--- /dev/null
+From 860f01e96981a68553f3ca49f574ff14fe955e72 Mon Sep 17 00:00:00 2001
+From: Valentin Vidic <Valentin.Vidic@CARNet.hr>
+Date: Fri, 5 May 2017 21:07:33 +0200
+Subject: ipmi/watchdog: fix watchdog timeout set on reboot
+
+From: Valentin Vidic <Valentin.Vidic@CARNet.hr>
+
+commit 860f01e96981a68553f3ca49f574ff14fe955e72 upstream.
+
+systemd by default starts watchdog on reboot and sets the timer to
+ShutdownWatchdogSec=10min. Reboot handler in ipmi_watchdog than reduces
+the timer to 120s which is not enough time to boot a Xen machine with
+a lot of RAM. As a result the machine is rebooted the second time
+during the long run of (XEN) Scrubbing Free RAM.....
+
+Fix this by setting the timer to 120s only if it was previously
+set to a low value.
+
+Signed-off-by: Valentin Vidic <Valentin.Vidic@CARNet.hr>
+Signed-off-by: Corey Minyard <cminyard@mvista.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/ipmi/ipmi_watchdog.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/char/ipmi/ipmi_watchdog.c
++++ b/drivers/char/ipmi/ipmi_watchdog.c
+@@ -1162,10 +1162,11 @@ static int wdog_reboot_handler(struct no
+ ipmi_watchdog_state = WDOG_TIMEOUT_NONE;
+ ipmi_set_timeout(IPMI_SET_TIMEOUT_NO_HB);
+ } else if (ipmi_watchdog_state != WDOG_TIMEOUT_NONE) {
+- /* Set a long timer to let the reboot happens, but
+- reboot if it hangs, but only if the watchdog
++ /* Set a long timer to let the reboot happen or
++ reset if it hangs, but only if the watchdog
+ timer was already running. */
+- timeout = 120;
++ if (timeout < 120)
++ timeout = 120;
+ pretimeout = 0;
+ ipmi_watchdog_state = WDOG_TIMEOUT_RESET;
+ ipmi_set_timeout(IPMI_SET_TIMEOUT_NO_HB);
--- /dev/null
+From c13c43d54f2c6a3be1c675766778ac1ad8dfbfcc Mon Sep 17 00:00:00 2001
+From: Vishal Verma <vishal.l.verma@intel.com>
+Date: Thu, 29 Jun 2017 16:59:11 -0600
+Subject: libnvdimm, btt: fix btt_rw_page not returning errors
+
+From: Vishal Verma <vishal.l.verma@intel.com>
+
+commit c13c43d54f2c6a3be1c675766778ac1ad8dfbfcc upstream.
+
+btt_rw_page was not propagating errors frm btt_do_bvec, resulting in any
+IO errors via the rw_page path going unnoticed. the pmem driver recently
+fixed this in e10624f pmem: fail io-requests to known bad blocks
+but same problem in BTT went neglected.
+
+Fixes: 5212e11fde4d ("nd_btt: atomic sector updates")
+Cc: Toshi Kani <toshi.kani@hpe.com>
+Cc: Dan Williams <dan.j.williams@intel.com>
+Cc: Jeff Moyer <jmoyer@redhat.com>
+Signed-off-by: Vishal Verma <vishal.l.verma@intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/nvdimm/btt.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/nvdimm/btt.c
++++ b/drivers/nvdimm/btt.c
+@@ -1205,10 +1205,13 @@ static int btt_rw_page(struct block_devi
+ struct page *page, int rw)
+ {
+ struct btt *btt = bdev->bd_disk->private_data;
++ int rc;
+
+- btt_do_bvec(btt, NULL, page, PAGE_CACHE_SIZE, 0, rw, sector);
+- page_endio(page, rw & WRITE, 0);
+- return 0;
++ rc = btt_do_bvec(btt, NULL, page, PAGE_CACHE_SIZE, 0, rw, sector);
++ if (rc == 0)
++ page_endio(page, rw & WRITE, 0);
++
++ return rc;
+ }
+
+
--- /dev/null
+From 975e83cfb8dc16e7a2fdc58188c77c0c605876c2 Mon Sep 17 00:00:00 2001
+From: Sudeep Holla <Sudeep.Holla@arm.com>
+Date: Fri, 14 Jul 2017 11:51:48 +0100
+Subject: PM / Domains: defer dev_pm_domain_set() until genpd->attach_dev succeeds if present
+
+From: Sudeep Holla <Sudeep.Holla@arm.com>
+
+commit 975e83cfb8dc16e7a2fdc58188c77c0c605876c2 upstream.
