From: Greg Kroah-Hartman Date: Fri, 22 Sep 2017 12:03:41 +0000 (+0200) Subject: 4.13-stable patches X-Git-Tag: v3.18.72~7 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9e3fdc1d6cba10fc830ecd49cb9897c693730c00;p=thirdparty%2Fkernel%2Fstable-queue.git 4.13-stable patches added patches: alsa-seq-cancel-pending-autoload-work-at-unbinding-device.patch bcache-correct-cache_dirty_target-in-__update_writeback_rate.patch bcache-correct-return-value-for-sysfs-attach-errors.patch bcache-do-not-subtract-sectors_to_gc-for-bypassed-io.patch bcache-fix-bch_hprint-crash-and-improve-output.patch bcache-fix-for-gc-and-write-back-race.patch bcache-fix-leak-of-bdev-reference.patch bcache-fix-sequential-large-write-io-bypass.patch bcache-initialize-dirty-stripes-in-flash_dev_run.patch media-adv7180-add-missing-adv7180cp-adv7180st-i2c-device-ids.patch media-revert-lirc_dev-remove-superfluous-get-put_device-calls.patch media-uvcvideo-prevent-heap-overflow-when-accessing-mapped-controls.patch media-v4l2-compat-ioctl32-fix-timespec-conversion.patch media-venus-fix-copy-paste-error-in-return_buf_error.patch pm-devfreq-fix-memory-leak-when-fail-to-register-device.patch sched-cpuset-pm-fix-cpuset-vs.-suspend-resume-bugs.patch --- diff --git a/queue-4.13/alsa-seq-cancel-pending-autoload-work-at-unbinding-device.patch b/queue-4.13/alsa-seq-cancel-pending-autoload-work-at-unbinding-device.patch new file mode 100644 index 00000000000..9c29cfe8245 --- /dev/null +++ b/queue-4.13/alsa-seq-cancel-pending-autoload-work-at-unbinding-device.patch @@ -0,0 +1,79 @@ +From fc27fe7e8deef2f37cba3f2be2d52b6ca5eb9d57 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 12 Sep 2017 12:41:20 +0200 +Subject: ALSA: seq: Cancel pending autoload work at unbinding device + +From: Takashi Iwai + +commit fc27fe7e8deef2f37cba3f2be2d52b6ca5eb9d57 upstream. + +ALSA sequencer core has a mechanism to load the enumerated devices +automatically, and it's performed in an off-load work. This seems +causing some race when a sequencer is removed while the pending +autoload work is running. As syzkaller spotted, it may lead to some +use-after-free: + BUG: KASAN: use-after-free in snd_rawmidi_dev_seq_free+0x69/0x70 + sound/core/rawmidi.c:1617 + Write of size 8 at addr ffff88006c611d90 by task kworker/2:1/567 + + CPU: 2 PID: 567 Comm: kworker/2:1 Not tainted 4.13.0+ #29 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 + Workqueue: events autoload_drivers + Call Trace: + __dump_stack lib/dump_stack.c:16 [inline] + dump_stack+0x192/0x22c lib/dump_stack.c:52 + print_address_description+0x78/0x280 mm/kasan/report.c:252 + kasan_report_error mm/kasan/report.c:351 [inline] + kasan_report+0x230/0x340 mm/kasan/report.c:409 + __asan_report_store8_noabort+0x1c/0x20 mm/kasan/report.c:435 + snd_rawmidi_dev_seq_free+0x69/0x70 sound/core/rawmidi.c:1617 + snd_seq_dev_release+0x4f/0x70 sound/core/seq_device.c:192 + device_release+0x13f/0x210 drivers/base/core.c:814 + kobject_cleanup lib/kobject.c:648 [inline] + kobject_release lib/kobject.c:677 [inline] + kref_put include/linux/kref.h:70 [inline] + kobject_put+0x145/0x240 lib/kobject.c:694 + put_device+0x25/0x30 drivers/base/core.c:1799 + klist_devices_put+0x36/0x40 drivers/base/bus.c:827 + klist_next+0x264/0x4a0 lib/klist.c:403 + next_device drivers/base/bus.c:270 [inline] + bus_for_each_dev+0x17e/0x210 drivers/base/bus.c:312 + autoload_drivers+0x3b/0x50 sound/core/seq_device.c:117 + process_one_work+0x9fb/0x1570 kernel/workqueue.c:2097 + worker_thread+0x1e4/0x1350 kernel/workqueue.c:2231 + kthread+0x324/0x3f0 kernel/kthread.c:231 + ret_from_fork+0x25/0x30 arch/x86/entry/entry_64.S:425 + +The fix is simply to assure canceling the autoload work at removing +the device. + +Reported-by: Andrey Konovalov +Tested-by: Andrey Konovalov +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/seq_device.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/sound/core/seq_device.c ++++ b/sound/core/seq_device.c +@@ -148,8 +148,10 @@ void snd_seq_device_load_drivers(void) + flush_work(&autoload_work); + } + EXPORT_SYMBOL(snd_seq_device_load_drivers); ++#define cancel_autoload_drivers() cancel_work_sync(&autoload_work) + #else + #define queue_autoload_drivers() /* NOP */ ++#define cancel_autoload_drivers() /* NOP */ + #endif + + /* +@@ -159,6 +161,7 @@ static int snd_seq_device_dev_free(struc + { + struct snd_seq_device *dev = device->device_data; + ++ cancel_autoload_drivers(); + put_device(&dev->dev); + return 0; + } diff --git a/queue-4.13/bcache-correct-cache_dirty_target-in-__update_writeback_rate.patch b/queue-4.13/bcache-correct-cache_dirty_target-in-__update_writeback_rate.patch new file mode 100644 index 00000000000..31fd6044a3c --- /dev/null +++ b/queue-4.13/bcache-correct-cache_dirty_target-in-__update_writeback_rate.patch @@ -0,0 +1,90 @@ +From a8394090a9129b40f9d90dcb7f4a49d60c727ca6 Mon Sep 17 00:00:00 2001 +From: Tang Junhui +Date: Wed, 6 Sep 2017 14:25:56 +0800 +Subject: bcache: correct cache_dirty_target in __update_writeback_rate() + +From: Tang Junhui + +commit a8394090a9129b40f9d90dcb7f4a49d60c727ca6 upstream. + +__update_write_rate() uses a Proportion-Differentiation Controller +algorithm to control writeback rate. A