Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1326014 > unrolled thread

[3.16.y-ckt stable] Linux 3.16.7-ckt24 stable review

Back to article view | Back to linux.kernel

Contents

  [3.16.y-ckt stable] Linux 3.16.7-ckt24 stable review Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 179/180] cifs: Ratelimit kernel log messages Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 017/180] xen-netfront: print correct number of queues Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 168/180] batman-adv: Drop immediate batadv_neigh_node free function Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 159/180] um: Fix build error and kconfig for i386 Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 120/180] crypto: af_alg - Disallow bind/setkey/... after accept(2) Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 170/180] batman-adv: Drop immediate batadv_hard_iface free function Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 057/180] rtlwifi: rtl8192cu: Add missing parameter setup Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 105/180] cifs: fix race between call_async() and reconnect() Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 046/180] arm64: kernel: enforce pmuserenr_el0 initialization and restore Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 050/180] udf: limit the maximum number of indirect extents in a row Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 020/180] sctp: Prevent soft lockup when sctp_accept() is called during a timeout event Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 156/180] power: test_power: correctly handle empty writes Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 160/180] ipv6: tcp: add rcu locking in tcp_v6_send_synack() Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 055/180] rtlwifi: rtl8192se: Fix module parameter initialization Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 010/180] bonding: Prevent IPv6 link local address on enslaved devices Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 071/180] x86/xen: don't reset vcpu_info on a cancelled suspend Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 098/180] x86/mm: Improve switch_mm() barrier comments Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 082/180] drm/nouveau/kms: take mode_config mutex in connector hotplug path Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 112/180] zram/zcomp: use GFP_NOIO to allocate streams Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 025/180] [media] media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 004/180] connector: bump skb->users before callback invocation Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 006/180] bridge: Only call /sbin/bridge-stp for the initial network namespace Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 092/180] ALSA: seq: Fix race at timer setup and close Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 171/180] batman-adv: Drop immediate orig_node free function Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 180/180] HID: usbhid: fix recursive deadlock Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 040/180] powerpc: Make value-returning atomics fully ordered Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 149/180] mtd: nand: remove unused and buggy get_platform_nandchip() helper function Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 001/180] drm/nouveau/nv46: Change mc subdev oclass from nv44 to nv4c Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 036/180] EDAC: Fix the leak of mci->bus->name when bus_register fails Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 014/180] team: Replace rcu_read_lock with a mutex in team_vlan_rx_kill_vid Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 096/180] scripts/recordmcount.pl: support data in text section on powerpc Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 077/180] locks: fix unlock when fcntl_setlk races with a close Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 054/180] rtlwifi: rtl8192de: Fix incorrect module parameter descriptions Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 030/180] xhci: refuse loading if nousb is used Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 143/180] SCSI: initio: remove duplicate module device table Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 155/180] perf/x86: Fix filter_events() bug with event mappings Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 162/180] Btrfs: clean up an error code in btrfs_init_space_info() Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 164/180] batman-adv: Avoid recursive call_rcu for batadv_bla_claim Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 175/180] net/mlx4: Remove unused macro Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 174/180] IB/mlx4: Initialize hop_limit when creating address handle Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 157/180] firmware: actually return NULL on failed request_firmware_nowait() Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 163/180] bridge: fix lockdep addr_list_lock false positive splat Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 165/180] batman-adv: Avoid recursive call_rcu for batadv_nc_node Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 166/180] batman-adv: fix potential TT client + orig-node memory leak Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 167/180] batman-adv: Drop immediate batadv_orig_ifinfo free function Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 176/180] arm64: fix building without CONFIG_UID16 Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 173/180] mmc: debugfs: correct wrong voltage value Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 161/180] mmc: sd: limit SD card power limit according to cards capabilities Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 154/180] kconfig: return 'false' instead of 'no' in bool function Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 169/180] batman-adv: Drop immediate neigh_ifinfo free function Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 153/180] sysrq: Fix warning in sysrq generated crash. Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 152/180] x86/LDT: Print the real LDT base address Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 172/180] printk: help pr_debug and pr_devel to optimize out arguments Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 158/180] target: Fix a memory leak in target_dev_lba_map_store() Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 177/180] mn10300: Select CONFIG_HAVE_UID16 to fix build failure Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 178/180] openrisc: fix CONFIG_UID16 setting Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 151/180] pinctrl: bcm2835: Fix memory leak in error path Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:00 +0100
    [PATCH 3.16.y-ckt 141/180] drm/i915: On fb alloc failure, unref gem object where it gets refed Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:00 +0100
    [PATCH 3.16.y-ckt 145/180] clk: st: avoid uninitialized variable use Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:00 +0100
    [PATCH 3.16.y-ckt 144/180] clk: xgene: Fix divider with non-zero shift value Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:00 +0100
    [PATCH 3.16.y-ckt 147/180] mtd: nand: fix ONFI parameter page layout Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:00 +0100
    [PATCH 3.16.y-ckt 146/180] ath9k_htc: check for underflow in ath9k_htc_rx_msg() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:00 +0100
    [PATCH 3.16.y-ckt 148/180] mtd: nand: denali: add missing nand_release() call in denali_remove() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:00 +0100
    [PATCH 3.16.y-ckt 138/180] MAINTAINERS: return arch/sh to maintained state, with new maintainers Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
    [PATCH 3.16.y-ckt 142/180] [media] rc: allow rc modules to be loaded if rc-main is not a module Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
    [PATCH 3.16.y-ckt 134/180] ideapad-laptop: Add Lenovo ideapad Y700-17ISK to no_hw_rfkill dmi list Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
    [PATCH 3.16.y-ckt 133/180] IB/qib: Support creating qps with GFP_NOIO flag Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
    [PATCH 3.16.y-ckt 052/180] USB: cp210x: add ID for ELV Marble Sound Board 1 Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
    [PATCH 3.16.y-ckt 140/180] drm/i915: avoid deadlock on failure paths in __intel_framebuffer_create() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
    [PATCH 3.16.y-ckt 139/180] ideapad-laptop: Add Lenovo Yoga 700 to no_hw_rfkill dmi list Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
    [PATCH 3.16.y-ckt 137/180] ocfs2: NFS hangs in __ocfs2_cluster_lock due to race with ocfs2_unblock_lock Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
    [PATCH 3.16.y-ckt 135/180] iscsi-target: Fix potential dead-lock during node acl delete Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
    [PATCH 3.16.y-ckt 129/180] ALSA: control: Avoid kernel warnings from tlv ioctl with numid 0 Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
    [PATCH 3.16.y-ckt 136/180] ALSA: timer: Handle disconnection more safely Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
    [PATCH 3.16.y-ckt 115/180] memcg: only free spare array when readers are done Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 127/180] ALSA: pcm: Fix snd_pcm_hw_params struct copy in compat mode Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 118/180] printk: do cond_resched() between lines while outputting to consoles Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 110/180] ocfs2/dlm: ignore cleaning the migration mle that is inuse Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 107/180] m32r: fix m32104ut_defconfig build fail Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 124/180] crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey path Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 111/180] ALSA: timer: Harden slave timer list handling Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 132/180] IB/qib: fix mcast detach when qp not attached Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 117/180] kernel/panic.c: turn off locks debug before releasing console lock Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 114/180] mm: soft-offline: check return value in second __get_any_page() call Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 083/180] x86/mm: Add barriers and document switch_mm()-vs-flush synchronization Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 123/180] crypto: hash - Add crypto_ahash_has_setkey Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 128/180] ALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 116/180] panic: release stale console lock to always get the logbuf printed out Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 126/180] ALSA: hrtimer: Fix stall by hrtimer_cancel() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 119/180] ALSA: hda - Fix bass pin fixup for ASUS N550JX Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 122/180] crypto: af_alg - Add nokey compatibility path Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 130/180] crypto: algif_skcipher - Load TX SG list after waiting Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 131/180] crypto: crc32c - Fix crc32c soft dependency Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 125/180] crypto: af_alg - Forbid bind(2) when nokey child sockets are present Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 113/180] zram: try vmalloc() after kmalloc() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 121/180] crypto: af_alg - Fix socket double-free when accept fails Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 090/180] x86/reboot/quirks: Add iMac10,1 to pci_reboot_dmi_table[] Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 093/180] virtio_balloon: fix race by fill and leak Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 084/180] x86/boot: Double BOOT_HEAP_SIZE to 64KB Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 087/180] xfs: handle dquot buffer readahead in log recovery correctly Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 103/180] ALSA: timer: Fix race among timer ioctls Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 075/180] PCI: host: Mark PCIe/PCI (MSI) IRQ cascade handlers as IRQF_NO_THREAD Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 095/180] parisc: Fix __ARCH_SI_PREAMBLE_SIZE Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 094/180] virtio_balloon: fix race between migration and ballooning Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 104/180] sparc64: fix incorrect sign extension in sys_sparc64_personality Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 085/180] s390: fix normalization bug in exception table sorting Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 088/180] clocksource/drivers/vt8500: Increase the minimum delta Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 100/180] dmaengine: dw: fix cyclic transfer setup Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 091/180] ALSA: seq: Fix missing NULL check at remove_events ioctl Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 101/180] dmaengine: dw: fix cyclic transfer callbacks Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 097/180] powerpc/module: Handle R_PPC64_ENTRY relocations Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 108/180] dma-debug: switch check from _text to _stext Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 106/180] cifs_dbg() outputs an uninitialized buffer in cifs_readdir() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 089/180] Input: elantech - mark protocols v2 and v3 as semi-mt Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 078/180] ASoC: compress: Fix compress device direction check Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 102/180] mmc: mmci: fix an ages old detection error Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 086/180] xfs: inode recovery readahead can race with inode buffer creation Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 109/180] scripts/bloat-o-meter: fix python3 syntax error Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 068/180] wlcore/wl12xx: spi: fix NULL pointer dereference (Oops) Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
    [PATCH 3.16.y-ckt 079/180] dm snapshot: fix hung bios when copy error occurs Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
    [PATCH 3.16.y-ckt 067/180] bcache: Change refill_dirty() to always scan entire disk if necessary Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
    [PATCH 3.16.y-ckt 069/180] Input: i8042 - add Fujitsu Lifebook U745 to the nomux list Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
    [PATCH 3.16.y-ckt 072/180] udf: Prevent buffer overrun with multi-byte characters Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
    [PATCH 3.16.y-ckt 070/180] libxfs: pack the agfl header structure so XFS_AGFL_SIZE is correct Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
    [PATCH 3.16.y-ckt 073/180] udf: Check output buffer length when converting name to CS0 Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
    [PATCH 3.16.y-ckt 076/180] iwlwifi: update and fix 7265 series PCI IDs Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
    [PATCH 3.16.y-ckt 080/180] uml: fix hostfs mknod() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
    [PATCH 3.16.y-ckt 074/180] PCI: Fix minimum allocation address overwrite Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
    [PATCH 3.16.y-ckt 081/180] uml: flush stdout before forking Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
    [PATCH 3.16.y-ckt 060/180] bcache: fix a livelock when we cause a huge number of cache misses Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 065/180] bcache: allows use of register in udev to avoid "device_busy" error. Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 047/180] drm/radeon: clean up fujitsu quirks Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 064/180] bcache: unregister reboot notifier if bcache fails to unregister device Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 056/180] rtlwifi: rtl8192ce: Fix handling of module parameters Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 063/180] bcache: fix a leak in bch_cached_dev_run() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 049/180] mmc: sdhci: Fix sdhci_runtime_pm_bus_on/off() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 058/180] NFSv4: Don't perform cached access checks before we've OPENed the file Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 062/180] bcache: clear BCACHE_DEV_UNLINK_DONE flag when attaching a backing device Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 044/180] futex: Drop refcount if requeue_pi() acquired the rtmutex Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 066/180] bcache: prevent crash on changing writeback_running Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 053/180] posix-clock: Fix return code on the poll method's error path Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 048/180] mmc: sdio: Fix invalid vdd in voltage switch power cycle Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 042/180] dm space map metadata: remove unused variable in brb_pop() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 061/180] bcache: Add a cond_resched() call to gc Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 059/180] NFS: Fix attribute cache revalidation Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 051/180] nfs: Fix race in __update_open_stateid() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 016/180] xen-netfront: respect user provided max_queues Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 028/180] KVM: x86: correctly print #AC in traces Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 022/180] sctp: start t5 timer only when peer rwnd is 0 and local state is SHUTDOWN_PENDING Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 029/180] drm/radeon: call hpd_irq_event on resume Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 021/180] sctp: convert sack_needed and sack_generation to bits Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 039/180] arm64: mm: ensure that the zero page is visible to the page table walker Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 026/180] tools lib traceevent: Fix output of %llu for 64 bit values read on 32 bit machines Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 015/180] xen-netback: respect user provided max_queues Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 035/180] wlcore/wl12xx: spi: fix oops on firmware load Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 023/180] nfs: Fix unused variable error Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 041/180] powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 031/180] arm64: Clear out any singlestep state on a ptrace detach operation Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 024/180] [media] gspca: ov534/topro: prevent a division by 0 Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 034/180] rtlwifi: fix memory leak for USB device Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 043/180] dm thin: fix race condition when destroying thin pool workqueue Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 045/180] arm64: mdscr_el1: avoid exposing DCC to userspace Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 033/180] Bluetooth: Add support of Toshiba Broadcom based devices Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 032/180] time: Avoid signed overflow in timekeeping_get_ns() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 027/180] KVM: x86: expose MSR_TSC_AUX to userspace Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 018/180] xen-netfront: update num_queues to real created Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 038/180] EDAC: Robustify workqueues destruction Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 037/180] EDAC, mc_sysfs: Fix freeing bus' name Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 019/180] xfrm: dst_entries_init() per-net dst_ops Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 011/180] phonet: properly unshare skbs in phonet_rcv() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100
    [PATCH 3.16.y-ckt 009/180] tcp_yeah: don't set ssthresh below 2 Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100
    [PATCH 3.16.y-ckt 012/180] net: bpf: reject invalid shifts Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100
    [PATCH 3.16.y-ckt 003/180] sctp: sctp should release assoc when sctp_make_abort_user return NULL in sctp_close Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100
    [PATCH 3.16.y-ckt 007/180] vxlan: fix test which detect duplicate vxlan iface Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100
    [PATCH 3.16.y-ckt 013/180] ipv6: update skb->csum when CE mark is propagated Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100
    [PATCH 3.16.y-ckt 005/180] unix: properly account for FDs passed over unix sockets Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100
    [PATCH 3.16.y-ckt 002/180] veth: don’t modify ip_summed; doing so treats packets with bad checksums as good. Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100
    [PATCH 3.16.y-ckt 008/180] net: sctp: prevent writes to cookie_hmac_alg from accessing invalid memory Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100

