2 + #define __SWP_TYPE_BITS 6 diff --git a/queue-4.5/bcache-cleaned-up-error-handling-around-register_cache.patch b/queue-4.5/bcache-cleaned-up-error-handling-around-register_cache.patch new file mode 100644 index 00000000000..fefe75b7c66 --- /dev/null +++ b/queue-4.5/bcache-cleaned-up-error-handling-around-register_cache.patch @@ -0,0 +1,112 @@ +From 9b299728ed777428b3908ac72ace5f8f84b97789 Mon Sep 17 00:00:00 2001 +From: Eric Wheeler +Date: Fri, 26 Feb 2016 14:33:56 -0800 +Subject: bcache: cleaned up error handling around register_cache() + +From: Eric Wheeler + +commit 9b299728ed777428b3908ac72ace5f8f84b97789 upstream. + +Fix null pointer dereference by changing register_cache() to return an int +instead of being void. This allows it to return -ENOMEM or -ENODEV and +enables upper layers to handle the OOM case without NULL pointer issues. + +See this thread: + http://thread.gmane.org/gmane.linux.kernel.bcache.devel/3521 + +Fixes this error: + gargamel:/sys/block/md5/bcache# echo /dev/sdh2 > /sys/fs/bcache/register + + bcache: register_cache() error opening sdh2: cannot allocate memory + BUG: unable to handle kernel NULL pointer dereference at 00000000000009b8 + IP: [] cache_set_flush+0x102/0x15c [bcache] + PGD 120dff067 PUD 1119a3067 PMD 0 + Oops: 0000 [#1] SMP + Modules linked in: veth ip6table_filter ip6_tables + (...) + CPU: 4 PID: 3371 Comm: kworker/4:3 Not tainted 4.4.2-amd64-i915-volpreempt-20160213bc1 #3 + Hardware name: System manufacturer System Product Name/P8H67-M PRO, BIOS 3904 04/27/2013 + Workqueue: events cache_set_flush [bcache] + task: ffff88020d5dc280 ti: ffff88020b6f8000 task.ti: ffff88020b6f8000 + RIP: 0010:[] [] cache_set_flush+0x102/0x15c [bcache] + +Signed-off-by: Eric Wheeler +Tested-by: Marc MERLIN +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/bcache/super.c | 34 ++++++++++++++++++++++------------ + 1 file changed, 22 insertions(+), 12 deletions(-) + +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -1828,11 +1828,12 @@ static int cache_alloc(struct cache_sb * + return 0; + } + +-static void register_cache(struct cache_sb *sb, struct page *sb_page, ++static int register_cache(struct cache_sb *sb, struct page *sb_page, + struct block_device *bdev, struct cache *ca) + { + char name[BDEVNAME_SIZE]; +- const char *err = "cannot allocate memory"; ++ const char *err = NULL; ++ int ret = 0; + + memcpy(&ca->sb, sb, sizeof(struct cache_sb)); + ca->bdev = bdev; +@@ -1847,27 +1848,35 @@ static void register_cache(struct cache_ + if (blk_queue_discard(bdev_get_queue(ca->bdev))) + ca->discard = CACHE_DISCARD(&ca->sb); + +- if (cache_alloc(sb, ca) != 0) ++ ret = cache_alloc(sb, ca); ++ if (ret != 0) + goto err; + +- err = "error creating kobject"; +- if (kobject_add(&ca->kobj, &part_to_dev(bdev->bd_part)->kobj, "bcache")) +- goto err; ++ if (kobject_add(&ca->kobj, &part_to_dev(bdev->bd_part)->kobj, "bcache")) { ++ err = "error calling kobject_add"; ++ ret = -ENOMEM; ++ goto out; ++ } + + mutex_lock(&bch_register_lock); + err = register_cache_set(ca); + mutex_unlock(&bch_register_lock); + +- if (err) +- goto err; ++ if (err) { ++ ret = -ENODEV; ++ goto out; ++ } + + pr_info("registered cache device %s", bdevname(bdev, name)); ++ + out: + kobject_put(&ca->kobj); +- return; ++ + err: +- pr_notice("error opening %s: %s", bdevname(bdev, name), err); +- goto out; ++ if (err) ++ pr_notice("error opening %s: %s", bdevname(bdev, name), err); ++ ++ return ret; + } + + /* Global interfaces/init */ +@@ -1965,7 +1974,8 @@ static ssize_t register_bcache(struct ko + if (!ca) + goto err_close; + +- register_cache(sb, sb_page, bdev, ca); ++ if (register_cache(sb, sb_page, bdev, ca) != 0) ++ goto err_close; + } + out: + if (sb_page) diff --git a/queue-4.5/bcache-fix-cache_set_flush-null-pointer-dereference-on-oom.patch b/queue-4.5/bcache-fix-cache_set_flush-null-pointer-dereference-on-oom.patch new file mode 100644 index 00000000000..6d99caa2333 --- /dev/null +++ b/queue-4.5/bcache-fix-cache_set_flush-null-pointer-dereference-on-oom.patch @@ -0,0 +1,34 @@ +From f8b11260a445169989d01df75d35af0f56178f95 Mon Sep 17 00:00:00 2001 +From: Eric Wheeler +Date: Mon, 7 Mar 2016 15:17:50 -0800 +Subject: bcache: fix cache_set_flush() NULL pointer dereference on OOM + +From: Eric Wheeler + +commit f8b11260a445169989d01df75d35af0f56178f95 upstream. + +When bch_cache_set_alloc() fails to kzalloc the cache_set, the +asyncronous closure handling tries to dereference a cache_set that +hadn't yet been allocated inside of cache_set_flush() which is called +by __cache_set_unregister() during cleanup. This appears to happen only +during an OOM condition on bcache_register. + +Signed-off-by: Eric Wheeler +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/bcache/super.