dirty target number is used in +this PD controller to control writeback rate. A larger target number +will make the writeback rate smaller, on the versus, a smaller target +number will make the writeback rate larger. + +bcache uses the following steps to calculate the target number, +1) cache_sectors = all-buckets-of-cache-set * buckets-size +2) cache_dirty_target = cache_sectors * cached-device-writeback_percent +3) target = cache_dirty_target * +(sectors-of-cached-device/sectors-of-all-cached-devices-of-this-cache-set) + +The calculation at step 1) for cache_sectors is incorrect, which does +not consider dirty blocks occupied by flash only volume. + +A flash only volume can be took as a bcache device without cached +device. All data sectors allocated for it are persistent on cache device +and marked dirty, they are not touched by bcache writeback and garbage +collection code. So data blocks of flash only volume should be ignore +when calculating cache_sectors of cache set. + +Current code does not subtract dirty sectors of flash only volume, which +results a larger target number from the above 3 steps. And in sequence +the cache device's writeback rate is smaller then a correct value, +writeback speed is slower on all cached devices. + +This patch fixes the incorrect slower writeback rate by subtracting +dirty sectors of flash only volumes in __update_writeback_rate(). + +(Commit log composed by Coly Li to pass checkpatch.pl checking) + +Signed-off-by: Tang Junhui +Reviewed-by: Coly Li +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/bcache/writeback.c | 3 ++- + drivers/md/bcache/writeback.h | 19 +++++++++++++++++++ + 2 files changed, 21 insertions(+), 1 deletion(-) + +--- a/drivers/md/bcache/writeback.c ++++ b/drivers/md/bcache/writeback.c +@@ -21,7 +21,8 @@ + static void __update_writeback_rate(struct cached_dev *dc) + { + struct cache_set *c = dc->disk.c; +- uint64_t cache_sectors = c->nbuckets * c->sb.bucket_size; ++ uint64_t cache_sectors = c->nbuckets * c->sb.bucket_size - ++ bcache_flash_devs_sectors_dirty(c); + uint64_t cache_dirty_target = + div_u64(cache_sectors * dc->writeback_percent, 100); + +--- a/drivers/md/bcache/writeback.h ++++ b/drivers/md/bcache/writeback.h +@@ -14,6 +14,25 @@ static inline uint64_t bcache_dev_sector + return ret; + } + ++static inline uint64_t bcache_flash_devs_sectors_dirty(struct cache_set *c) ++{ ++ uint64_t i, ret = 0; ++ ++ mutex_lock(&bch_register_lock); ++ ++ for (i = 0; i < c->nr_uuids; i++) { ++ struct bcache_device *d = c->devices[i]; ++ ++ if (!d || !UUID_FLASH_ONLY(&c->uuids[i])) ++ continue; ++ ret += bcache_dev_sectors_dirty(d); ++ } ++ ++ mutex_unlock(&bch_register_lock); ++ ++ return ret; ++} ++ + static inline unsigned offset_to_stripe(struct bcache_device *d, + uint64_t offset) + { diff --git a/queue-4.13/bcache-correct-return-value-for-sysfs-attach-errors.patch b/queue-4.13/bcache-correct-return-value-for-sysfs-attach-errors.patch new file mode 100644 index 00000000000..24fe00f6a24 --- /dev/null +++ b/queue-4.13/bcache-correct-return-value-for-sysfs-attach-errors.patch @@ -0,0 +1,45 @@ +From 77fa100f27475d08a569b9d51c17722130f089e7 Mon Sep 17 00:00:00 2001 +From: Tony Asleson +Date: Wed, 6 Sep 2017 14:25:57 +0800 +Subject: bcache: Correct return value for sysfs attach errors + +From: Tony Asleson + +commit 77fa100f27475d08a569b9d51c17722130f089e7 upstream. + +If you encounter any errors in bch_cached_dev_attach it will return +a negative error code. The variable 'v' which stores the result is +unsigned, thus user space sees a very large value returned for bytes +written which can cause incorrect user space behavior. Utilize 1 +signed variable to use throughout the function to preserve error return +capability. + +Signed-off-by: Tony Asleson +Acked-by: Coly Li +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/bcache/sysfs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/md/bcache/sysfs.c ++++ b/drivers/md/bcache/sysfs.c +@@ -192,7 +192,7 @@ STORE(__cached_dev) + { + struct cached_dev *dc = container_of(kobj, struct cached_dev, + disk.kobj); +- unsigned v = size; ++ ssize_t v = size; + struct cache_set *c; + struct kobj_uevent_env *env; + +@@ -227,7 +227,7 @@ STORE(__cached_dev) + bch_cached_dev_run(dc); + + if (attr == &sysfs_cache_mode) { +- ssize_t v = bch_read_string_list(buf, bch_cache_modes + 1); ++ v = bch_read_string_list(buf, bch_cache_modes + 1); + + if (v < 0) + return v; diff --git a/queue-4.13/bcache-do-not-subtract-sectors_to_gc-for-bypassed-io.patch b/queue-4.13/bcache-do-not-subtract-sectors_to_gc-for-bypassed-io.patch new file mode 100644 index 00000000000..cde4b507522 --- /dev/null +++ b/queue-4.13/bcache-do-not-subtract-sectors_to_gc-for-bypassed-io.patch @@ -0,0 +1,41 @@ +From 69daf03adef5f7bc13e0ac86b4b8007df1767aab Mon Sep 17 00:00:00 2001 +From: Tang Junhui +Date: Wed, 6 Sep 2017 14:25:53 +0800 +Subject: bcache: do not subtract sectors_to_gc for bypassed IO + +From: Tang Junhui + +commit 69daf03adef5f7bc13e0ac86b4b8007df1767aab upstream. + +Since bypassed IOs use no bucket, so do not subtract sectors_to_gc to +trigger gc thread. + +Signed-off-by: tang.junhui +Acked-by: Coly Li +Reviewed-by: Eric Wheeler +Reviewed-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/bcache/request.