Page 6 of 9 — ← Prev page 1 2 3 4 5 [6] 7 8 9  Next page →

#1326176 — [PATCH 3.16.y-ckt 087/180] xfs: handle dquot buffer readahead in log recovery correctly

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Dave Chinner <dchinner@redhat.com>

commit 7d6a13f023567d573ac362502bb702eda716e654 upstream.

When we do dquot readahead in log recovery, we do not use a verifier
as the underlying buffer may not have dquots in it. e.g. the
allocation operation hasn't yet been replayed. Hence we do not want
to fail recovery because we detect an operation to be replayed has
not been run yet. This problem was addressed for inodes in commit
d891400 ("xfs: inode buffers may not be valid during recovery
readahead") but the problem was not recognised to exist for dquots
and their buffers as the dquot readahead did not have a verifier.

The result of not using a verifier is that when the buffer is then
next read to replay a dquot modification, the dquot buffer verifier
will only be attached to the buffer if *readahead is not complete*.
Hence we can read the buffer, replay the dquot changes and then add
it to the delwri submission list without it having a verifier
attached to it. This then generates warnings in xfs_buf_ioapply(),
which catches and warns about this case.

Fix this and make it handle the same readahead verifier error cases
as for inode buffers by adding a new readahead verifier that has a
write operation as well as a read operation that marks the buffer as
not done if any corruption is detected.  Also make sure we don't run
readahead if the dquot buffer has been marked as cancelled by
recovery.

This will result in readahead either succeeding and the buffer
having a valid write verifier, or readahead failing and the buffer
state requiring the subsequent read to resubmit the IO with the new
verifier.  In either case, this will result in the buffer always
ending up with a valid write verifier on it.

Note: we also need to fix the inode buffer readahead error handling
to mark the buffer with EIO. Brian noticed the code I copied from
there wrong during review, so fix it at the same time. Add comments
linking the two functions that handle readahead verifier errors
together so we don't forget this behavioural link in future.

Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
[ luis: backported to 3.16:
  - struct xfs_buf_ops does not have a 'name' field in 3.16
  - adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 fs/xfs/xfs_dquot_buf.c   | 35 +++++++++++++++++++++++++++++------
 fs/xfs/xfs_inode_buf.c   |  2 ++
 fs/xfs/xfs_log_recover.c |  9 +++++++--
 fs/xfs/xfs_quota_defs.h  |  2 +-
 fs/xfs/xfs_shared.h      |  1 +
 5 files changed, 40 insertions(+), 9 deletions(-)

diff --git a/fs/xfs/xfs_dquot_buf.c b/fs/xfs/xfs_dquot_buf.c
index c2ac0c611ad8..0d54f5656c95 100644
--- a/fs/xfs/xfs_dquot_buf.c
+++ b/fs/xfs/xfs_dquot_buf.c
@@ -56,7 +56,7 @@ xfs_dqcheck(
 	xfs_dqid_t	 id,
 	uint		 type,	  /* used only when IO_dorepair is true */
 	uint		 flags,
-	char		 *str)
+	const char	 *str)
 {
 	xfs_dqblk_t	 *d = (xfs_dqblk_t *)ddq;
 	int		errs = 0;
@@ -209,7 +209,8 @@ xfs_dquot_buf_verify_crc(
 STATIC bool
 xfs_dquot_buf_verify(
 	struct xfs_mount	*mp,
-	struct xfs_buf		*bp)
+	struct xfs_buf		*bp,
+	int			warn)
 {
 	struct xfs_dqblk	*d = (struct xfs_dqblk *)bp->b_addr;
 	xfs_dqid_t		id = 0;
@@ -242,8 +243,7 @@ xfs_dquot_buf_verify(
 		if (i == 0)
 			id = be32_to_cpu(ddq->d_id);
 