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -1373,6 +1373,9 @@ static void cache_set_flush(struct closu + struct btree *b; + unsigned i; + ++ if (!c) ++ closure_return(cl); ++ + bch_cache_accounting_destroy(&c->accounting); + + kobject_put(&c->internal); diff --git a/queue-4.5/bcache-fix-race-of-writeback-thread-starting-before-complete-initialization.patch b/queue-4.5/bcache-fix-race-of-writeback-thread-starting-before-complete-initialization.patch new file mode 100644 index 00000000000..7c0f9d3e56a --- /dev/null +++ b/queue-4.5/bcache-fix-race-of-writeback-thread-starting-before-complete-initialization.patch @@ -0,0 +1,53 @@ +From 07cc6ef8edc47f8b4fc1e276d31127a0a5863d4d Mon Sep 17 00:00:00 2001 +From: Eric Wheeler +Date: Fri, 26 Feb 2016 14:39:06 -0800 +Subject: bcache: fix race of writeback thread starting before complete initialization + +From: Eric Wheeler + +commit 07cc6ef8edc47f8b4fc1e276d31127a0a5863d4d upstream. + +The bch_writeback_thread might BUG_ON in read_dirty() if +dc->sb==BDEV_STATE_DIRTY and bch_sectors_dirty_init has not yet completed +its related initialization. This patch downs the dc->writeback_lock until +after initialization is complete, thus preventing bch_writeback_thread +from proceeding prematurely. + +See this thread: + http://thread.gmane.org/gmane.linux.kernel.bcache.devel/3453 + +Signed-off-by: Eric Wheeler +Tested-by: Marc MERLIN +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/bcache/super.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -1015,8 +1015,12 @@ int bch_cached_dev_attach(struct cached_ + */ + atomic_set(&dc->count, 1); + +- if (bch_cached_dev_writeback_start(dc)) ++ /* Block writeback thread, but spawn it */ ++ down_write(&dc->writeback_lock); ++ if (bch_cached_dev_writeback_start(dc)) { ++ up_write(&dc->writeback_lock); + return -ENOMEM; ++ } + + if (BDEV_STATE(&dc->sb) == BDEV_STATE_DIRTY) { + bch_sectors_dirty_init(dc); +@@ -1028,6 +1032,9 @@ int bch_cached_dev_attach(struct cached_ + bch_cached_dev_run(dc); + bcache_device_link(&dc->disk, c, "bdev"); + ++ /* Allow the writeback thread to proceed */ ++ up_write(&dc->writeback_lock); ++ + pr_info("Caching %s as %s on set %pU", + bdevname(dc->bdev, buf), dc->disk.disk->disk_name, + dc->disk.c->sb.set_uuid); diff --git a/queue-4.5/bluetooth-add-new-ar3012-id-0489-e095.patch b/queue-4.5/bluetooth-add-new-ar3012-id-0489-e095.patch new file mode 100644 index 00000000000..819649ba6f7 --- /dev/null +++ b/queue-4.5/bluetooth-add-new-ar3012-id-0489-e095.patch @@ -0,0 +1,59 @@ +From 28c971d82fb58ef7cba22e5308be6d2d2590473d Mon Sep 17 00:00:00 2001 +From: Dmitry Tunin +Date: Wed, 10 Feb 2016 00:49:11 +0300 +Subject: Bluetooth: Add new AR3012 ID 0489:e095 + +From: Dmitry Tunin + +commit 28c971d82fb58ef7cba22e5308be6d2d2590473d upstream. + +T: Bus=01 Lev=01 Prnt=01 Port=04 Cnt=02 Dev#= 3 Spd=12 MxCh= 0 +D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=0489 ProdID=e095 Rev=00.01 +C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb + +This device requires ar3k/AthrBT_0x31010100.dfu and +ar3k/ramps_0x31010100_40.dfu firmware files that are not in +linux-firmware yet. + +BugLink: https://bugs.launchpad.net/bugs/1542944 + +Signed-off-by: Dmitry Tunin +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/ath3k.c | 2 ++ + drivers/bluetooth/btusb.c | 1 + + 2 files changed, 3 insertions(+) + +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -82,6 +82,7 @@ static const struct usb_device_id ath3k_ + { USB_DEVICE(0x0489, 0xe05f) }, + { USB_DEVICE(0x0489, 0xe076) }, + { USB_DEVICE(0x0489, 0xe078) }, ++ { USB_DEVICE(0x0489, 0xe095) }, + { USB_DEVICE(0x04c5, 0x1330) }, + { USB_DEVICE(0x04CA, 0x3004) }, + { USB_DEVICE(0x04CA, 0x3005) }, +@@ -147,6 +148,7 @@ static const struct usb_device_id ath3k_ + { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -196,6 +196,7 @@ static const struct usb_device_id blackl + { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, diff --git a/queue-4.5/bluetooth-fix-potential-buffer-overflow-with-add-advertising.patch b/queue-4.5/bluetooth-fix-potential-buffer-overflow-with-add-advertising.patch new file mode 100644 index 00000000000..ea1ef5782b8 --- /dev/null +++ b/queue-4.5/bluetooth-fix-potential-buffer-overflow-with-add-advertising.patch @@ -0,0 +1,37 @@ +From 6a0e78072c2ae7b20b14e0249d8108441ea928d2 Mon Sep 17 00:00:00 2001 +From: Johan Hedberg +Date: Fri, 11 Mar 2016 09:56:33 +0200 +Subject: Bluetooth: Fix potential buffer overflow with Add Advertising + +From: Johan Hedberg + +commit 6a0e78072c2ae7b20b14e0249d8108441ea928d2 upstream. + +The Add Advertising command handler does the appropriate checks for +the AD and Scan Response data, however fails to take into account the +general length of the mgmt command itself, which could lead to +potential buffer overflows. This patch adds the necessary check that +the mgmt command length is consistent with the given ad and scan_rsp +lengths. + +Signed-off-by: Johan Hedberg +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/mgmt.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -5979,6 +5979,10 @@ static int add_advertising(struct sock * + return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, + MGMT_STATUS_INVALID_PARAMS); + ++ if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) ++ return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, ++ MGMT_STATUS_INVALID_PARAMS); ++ + flags = __le32_to_cpu(cp->flags); + timeout = __le16_to_cpu(cp->timeout); + duration = __le16_to_cpu(cp->duration); diff --git a/queue-4.5/brd-fix-discard-request-processing.patch b/queue-4.5/brd-fix-discard-request-processing.patch new file mode 100644 index 00000000000..70ccac30f30 --- /dev/null +++ b/queue-4.5/brd-fix-discard-request-processing.patch @@ -0,0 +1,36 @@ +From 5e4298be45e83ecdffaabb370eea9396889b07f1 Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Tue, 15 Dec 2015 16:38:22 +0100 +Subject: brd: Fix discard request processing + +From: Bart Van Assche + +commit 