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/md/bcache/request.c ++++ b/drivers/md/bcache/request.c +@@ -196,12 +196,12 @@ static void bch_data_insert_start(struct + struct data_insert_op *op = container_of(cl, struct data_insert_op, cl); + struct bio *bio = op->bio, *n; + +- if (atomic_sub_return(bio_sectors(bio), &op->c->sectors_to_gc) < 0) +- wake_up_gc(op->c); +- + if (op->bypass) + return bch_data_invalidate(cl); + ++ if (atomic_sub_return(bio_sectors(bio), &op->c->sectors_to_gc) < 0) ++ wake_up_gc(op->c); ++ + /* + * Journal writes are marked REQ_PREFLUSH; if the original write was a + * flush, it'll wait on the journal write. diff --git a/queue-4.13/bcache-fix-bch_hprint-crash-and-improve-output.patch b/queue-4.13/bcache-fix-bch_hprint-crash-and-improve-output.patch new file mode 100644 index 00000000000..b8b39a35d41 --- /dev/null +++ b/queue-4.13/bcache-fix-bch_hprint-crash-and-improve-output.patch @@ -0,0 +1,97 @@ +From 9276717b9e297a62d1151a43d1cd286213f68eb7 Mon Sep 17 00:00:00 2001 +From: Michael Lyle +Date: Wed, 6 Sep 2017 14:26:02 +0800 +Subject: bcache: fix bch_hprint crash and improve output + +From: Michael Lyle + +commit 9276717b9e297a62d1151a43d1cd286213f68eb7 upstream. + +Most importantly, solve a crash where %llu was used to format signed +numbers. This would cause a buffer overflow when reading sysfs +writeback_rate_debug, as only 20 bytes were allocated for this and +%llu writes 20 characters plus a null. + +Always use the units mechanism rather than having different output +paths for simplicity. + +Also, correct problems with display output where 1.10 was a larger +number than 1.09, by multiplying by 10 and then dividing by 1024 instead +of dividing by 100. (Remainders of >= 1000 would print as .10). + +Minor changes: Always display the decimal point instead of trying to +omit it based on number of digits shown. Decide what units to use +based on 1000 as a threshold, not 1024 (in other words, always print +at most 3 digits before the decimal point). + +Signed-off-by: Michael Lyle +Reported-by: Dmitry Yu Okunev +Acked-by: Kent Overstreet +Reviewed-by: Coly Li +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/bcache/util.c | 46 +++++++++++++++++++++++++++++++++------------- + 1 file changed, 33 insertions(+), 13 deletions(-) + +--- a/drivers/md/bcache/util.c ++++ b/drivers/md/bcache/util.c +@@ -74,24 +74,44 @@ STRTO_H(strtouint, unsigned int) + STRTO_H(strtoll, long long) + STRTO_H(strtoull, unsigned long long) + ++/** ++ * bch_hprint() - formats @v to human readable string for sysfs. ++ * ++ * @v - signed 64 bit integer ++ * @buf - the (at least 8 byte) buffer to format the result into. ++ * ++ * Returns the number of bytes used by format. ++ */ + ssize_t bch_hprint(char *buf, int64_t v) + { + static const char units[] = "?kMGTPEZY"; +- char dec[4] = ""; +- int u, t = 0; ++ int u = 0, t; + +- for (u = 0; v >= 1024 || v <= -1024; u++) { +- t = v & ~(~0 << 10); +- v >>= 10; +- } ++ uint64_t q; + +- if (!u) +- return sprintf(buf, "%llu", v); +- +- if (v < 100 && v > -100) +- snprintf(dec, sizeof(dec), ".%i", t / 100); +- +- return sprintf(buf, "%lli%s%c", v, dec, units[u]); ++ if (v < 0) ++ q = -v; ++ else ++ q = v; ++ ++ /* For as long as the number is more than 3 digits, but at least ++ * once, shift right / divide by 1024. Keep the remainder for ++ * a digit after the decimal point. ++ */ ++ do { ++ u++; ++ ++ t = q & ~(~0 << 10); ++ q >>= 10; ++ } while (q >= 1000); ++ ++ if (v < 0) ++ /* '-', up to 3 digits, '.', 1 digit, 1 character, null; ++ * yields 8 bytes. ++ */ ++ return sprintf(buf, "-%llu.%i%c", q, t * 10 / 1024, units[u]); ++ else ++ return sprintf(buf, "%llu.%i%c", q, t * 10 / 1024, units[u]); + } + + ssize_t bch_snprint_string_list(char *buf, size_t size, const char * const list[], diff --git a/queue-4.13/bcache-fix-for-gc-and-write-back-race.patch b/queue-4.13/bcache-fix-for-gc-and-write-back-race.patch new file mode 100644 index 00000000000..df263e08415 --- /dev/null +++ b/queue-4.13/bcache-fix-for-gc-and-write-back-race.patch @@ -0,0 +1,117 @@ +From 9baf30972b5568d8b5bc8b3c46a6ec5b58100463 Mon Sep 17 00:00:00 2001 +From: Tang Junhui +Date: Wed, 6 Sep 2017 14:25:59 +0800 +Subject: bcache: fix for gc and write-back race + +From: Tang Junhui + +commit 9baf30972b5568d8b5bc8b3c46a6ec5b58100463 upstream. + +gc and write-back get raced (see the email "bcache get stucked" I sended +before): +gc thread write-back thread +| |bch_writeback_thread() +|bch_gc_thread() | +| |==>read_dirty() +|==>bch_btree_gc() | +|==>btree_root() //get btree root | +| //node write locker | +|==>bch_btree_gc_root() | +| |==>read_dirty_submit() +| |==>write_dirty() +| |==>continue_at(cl, +| | write_dirty_finish, +| | system_wq); +| |==>write_dirty_finish()//excute +| | //in system_wq +| |==>bch_btree_insert() +| |==>bch_btree_map_leaf_nodes() +| |==>__bch_btree_map_nodes() +| |==>btree_root //try to get btree +| | //root node read +| | //lock +| |-----stuck here +|==>bch_btree_set_root() +|==>bch_journal_meta() +|==>bch_journal() +|==>journal_try_write() +|==>journal_write_unlocked() //journal_full(&c->journal) +| //condition