-		error = xfs_dqcheck(mp, ddq, id + i, 0, XFS_QMOPT_DOWARN,
-				       "xfs_dquot_buf_verify");
+		error = xfs_dqcheck(mp, ddq, id + i, 0, warn, __func__);
 		if (error)
 			return false;
 	}
@@ -258,7 +258,7 @@ xfs_dquot_buf_read_verify(
 
 	if (!xfs_dquot_buf_verify_crc(mp, bp))
 		xfs_buf_ioerror(bp, EFSBADCRC);
-	else if (!xfs_dquot_buf_verify(mp, bp))
+	else if (!xfs_dquot_buf_verify(mp, bp, XFS_QMOPT_DOWARN))
 		xfs_buf_ioerror(bp, EFSCORRUPTED);
 
 	if (bp->b_error)
@@ -266,6 +266,25 @@ xfs_dquot_buf_read_verify(
 }
 
 /*
+ * readahead errors are silent and simply leave the buffer as !done so a real
+ * read will then be run with the xfs_dquot_buf_ops verifier. See
+ * xfs_inode_buf_verify() for why we use EIO and ~XBF_DONE here rather than
+ * reporting the failure.
+ */
+static void
+xfs_dquot_buf_readahead_verify(
+	struct xfs_buf	*bp)
+{
+	struct xfs_mount	*mp = bp->b_target->bt_mount;
+
+	if (!xfs_dquot_buf_verify_crc(mp, bp) ||
+	    !xfs_dquot_buf_verify(mp, bp, 0)) {
+		xfs_buf_ioerror(bp, -EIO);
+		bp->b_flags &= ~XBF_DONE;
+	}
+}
+
+/*
  * we don't calculate the CRC here as that is done when the dquot is flushed to
  * the buffer after the update is done. This ensures that the dquot in the
  * buffer always has an up-to-date CRC value.
@@ -276,7 +295,7 @@ xfs_dquot_buf_write_verify(
 {
 	struct xfs_mount	*mp = bp->b_target->bt_mount;
 
-	if (!xfs_dquot_buf_verify(mp, bp)) {
+	if (!xfs_dquot_buf_verify(mp, bp, XFS_QMOPT_DOWARN)) {
 		xfs_buf_ioerror(bp, EFSCORRUPTED);
 		xfs_verifier_error(bp);
 		return;
@@ -288,3 +307,7 @@ const struct xfs_buf_ops xfs_dquot_buf_ops = {
 	.verify_write = xfs_dquot_buf_write_verify,
 };
 
+const struct xfs_buf_ops xfs_dquot_buf_ra_ops = {
+	.verify_read = xfs_dquot_buf_readahead_verify,
+	.verify_write = xfs_dquot_buf_write_verify,
+};
diff --git a/fs/xfs/xfs_inode_buf.c b/fs/xfs/xfs_inode_buf.c
index fdc04bd2fdf7..46a6545f84f3 100644
--- a/fs/xfs/xfs_inode_buf.c
+++ b/fs/xfs/xfs_inode_buf.c
@@ -72,6 +72,8 @@ xfs_inobp_check(
  * recovery and we don't get unnecssary panics on debug kernels. We use EIO here
  * because all we want to do is say readahead failed; there is no-one to report
  * the error to, so this will distinguish it from a non-ra verifier failure.
+ * Changes to this readahead error behavour also need to be reflected in
+ * xfs_dquot_buf_readahead_verify().
  */
 static void
 xfs_inode_buf_verify(
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index dae4723a02bf..4b973653a0e8 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -3334,6 +3334,7 @@ xlog_recover_dquot_ra_pass2(
 	struct xfs_disk_dquot	*recddq;
 	struct xfs_dq_logformat	*dq_f;
 	uint			type;
+	int			len;
 
 
 	if (mp->m_qflags == 0)
@@ -3354,8 +3355,12 @@ xlog_recover_dquot_ra_pass2(
 	ASSERT(dq_f);
 	ASSERT(dq_f->qlf_len == 1);
 
-	xfs_buf_readahead(mp->m_ddev_targp, dq_f->qlf_blkno,
-			  XFS_FSB_TO_BB(mp, dq_f->qlf_len), NULL);
+	len = XFS_FSB_TO_BB(mp, dq_f->qlf_len);
+	if (xlog_peek_buffer_cancelled(log, dq_f->qlf_blkno, len, 0))
+		return;
+
+	xfs_buf_readahead(mp->m_ddev_targp, dq_f->qlf_blkno, len,
+			  &xfs_dquot_buf_ra_ops);
 }
 
 STATIC void
diff --git a/fs/xfs/xfs_quota_defs.h b/fs/xfs/xfs_quota_defs.h
index 137e20937077..6fc554e2d846 100644
--- a/fs/xfs/xfs_quota_defs.h
+++ b/fs/xfs/xfs_quota_defs.h
@@ -155,7 +155,7 @@ typedef __uint16_t	xfs_qwarncnt_t;
 #define XFS_QMOPT_RESBLK_MASK	(XFS_QMOPT_RES_REGBLKS | XFS_QMOPT_RES_RTBLKS)
 
 extern int xfs_dqcheck(struct xfs_mount *mp, xfs_disk_dquot_t *ddq,
-		       xfs_dqid_t id, uint type, uint flags, char *str);
+		       xfs_dqid_t id, uint type, uint flags, const char *str);
 extern int xfs_calc_dquots_per_chunk(unsigned int nbblks);
 
 #endif	/* __XFS_QUOTA_H__ */
diff --git a/fs/xfs/xfs_shared.h b/fs/xfs/xfs_shared.h
index 82404da2ca67..41b510c11e2c 100644
--- a/fs/xfs/xfs_shared.h
+++ b/fs/xfs/xfs_shared.h
@@ -49,6 +49,7 @@ extern const struct xfs_buf_ops xfs_inobt_buf_ops;
 extern const struct xfs_buf_ops xfs_inode_buf_ops;
 extern const struct xfs_buf_ops xfs_inode_buf_ra_ops;
 extern const struct xfs_buf_ops xfs_dquot_buf_ops;
+extern const struct xfs_buf_ops xfs_dquot_buf_ra_ops;
 extern const struct xfs_buf_ops xfs_sb_buf_ops;
 extern const struct xfs_buf_ops xfs_sb_quiet_buf_ops;
 extern const struct xfs_buf_ops xfs_symlink_buf_ops;

[toc] | [prev] | [next] | [standalone]

#1326177 — [PATCH 3.16.y-ckt 103/180] ALSA: timer: Fix race among timer ioctls

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Takashi Iwai <tiwai@suse.de>

commit af368027a49a751d6ff4ee9e3f9961f35bb4fede upstream.

ALSA timer ioctls have an open race and this may lead to a
use-after-free of timer instance object.  A simplistic fix is to make
each ioctl exclusive.  We have already tread_sem for controlling the
tread, and extend this as a global mutex to be applied to each ioctl.

The downside is, of course, the worse concurrency.  But these ioctls
aren't to be parallel accessible, in anyway, so it should be fine to
serialize there.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 sound/core/timer.c | 32 +++++++++++++++++++-------------
 1 file changed, 19 insertions(+), 13 deletions(-)

diff --git a/sound/core/timer.c b/sound/core/timer.c
index 222c549341c8..79fd8a1a9afc 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -73,7 +73,7 @@ struct snd_timer_user {
 	struct timespec tstamp;		/* trigger tstamp */
 	wait_queue_head_t qchange_sleep;
 	struct fasync_struct *fasync;
-	struct mutex tread_sem;
+	struct mutex ioctl_lock;
 };
 
 /* list of timers */
@@ -1257,7 +1257,7 @@ static int snd_timer_user_open(struct inode *inode, struct file *file)
 		return -ENOMEM;
 	spin_lock_init(&tu->qlock);
 	init_waitqueue_head(&tu->qchange_sleep);
-	mutex_init(&tu->tread_sem);
+	mutex_init(&tu->ioctl_lock);
 	tu->ticks = 1;
 	tu->queue_size = 128;
 	tu->queue = kmalloc(tu->queue_size * sizeof(struct snd_timer_read),
@@ -1277,8 +1277,10 @@ static int snd_timer_user_release(struct inode *inode, struct file *file)
 	if (file->private_data) {
 		tu = file->private_data;
 		file->private_data = NULL;
+		mutex_lock(&tu->ioctl_lock);
 		if (tu->timeri)
 			snd_timer_close(tu->timeri);
+		mutex_unlock(&tu->ioctl_lock);
 		kfree(tu->queue);
 		kfree(tu->tqueue);
 		kfree(tu);
@@ -1516,7 +1518,6 @@ static int snd_timer_user_tselect(struct file *file,
 	int err = 0;
 
 	tu = file->private_data;
-	mutex_lock(&tu->tread_sem);
 	if (tu->timeri) {
 		snd_timer_close(tu->timeri);
 		tu->timeri = NULL;
@@ -1560,7 +1561,6 @@ static int snd_timer_user_tselect(struct file *file,
 	}
 
       __err:
-      	mutex_unlock(&tu->tread_sem);
 	return err;
 }
 
@@ -1773,7 +1773,7 @@ enum {
 	SNDRV_TIMER_IOCTL_PAUSE_OLD = _IO('T', 0x23),
 };
 
-static long snd_timer_user_ioctl(struct file *file, unsigned int cmd,
+static long __snd_timer_user_ioctl(struct file *file, unsigned int cmd,
 				 unsigned long arg)
 {
 	struct snd_timer_user *tu;
@@ -1790,17 +1790,11 @@ static long snd_timer_user_ioctl(struct file *file, unsigned int cmd,
 	{
 		int xarg;
 