5e4298be45e83ecdffaabb370eea9396889b07f1 upstream. + +Avoid that discard requests with size => PAGE_SIZE fail with +-EIO. Refuse discard requests if the discard size is not a +multiple of the page size. + +Fixes: 2dbe54957636 ("brd: Refuse improperly aligned discard requests") +Signed-off-by: Bart Van Assche +Reviewed-by: Jan Kara +Cc: Christoph Hellwig +Cc: Robert Elliot +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/brd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/block/brd.c ++++ b/drivers/block/brd.c +@@ -341,7 +341,7 @@ static blk_qc_t brd_make_request(struct + + if (unlikely(bio->bi_rw & REQ_DISCARD)) { + if (sector & ((PAGE_SIZE >> SECTOR_SHIFT) - 1) || +- bio->bi_iter.bi_size & PAGE_MASK) ++ bio->bi_iter.bi_size & ~PAGE_MASK) + goto io_error; + discard_from_brd(brd, sector, bio->bi_iter.bi_size); + goto out; diff --git a/queue-4.5/cgroup-ignore-css_sets-associated-with-dead-cgroups-during-migration.patch b/queue-4.5/cgroup-ignore-css_sets-associated-with-dead-cgroups-during-migration.patch new file mode 100644 index 00000000000..c6d0a57bd74 --- /dev/null +++ b/queue-4.5/cgroup-ignore-css_sets-associated-with-dead-cgroups-during-migration.patch @@ -0,0 +1,120 @@ +From 2b021cbf3cb6208f0d40fd2f1869f237934340ed Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Tue, 15 Mar 2016 20:43:04 -0400 +Subject: cgroup: ignore css_sets associated with dead cgroups during migration + +From: Tejun Heo + +commit 2b021cbf3cb6208f0d40fd2f1869f237934340ed upstream. + +Before 2e91fa7f6d45 ("cgroup: keep zombies associated with their +original cgroups"), all dead tasks were associated with init_css_set. +If a zombie task is requested for migration, while migration prep +operations would still be performed on init_css_set, the actual +migration would ignore zombie tasks. As init_css_set is always valid, +this worked fine. + +However, after 2e91fa7f6d45, zombie tasks stay with the css_set it was +associated with at the time of death. Let's say a task T associated +with cgroup A on hierarchy H-1 and cgroup B on hiearchy H-2. After T +becomes a zombie, it would still remain associated with A and B. If A +only contains zombie tasks, it can be removed. On removal, A gets +marked offline but stays pinned until all zombies are drained. At +this point, if migration is initiated on T to a cgroup C on hierarchy +H-2, migration path would try to prepare T's css_set for migration and +trigger the following. + + WARNING: CPU: 0 PID: 1576 at kernel/cgroup.c:474 cgroup_get+0x121/0x160() + CPU: 0 PID: 1576 Comm: bash Not tainted 4.4.0-work+ #289 + ... + Call Trace: + [] dump_stack+0x4e/0x82 + [] warn_slowpath_common+0x78/0xb0 + [] warn_slowpath_null+0x15/0x20 + [] cgroup_get+0x121/0x160 + [] link_css_set+0x7b/0x90 + [] find_css_set+0x3bc/0x5e0 + [] cgroup_migrate_prepare_dst+0x89/0x1f0 + [] cgroup_attach_task+0x157/0x230 + [] __cgroup_procs_write+0x2b7/0x470 + [] cgroup_tasks_write+0xc/0x10 + [] cgroup_file_write+0x30/0x1b0 + [] kernfs_fop_write+0x13c/0x180 + [] __vfs_write+0x23/0xe0 + [] vfs_write+0xa4/0x1a0 + [] SyS_write+0x44/0xa0 + [] entry_SYSCALL_64_fastpath+0x12/0x6f + +It doesn't make sense to prepare migration for css_sets pointing to +dead cgroups as they are guaranteed to contain only zombies which are +ignored later during migration. This patch makes cgroup destruction +path mark all affected css_sets as dead and updates the migration path +to ignore them during preparation. + +Signed-off-by: Tejun Heo +Fixes: 2e91fa7f6d45 ("cgroup: keep zombies associated with their original cgroups") +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/cgroup-defs.h | 3 +++ + kernel/cgroup.c | 20 ++++++++++++++++++-- + 2 files changed, 21 insertions(+), 2 deletions(-) + +--- a/include/linux/cgroup-defs.h ++++ b/include/linux/cgroup-defs.h +@@ -210,6 +210,9 @@ struct css_set { + /* all css_task_iters currently walking this cset */ + struct list_head task_iters; + ++ /* dead and being drained, ignore for migration */ ++ bool dead; ++ + /* For RCU-protected deletion */ + struct rcu_head rcu_head; + }; +--- a/kernel/cgroup.c ++++ b/kernel/cgroup.c +@@ -2474,6 +2474,14 @@ static void cgroup_migrate_add_src(struc + lockdep_assert_held(&cgroup_mutex); + lockdep_assert_held(&css_set_lock); + ++ /* ++ * If ->dead, @src_set is associated with one or more dead cgroups ++ * and doesn't contain any migratable tasks. Ignore it early so ++ * that the rest of migration path doesn't get confused by it. ++ */ ++ if (src_cset->dead) ++ return; ++ + src_cgrp = cset_cgroup_from_root(src_cset, dst_cgrp->root); + + if (!list_empty(&src_cset->mg_preload_node)) +@@ -5114,6 +5122,7 @@ static int cgroup_destroy_locked(struct + __releases(&cgroup_mutex) __acquires(&cgroup_mutex) + { + struct cgroup_subsys_state *css; ++ struct cgrp_cset_link *link; + int ssid; + + lockdep_assert_held(&cgroup_mutex); +@@ -5134,11 +5143,18 @@ static int cgroup_destroy_locked(struct + return -EBUSY; + + /* +- * Mark @cgrp dead. This prevents further task migration and child +- * creation by disabling cgroup_lock_live_group(). ++ * Mark @cgrp and the associated csets dead. The former prevents ++ * further task migration and child creation by disabling ++ * cgroup_lock_live_group(). The latter makes the csets ignored by ++ * the migration path. + */ + cgrp->self.flags &= ~CSS_ONLINE; + ++ spin_lock_bh(&css_set_lock); ++ list_for_each_entry(link, &cgrp->cset_links, cset_link) ++ link->cset->dead = true; ++ spin_unlock_bh(&css_set_lock); ++ + /* initiate massacre of all css's */ + for_each_css(css, ssid, cgrp) + kill_css(css); diff --git a/queue-4.5/drivers-firmware-broadcom-bcm47xx_nvram.c-fix-incorrect-__ioread32_copy.patch b/queue-4.5/drivers-firmware-broadcom-bcm47xx_nvram.c-fix-incorrect-__ioread32_copy.patch new file mode 100644 index 00000000000..ef5425c0c33 --- /dev/null +++ b/queue-4.5/drivers-firmware-broadcom-bcm47xx_nvram.c-fix-incorrect-__ioread32_copy.patch @@ -0,0 +1,51 @@ +From 4c11e554fb894b381a3dc47069259d87a2e6ffc9 Mon Sep 17 00:00:00 2001 +From: Aaro Koskinen +Date: Thu, 17 Mar 2016 14:17:20 -0700 +Subject: drivers/firmware/broadcom/bcm47xx_nvram.c: fix incorrect __ioread32_copy + +From: Aaro Koskinen + +commit 4c11e554fb894b381a3dc47069259d87a2e6ffc9 upstream. + +Commit 1f330c327900 ("drivers/firmware/broadcom/bcm47xx_nvram.c: use +__ioread32_copy() instead of open-coding") switched to use a generic +copy function, but failed to notice that the header pointer is updated +between the two copies, resulting in bogus data being copied in the +latter one. Fix by keeping the old header pointer. + +The patch fixes totally broken networking on WRT54GL router (both LAN and +WLAN interfaces fail to probe). + +Fixes: 1f330c327900 ("drivers/firmware/broadcom/bcm47xx_nvram.c: use __ioread32_copy() instead of open-coding") +Signed-off-by: Aaro Koskinen +Reviewed-by: Stephen Boyd +Cc: Rafal Milecki +Cc: Hauke Mehrtens +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firmware/broadcom/bcm47xx_nvram.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/firmware/broadcom/bcm47xx_nvram.c ++++ b/drivers/firmware/broadcom/bcm47xx_nvram.c +@@ -94,15 +94,14 @@ static int nvram_find_and_copy(void __io + + found: + __ioread32_copy(nvram_buf, header, sizeof(*header) / 4); +- header = (struct nvram_header *)nvram_buf; +- nvram_len = header->len; ++ nvram_len = ((struct nvram_header *)(nvram_buf))->len; + if (nvram_len > size) { + pr_err("The nvram size according to the header seems to be bigger than the partition on flash\n"); + nvram_len = size; + } + if (nvram_len >= NVRAM_SPACE) { + pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n", +- header->len, NVRAM_SPACE - 1); ++ nvram_len, NVRAM_SPACE - 1); + nvram_len = NVRAM_SPACE - 1; + } + /* proceed reading data after header */ diff --git a/queue-4.5/gpio-pca953x-fix-pca953x_gpio_set_multiple-on-64-bit.patch b/queue-4.5/gpio-pca953x-fix-pca953x_gpio_set_multiple-on-64-bit.patch new file mode 100644 index 00000000000..9f966a2bf20 --- /dev/null +++ b/queue-4.5/gpio-pca953x-fix-pca953x_gpio_set_multiple-on-64-bit.patch @@ -0,0 +1,39 @@ +From e0a8604f1300cefab4aeafe214fc57954a7b4487 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Fri, 11 Mar 2016 17:31:27 +0100 +Subject: gpio: pca953x: Fix pca953x_gpio_set_multiple() on 64-bit + +From: Geert Uytterhoeven + +commit e0a8604f1300cefab4aeafe214fc57954a7b4487 upstream. + +pca953x_gpio_set_multiple() divides by 4 to convert from longs to bytes, +which assumes a 32-bit platform, and is not correct on 64-bit platforms. +Use "sizeof(...)" instead to fix this. + +Fixes: b4818afeacbd8182 ("gpio: pca953x: Add set_multiple to allow multiple bits to be set in one write.") +Signed-off-by: Geert Uytterhoeven +Acked-by: Phil Reid +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpio/gpio-pca953x.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/gpio/gpio-pca953x.c ++++ b/drivers/gpio/gpio-pca953x.c +@@ -367,9 +367,11 @@ static void pca953x_gpio_set_multiple(st + memcpy(reg_val, chip->reg_output, NBANK(chip)); + mutex_lock(&chip->i2c_lock); + for(bank=0; bank> ((bank % 4) * 8); ++ unsigned bankmask = mask[bank / sizeof(*mask)] >> ++ ((bank % sizeof(*mask)) * 8); + if(bankmask) { +- unsigned bankval = bits[bank/4] >> ((bank % 4) * 8); ++ unsigned bankval = bits[bank / sizeof(*bits)] >> ++ ((bank % sizeof(*bits)) * 8); + reg_val[bank] = (reg_val[bank] & ~bankmask) | bankval; + } + } diff --git a/queue-4.5/ia64-define-ioremap_uc.patch b/queue-4.5/ia64-define-ioremap_uc.patch new file mode 100644 index 00000000000..d050a0d2b4c --- /dev/null +++ b/queue-4.5/ia64-define-ioremap_uc.patch @@ -0,0 +1,37 @@ +From b0f84ac352762ed02d7ea9f284942a8cab7f9077 Mon Sep 17 00:00:00 2001 +From: "Luis R. Rodriguez" +Date: Thu, 17 Mar 2016 14:17:16 -0700 +Subject: ia64: define ioremap_uc() + +From: Luis R. Rodriguez + +commit b0f84ac352762ed02d7ea9f284942a8cab7f9077 upstream. + +All architectures now need ioremap_uc(), ia64 seems defines this already +through its ioremap_nocache() and it already ensures it *only* uses UC. + +This is needed since v4.3 to complete an allyesconfig compile on ia64, +there were others archs that needed this, and this one seems to have +fallen through the cracks. + +Signed-off-by: Luis R. Rodriguez +Reported-by: kbuild test robot +Acked-by: Tony Luck +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/ia64/include/asm/io.