satisfied +|==>continue_at(cl, journal_write, system_wq); //try to excute +| //journal_write in system_wq +| //but work queue is excuting +| //write_dirty_finish() +|==>closure_sync(); //wait journal_write execute +| //over and wake up gc, +|-------------stuck here +|==>release root node write locker + +This patch alloc a separate work-queue for write-back thread to avoid such +race. + +(Commit log re-organized by Coly Li to pass checkpatch.pl checking) + +Signed-off-by: Tang Junhui +Acked-by: Coly Li +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/bcache/bcache.h | 1 + + drivers/md/bcache/super.c | 2 ++ + drivers/md/bcache/writeback.c | 9 +++++++-- + 3 files changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/md/bcache/bcache.h ++++ b/drivers/md/bcache/bcache.h +@@ -333,6 +333,7 @@ struct cached_dev { + /* Limit number of writeback bios in flight */ + struct semaphore in_flight; + struct task_struct *writeback_thread; ++ struct workqueue_struct *writeback_write_wq; + + struct keybuf writeback_keys; + +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -1059,6 +1059,8 @@ static void cached_dev_free(struct closu + cancel_delayed_work_sync(&dc->writeback_rate_update); + if (!IS_ERR_OR_NULL(dc->writeback_thread)) + kthread_stop(dc->writeback_thread); ++ if (dc->writeback_write_wq) ++ destroy_workqueue(dc->writeback_write_wq); + + mutex_lock(&bch_register_lock); + +--- a/drivers/md/bcache/writeback.c ++++ b/drivers/md/bcache/writeback.c +@@ -187,7 +187,7 @@ static void write_dirty(struct closure * + + closure_bio_submit(&io->bio, cl); + +- continue_at(cl, write_dirty_finish, system_wq); ++ continue_at(cl, write_dirty_finish, io->dc->writeback_write_wq); + } + + static void read_dirty_endio(struct bio *bio) +@@ -207,7 +207,7 @@ static void read_dirty_submit(struct clo + + closure_bio_submit(&io->bio, cl); + +- continue_at(cl, write_dirty, system_wq); ++ continue_at(cl, write_dirty, io->dc->writeback_write_wq); + } + + static void read_dirty(struct cached_dev *dc) +@@ -517,6 +517,11 @@ void bch_cached_dev_writeback_init(struc + + int bch_cached_dev_writeback_start(struct cached_dev *dc) + { ++ dc->writeback_write_wq = alloc_workqueue("bcache_writeback_wq", ++ WQ_MEM_RECLAIM, 0); ++ if (!dc->writeback_write_wq) ++ return -ENOMEM; ++ + dc->writeback_thread = kthread_create(bch_writeback_thread, dc, + "bcache_writeback"); + if (IS_ERR(dc->writeback_thread)) diff --git a/queue-4.13/bcache-fix-leak-of-bdev-reference.patch b/queue-4.13/bcache-fix-leak-of-bdev-reference.patch new file mode 100644 index 00000000000..f4ad63ef14a --- /dev/null +++ b/queue-4.13/bcache-fix-leak-of-bdev-reference.patch @@ -0,0 +1,34 @@ +From 4b758df21ee7081ab41448d21d60367efaa625b3 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 6 Sep 2017 14:25:51 +0800 +Subject: bcache: Fix leak of bdev reference + +From: Jan Kara + +commit 4b758df21ee7081ab41448d21d60367efaa625b3 upstream. + +If blkdev_get_by_path() in register_bcache() fails, we try to lookup the +block device using lookup_bdev() to detect which situation we are in to +properly report error. However we never drop the reference returned to +us from lookup_bdev(). Fix that. + +Signed-off-by: Jan Kara +Acked-by: Coly Li +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/bcache/super.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -1965,6 +1965,8 @@ static ssize_t register_bcache(struct ko + else + err = "device busy"; + mutex_unlock(&bch_register_lock); ++ if (!IS_ERR(bdev)) ++ bdput(bdev); + if (attr == &ksysfs_register_quiet) + goto out; + } diff --git a/queue-4.13/bcache-fix-sequential-large-write-io-bypass.patch b/queue-4.13/bcache-fix-sequential-large-write-io-bypass.patch new file mode 100644 index 00000000000..0e39f4738b6 --- /dev/null +++ b/queue-4.13/bcache-fix-sequential-large-write-io-bypass.patch @@ -0,0 +1,49 @@ +From c81ffa32a214c84b08900fbc9d432187bd948eba Mon Sep 17 00:00:00 2001 +From: Tang Junhui +Date: Wed, 6 Sep 2017 14:25:52 +0800 +Subject: bcache: fix sequential large write IO bypass +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tang Junhui + +commit c81ffa32a214c84b08900fbc9d432187bd948eba upstream. + +Sequential write IOs were tested with bs=1M by FIO in writeback cache +mode, these IOs were expected to be bypassed, but actually they did not. +We debug the code, and find in check_should_bypass(): + if (!congested && + mode == CACHE_MODE_WRITEBACK && + op_is_write(bio_op(bio)) && + (bio-＞bi_opf & REQ_SYNC)) + goto rescale +that means, If in writeback mode, a write IO with REQ_SYNC flag will not +be bypassed though it is a sequential large IO, It's not a correct thing +to do actually, so this patch remove these codes. + +Signed-off-by: tang.junhui +Reviewed-by: Kent Overstreet +Reviewed-by: Eric Wheeler +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/bcache/request.c | 6 ------ + 1 file changed, 6 deletions(-) + +--- a/drivers/md/bcache/request.c ++++ b/drivers/md/bcache/request.c +@@ -400,12 +400,6 @@ static bool check_should_bypass(struct c + if (!congested && !dc->sequential_cutoff) + goto rescale; + +- if (!congested && +- mode == CACHE_MODE_WRITEBACK && +- op_is_write(bio->bi_opf) && +- op_is_sync(bio->bi_opf)) +- goto