-		mutex_lock(&tu->tread_sem);
-		if (tu->timeri)	{	/* too late */
-			mutex_unlock(&tu->tread_sem);
+		if (tu->timeri)	/* too late */
 			return -EBUSY;
-		}
-		if (get_user(xarg, p)) {
-			mutex_unlock(&tu->tread_sem);
+		if (get_user(xarg, p))
 			return -EFAULT;
-		}
 		tu->tread = xarg ? 1 : 0;
-		mutex_unlock(&tu->tread_sem);
 		return 0;
 	}
 	case SNDRV_TIMER_IOCTL_GINFO:
@@ -1833,6 +1827,18 @@ static long snd_timer_user_ioctl(struct file *file, unsigned int cmd,
 	return -ENOTTY;
 }
 
+static long snd_timer_user_ioctl(struct file *file, unsigned int cmd,
+				 unsigned long arg)
+{
+	struct snd_timer_user *tu = file->private_data;
+	long ret;
+
+	mutex_lock(&tu->ioctl_lock);
+	ret = __snd_timer_user_ioctl(file, cmd, arg);
+	mutex_unlock(&tu->ioctl_lock);
+	return ret;
+}
+
 static int snd_timer_user_fasync(int fd, struct file * file, int on)
 {
 	struct snd_timer_user *tu;

[toc] | [prev] | [next] | [standalone]

#1326178 — [PATCH 3.16.y-ckt 075/180] PCI: host: Mark PCIe/PCI (MSI) IRQ cascade handlers as IRQF_NO_THREAD

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Grygorii Strashko <grygorii.strashko@ti.com>

commit 8ff0ef996ca00028519c70e8d51d32bd37eb51dc upstream.

On -RT and if kernel is booting with "threadirqs" cmd line parameter,
PCIe/PCI (MSI) IRQ cascade handlers (like dra7xx_pcie_msi_irq_handler())
will be forced threaded and, as result, will generate warnings like this:

  WARNING: CPU: 1 PID: 82 at kernel/irq/handle.c:150 handle_irq_event_percpu+0x14c/0x174()
  irq 460 handler irq_default_primary_handler+0x0/0x14 enabled interrupts
  Backtrace:
   (warn_slowpath_common) from (warn_slowpath_fmt+0x38/0x40)
   (warn_slowpath_fmt) from (handle_irq_event_percpu+0x14c/0x174)
   (handle_irq_event_percpu) from (handle_irq_event+0x84/0xb8)
   (handle_irq_event) from (handle_simple_irq+0x90/0x118)
   (handle_simple_irq) from (generic_handle_irq+0x30/0x44)
   (generic_handle_irq) from (dra7xx_pcie_msi_irq_handler+0x7c/0x8c)
   (dra7xx_pcie_msi_irq_handler) from (irq_forced_thread_fn+0x28/0x5c)
   (irq_forced_thread_fn) from (irq_thread+0x128/0x204)

This happens because all of them invoke generic_handle_irq() from the
requested handler.  generic_handle_irq() grabs raw_locks and thus needs to
run in raw-IRQ context.

This issue was originally reproduced on TI dra7-evem, but, as was
identified during discussion [1], other hosts can also suffer from this
issue.  Fix all them at once by marking PCIe/PCI (MSI) IRQ cascade handlers
IRQF_NO_THREAD explicitly.

[1] http://lkml.kernel.org/r/1448027966-21610-1-git-send-email-grygorii.strashko@ti.com

[bhelgaas: add stable tag, fix typos]
Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Lucas Stach <l.stach@pengutronix.de> (for imx6)
CC: Kishon Vijay Abraham I <kishon@ti.com>
CC: Jingoo Han <jingoohan1@gmail.com>
CC: Kukjin Kim <kgene@kernel.org>
CC: Krzysztof Kozlowski <k.kozlowski@samsung.com>
CC: Richard Zhu <Richard.Zhu@freescale.com>
CC: Thierry Reding <thierry.reding@gmail.com>
CC: Stephen Warren <swarren@wwwdotorg.org>
CC: Alexandre Courbot <gnurou@gmail.com>
CC: Simon Horman <horms@verge.net.au>
CC: Pratyush Anand <pratyush.anand@gmail.com>
CC: Michal Simek <michal.simek@xilinx.com>
CC: "Sören Brinkmann" <soren.brinkmann@xilinx.com>
CC: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
[ luis: backported to 3.16:
  - dropped changes to pci-dra7xx.c, pcie-spear13xx.c, pcie-xilinx.c
  - adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/pci/host/pci-exynos.c | 3 ++-
 drivers/pci/host/pci-imx6.c   | 3 ++-
 drivers/pci/host/pci-tegra.c  | 2 +-
 drivers/pci/host/pcie-rcar.c  | 6 ++++--
 4 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/drivers/pci/host/pci-exynos.c b/drivers/pci/host/pci-exynos.c
index c5d0ca384502..ab8bcaabaf21 100644
--- a/drivers/pci/host/pci-exynos.c
+++ b/drivers/pci/host/pci-exynos.c
@@ -535,7 +535,8 @@ static int __init add_pcie_port(struct pcie_port *pp,
 
 		ret = devm_request_irq(&pdev->dev, pp->msi_irq,
 					exynos_pcie_msi_irq_handler,
-					IRQF_SHARED, "exynos-pcie", pp);
+					IRQF_SHARED | IRQF_NO_THREAD,
+					"exynos-pcie", pp);
 		if (ret) {
 			dev_err(&pdev->dev, "failed to request msi irq\n");
 			return ret;
diff --git a/drivers/pci/host/pci-imx6.c b/drivers/pci/host/pci-imx6.c
index a568efaa331c..72cd923e4ab3 100644
--- a/drivers/pci/host/pci-imx6.c
+++ b/drivers/pci/host/pci-imx6.c
@@ -497,7 +497,8 @@ static int __init imx6_add_pcie_port(struct pcie_port *pp,
 
 		ret = devm_request_irq(&pdev->dev, pp->msi_irq,
 		                       imx6_pcie_msi_handler,
-		                       IRQF_SHARED, "mx6-pcie-msi", pp);
+				       IRQF_SHARED | IRQF_NO_THREAD,
+				       "mx6-pcie-msi", pp);
 		if (ret) {
 			dev_err(&pdev->dev, "failed to request MSI irq\n");
 			return -ENODEV;
diff --git a/drivers/pci/host/pci-tegra.c b/drivers/pci/host/pci-tegra.c
index 083cf37ca047..0407b1d6bab8 100644
--- a/drivers/pci/host/pci-tegra.c
+++ b/drivers/pci/host/pci-tegra.c
@@ -1280,7 +1280,7 @@ static int tegra_pcie_enable_msi(struct tegra_pcie *pcie)
 
 	msi->irq = err;
 
-	err = request_irq(msi->irq, tegra_pcie_msi_irq, 0,
+	err = request_irq(msi->irq, tegra_pcie_msi_irq, IRQF_NO_THREAD,
 			  tegra_msi_irq_chip.name, pcie);
 	if (err < 0) {
 		dev_err(&pdev->dev, "failed to request IRQ: %d\n", err);
diff --git a/drivers/pci/host/pcie-rcar.c b/drivers/pci/host/pcie-rcar.c
index f7d3de32c9a0..b5b0d683bb2d 100644
--- a/drivers/pci/host/pcie-rcar.c
+++ b/drivers/pci/host/pcie-rcar.c
@@ -712,14 +712,16 @@ static int rcar_pcie_enable_msi(struct rcar_pcie *pcie)
 
 	/* Two irqs are for MSI, but they are also used for non-MSI irqs */
 	err = devm_request_irq(&pdev->dev, msi->irq1, rcar_pcie_msi_irq,
-			       IRQF_SHARED, rcar_msi_irq_chip.name, pcie);
+			       IRQF_SHARED | IRQF_NO_THREAD,
+			       rcar_msi_irq_chip.name, pcie);
 	if (err < 0) {
 		dev_err(&pdev->dev, "failed to request IRQ: %d\n", err);
 		goto err;
 	}
 
 	err = devm_request_irq(&pdev->dev, msi->irq2, rcar_pcie_msi_irq,
-			       IRQF_SHARED, rcar_msi_irq_chip.name, pcie);
+			       IRQF_SHARED | IRQF_NO_THREAD,
+			       rcar_msi_irq_chip.name, pcie);
 	if (err < 0) {
 		dev_err(&pdev->dev, "failed to request IRQ: %d\n", err);
 		goto err;

[toc] | [prev] | [next] | [standalone]

#1326179 — [PATCH 3.16.y-ckt 095/180] parisc: Fix __ARCH_SI_PREAMBLE_SIZE

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Helge Deller <deller@gmx.de>

commit e60fc5aa608eb38b47ba4ee058f306f739eb70a0 upstream.

On a 64bit kernel build the compiler aligns the _sifields union in the
struct siginfo_t on a 64bit address. The __ARCH_SI_PREAMBLE_SIZE define
compensates for this alignment and thus fixes the wait testcase of the
strace package.

The symptoms of a wrong __ARCH_SI_PREAMBLE_SIZE value is that
_sigchld.si_stime variable is missed to be copied and thus after a
copy_siginfo() will have uninitialized values.

Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 arch/parisc/include/uapi/asm/siginfo.h | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/parisc/include/uapi/asm/siginfo.h b/arch/parisc/include/uapi/asm/siginfo.h
index d7034728f377..1c75565d984b 100644
--- a/arch/parisc/include/uapi/asm/siginfo.h
+++ b/arch/parisc/include/uapi/asm/siginfo.h
@@ -1,6 +1,10 @@
 #ifndef _PARISC_SIGINFO_H
 #define _PARISC_SIGINFO_H
 
+#if defined(__LP64__)
+#define __ARCH_SI_PREAMBLE_SIZE   (4 * sizeof(int))
+#endif
+
 #include <asm-generic/siginfo.h>
 
 #undef NSIGTRAP

[toc] | [prev] | [next] | [standalone]

#1326180 — [PATCH 3.16.y-ckt 094/180] virtio_balloon: fix race between migration and ballooning

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Minchan Kim <minchan@kernel.org>

commit 21ea9fb69e7c4b1b1559c3e410943d3ff248ffcb upstream.

In balloon_page_dequeue, pages_lock should cover the loop
(ie, list_for_each_entry_safe). Otherwise, the cursor page could
be isolated by compaction and then list_del by isolation could
poison the page->lru.{prev,next} so the loop finally could
access wrong address like this. This patch fixes the bug.

general protection fault: 0000 [#1] SMP
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 2 PID: 82 Comm: vballoon Not tainted 4.4.0-rc5-mm1-access_bit+ #1906
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff8800a7ff0000 ti: ffff8800a7fec000 task.ti: ffff8800a7fec000
RIP: 0010:[<ffffffff8115e754>]  [<ffffffff8115e754>] balloon_page_dequeue+0x54/0x130
RSP: 0018:ffff8800a7fefdc0  EFLAGS: 00010246
RAX: ffff88013fff9a70 RBX: ffffea000056fe00 RCX: 0000000000002b7d
RDX: ffff88013fff9a70 RSI: ffffea000056fe00 RDI: ffff88013fff9a68
RBP: ffff8800a7fefde8 R08: ffffea000056fda0 R09: 0000000000000000
R10: ffff8800a7fefd90 R11: 0000000000000001 R12: dead0000000000e0
R13: ffffea000056fe20 R14: ffff880138809070 R15: ffff880138809060
FS:  0000000000000000(0000) GS:ffff88013fc40000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00007f229c10e000 CR3: 00000000b8b53000 CR4: 00000000000006a0
Stack:
 0000000000000100 ffff880138809088 ffff880138809000 ffff880138809060
 0000000000000046 ffff8800a7fefe28 ffffffff812c86d3 ffff880138809020
 ffff880138809000 fffffffffff91900 0000000000000100 ffff880138809060
Call Trace:
 [<ffffffff812c86d3>] leak_balloon+0x93/0x1a0
 [<ffffffff812c8bc7>] balloon+0x217/0x2a0
 [<ffffffff8143739e>] ? __schedule+0x31e/0x8b0
 [<ffffffff81078160>] ? abort_exclusive_wait+0xb0/0xb0
 [<ffffffff812c89b0>] ? update_balloon_stats+0xf0/0xf0
 [<ffffffff8105b6e9>] kthread+0xc9/0xe0
 [<ffffffff8105b620>] ? kthread_park+0x60/0x60
 [<ffffffff8143b4af>] ret_from_fork+0x3f/0x70
 [<ffffffff8105b620>] ? kthread_park+0x60/0x60
Code: 8d 60 e0 0f 84 af 00 00 00 48 8b 43 20 a8 01 75 3b 48 89 d8 f0 0f ba 28 00 72 10 48 8b 03 f6 c4 08 75 2f 48 89 df e8 8c 83 f9 ff <49> 8b 44 24 20 4d 8d 6c 24 20 48 83 e8 20 4d 39 f5 74 7a 4c 89
RIP  [<ffffffff8115e754>] balloon_page_dequeue+0x54/0x130
 RSP <ffff8800a7fefdc0>
---[ end trace 43cf28060d708d5f ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled

Signed-off-by: Minchan Kim <minchan@kernel.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Rafael Aquini <aquini@redhat.com>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 mm/balloon_compaction.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/mm/balloon_compaction.c b/mm/balloon_compaction.c
index 6e45a5074bf0..9b0f218af70b 100644
--- a/mm/balloon_compaction.c
+++ b/mm/balloon_compaction.c
@@ -86,6 +86,7 @@ struct page *balloon_page_dequeue(struct balloon_dev_info *b_dev_info)
 	bool dequeued_page;
 
 	dequeued_page = false;
+	spin_lock_irqsave(&b_dev_info->pages_lock, flags);
 	list_for_each_entry_safe(page, tmp, &b_dev_info->pages, lru) {
 		/*
 		 * Block others from accessing the 'page' while we get around
@@ -93,7 +94,6 @@ struct page *balloon_page_dequeue(struct balloon_dev_info *b_dev_info)
 		 * to be released by the balloon driver.
 		 */
 		if (trylock_page(page)) {
-			spin_lock_irqsave(&b_dev_info->pages_lock, flags);
 			/*
 			 * Raise the page refcount here to prevent any wrong
 			 * attempt to isolate this page, in case of coliding
@@ -105,12 +105,12 @@ struct page *balloon_page_dequeue(struct balloon_dev_info *b_dev_info)
 			 */
 			get_page(page);
 			balloon_page_delete(page);
-			spin_unlock_irqrestore(&b_dev_info->pages_lock, flags);
 			unlock_page(page);
 			dequeued_page = true;
 			break;
 		}
 	}
+	spin_unlock_irqrestore(&b_dev_info->pages_lock, flags);
 
 	if (!dequeued_page) {
 		/*

[toc] | [prev] | [next] | [standalone]

#1326181 — [PATCH 3.16.y-ckt 104/180] sparc64: fix incorrect sign extension in sys_sparc64_personality

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: "Dmitry V. Levin" <ldv@altlinux.org>

commit 525fd5a94e1be0776fa652df5c687697db508c91 upstream.

The value returned by sys_personality has type "long int".
It is saved to a variable of type "int", which is not a problem
yet because the type of task_struct->pesonality is "unsigned int".
The problem is the sign extension from "int" to "long int"
that happens on return from sys_sparc64_personality.

For example, a userspace call personality((unsigned) -EINVAL) will
result to any subsequent personality call, including absolutely
harmless read-only personality(0xffffffff) call, failing with
errno set to EINVAL.

Signed-off-by: Dmitry V. Levin <ldv@altlinux.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 arch/sparc/kernel/sys_sparc_64.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
index 30e7ddb27a3a..c690c8e16a96 100644
--- a/arch/sparc/kernel/sys_sparc_64.c
+++ b/arch/sparc/kernel/sys_sparc_64.c
@@ -413,7 +413,7 @@ out:
 
 SYSCALL_DEFINE1(sparc64_personality, unsigned long, personality)
 {
-	int ret;
+	long ret;
 
 	if (personality(current->personality) == PER_LINUX32 &&
 	    personality(personality) == PER_LINUX)

[toc] | [prev] | [next] | [standalone]

#1326182 — [PATCH 3.16.y-ckt 085/180] s390: fix normalization bug in exception table sorting

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Ard Biesheuvel <ard.biesheuvel@linaro.org>

commit bcb7825a77f41c7dd91da6f7ac10b928156a322e upstream.

The normalization pass in the sorting routine of the relative exception
table serves two purposes:
- it ensures that the address fields of the exception table entries are
  fully ordered, so that no ambiguities arise between entries with
  identical instruction offsets (i.e., when two instructions that are
  exactly 8 bytes apart each have an exception table entry associated with
  them)
- it ensures that the offsets of both the instruction and the fixup fields
  of each entry are relative to their final location after sorting.

Commit eb608fb366de ("s390/exceptions: switch to relative exception table
entries") ported the relative exception table format from x86, but modified
the sorting routine to only normalize the instruction offset field and not
the fixup offset field. The result is that the fixup offset of each entry
will be relative to the original location of the entry before sorting,
likely leading to crashes when those entries are dereferenced.

Fixes: eb608fb366de ("s390/exceptions: switch to relative exception table entries")
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 arch/s390/mm/extable.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/arch/s390/mm/extable.c b/arch/s390/mm/extable.c
index 4d1ee88864e8..18c8b819b0aa 100644
--- a/arch/s390/mm/extable.c
+++ b/arch/s390/mm/extable.c
@@ -52,12 +52,16 @@ void sort_extable(struct exception_table_entry *start,
 	int i;
 
 	/* Normalize entries to being relative to the start of the section */
-	for (p = start, i = 0; p < finish; p++, i += 8)
+	for (p = start, i = 0; p < finish; p++, i += 8) {
 		p->insn += i;
+		p->fixup += i + 4;
+	}
 	sort(start, finish - start, sizeof(*start), cmp_ex, NULL);
 	/* Denormalize all entries */
-	for (p = start, i = 0; p < finish; p++, i += 8)
+	for (p = start, i = 0; p < finish; p++, i += 8) {
 		p->insn -= i;
+		p->fixup -= i + 4;
+	}
 }
 
 #ifdef CONFIG_MODULES

[toc] | [prev] | [next] | [standalone]

#1326185 — [PATCH 3.16.y-ckt 088/180] clocksource/drivers/vt8500: Increase the minimum delta

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Roman Volkov <rvolkov@v1ros.org>

commit f9eccf24615672896dc13251410c3f2f33a14f95 upstream.