+
+If the genpd->attach_dev or genpd->power_on fails, genpd_dev_pm_attach
+may return -EPROBE_DEFER initially. However genpd_alloc_dev_data sets
+the PM domain for the device unconditionally.
+
+When subsequent attempts are made to call genpd_dev_pm_attach, it may
+return -EEXISTS checking dev->pm_domain without re-attempting to call
+attach_dev or power_on.
+
+platform_drv_probe then attempts to call drv->probe as the return value
+-EEXIST != -EPROBE_DEFER, which may end up in a situation where the
+device is accessed without it's power domain switched on.
+
+Fixes: f104e1e5ef57 (PM / Domains: Re-order initialization of generic_pm_domain_data)
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/base/power/domain.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/base/power/domain.c
++++ b/drivers/base/power/domain.c
+@@ -1188,7 +1188,6 @@ static struct generic_pm_domain_data *ge
+ }
+
+ dev->power.subsys_data->domain_data = &gpd_data->base;
+- dev->pm_domain = &genpd->domain;
+
+ spin_unlock_irq(&dev->power.lock);
+
+@@ -1207,7 +1206,6 @@ static void genpd_free_dev_data(struct d
+ {
+ spin_lock_irq(&dev->power.lock);
+
+- dev->pm_domain = NULL;
+ dev->power.subsys_data->domain_data = NULL;
+
+ spin_unlock_irq(&dev->power.lock);
+@@ -1248,6 +1246,8 @@ int __pm_genpd_add_device(struct generic
+ if (ret)
+ goto out;
+
++ dev->pm_domain = &genpd->domain;
++
+ genpd->device_count++;
+ genpd->max_off_time_changed = true;
+
+@@ -1299,6 +1299,8 @@ int pm_genpd_remove_device(struct generi
+ if (genpd->detach_dev)
+ genpd->detach_dev(genpd, dev);
+
++ dev->pm_domain = NULL;
++
+ list_del_init(&pdd->list_node);
+
+ mutex_unlock(&genpd->lock);
--- /dev/null
+From 5a7a88f1b488e4ee49eb3d5b82612d4d9ffdf2c3 Mon Sep 17 00:00:00 2001
+From: "Ismail, Mustafa" <mustafa.ismail@intel.com>
+Date: Fri, 14 Jul 2017 09:41:30 -0500
+Subject: RDMA/uverbs: Fix the check for port number
+
+From: Ismail, Mustafa <mustafa.ismail@intel.com>
+
+commit 5a7a88f1b488e4ee49eb3d5b82612d4d9ffdf2c3 upstream.
+
+The port number is only valid if IB_QP_PORT is set in the mask.
+So only check port number if it is valid to prevent modify_qp from
+failing due to an invalid port number.
+
+Fixes: 5ecce4c9b17b("Check port number supplied by user verbs cmds")
+Reviewed-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>
+Tested-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/infiniband/core/uverbs_cmd.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/core/uverbs_cmd.c
++++ b/drivers/infiniband/core/uverbs_cmd.c
+@@ -2287,8 +2287,9 @@ ssize_t ib_uverbs_modify_qp(struct ib_uv
+ if (copy_from_user(&cmd, buf, sizeof cmd))
+ return -EFAULT;
+
+- if (cmd.port_num < rdma_start_port(ib_dev) ||
+- cmd.port_num > rdma_end_port(ib_dev))
++ if ((cmd.attr_mask & IB_QP_PORT) &&
++ (cmd.port_num < rdma_start_port(ib_dev) ||
++ cmd.port_num > rdma_end_port(ib_dev)))
+ return -EINVAL;
+
+ INIT_UDATA(&udata, buf + sizeof cmd, NULL, in_len - sizeof cmd,
--- /dev/null
+From 96b777452d8881480fd5be50112f791c17db4b6b Mon Sep 17 00:00:00 2001
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Date: Wed, 8 Feb 2017 14:27:27 +0300
+Subject: sched/cgroup: Move sched_online_group() back into css_online() to fix crash
+
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+
+commit 96b777452d8881480fd5be50112f791c17db4b6b upstream.