rescale; +- + spin_lock(&dc->io_lock); + + hlist_for_each_entry(i, iohash(dc, bio->bi_iter.bi_sector), hash) diff --git a/queue-4.13/bcache-initialize-dirty-stripes-in-flash_dev_run.patch b/queue-4.13/bcache-initialize-dirty-stripes-in-flash_dev_run.patch new file mode 100644 index 00000000000..2ca5c9d2659 --- /dev/null +++ b/queue-4.13/bcache-initialize-dirty-stripes-in-flash_dev_run.patch @@ -0,0 +1,94 @@ +From 175206cf9ab63161dec74d9cd7f9992e062491f5 Mon Sep 17 00:00:00 2001 +From: Tang Junhui +Date: Thu, 7 Sep 2017 01:28:53 +0800 +Subject: bcache: initialize dirty stripes in flash_dev_run() + +From: Tang Junhui + +commit 175206cf9ab63161dec74d9cd7f9992e062491f5 upstream. + +bcache uses a Proportion-Differentiation Controller algorithm to control +writeback rate to cached devices. In the PD controller algorithm, dirty +stripes of thin flash device should not be counted in, because flash only +volumes never write back dirty data. + +Currently dirty stripe counter for thin flash device is not initialized +when the thin flash device starts. Which means the following calculation +in PD controller will reference an undefined dirty stripes number, and +all cached devices attached to the same cache set where the thin flash +device lies on may have an inaccurate writeback rate. + +This patch calles bch_sectors_dirty_init() in flash_dev_run(), to +correctly initialize dirty stripe counter when the thin flash device +starts to run. This patch also does following parameter data type change, + -void bch_sectors_dirty_init(struct cached_dev *dc); + +void bch_sectors_dirty_init(struct bcache_device *); +to call this function conveniently in flash_dev_run(). + +(Commit log is composed by Coly Li) + +Signed-off-by: Tang Junhui +Reviewed-by: Coly Li +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/bcache/super.c | 3 ++- + drivers/md/bcache/writeback.c | 8 ++++---- + drivers/md/bcache/writeback.h | 2 +- + 3 files changed, 7 insertions(+), 6 deletions(-) + +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -1026,7 +1026,7 @@ int bch_cached_dev_attach(struct cached_ + } + + if (BDEV_STATE(&dc->sb) == BDEV_STATE_DIRTY) { +- bch_sectors_dirty_init(dc); ++ bch_sectors_dirty_init(&dc->disk); + atomic_set(&dc->has_dirty, 1); + atomic_inc(&dc->count); + bch_writeback_queue(dc); +@@ -1228,6 +1228,7 @@ static int flash_dev_run(struct cache_se + goto err; + + bcache_device_attach(d, c, u - c->uuids); ++ bch_sectors_dirty_init(d); + bch_flash_dev_request_init(d); + add_disk(d->disk); + +--- a/drivers/md/bcache/writeback.c ++++ b/drivers/md/bcache/writeback.c +@@ -482,17 +482,17 @@ static int sectors_dirty_init_fn(struct + return MAP_CONTINUE; + } + +-void bch_sectors_dirty_init(struct cached_dev *dc) ++void bch_sectors_dirty_init(struct bcache_device *d) + { + struct sectors_dirty_init op; + + bch_btree_op_init(&op.op, -1); +- op.inode = dc->disk.id; ++ op.inode = d->id; + +- bch_btree_map_keys(&op.op, dc->disk.c, &KEY(op.inode, 0, 0), ++ bch_btree_map_keys(&op.op, d->c, &KEY(op.inode, 0, 0), + sectors_dirty_init_fn, 0); + +- dc->disk.sectors_dirty_last = bcache_dev_sectors_dirty(&dc->disk); ++ d->sectors_dirty_last = bcache_dev_sectors_dirty(d); + } + + void bch_cached_dev_writeback_init(struct cached_dev *dc) +--- a/drivers/md/bcache/writeback.h ++++ b/drivers/md/bcache/writeback.h +@@ -84,7 +84,7 @@ static inline void bch_writeback_add(str + + void bcache_dev_sectors_dirty_add(struct cache_set *, unsigned, uint64_t, int); + +-void bch_sectors_dirty_init(struct cached_dev *dc); ++void bch_sectors_dirty_init(struct bcache_device *); + void bch_cached_dev_writeback_init(struct cached_dev *); + int bch_cached_dev_writeback_start(struct cached_dev *); + diff --git a/queue-4.13/media-adv7180-add-missing-adv7180cp-adv7180st-i2c-device-ids.patch b/queue-4.13/media-adv7180-add-missing-adv7180cp-adv7180st-i2c-device-ids.patch new file mode 100644 index 00000000000..40f8897f3b9 --- /dev/null +++ b/queue-4.13/media-adv7180-add-missing-adv7180cp-adv7180st-i2c-device-ids.patch @@ -0,0 +1,33 @@ +From 281ddc3cdc10413b98531d701ab5323c4f3ff1f4 Mon Sep 17 00:00:00 2001 +From: Ulrich Hecht +Date: Mon, 3 Jul 2017 04:43:33 -0400 +Subject: media: adv7180: add missing adv7180cp, adv7180st i2c device IDs + +From: Ulrich Hecht + +commit 281ddc3cdc10413b98531d701ab5323c4f3ff1f4 upstream. + +Fixes a crash on Renesas R8A7793 Gose board that uses these "compatible" +entries. + +Signed-off-by: Ulrich Hecht +Tested-by: Geert Uytterhoeven +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/i2c/adv7180.