The vt8500 clocksource driver declares itself as capable to handle the
minimum delay of 4 cycles by passing the value into
clockevents_config_and_register(). The vt8500_timer_set_next_event()
requires the passed cycles value to be at least 16. The impact is that
userspace hangs in nanosleep() calls with small delay intervals.

This problem is reproducible in Linux 4.2 starting from:
c6eb3f70d448 ('hrtimer: Get rid of hrtimer softirq')

From Russell King, more detailed explanation:

"It's a speciality of the StrongARM/PXA hardware. It takes a certain
number of OSCR cycles for the value written to hit the compare registers.
So, if a very small delta is written (eg, the compare register is written
with a value of OSCR + 1), the OSCR will have incremented past this value
before it hits the underlying hardware. The result is, that you end up
waiting a very long time for the OSCR to wrap before the event fires.

So, we introduce a check in set_next_event() to detect this and return
-ETIME if the calculated delta is too small, which causes the generic
clockevents code to retry after adding the min_delta specified in
clockevents_config_and_register() to the current time value.

min_delta must be sufficient that we don't re-trip the -ETIME check - if
we do, we will return -ETIME, forward the next event time, try to set it,
return -ETIME again, and basically lock the system up. So, min_delta
must be larger than the check inside set_next_event(). A factor of two
was chosen to ensure that this situation would never occur.

The PXA code worked on PXA systems for years, and I'd suggest no one
changes this mechanism without access to a wide range of PXA systems,
otherwise they're risking breakage."

Cc: Russell King <linux@arm.linux.org.uk>
Acked-by: Alexey Charkov <alchark@gmail.com>
Signed-off-by: Roman Volkov <rvolkov@v1ros.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/clocksource/vt8500_timer.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/clocksource/vt8500_timer.c b/drivers/clocksource/vt8500_timer.c
index 1098ed3b9b89..dc45ddb36117 100644
--- a/drivers/clocksource/vt8500_timer.c
+++ b/drivers/clocksource/vt8500_timer.c
@@ -50,6 +50,8 @@
 
 #define msecs_to_loops(t) (loops_per_jiffy / 1000 * HZ * t)
 
+#define MIN_OSCR_DELTA		16
+
 static void __iomem *regbase;
 
 static cycle_t vt8500_timer_read(struct clocksource *cs)
@@ -80,7 +82,7 @@ static int vt8500_timer_set_next_event(unsigned long cycles,
 		cpu_relax();
 	writel((unsigned long)alarm, regbase + TIMER_MATCH_VAL);
 
-	if ((signed)(alarm - clocksource.read(&clocksource)) <= 16)
+	if ((signed)(alarm - clocksource.read(&clocksource)) <= MIN_OSCR_DELTA)
 		return -ETIME;
 
 	writel(1, regbase + TIMER_IER_VAL);
@@ -160,7 +162,7 @@ static void __init vt8500_timer_init(struct device_node *np)
 		pr_err("%s: setup_irq failed for %s\n", __func__,
 							clockevent.name);
 	clockevents_config_and_register(&clockevent, VT8500_TIMER_HZ,
-					4, 0xf0000000);
+					MIN_OSCR_DELTA * 2, 0xf0000000);
 }
 
 CLOCKSOURCE_OF_DECLARE(vt8500, "via,vt8500-timer", vt8500_timer_init);

[toc] | [prev] | [next] | [standalone]

#1326187 — [PATCH 3.16.y-ckt 100/180] dmaengine: dw: fix cyclic transfer setup

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Mans Rullgard <mans@mansr.com>

commit df3bb8a0e619d501cd13334c3e0586edcdcbc716 upstream.

Commit 61e183f83069 ("dmaengine/dw_dmac: Reconfigure interrupt and
chan_cfg register on resume") moved some channel initialisation to
a new function which must be called before starting a transfer.

This updates dw_dma_cyclic_start() to use dwc_dostart() like the other
modes, thus ensuring dwc_initialize() gets called and removing some code
duplication.

Fixes: 61e183f83069 ("dmaengine/dw_dmac: Reconfigure interrupt and chan_cfg register on resume")
Signed-off-by: Mans Rullgard <mans@mansr.com>
Reviewed-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/dma/dw/core.c | 22 +---------------------
 1 file changed, 1 insertion(+), 21 deletions(-)

diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
index b37d58f4cc93..9ce8d5eda1c3 100644
--- a/drivers/dma/dw/core.c
+++ b/drivers/dma/dw/core.c
@@ -1206,7 +1206,6 @@ static void dwc_free_chan_resources(struct dma_chan *chan)
 int dw_dma_cyclic_start(struct dma_chan *chan)
 {
 	struct dw_dma_chan	*dwc = to_dw_dma_chan(chan);
-	struct dw_dma		*dw = to_dw_dma(dwc->chan.device);
 	unsigned long		flags;
 
 	if (!test_bit(DW_DMA_IS_CYCLIC, &dwc->flags)) {
@@ -1215,26 +1214,7 @@ int dw_dma_cyclic_start(struct dma_chan *chan)
 	}
 
 	spin_lock_irqsave(&dwc->lock, flags);
-
-	/* Assert channel is idle */
-	if (dma_readl(dw, CH_EN) & dwc->mask) {
-		dev_err(chan2dev(&dwc->chan),
-			"BUG: Attempted to start non-idle channel\n");
-		dwc_dump_chan_regs(dwc);
-		spin_unlock_irqrestore(&dwc->lock, flags);
-		return -EBUSY;
-	}
-
-	dma_writel(dw, CLEAR.ERROR, dwc->mask);
-	dma_writel(dw, CLEAR.XFER, dwc->mask);
-
-	/* Setup DMAC channel registers */
-	channel_writel(dwc, LLP, dwc->cdesc->desc[0]->txd.phys);
-	channel_writel(dwc, CTL_LO, DWC_CTLL_LLP_D_EN | DWC_CTLL_LLP_S_EN);
-	channel_writel(dwc, CTL_HI, 0);
-
-	channel_set_bit(dw, CH_EN, dwc->mask);
-
+	dwc_dostart(dwc, dwc->cdesc->desc[0]);
 	spin_unlock_irqrestore(&dwc->lock, flags);
 
 	return 0;

[toc] | [prev] | [next] | [standalone]

#1326189 — [PATCH 3.16.y-ckt 091/180] ALSA: seq: Fix missing NULL check at remove_events ioctl

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Takashi Iwai <tiwai@suse.de>

commit 030e2c78d3a91dd0d27fef37e91950dde333eba1 upstream.

snd_seq_ioctl_remove_events() calls snd_seq_fifo_clear()
unconditionally even if there is no FIFO assigned, and this leads to
an Oops due to NULL dereference.  The fix is just to add a proper NULL
check.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 sound/core/seq/seq_clientmgr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index 225c73152ee9..ab4cd2930ce3 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -1962,7 +1962,7 @@ static int snd_seq_ioctl_remove_events(struct snd_seq_client *client,
 		 * No restrictions so for a user client we can clear
 		 * the whole fifo
 		 */
-		if (client->type == USER_CLIENT)
+		if (client->type == USER_CLIENT && client->data.user.fifo)
 			snd_seq_fifo_clear(client->data.user.fifo);
 	}
 

[toc] | [prev] | [next] | [standalone]

#1326190 — [PATCH 3.16.y-ckt 101/180] dmaengine: dw: fix cyclic transfer callbacks

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Mans Rullgard <mans@mansr.com>

commit 2895b2cad6e7a95104cf396e5330054453382ae1 upstream.

Cyclic transfer callbacks rely on block completion interrupts which were
disabled in commit ff7b05f29fd4 ("dmaengine/dw_dmac: Don't handle block
interrupts").  This re-enables block interrupts so the cyclic callbacks
can work.  Other transfer types are not affected as they set the INT_EN
bit only on the last block.

Fixes: ff7b05f29fd4 ("dmaengine/dw_dmac: Don't handle block interrupts")
Signed-off-by: Mans Rullgard <mans@mansr.com>
Reviewed-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/dma/dw/core.c | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
index 9ce8d5eda1c3..e968366e6cdd 100644
--- a/drivers/dma/dw/core.c
+++ b/drivers/dma/dw/core.c
@@ -169,6 +169,7 @@ static void dwc_initialize(struct dw_dma_chan *dwc)
 
 	/* Enable interrupts */
 	channel_set_bit(dw, MASK.XFER, dwc->mask);
+	channel_set_bit(dw, MASK.BLOCK, dwc->mask);
 	channel_set_bit(dw, MASK.ERROR, dwc->mask);
 
 	dwc->initialized = true;
@@ -544,16 +545,17 @@ EXPORT_SYMBOL(dw_dma_get_dst_addr);
 
 /* Called with dwc->lock held and all DMAC interrupts disabled */
 static void dwc_handle_cyclic(struct dw_dma *dw, struct dw_dma_chan *dwc,
-		u32 status_err, u32 status_xfer)
+		u32 status_block, u32 status_err, u32 status_xfer)
 {
 	unsigned long flags;
 