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/ia64/include/asm/io.h ++++ b/arch/ia64/include/asm/io.h +@@ -433,6 +433,7 @@ static inline void __iomem * ioremap_cac + return ioremap(phys_addr, size); + } + #define ioremap_cache ioremap_cache ++#define ioremap_uc ioremap_nocache + + + /* diff --git a/queue-4.5/ib-srpt-simplify-srpt_handle_tsk_mgmt.patch b/queue-4.5/ib-srpt-simplify-srpt_handle_tsk_mgmt.patch new file mode 100644 index 00000000000..284be3bcb53 --- /dev/null +++ b/queue-4.5/ib-srpt-simplify-srpt_handle_tsk_mgmt.patch @@ -0,0 +1,122 @@ +From 51093254bf879bc9ce96590400a87897c7498463 Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Thu, 11 Feb 2016 11:03:09 -0800 +Subject: IB/srpt: Simplify srpt_handle_tsk_mgmt() + +From: Bart Van Assche + +commit 51093254bf879bc9ce96590400a87897c7498463 upstream. + +Let the target core check task existence instead of the SRP target +driver. Additionally, let the target core check the validity of the +task management request instead of the ib_srpt driver. + +This patch fixes the following kernel crash: + +BUG: unable to handle kernel NULL pointer dereference at 0000000000000001 +IP: [] srpt_handle_new_iu+0x6d7/0x790 [ib_srpt] +Oops: 0002 [#1] SMP +Call Trace: + [] srpt_process_completion+0xde/0x570 [ib_srpt] + [] srpt_compl_thread+0x13f/0x160 [ib_srpt] + [] kthread+0xcf/0xe0 + [] ret_from_fork+0x7c/0xb0 + +Signed-off-by: Bart Van Assche +Fixes: 3e4f574857ee ("ib_srpt: Convert TMR path to target_submit_tmr") +Tested-by: Alex Estrin +Reviewed-by: Christoph Hellwig +Cc: Nicholas Bellinger +Cc: Sagi Grimberg +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/ulp/srpt/ib_srpt.c | 59 ---------------------------------- + 1 file changed, 1 insertion(+), 58 deletions(-) + +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -1670,47 +1670,6 @@ send_sense: + return -1; + } + +-/** +- * srpt_rx_mgmt_fn_tag() - Process a task management function by tag. +- * @ch: RDMA channel of the task management request. +- * @fn: Task management function to perform. +- * @req_tag: Tag of the SRP task management request. +- * @mgmt_ioctx: I/O context of the task management request. +- * +- * Returns zero if the target core will process the task management +- * request asynchronously. +- * +- * Note: It is assumed that the initiator serializes tag-based task management +- * requests. +- */ +-static int srpt_rx_mgmt_fn_tag(struct srpt_send_ioctx *ioctx, u64 tag) +-{ +- struct srpt_device *sdev; +- struct srpt_rdma_ch *ch; +- struct srpt_send_ioctx *target; +- int ret, i; +- +- ret = -EINVAL; +- ch = ioctx->ch; +- BUG_ON(!ch); +- BUG_ON(!ch->sport); +- sdev = ch->sport->sdev; +- BUG_ON(!sdev); +- spin_lock_irq(&sdev->spinlock); +- for (i = 0; i < ch->rq_size; ++i) { +- target = ch->ioctx_ring[i]; +- if (target->cmd.se_lun == ioctx->cmd.se_lun && +- target->cmd.tag == tag && +- srpt_get_cmd_state(target) != SRPT_STATE_DONE) { +- ret = 0; +- /* now let the target core abort &target->cmd; */ +- break; +- } +- } +- spin_unlock_irq(&sdev->spinlock); +- return ret; +-} +- + static int srp_tmr_to_tcm(int fn) + { + switch (fn) { +@@ -1745,7 +1704,6 @@ static void srpt_handle_tsk_mgmt(struct + struct se_cmd *cmd; + struct se_session *sess = ch->sess; + uint64_t unpacked_lun; +- uint32_t tag = 0; + int tcm_tmr; + int rc; + +@@ -1761,25 +1719,10 @@ static void srpt_handle_tsk_mgmt(struct + srpt_set_cmd_state(send_ioctx, SRPT_STATE_MGMT); + send_ioctx->cmd.tag = srp_tsk->tag; + tcm_tmr = srp_tmr_to_tcm(srp_tsk->tsk_mgmt_func); +- if (tcm_tmr < 0) { +- send_ioctx->cmd.se_tmr_req->response = +- TMR_TASK_MGMT_FUNCTION_NOT_SUPPORTED; +- goto fail; +- } + unpacked_lun = srpt_unpack_lun((uint8_t *)&srp_tsk->lun, + sizeof(srp_tsk->lun)); +- +- if (srp_tsk->tsk_mgmt_func == SRP_TSK_ABORT_TASK) { +- rc = srpt_rx_mgmt_fn_tag(send_ioctx, srp_tsk->task_tag); +- if (rc < 0) { +- send_ioctx->cmd.se_tmr_req->response = +- TMR_TASK_DOES_NOT_EXIST; +- goto fail; +- } +- tag = srp_tsk->task_tag; +- } + rc = target_submit_tmr(&send_ioctx->cmd, sess, NULL, unpacked_lun, +- srp_tsk, tcm_tmr, GFP_KERNEL, tag, ++ srp_tsk, tcm_tmr, GFP_KERNEL, srp_tsk->task_tag, + TARGET_SCF_ACK_KREF); + if (rc != 0) { + send_ioctx->cmd.se_tmr_req->response = TMR_FUNCTION_REJECTED; diff --git a/queue-4.5/jbd2-fix-fs-corruption-possibility-in-jbd2_journal_destroy-on-umount-path.patch b/queue-4.5/jbd2-fix-fs-corruption-possibility-in-jbd2_journal_destroy-on-umount-path.patch new file mode 100644 index 00000000000..eb63c6a127d --- /dev/null +++ b/queue-4.5/jbd2-fix-fs-corruption-possibility-in-jbd2_journal_destroy-on-umount-path.patch @@ -0,0 +1,124 @@ +From c0a2ad9b50dd80eeccd73d9ff962234590d5ec93 Mon Sep 17 00:00:00 2001 +From: OGAWA Hirofumi +Date: Wed, 9 Mar 2016 23:47:25 -0500 +Subject: jbd2: fix FS corruption possibility in jbd2_journal_destroy() on umount path + +From: OGAWA Hirofumi + +commit c0a2ad9b50dd80eeccd73d9ff962234590d5ec93 upstream. + +On umount path, jbd2_journal_destroy() writes latest transaction ID +(->j_tail_sequence) to be used at next mount. + +The bug is that ->j_tail_sequence is not holding latest transaction ID +in some cases. So, at next mount, there is chance to conflict with +remaining (not overwritten yet) transactions. + + mount (id=10) + write transaction (id=11) + write transaction (id=12) + umount (id=10) <= the bug doesn't write latest ID + + mount (id=10) + write transaction (id=11) + crash + + mount + [recovery process] + transaction (id=11) + transaction (id=12) <= valid transaction ID, but old commit + must not replay + +Like above, this bug become the cause of recovery failure, or FS +corruption. + +So why ->j_tail_sequence doesn't point latest ID? + +Because if checkpoint transactions was reclaimed by memory pressure +(i.e. bdev_try_to_free_page()), then ->j_tail_sequence is not updated. +(And another case is, __jbd2_journal_clean_checkpoint_list() is called +with empty transaction.) + +So in above cases, ->j_tail_sequence is not pointing latest +transaction ID at umount path. Plus, REQ_FLUSH for checkpoint is not +done too. + +So, to fix this problem with minimum changes, this patch updates +->j_tail_sequence, and issue REQ_FLUSH. (With more complex changes, +some optimizations would be possible to avoid unnecessary REQ_FLUSH +for example though.) + +BTW, + + journal->j_tail_sequence = + ++journal->j_transaction_sequence; + +Increment of ->j_transaction_sequence seems to be unnecessary, but +ext3 does this. + +Signed-off-by: OGAWA Hirofumi +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jbd2/journal.