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/media/i2c/adv7180.c ++++ b/drivers/media/i2c/adv7180.c +@@ -1402,6 +1402,8 @@ static int adv7180_remove(struct i2c_cli + + static const struct i2c_device_id adv7180_id[] = { + { "adv7180", (kernel_ulong_t)&adv7180_info }, ++ { "adv7180cp", (kernel_ulong_t)&adv7180_info }, ++ { "adv7180st", (kernel_ulong_t)&adv7180_info }, + { "adv7182", (kernel_ulong_t)&adv7182_info }, + { "adv7280", (kernel_ulong_t)&adv7280_info }, + { "adv7280-m", (kernel_ulong_t)&adv7280_m_info }, diff --git a/queue-4.13/media-revert-lirc_dev-remove-superfluous-get-put_device-calls.patch b/queue-4.13/media-revert-lirc_dev-remove-superfluous-get-put_device-calls.patch new file mode 100644 index 00000000000..b04719a57fb --- /dev/null +++ b/queue-4.13/media-revert-lirc_dev-remove-superfluous-get-put_device-calls.patch @@ -0,0 +1,65 @@ +From a607f51e5a4c421e2097077db88105402099c528 Mon Sep 17 00:00:00 2001 +From: Sean Young +Date: Fri, 4 Aug 2017 10:12:03 -0400 +Subject: media: Revert "[media] lirc_dev: remove superfluous get/put_device() calls" + +From: Sean Young + +commit a607f51e5a4c421e2097077db88105402099c528 upstream. + +This reverts commit 5be2b76a9ca4ea5fd3e221114d62eeb0d78267ca. + +Only when the lirc device is freed, should we drop our reference to +rc_dev, else we the rc_dev is freed to early. If userspace has +a file descriptor open during unplug, it goes bang. + +================================================================== +BUG: KASAN: use-after-free in __lock_acquire+0x7bb/0x1e10 +Read of size 8 at addr ffff8801d7d61ed0 by task ir-rec/2609 + +-snip- + mutex_lock_nested+0x1b/0x20 + ? mutex_lock_nested+0x1b/0x20 + rc_close.part.6+0x20/0x60 [rc_core] + rc_close+0x13/0x20 [rc_core] + lirc_dev_fop_close+0x62/0xd0 [lirc_dev] + __fput+0x236/0x410 + ? fput+0xb0/0xb0 + ? do_raw_spin_trylock+0x110/0x110 + ? set_rq_offline.part.70+0xa0/0xa0 + ____fput+0xe/0x10 + task_work_run+0x116/0x180 + ? task_work_cancel+0x170/0x170 + ? _raw_spin_unlock+0x27/0x40 + ? switch_task_namespaces+0x5f/0x90 + do_exit+0x68b/0xe80 + +Fixes: 5be2b76a9ca4 ("[media] lirc_dev: remove superfluous get/put_device() calls") +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/rc/lirc_dev.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/media/rc/lirc_dev.c ++++ b/drivers/media/rc/lirc_dev.c +@@ -59,6 +59,8 @@ static void lirc_release(struct device * + { + struct irctl *ir = container_of(ld, struct irctl, dev); + ++ put_device(ir->dev.parent); ++ + if (ir->buf_internal) { + lirc_buffer_free(ir->buf); + kfree(ir->buf); +@@ -218,6 +220,8 @@ int lirc_register_driver(struct lirc_dri + + mutex_unlock(&lirc_dev_lock); + ++ get_device(ir->dev.parent); ++ + dev_info(ir->d.dev, "lirc_dev: driver %s registered at minor = %d\n", + ir->d.name, ir->d.minor); + diff --git a/queue-4.13/media-uvcvideo-prevent-heap-overflow-when-accessing-mapped-controls.patch b/queue-4.13/media-uvcvideo-prevent-heap-overflow-when-accessing-mapped-controls.patch new file mode 100644 index 00000000000..fb5f5df5ae8 --- /dev/null +++ b/queue-4.13/media-uvcvideo-prevent-heap-overflow-when-accessing-mapped-controls.patch @@ -0,0 +1,42 @@ +From 7e09f7d5c790278ab98e5f2c22307ebe8ad6e8ba Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Tue, 8 Aug 2017 08:56:21 -0400 +Subject: media: uvcvideo: Prevent heap overflow when accessing mapped controls + +From: Guenter Roeck + +commit 7e09f7d5c790278ab98e5f2c22307ebe8ad6e8ba upstream. + +The size of uvc_control_mapping is user controlled leading to a +potential heap overflow in the uvc driver. This adds a check to verify +the user provided size fits within the bounds of the defined buffer +size. + +Originally-from: Richard Simmons + +Signed-off-by: Guenter Roeck +Reviewed-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/uvc/uvc_ctrl.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/media/usb/uvc/uvc_ctrl.c ++++ b/drivers/media/usb/uvc/uvc_ctrl.c +@@ -2002,6 +2002,13 @@ int uvc_ctrl_add_mapping(struct uvc_vide + goto done; + } + ++ /* Validate the user-provided bit-size and offset */ ++ if (mapping->size > 32 || ++ mapping->offset + mapping->size > ctrl->info.size * 8) { ++ ret = -EINVAL; ++ goto done; ++ } ++ + list_for_each_entry(map, &ctrl->info.mappings, list) { + if (mapping->id == map->id) { + uvc_trace(UVC_TRACE_CONTROL, "Can't add mapping '%s', " diff --git a/queue-4.13/media-v4l2-compat-ioctl32-fix-timespec-conversion.patch b/queue-4.13/media-v4l2-compat-ioctl32-fix-timespec-conversion.patch new file mode 100644 index 00000000000..8a3b0326ee1 --- /dev/null +++ b/queue-4.13/media-v4l2-compat-ioctl32-fix-timespec-conversion.patch @@ -0,0 +1,48 @@ +From 9c7ba1d7634cef490b85bc64c4091ff004821bfd Mon Sep 17 00:00:00 2001 +From: Daniel Mentz +Date: Wed, 2 Aug 2017 23:42:17 -0400 +Subject: media: v4l2-compat-ioctl32: Fix timespec conversion + +From: Daniel Mentz + +commit 9c7ba1d7634cef490b85bc64c4091ff004821bfd upstream. + +Certain syscalls like recvmmsg support 64 bit timespec values for the +X32 ABI. The helper function compat_put_timespec converts a timespec +value to a 32 bit or 64 bit value depending on what ABI is used. The +v4l2 compat layer, however, is not designed to support 64 bit timespec +values and always uses 32 bit values. Hence, compat_put_timespec must +not be used. + +Without this patch, user space will be provided with bad timestamp +values from the VIDIOC_DQEVENT ioctl. Also, fields of the struct +v4l2_event32 that come immediately after timestamp get overwritten, +namely the field named id. + +Fixes: 81993e81a994 ("compat: Get rid of (get|put)_compat_time(val|spec)") +Cc: H. Peter Anvin +Cc: Laurent Pinchart +Cc: Tiffany Lin +Cc: Ricardo Ribalda Delgado +Cc: Sakari Ailus +Signed-off-by: Daniel Mentz +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c ++++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +@@ -796,7 +796,8 @@ static int put_v4l2_event32(struct v4l2_ + copy_to_user(&up->u, &kp->u, sizeof(kp->u)) || + put_user(kp->pending, &up->pending) || + put_user(kp->sequence, &up->sequence) || +- compat_put_timespec(&kp->timestamp, &up->timestamp) || ++ put_user(kp->timestamp.tv_sec, &up->timestamp.tv_sec) || ++ put_user(kp->timestamp.tv_nsec, &up->timestamp.tv_nsec) || + put_user(kp->id, &up->id) || + copy_to_user(up->reserved, kp->reserved, 8 * sizeof(__u32))) + return -EFAULT; diff --git a/queue-4.13/media-venus-fix-copy-paste-error-in-return_buf_error.patch b/queue-4.13/media-venus-fix-copy-paste-error-in-return_buf_error.patch new file mode 100644 index 00000000000..e4fe14ae38b --- /dev/null +++ b/queue-4.13/media-venus-fix-copy-paste-error-in-return_buf_error.patch @@ -0,0 +1,35 @@ +From 0de0ef6c3f2dd7e9965270683445917e10384ab0 Mon Sep 17 00:00:00 2001 +From: "Gustavo A. R. Silva" +Date: Fri, 18 Aug 2017 12:07:19 -0400 +Subject: media: venus: fix copy/paste error in return_buf_error + +From: Gustavo A. R. Silva + +commit 0de0ef6c3f2dd7e9965270683445917e10384ab0 upstream. + +Call function v4l2_m2m_dst_buf_remove_by_buf() instead of +v4l2_m2m_src_buf_remove_by_buf() + +Addresses-Coverity-ID: 1415317 + +Signed-off-by: Gustavo A. R. Silva +Acked-by: Stanimir Varbanov +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/platform/qcom/venus/helpers.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/platform/qcom/venus/helpers.c ++++ b/drivers/media/platform/qcom/venus/helpers.c +@@ -243,7 +243,7 @@ static void return_buf_error(struct venu + if (vbuf->vb2_buf.type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) + v4l2_m2m_src_buf_remove_by_buf(m2m_ctx, vbuf); + else +- v4l2_m2m_src_buf_remove_by_buf(m2m_ctx, vbuf); ++ v4l2_m2m_dst_buf_remove_by_buf(m2m_ctx, vbuf); + + v4l2_m2m_buf_done(vbuf, VB2_BUF_STATE_ERROR); + } diff --git a/queue-4.13/pm-devfreq-fix-memory-leak-when-fail-to-register-device.patch b/queue-4.13/pm-devfreq-fix-memory-leak-when-fail-to-register-device.patch new file mode 100644 index 00000000000..303cb2bfa91 --- /dev/null +++ b/queue-4.13/pm-devfreq-fix-memory-leak-when-fail-to-register-device.patch @@ -0,0 +1,46 @@ +From 9e14de1077e9c34f141cf98bdba60cdd5193d962 Mon Sep 17 00:00:00 2001 +From: Chanwoo Choi +Date: Thu, 24 Aug 2017 10:42:48 +0900 +Subject: PM / devfreq: Fix memory leak when fail to register device + +From: Chanwoo Choi + +commit 9e14de1077e9c34f141cf98bdba60cdd5193d962 upstream. + +When the devfreq_add_device fails to register deivce, the memory +leak of devfreq instance happen. So, this patch fix the memory +leak issue. Before freeing the devfreq instance checks whether +devfreq instance is NULL or not because the device_unregister() +frees the devfreq instance when jumping to the 'err_init'. +It is to prevent the duplicate the kfee(devfreq). + +Fixes: ac4b281176a5 ("PM / devfreq: fix duplicated kfree on devfreq pointer") +Signed-off-by: Chanwoo Choi +Signed-off-by: MyungJoo Ham +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/devfreq/devfreq.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/devfreq/devfreq.c ++++ b/drivers/devfreq/devfreq.c +@@ -564,7 +564,7 @@ struct devfreq *devfreq_add_device(struc + err = device_register(&devfreq->dev); + if (err) { + mutex_unlock(&devfreq->lock); +- goto err_out; ++ goto err_dev; + } + + devfreq->trans_table = devm_kzalloc(&devfreq->dev, +@@ -610,6 +610,9 @@ err_init: + mutex_unlock(&devfreq_list_lock); + + device_unregister(&devfreq->dev); ++err_dev: ++ if (devfreq) ++ kfree(devfreq); + err_out: + return ERR_PTR(err); + } diff --git a/queue-4.13/sched-cpuset-pm-fix-cpuset-vs.-suspend-resume-bugs.patch b/queue-4.13/sched-cpuset-pm-fix-cpuset-vs.-suspend-resume-bugs.patch new file mode 100644 index 00000000000..dacbf5fd18b --- /dev/null +++ b/queue-4.13/sched-cpuset-pm-fix-cpuset-vs.-suspend-resume-bugs.patch @@ -0,0 +1,167 @@ +From 50e76632339d4655859523a39249dd95ee5e93e7 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Thu, 7 Sep 2017 11:13:38 +0200 +Subject: sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs + +From: Peter Zijlstra + +commit 50e76632339d4655859523a39249dd95ee5e93e7 upstream. + +Cpusets vs. suspend-resume is _completely_ broken. And it got noticed +because it now resulted in non-cpuset usage breaking too. + +On suspend cpuset_cpu_inactive() doesn't call into +cpuset_update_active_cpus() because it doesn't want to move tasks about, +there is no need, all tasks are frozen and won't run again until after +we've resumed everything. + +But this means that when we finally do call into +cpuset_update_active_cpus() after resuming the last frozen cpu in +cpuset_cpu_active(), the top_cpuset will not have any difference with +the cpu_active_mask and this it will not in fact do _anything_. + +So the cpuset configuration will not be restored. This was largely +hidden because we would unconditionally create identity domains and +mobile users would not in fact use cpusets much. And servers what do use +cpusets tend to not suspend-resume much. + +An addition problem is that we'd not in fact wait for the cpuset work to +finish before resuming the tasks, allowing