-	if (dwc->mask) {
+	if (status_block & dwc->mask) {
 		void (*callback)(void *param);
 		void *callback_param;
 
 		dev_vdbg(chan2dev(&dwc->chan), "new cyclic period llp 0x%08x\n",
 				channel_readl(dwc, LLP));
+		dma_writel(dw, CLEAR.BLOCK, dwc->mask);
 
 		callback = dwc->cdesc->period_callback;
 		callback_param = dwc->cdesc->period_callback_param;
@@ -585,6 +587,7 @@ static void dwc_handle_cyclic(struct dw_dma *dw, struct dw_dma_chan *dwc,
 		channel_writel(dwc, CTL_LO, 0);
 		channel_writel(dwc, CTL_HI, 0);
 
+		dma_writel(dw, CLEAR.BLOCK, dwc->mask);
 		dma_writel(dw, CLEAR.ERROR, dwc->mask);
 		dma_writel(dw, CLEAR.XFER, dwc->mask);
 
@@ -601,10 +604,12 @@ static void dw_dma_tasklet(unsigned long data)
 {
 	struct dw_dma *dw = (struct dw_dma *)data;
 	struct dw_dma_chan *dwc;
+	u32 status_block;
 	u32 status_xfer;
 	u32 status_err;
 	int i;
 
+	status_block = dma_readl(dw, RAW.BLOCK);
 	status_xfer = dma_readl(dw, RAW.XFER);
 	status_err = dma_readl(dw, RAW.ERROR);
 
@@ -613,7 +618,8 @@ static void dw_dma_tasklet(unsigned long data)
 	for (i = 0; i < dw->dma.chancnt; i++) {
 		dwc = &dw->chan[i];
 		if (test_bit(DW_DMA_IS_CYCLIC, &dwc->flags))
-			dwc_handle_cyclic(dw, dwc, status_err, status_xfer);
+			dwc_handle_cyclic(dw, dwc, status_block, status_err,
+					status_xfer);
 		else if (status_err & (1 << i))
 			dwc_handle_error(dw, dwc);
 		else if (status_xfer & (1 << i))
@@ -624,6 +630,7 @@ static void dw_dma_tasklet(unsigned long data)
 	 * Re-enable interrupts.
 	 */
 	channel_set_bit(dw, MASK.XFER, dw->all_chan_mask);
+	channel_set_bit(dw, MASK.BLOCK, dw->all_chan_mask);
 	channel_set_bit(dw, MASK.ERROR, dw->all_chan_mask);
 }
 
@@ -643,6 +650,7 @@ static irqreturn_t dw_dma_interrupt(int irq, void *dev_id)
 	 * softirq handler.
 	 */
 	channel_clear_bit(dw, MASK.XFER, dw->all_chan_mask);
+	channel_clear_bit(dw, MASK.BLOCK, dw->all_chan_mask);
 	channel_clear_bit(dw, MASK.ERROR, dw->all_chan_mask);
 
 	status = dma_readl(dw, STATUS_INT);
@@ -653,6 +661,7 @@ static irqreturn_t dw_dma_interrupt(int irq, void *dev_id)
 
 		/* Try to recover */
 		channel_clear_bit(dw, MASK.XFER, (1 << 8) - 1);
+		channel_clear_bit(dw, MASK.BLOCK, (1 << 8) - 1);
 		channel_clear_bit(dw, MASK.SRC_TRAN, (1 << 8) - 1);
 		channel_clear_bit(dw, MASK.DST_TRAN, (1 << 8) - 1);
 		channel_clear_bit(dw, MASK.ERROR, (1 << 8) - 1);
@@ -1182,6 +1191,7 @@ static void dwc_free_chan_resources(struct dma_chan *chan)
 
 	/* Disable interrupts */
 	channel_clear_bit(dw, MASK.XFER, dwc->mask);
+	channel_clear_bit(dw, MASK.BLOCK, dwc->mask);
 	channel_clear_bit(dw, MASK.ERROR, dwc->mask);
 
 	spin_unlock_irqrestore(&dwc->lock, flags);
@@ -1419,6 +1429,7 @@ void dw_dma_cyclic_free(struct dma_chan *chan)
 
 	dwc_chan_disable(dw, dwc);
 
+	dma_writel(dw, CLEAR.BLOCK, dwc->mask);
 	dma_writel(dw, CLEAR.ERROR, dwc->mask);
 	dma_writel(dw, CLEAR.XFER, dwc->mask);
 
@@ -1443,6 +1454,7 @@ static void dw_dma_off(struct dw_dma *dw)
 	dma_writel(dw, CFG, 0);
 
 	channel_clear_bit(dw, MASK.XFER, dw->all_chan_mask);
+	channel_clear_bit(dw, MASK.BLOCK, dw->all_chan_mask);
 	channel_clear_bit(dw, MASK.SRC_TRAN, dw->all_chan_mask);
 	channel_clear_bit(dw, MASK.DST_TRAN, dw->all_chan_mask);
 	channel_clear_bit(dw, MASK.ERROR, dw->all_chan_mask);
@@ -1531,9 +1543,6 @@ int dw_dma_probe(struct dw_dma_chip *chip, struct dw_dma_platform_data *pdata)
 	/* Force dma off, just in case */
 	dw_dma_off(dw);
 
-	/* Disable BLOCK interrupts as well */
-	channel_clear_bit(dw, MASK.BLOCK, dw->all_chan_mask);
-
 	/* Create a pool of consistent memory blocks for hardware descriptors */
 	dw->desc_pool = dmam_pool_create("dw_dmac_desc_pool", chip->dev,
 					 sizeof(struct dw_desc), 4, 0);

[toc] | [prev] | [next] | [standalone]

#1326192 — [PATCH 3.16.y-ckt 097/180] powerpc/module: Handle R_PPC64_ENTRY relocations

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Ulrich Weigand <ulrich.weigand@de.ibm.com>

commit a61674bdfc7c2bf909c4010699607b62b69b7bec upstream.

GCC 6 will include changes to generated code with -mcmodel=large,
which is used to build kernel modules on powerpc64le.  This was
necessary because the large model is supposed to allow arbitrary
sizes and locations of the code and data sections, but the ELFv2
global entry point prolog still made the unconditional assumption
that the TOC associated with any particular function can be found
within 2 GB of the function entry point:

func:
	addis r2,r12,(.TOC.-func)@ha
	addi  r2,r2,(.TOC.-func)@l
	.localentry func, .-func

To remove this assumption, GCC will now generate instead this global
entry point prolog sequence when using -mcmodel=large:

	.quad .TOC.-func
func:
	.reloc ., R_PPC64_ENTRY
	ld    r2, -8(r12)
	add   r2, r2, r12
	.localentry func, .-func

The new .reloc triggers an optimization in the linker that will
replace this new prolog with the original code (see above) if the
linker determines that the distance between .TOC. and func is in
range after all.

Since this new relocation is now present in module object files,
the kernel module loader is required to handle them too.  This
patch adds support for the new relocation and implements the
same optimization done by the GNU linker.

Signed-off-by: Ulrich Weigand <ulrich.weigand@de.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 arch/powerpc/include/uapi/asm/elf.h |  2 ++
 arch/powerpc/kernel/module_64.c     | 27 +++++++++++++++++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/arch/powerpc/include/uapi/asm/elf.h b/arch/powerpc/include/uapi/asm/elf.h
index 59dad113897b..c2d21d11c2d2 100644
--- a/arch/powerpc/include/uapi/asm/elf.h
+++ b/arch/powerpc/include/uapi/asm/elf.h
@@ -295,6 +295,8 @@ do {									\
 #define R_PPC64_TLSLD		108
 #define R_PPC64_TOCSAVE		109
 
+#define R_PPC64_ENTRY		118
+
 #define R_PPC64_REL16		249
 #define R_PPC64_REL16_LO	250
 #define R_PPC64_REL16_HI	251
diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c
index d807ee626af9..ec4106224d89 100644
--- a/arch/powerpc/kernel/module_64.c
+++ b/arch/powerpc/kernel/module_64.c
@@ -637,6 +637,33 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
 			 */
 			break;
 
+		case R_PPC64_ENTRY:
+			/*
+			 * Optimize ELFv2 large code model entry point if
+			 * the TOC is within 2GB range of current location.
+			 */
+			value = my_r2(sechdrs, me) - (unsigned long)location;
+			if (value + 0x80008000 > 0xffffffff)
+				break;
+			/*
+			 * Check for the large code model prolog sequence:
+		         *	ld r2, ...(r12)
+			 *	add r2, r2, r12
+			 */
+			if ((((uint32_t *)location)[0] & ~0xfffc)
+			    != 0xe84c0000)
+				break;
+			if (((uint32_t *)location)[1] != 0x7c426214)
+				break;
+			/*
+			 * If found, replace it with:
+			 *	addis r2, r12, (.TOC.-func)@ha
+			 *	addi r2, r12, (.TOC.-func)@l
+			 */
+			((uint32_t *)location)[0] = 0x3c4c0000 + PPC_HA(value);
+			((uint32_t *)location)[1] = 0x38420000 + PPC_LO(value);
+			break;
+
 		case R_PPC64_REL16_HA:
 			/* Subtract location pointer */
 			value -= (unsigned long)location;

[toc] | [prev] | [next] | [standalone]

#1326194 — [PATCH 3.16.y-ckt 108/180] dma-debug: switch check from _text to _stext

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Laura Abbott <labbott@fedoraproject.org>

commit ea535e418c01837d07b6c94e817540f50bfdadb0 upstream.