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -1408,11 +1408,12 @@ out: + /** + * jbd2_mark_journal_empty() - Mark on disk journal as empty. + * @journal: The journal to update. ++ * @write_op: With which operation should we write the journal sb + * + * Update a journal's dynamic superblock fields to show that journal is empty. + * Write updated superblock to disk waiting for IO to complete. + */ +-static void jbd2_mark_journal_empty(journal_t *journal) ++static void jbd2_mark_journal_empty(journal_t *journal, int write_op) + { + journal_superblock_t *sb = journal->j_superblock; + +@@ -1430,7 +1431,7 @@ static void jbd2_mark_journal_empty(jour + sb->s_start = cpu_to_be32(0); + read_unlock(&journal->j_state_lock); + +- jbd2_write_superblock(journal, WRITE_FUA); ++ jbd2_write_superblock(journal, write_op); + + /* Log is no longer empty */ + write_lock(&journal->j_state_lock); +@@ -1716,7 +1717,13 @@ int jbd2_journal_destroy(journal_t *jour + if (journal->j_sb_buffer) { + if (!is_journal_aborted(journal)) { + mutex_lock(&journal->j_checkpoint_mutex); +- jbd2_mark_journal_empty(journal); ++ ++ write_lock(&journal->j_state_lock); ++ journal->j_tail_sequence = ++ ++journal->j_transaction_sequence; ++ write_unlock(&journal->j_state_lock); ++ ++ jbd2_mark_journal_empty(journal, WRITE_FLUSH_FUA); + mutex_unlock(&journal->j_checkpoint_mutex); + } else + err = -EIO; +@@ -1975,7 +1982,7 @@ int jbd2_journal_flush(journal_t *journa + * the magic code for a fully-recovered superblock. Any future + * commits of data to the journal will restore the current + * s_start value. */ +- jbd2_mark_journal_empty(journal); ++ jbd2_mark_journal_empty(journal, WRITE_FUA); + mutex_unlock(&journal->j_checkpoint_mutex); + write_lock(&journal->j_state_lock); + J_ASSERT(!journal->j_running_transaction); +@@ -2021,7 +2028,7 @@ int jbd2_journal_wipe(journal_t *journal + if (write) { + /* Lock to make assertions happy... */ + mutex_lock(&journal->j_checkpoint_mutex); +- jbd2_mark_journal_empty(journal); ++ jbd2_mark_journal_empty(journal, WRITE_FUA); + mutex_unlock(&journal->j_checkpoint_mutex); + } + diff --git a/queue-4.5/mm-memcontrol-reclaim-and-oom-kill-when-shrinking-memory.max-below-usage.patch b/queue-4.5/mm-memcontrol-reclaim-and-oom-kill-when-shrinking-memory.max-below-usage.patch new file mode 100644 index 00000000000..7318be1a6e2 --- /dev/null +++ b/queue-4.5/mm-memcontrol-reclaim-and-oom-kill-when-shrinking-memory.max-below-usage.patch @@ -0,0 +1,120 @@ +From b6e6edcfa40561e9c8abe5eecf1c96f8e5fd9c6f Mon Sep 17 00:00:00 2001 +From: Johannes Weiner +Date: Thu, 17 Mar 2016 14:20:28 -0700 +Subject: mm: memcontrol: reclaim and OOM kill when shrinking memory.max below usage + +From: Johannes Weiner + +commit b6e6edcfa40561e9c8abe5eecf1c96f8e5fd9c6f upstream. + +Setting the original memory.limit_in_bytes hardlimit is subject to a +race condition when the desired value is below the current usage. The +code tries a few times to first reclaim and then see if the usage has +dropped to where we would like it to be, but there is no locking, and +the workload is free to continue making new charges up to the old limit. +Thus, attempting to shrink a workload relies on pure luck and hope that +the workload happens to cooperate. + +To fix this in the cgroup2 memory.max knob, do it the other way round: +set the limit first, then try enforcement. And if reclaim is not able +to succeed, trigger OOM kills in the group. Keep going until the new +limit is met, we run out of OOM victims and there's only unreclaimable +memory left, or the task writing to memory.max is killed. This allows +users to shrink groups reliably, and the behavior is consistent with +what happens when new charges are attempted in excess of memory.max. + +Signed-off-by: Johannes Weiner +Acked-by: Michal Hocko +Cc: Vladimir Davydov +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/cgroup-v2.txt | 6 ++++++ + mm/memcontrol.c | 38 ++++++++++++++++++++++++++++++++++---- + 2 files changed, 40 insertions(+), 4 deletions(-) + +--- a/Documentation/cgroup-v2.txt ++++ b/Documentation/cgroup-v2.txt +@@ -1368,6 +1368,12 @@ system than killing the group. Otherwis + limit this type of spillover and ultimately contain buggy or even + malicious applications. + ++Setting the original memory.limit_in_bytes below the current usage was ++subject to a race condition, where concurrent charges could cause the ++limit setting to fail. memory.max on the other hand will first set the ++limit to prevent new charges, and then reclaim and OOM kill until the ++new limit is met - or the task writing