spurious migrations outside +of the specified domains. + +Fix the rebuild by introducing cpuset_force_rebuild() and fix the +ordering with cpuset_wait_for_hotplug(). + +Reported-by: Andy Lutomirski +Signed-off-by: Peter Zijlstra (Intel) +Cc: Andy Lutomirski +Cc: Linus Torvalds +Cc: Mike Galbraith +Cc: Peter Zijlstra +Cc: Rafael J. Wysocki +Cc: Tejun Heo +Cc: Thomas Gleixner +Fixes: deb7aa308ea2 ("cpuset: reorganize CPU / memory hotplug handling") +Link: http://lkml.kernel.org/r/20170907091338.orwxrqkbfkki3c24@hirez.programming.kicks-ass.net +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/cpuset.h | 6 ++++++ + kernel/cgroup/cpuset.c | 16 +++++++++++++++- + kernel/power/process.c | 5 ++++- + kernel/sched/core.c | 7 +++---- + 4 files changed, 28 insertions(+), 6 deletions(-) + +--- a/include/linux/cpuset.h ++++ b/include/linux/cpuset.h +@@ -57,7 +57,9 @@ static inline void cpuset_dec(void) + + extern int cpuset_init(void); + extern void cpuset_init_smp(void); ++extern void cpuset_force_rebuild(void); + extern void cpuset_update_active_cpus(void); ++extern void cpuset_wait_for_hotplug(void); + extern void cpuset_cpus_allowed(struct task_struct *p, struct cpumask *mask); + extern void cpuset_cpus_allowed_fallback(struct task_struct *p); + extern nodemask_t cpuset_mems_allowed(struct task_struct *p); +@@ -170,11 +172,15 @@ static inline bool cpusets_enabled(void) + static inline int cpuset_init(void) { return 0; } + static inline void cpuset_init_smp(void) {} + ++static inline void cpuset_force_rebuild(void) { } ++ + static inline void cpuset_update_active_cpus(void) + { + partition_sched_domains(1, NULL, NULL); + } + ++static inline void cpuset_wait_for_hotplug(void) { } ++ + static inline void cpuset_cpus_allowed(struct task_struct *p, + struct cpumask *mask) + { +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -2260,6 +2260,13 @@ retry: + mutex_unlock(&cpuset_mutex); + } + ++static bool force_rebuild; ++ ++void cpuset_force_rebuild(void) ++{ ++ force_rebuild = true; ++} ++ + /** + * cpuset_hotplug_workfn - handle CPU/memory hotunplug for a cpuset + * +@@ -2334,8 +2341,10 @@ static void cpuset_hotplug_workfn(struct + } + + /* rebuild sched domains if cpus_allowed has changed */ +- if (cpus_updated) ++ if (cpus_updated || force_rebuild) { ++ force_rebuild = false; + rebuild_sched_domains(); ++ } + } + + void cpuset_update_active_cpus(void) +@@ -2354,6 +2363,11 @@ void cpuset_update_active_cpus(void) + schedule_work(&cpuset_hotplug_work); + } + ++void cpuset_wait_for_hotplug(void) ++{ ++ flush_work(&cpuset_hotplug_work); ++} ++ + /* + * Keep top_cpuset.mems_allowed tracking node_states[N_MEMORY]. + * Call this routine anytime after node_states[N_MEMORY] changes. +--- a/kernel/power/process.c ++++ b/kernel/power/process.c +@@ -20,8 +20,9 @@ + #include + #include + #include ++#include + +-/* ++/* + * Timeout for stopping processes + */ + unsigned int __read_mostly freeze_timeout_msecs = 20 * MSEC_PER_SEC; +@@ -202,6 +203,8 @@ void thaw_processes(void) + __usermodehelper_set_disable_depth(UMH_FREEZING); + thaw_workqueues(); + ++ cpuset_wait_for_hotplug(); ++ + read_lock(&tasklist_lock); + for_each_process_thread(g, p) { + /* No other threads should have PF_SUSPEND_TASK set */ +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -5538,16 +5538,15 @@ static void cpuset_cpu_active(void) + * operation in the resume sequence, just build a single sched + * domain, ignoring cpusets. + */ +- num_cpus_frozen--; +- if (likely(num_cpus_frozen)) { +- partition_sched_domains(1, NULL, NULL); ++ partition_sched_domains(1, NULL, NULL); ++ if (--num_cpus_frozen) + return; +- } + /* + * This is the last CPU online operation. So fall through and + * restore the original sched domains by considering the + * cpuset configurations. + */ ++ cpuset_force_rebuild(); + } + cpuset_update_active_cpus(); + } diff --git a/queue-4.13/series b/queue-4.13/series index 203f9d3460d..5b37e561ce4 100644 --- a/queue-4.13/series +++ b/queue-4.13/series @@ -83,3 +83,19 @@ pci-pciehp-report-power-fault-only-once-until-we-clear-it.patch net-netfilter-nf_conntrack_core-fix-net_conntrack_lock.patch s390-mm-fix-local-tlb-flushing-vs.-detach-of-an-mm-address-space.patch s390-mm-fix-race-on-mm-context.flush_mm.patch +media-v4l2-compat-ioctl32-fix-timespec-conversion.patch +media-revert-lirc_dev-remove-superfluous-get-put_device-calls.patch +media-venus-fix-copy-paste-error-in-return_buf_error.patch +media-uvcvideo-prevent-heap-overflow-when-accessing-mapped-controls.patch +media-adv7180-add-missing-adv7180cp-adv7180st-i2c-device-ids.patch +pm-devfreq-fix-memory-leak-when-fail-to-register-device.patch +alsa-seq-cancel-pending-autoload-work-at-unbinding-device.patch +bcache-initialize-dirty-stripes-in-flash_dev_run.patch +bcache-fix-leak-of-bdev-reference.patch +bcache-do-not-subtract-sectors_to_gc-for-bypassed-io.patch +bcache-correct-cache_dirty_target-in-__update_writeback_rate.patch +bcache-correct-return-value-for-sysfs-attach-errors.patch +bcache-fix-sequential-large-write-io-bypass.patch +bcache-fix-for-gc-and-write-back-race.patch +bcache-fix-bch_hprint-crash-and-improve-output.patch +sched-cpuset-pm-fix-cpuset-vs.-suspend-resume-bugs.patch