+
+Commit:
+
+ 2f5177f0fd7e ("sched/cgroup: Fix/cleanup cgroup teardown/init")
+
+.. moved sched_online_group() from css_online() to css_alloc().
+It exposes half-baked task group into global lists before initializing
+generic cgroup stuff.
+
+LTP testcase (third in cgroup_regression_test) written for testing
+similar race in kernels 2.6.26-2.6.28 easily triggers this oops:
+
+ BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
+ IP: kernfs_path_from_node_locked+0x260/0x320
+ CPU: 1 PID: 30346 Comm: cat Not tainted 4.10.0-rc5-test #4
+ Call Trace:
+ ? kernfs_path_from_node+0x4f/0x60
+ kernfs_path_from_node+0x3e/0x60
+ print_rt_rq+0x44/0x2b0
+ print_rt_stats+0x7a/0xd0
+ print_cpu+0x2fc/0xe80
+ ? __might_sleep+0x4a/0x80
+ sched_debug_show+0x17/0x30
+ seq_read+0xf2/0x3b0
+ proc_reg_read+0x42/0x70
+ __vfs_read+0x28/0x130
+ ? security_file_permission+0x9b/0xc0
+ ? rw_verify_area+0x4e/0xb0
+ vfs_read+0xa5/0x170
+ SyS_read+0x46/0xa0
+ entry_SYSCALL_64_fastpath+0x1e/0xad
+
+Here the task group is already linked into the global RCU-protected 'task_groups'
+list, but the css->cgroup pointer is still NULL.
+
+This patch reverts this chunk and moves online back to css_online().
+
+Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Fixes: 2f5177f0fd7e ("sched/cgroup: Fix/cleanup cgroup teardown/init")
+Link: http://lkml.kernel.org/r/148655324740.424917.5302984537258726349.stgit@buzz
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Matt Fleming <matt@codeblueprint.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/sched/core.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -8253,11 +8253,20 @@ cpu_cgroup_css_alloc(struct cgroup_subsy
+ if (IS_ERR(tg))
+ return ERR_PTR(-ENOMEM);
+
+- sched_online_group(tg, parent);
+-
+ return &tg->css;
+ }
+
++/* Expose task group only after completing cgroup initialization */
++static int cpu_cgroup_css_online(struct cgroup_subsys_state *css)
++{
++ struct task_group *tg = css_tg(css);
++ struct task_group *parent = css_tg(css->parent);
++
++ if (parent)
++ sched_online_group(tg, parent);
++ return 0;
++}
++
+ static void cpu_cgroup_css_released(struct cgroup_subsys_state *css)
+ {
+ struct task_group *tg = css_tg(css);
+@@ -8632,6 +8641,7 @@ static struct cftype cpu_files[] = {
+
+ struct cgroup_subsys cpu_cgrp_subsys = {
+ .css_alloc = cpu_cgroup_css_alloc,
++ .css_online = cpu_cgroup_css_online,
+ .css_released = cpu_cgroup_css_released,
+ .css_free = cpu_cgroup_css_free,
+ .fork = cpu_cgroup_fork,
mpt3sas-don-t-overreach-ioc-reply_post-during-initialization.patch
kaweth-fix-firmware-download.patch
kaweth-fix-oops-upon-failed-memory-allocation.patch
+sched-cgroup-move-sched_online_group-back-into-css_online-to-fix-crash.patch
+pm-domains-defer-dev_pm_domain_set-until-genpd-attach_dev-succeeds-if-present.patch
+rdma-uverbs-fix-the-check-for-port-number.patch
+libnvdimm-btt-fix-btt_rw_page-not-returning-errors.patch
+ipmi-watchdog-fix-watchdog-timeout-set-on-reboot.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