to memory.max is killed. ++ + The combined memory+swap accounting and limiting is replaced by real + control over swap space. + +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -1262,7 +1262,7 @@ static unsigned long mem_cgroup_get_limi + return limit; + } + +-static void mem_cgroup_out_of_memory(struct mem_cgroup *memcg, gfp_t gfp_mask, ++static bool mem_cgroup_out_of_memory(struct mem_cgroup *memcg, gfp_t gfp_mask, + int order) + { + struct oom_control oc = { +@@ -1340,6 +1340,7 @@ static void mem_cgroup_out_of_memory(str + } + unlock: + mutex_unlock(&oom_lock); ++ return chosen; + } + + #if MAX_NUMNODES > 1 +@@ -5088,6 +5089,8 @@ static ssize_t memory_max_write(struct k + char *buf, size_t nbytes, loff_t off) + { + struct mem_cgroup *memcg = mem_cgroup_from_css(of_css(of)); ++ unsigned int nr_reclaims = MEM_CGROUP_RECLAIM_RETRIES; ++ bool drained = false; + unsigned long max; + int err; + +@@ -5096,9 +5099,36 @@ static ssize_t memory_max_write(struct k + if (err) + return err; + +- err = mem_cgroup_resize_limit(memcg, max); +- if (err) +- return err; ++ xchg(&memcg->memory.limit, max); ++ ++ for (;;) { ++ unsigned long nr_pages = page_counter_read(&memcg->memory); ++ ++ if (nr_pages <= max) ++ break; ++ ++ if (signal_pending(current)) { ++ err = -EINTR; ++ break; ++ } ++ ++ if (!drained) { ++ drain_all_stock(memcg); ++ drained = true; ++ continue; ++ } ++ ++ if (nr_reclaims) { ++ if (!try_to_free_mem_cgroup_pages(memcg, nr_pages - max, ++ GFP_KERNEL, true)) ++ nr_reclaims--; ++ continue; ++ } ++ ++ mem_cgroup_events(memcg, MEMCG_OOM, 1); ++ if (!mem_cgroup_out_of_memory(memcg, GFP_KERNEL, 0)) ++ break; ++ } + + memcg_wb_domain_size_changed(memcg); + return nbytes; diff --git a/queue-4.5/mm-memcontrol-reclaim-when-shrinking-memory.high-below-usage.patch b/queue-4.5/mm-memcontrol-reclaim-when-shrinking-memory.high-below-usage.patch new file mode 100644 index 00000000000..463612cd790 --- /dev/null +++ b/queue-4.5/mm-memcontrol-reclaim-when-shrinking-memory.high-below-usage.patch @@ -0,0 +1,50 @@ +From 588083bb37a3cea8533c392370a554417c8f29cb Mon Sep 17 00:00:00 2001 +From: Johannes Weiner +Date: Thu, 17 Mar 2016 14:20:25 -0700 +Subject: mm: memcontrol: reclaim when shrinking memory.high below usage + +From: Johannes Weiner + +commit 588083bb37a3cea8533c392370a554417c8f29cb upstream. + +When setting memory.high below usage, nothing happens until the next +charge comes along, and then it will only reclaim its own charge and not +the now potentially huge excess of the new memory.high. This can cause +groups to stay in excess of their memory.high indefinitely. + +To fix that, when shrinking memory.high, kick off a reclaim cycle that +goes after the delta. + +Signed-off-by: Johannes Weiner +Acked-by: Michal Hocko +Cc: Vladimir Davydov +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/memcontrol.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -5051,6 +5051,7 @@ static ssize_t memory_high_write(struct + char *buf, size_t nbytes, loff_t off) + { + struct mem_cgroup *memcg = mem_cgroup_from_css(of_css(of)); ++ unsigned long nr_pages; + unsigned long high; + int err; + +@@ -5061,6 +5062,11 @@ static ssize_t memory_high_write(struct + + memcg->high = high; + ++ nr_pages = page_counter_read(&memcg->memory); ++ if (nr_pages > high) ++ try_to_free_mem_cgroup_pages(memcg, nr_pages - high, ++ GFP_KERNEL, true); ++ + memcg_wb_domain_size_changed(memcg); + return nbytes; + } diff --git a/queue-4.5/series b/queue-4.5/series index ed07f4efd7a..a394c052361 100644 --- a/queue-4.5/series +++ b/queue-4.5/series @@ -112,3 +112,35 @@ mtip32xx-handle-safe-removal-during-io.patch mtip32xx-handle-ftl-rebuild-failure-state-during-device-initialization.patch mtip32xx-implement-timeout-handler.patch mtip32xx-cleanup-queued-requests-after-surprise-removal.patch +alsa-hda-fix-unexpected-resume-through-regmap-code-path.patch +alsa-hda-apply-reboot-d3-fix-for-cx20724-codec-too.patch +alsa-pcm-avoid-bug-string-for-warnings-again.patch +alsa-intel8x0-add-clock-quirk-entry-for-ad1981b-on-ibm-thinkpad-x41.patch +alsa-hda-don-t-handle-eld-notify-from-invalid-port.patch +alsa-hda-fix-the-mic-mute-button-and-led-problem-for-a-lenovo-aio.patch +alsa-hda-add-new-gpu-codec-id-0x10de0082-to-snd-hda.patch +alsa-hda-fix-unconditional-gpio-toggle-via-automute.patch +alsa-hda-limit-i915-hdmi-binding-only-for-hsw-and-later.patch +alsa-hda-fix-spurious-kernel-warning-on-baytrail-hdmi.patch +alsa-hda-really-restrict-i915-notifier-to-hsw.patch +alsa-hda-fix-forgotten-hdmi-monitor_present-update.patch +alsa-hda-workaround-for-unbalanced-i915-power-refcount-by-concurrent-probe.patch +alsa-hda-fix-missing-eld-update-at-unplugging.patch +tools-hv-use-include-uapi-with-__exported_headers__.patch +jbd2-fix-fs-corruption-possibility-in-jbd2_journal_destroy-on-umount-path.patch +gpio-pca953x-fix-pca953x_gpio_set_multiple-on-64-bit.patch +arm64-update-pte_rdonly-in-set_pte_at-for-prot_none-permission.patch +brd-fix-discard-request-processing.patch +ib-srpt-simplify-srpt_handle_tsk_mgmt.patch +bcache-cleaned-up-error-handling-around-register_cache.patch +bcache-fix-race-of-writeback-thread-starting-before-complete-initialization.patch +bcache-fix-cache_set_flush-null-pointer-dereference-on-oom.patch +mm-memcontrol-reclaim-when-shrinking-memory.high-below-usage.patch +mm-memcontrol-reclaim-and-oom-kill-when-shrinking-memory.max-below-usage.patch +ia64-define-ioremap_uc.patch +drivers-firmware-broadcom-bcm47xx_nvram.c-fix-incorrect-__ioread32_copy.patch +watchdog-don-t-run-proc_watchdog_update-if-new-value-is-same-as-old.patch +watchdog-rc32434_wdt-fix-ioctl-error-handling.patch +bluetooth-add-new-ar3012-id-0489-e095.patch +bluetooth-fix-potential-buffer-overflow-with-add-advertising.patch +cgroup-ignore-css_sets-associated-with-dead-cgroups-during-migration.patch diff --git a/queue-4.5/tools-hv-use-include-uapi-with-__exported_headers__.patch b/queue-4.5/tools-hv-use-include-uapi-with-__exported_headers__.patch new file mode 100644 index 00000000000..37887ef8bb8 --- /dev/null +++ b/queue-4.5/tools-hv-use-include-uapi-with-__exported_headers__.patch @@ -0,0 +1,32 @@ +From 50fe6dd10069e7c062e27f29606f6e91ea979399 Mon Sep 17 00:00:00 2001 +From: Kamal Mostafa +Date: Wed, 27 Jan 2016 22:29:33 -0800 +Subject: tools/hv: Use include/uapi with __EXPORTED_HEADERS__ + +From: Kamal Mostafa + +commit 50fe6dd10069e7c062e27f29606f6e91ea979399 upstream. + +Use the local uapi headers to keep in sync with "recently" added #define's +(e.g. VSS_OP_REGISTER1). + +Fixes: 3eb2094c59e8 ("Adding makefile for tools/hv") +Signed-off-by: Kamal Mostafa +Signed-off-by: K. Y. Srinivasan +Signed-off-by: Greg Kroah-Hartman + +--- + tools/hv/Makefile | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/tools/hv/Makefile ++++ b/tools/hv/Makefile +@@ -5,6 +5,8 @@ PTHREAD_LIBS = -lpthread + WARNINGS = -Wall -Wextra + CFLAGS = $(WARNINGS) -g $(PTHREAD_LIBS) $(shell getconf LFS_CFLAGS) + ++CFLAGS += -D__EXPORTED_HEADERS__ -I../../include/uapi -I../../include ++ + all: hv_kvp_daemon hv_vss_daemon hv_fcopy_daemon + %: %.c + $(CC) $(CFLAGS) -o $@ $^ diff --git a/queue-4.5/watchdog-don-t-run-proc_watchdog_update-if-new-value-is-same-as-old.patch b/queue-4.5/watchdog-don-t-run-proc_watchdog_update-if-new-value-is-same-as-old.patch new file mode 100644 index 00000000000..930f5b93065 --- /dev/null +++ b/queue-4.5/watchdog-don-t-run-proc_watchdog_update-if-new-value-is-same-as-old.patch @@ -0,0 +1,66 @@ +From a1ee1932aa6bea0bb074f5e3ced112664e4637ed Mon Sep 17 00:00:00 2001 +From: Joshua Hunt +Date: Thu, 17 Mar 2016 14:17:23 -0700 +Subject: watchdog: don't run proc_watchdog_update if new value is same as old + +From: Joshua Hunt + +commit a1ee1932aa6bea0bb074f5e3ced112664e4637ed upstream. + +While working on a script to restore all sysctl params before a series of +tests I found that writing any value into the +/proc/sys/kernel/{nmi_watchdog,soft_watchdog,watchdog,watchdog_thresh} +causes them to call proc_watchdog_update(). + + NMI watchdog: enabled on all CPUs, permanently consumes one hw-PMU counter. + NMI watchdog: enabled on all CPUs, permanently consumes one hw-PMU counter. + NMI watchdog: enabled on all CPUs, permanently consumes one hw-PMU counter. + NMI watchdog: enabled on all CPUs, permanently consumes one hw-PMU counter. + +There doesn't appear to be a reason for doing this work every time a write +occurs, so only do it when the values change. + +Signed-off-by: Josh Hunt +Acked-by: Don Zickus +Reviewed-by: Aaron Tomlin +Cc: Ulrich Obergfell +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/watchdog.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/kernel/watchdog.c ++++ b/kernel/watchdog.c +@@ -923,6 +923,9 @@ static int proc_watchdog_common(int whic + * both lockup detectors are disabled if proc_watchdog_update() + * returns an error. + */ ++ if (old == new) ++ goto out; ++ + err = proc_watchdog_update(); + } + out: +@@ -967,7 +970,7 @@ int proc_soft_watchdog(struct ctl_table + int proc_watchdog_thresh(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos) + { +- int err, old; ++ int err, old, new; + + get_online_cpus(); + mutex_lock(&watchdog_proc_mutex); +@@ -987,6 +990,10 @@ int proc_watchdog_thresh(struct ctl_tabl + /* + * Update the sample period. Restore on failure. + */ ++ new = ACCESS_ONCE(watchdog_thresh); ++ if (old == new) ++ goto out; ++ + set_sample_period(); + err = proc_watchdog_update(); + if (err) { diff --git a/queue-4.5/watchdog-rc32434_wdt-fix-ioctl-error-handling.patch b/queue-4.5/watchdog-rc32434_wdt-fix-ioctl-error-handling.patch new file mode 100644 index 00000000000..c171b8f1f88 --- /dev/null +++ b/queue-4.5/watchdog-rc32434_wdt-fix-ioctl-error-handling.patch @@ -0,0 +1,38 @@ +From 10e7ac22cdd4d211cef99afcb9371b70cb175be6 Mon Sep 17 00:00:00 2001 +From: "Michael S. Tsirkin" +Date: Sun, 28 Feb 2016 17:44:09 +0200 +Subject: watchdog: rc32434_wdt: fix ioctl error handling + +From: Michael S. Tsirkin + +commit 10e7ac22cdd4d211cef99afcb9371b70cb175be6 upstream. + +Calling return copy_to_user(...) in an ioctl will not do the right thing +if there's a pagefault: copy_to_user returns the number of bytes not +copied in this case. + +Fix up watchdog/rc32434_wdt to do + return copy_to_user(...)) ? -EFAULT : 0; + +instead. + +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/watchdog/rc32434_wdt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/watchdog/rc32434_wdt.c ++++ b/drivers/watchdog/rc32434_wdt.c +@@ -237,7 +237,7 @@ static long rc32434_wdt_ioctl(struct fil + return -EINVAL; + /* Fall through */ + case WDIOC_GETTIMEOUT: +- return copy_to_user(argp, &timeout, sizeof(int)); ++ return copy_to_user(argp, &timeout, sizeof(int)) ? -EFAULT : 0; + default: + return -ENOTTY; + }