In include/asm-generic/sections.h:

  /*
   * Usage guidelines:
   * _text, _data: architecture specific, don't use them in
   * arch-independent code
   * [_stext, _etext]: contains .text.* sections, may also contain
   * .rodata.*
   *                   and/or .init.* sections

_text is not guaranteed across architectures.  Architectures such as ARM
may reuse parts which are not actually text and erroneously trigger a bug.
Switch to using _stext which is guaranteed to contain text sections.

Came out of https://lkml.kernel.org/g/<567B1176.4000106@redhat.com>

Signed-off-by: Laura Abbott <labbott@fedoraproject.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Cc: Russell King <linux@arm.linux.org.uk>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 lib/dma-debug.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/dma-debug.c b/lib/dma-debug.c
index 1c741f900028..1cbfc16d0b37 100644
--- a/lib/dma-debug.c
+++ b/lib/dma-debug.c
@@ -1165,7 +1165,7 @@ static inline bool overlap(void *addr, unsigned long len, void *start, void *end
 
 static void check_for_illegal_area(struct device *dev, void *addr, unsigned long len)
 {
-	if (overlap(addr, len, _text, _etext) ||
+	if (overlap(addr, len, _stext, _etext) ||
 	    overlap(addr, len, __start_rodata, __end_rodata))
 		err_printk(dev, NULL, "DMA-API: device driver maps memory from kernel text or rodata [addr=%p] [len=%lu]\n", addr, len);
 }

[toc] | [prev] | [next] | [standalone]

#1326195 — [PATCH 3.16.y-ckt 106/180] cifs_dbg() outputs an uninitialized buffer in cifs_readdir()

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Vasily Averin <vvs@virtuozzo.com>

commit 01b9b0b28626db4a47d7f48744d70abca9914ef1 upstream.

In some cases tmp_bug can be not filled in cifs_filldir and stay uninitialized,
therefore its printk with "%s" modifier can leak content of kernelspace memory.
If old content of this buffer does not contain '\0' access bejond end of
allocated object can crash the host.

Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Steve French <sfrench@localhost.localdomain>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 fs/cifs/readdir.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index b334a89d6a66..1320d1ecc630 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -849,6 +849,7 @@ int cifs_readdir(struct file *file, struct dir_context *ctx)
 		 * if buggy server returns . and .. late do we want to
 		 * check for that here?
 		 */
+		*tmp_buf = 0;
 		rc = cifs_filldir(current_entry, file, ctx,
 				  tmp_buf, max_len);
 		if (rc) {

[toc] | [prev] | [next] | [standalone]

#1326196 — [PATCH 3.16.y-ckt 089/180] Input: elantech - mark protocols v2 and v3 as semi-mt

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Benjamin Tissoires <benjamin.tissoires@redhat.com>

commit 6544a1df11c48c8413071aac3316792e4678fbfb upstream.

When using a protocol v2 or v3 hardware, elantech uses the function
elantech_report_semi_mt_data() to report data. This devices are rather
creepy because if num_finger is 3, (x2,y2) is (0,0). Yes, only one valid
touch is reported.

Anyway, userspace (libinput) is now confused by these (0,0) touches,
and detect them as palm, and rejects them.

Commit 3c0213d17a09 ("Input: elantech - fix semi-mt protocol for v3 HW")
was sufficient enough for xf86-input-synaptics and libinput before it has
palm rejection. Now we need to actually tell libinput that this device is
a semi-mt one and it should not rely on the actual values of the 2 touches.

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/input/mouse/elantech.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index f6f44bc78a75..447b4545c7f7 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1113,7 +1113,7 @@ static int elantech_set_input_params(struct psmouse *psmouse)
 			input_set_abs_params(dev, ABS_TOOL_WIDTH, ETP_WMIN_V2,
 					     ETP_WMAX_V2, 0, 0);
 		}
-		input_mt_init_slots(dev, 2, 0);
+		input_mt_init_slots(dev, 2, INPUT_MT_SEMI_MT);
 		input_set_abs_params(dev, ABS_MT_POSITION_X, x_min, x_max, 0, 0);
 		input_set_abs_params(dev, ABS_MT_POSITION_Y, y_min, y_max, 0, 0);
 		break;

[toc] | [prev] | [next] | [standalone]

#1326197 — [PATCH 3.16.y-ckt 078/180] ASoC: compress: Fix compress device direction check

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Vinod Koul <vinod.koul@intel.com>

commit a1068045883ed4a18363a4ebad0c3d55e473b716 upstream.

The detection of direction for compress was only taking into account codec
capabilities and not CPU ones. Fix this by checking the CPU side capabilities
as well

Tested-by: Ashish Panwar <ashish.panwar@intel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 sound/soc/soc-compress.c | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c
index f6a6eb0834b9..9ffd6009d0ec 100644
--- a/sound/soc/soc-compress.c
+++ b/sound/soc/soc-compress.c
@@ -626,17 +626,34 @@ int soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num)
 	struct snd_pcm *be_pcm;
 	char new_name[64];
 	int ret = 0, direction = 0;
+	int playback = 0, capture = 0;
 
 	/* check client and interface hw capabilities */
 	snprintf(new_name, sizeof(new_name), "%s %s-%d",
 			rtd->dai_link->stream_name, codec_dai->name, num);
 
 	if (codec_dai->driver->playback.channels_min)
+		playback = 1;
+	if (codec_dai->driver->capture.channels_min)
+		capture = 1;
+
+	capture = capture && cpu_dai->driver->capture.channels_min;
+	playback = playback && cpu_dai->driver->playback.channels_min;
+
+	/*
+	 * Compress devices are unidirectional so only one of the directions
+	 * should be set, check for that (xor)
+	 */
+	if (playback + capture != 1) {
+		dev_err(rtd->card->dev, "Invalid direction for compress P %d, C %d\n",
+				playback, capture);
+		return -EINVAL;
+	}
+
+	if(playback)
 		direction = SND_COMPRESS_PLAYBACK;
-	else if (codec_dai->driver->capture.channels_min)
-		direction = SND_COMPRESS_CAPTURE;
 	else
-		return -EINVAL;
+		direction = SND_COMPRESS_CAPTURE;
 
 	compr = kzalloc(sizeof(*compr), GFP_KERNEL);
 	if (compr == NULL) {

[toc] | [prev] | [next] | [standalone]

#1326198 — [PATCH 3.16.y-ckt 102/180] mmc: mmci: fix an ages old detection error

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Linus Walleij <linus.walleij@linaro.org>

commit 0bcb7efdff63564e80fe84dd36a9fbdfbf6697a4 upstream.

commit 4956e10903fd ("ARM: 6244/1: mmci: add variant data and default
MCICLOCK support") added variant data for ARM, U300 and Ux500 variants.
The Nomadik NHK8815/8820 variant was erroneously labeled as a U300
variant, and when the proper Nomadik variant was later introduced in
commit 34fd421349ff ("ARM: 7378/1: mmci: add support for the Nomadik MMCI
variant") this was not fixes. Let's say this fixes the latter commit as
there was no proper Nomadik support until then.

Fixes: 34fd421349ff ("ARM: 7378/1: mmci: add support for the Nomadik...")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/mmc/host/mmci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
index d3f05ad33f09..0deb8704f198 100644
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -1749,7 +1749,7 @@ static struct amba_id mmci_ids[] = {
 	{
 		.id     = 0x00280180,
 		.mask   = 0x00ffffff,
-		.data	= &variant_u300,
+		.data	= &variant_nomadik,
 	},
 	{
 		.id     = 0x00480180,

[toc] | [prev] | [next] | [standalone]

#1326200 — [PATCH 3.16.y-ckt 086/180] xfs: inode recovery readahead can race with inode buffer creation

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Dave Chinner <dchinner@redhat.com>

commit b79f4a1c68bb99152d0785ee4ea3ab4396cdacc6 upstream.

When we do inode readahead in log recovery, we do can do the
readahead before we've replayed the icreate transaction that stamps
the buffer with inode cores. The inode readahead verifier catches
this and marks the buffer as !done to indicate that it doesn't yet
contain valid inodes.

In adding buffer error notification  (i.e. setting b_error = -EIO at
the same time as as we clear the done flag) to such a readahead
verifier failure, we can then get subsequent inode recovery failing
with this error:

XFS (dm-0): metadata I/O error: block 0xa00060 ("xlog_recover_do..(read#2)") error 5 numblks 32

This occurs when readahead completion races with icreate item replay
such as:

	inode readahead
		find buffer
		lock buffer
		submit RA io
	....
	icreate recovery
	    xfs_trans_get_buffer
		find buffer
		lock buffer
		<blocks on RA completion>
	.....
	<ra completion>
		fails verifier
		clear XBF_DONE
		set bp->b_error = -EIO
		release and unlock buffer
	<icreate gains lock>
	icreate initialises buffer
	marks buffer as done
	adds buffer to delayed write queue
	releases buffer

At this point, we have an initialised inode buffer that is up to
date but has an -EIO state registered against it. When we finally
get to recovering an inode in that buffer:

	inode item recovery
	    xfs_trans_read_buffer
		find buffer
		lock buffer
		sees XBF_DONE is set, returns buffer
	    sees bp->b_error is set
		fail log recovery!

Essentially, we need xfs_trans_get_buf_map() to clear the error status of
the buffer when doing a lookup. This function returns uninitialised
buffers, so the buffer returned can not be in an error state and
none of the code that uses this function expects b_error to be set
on return. Indeed, there is an ASSERT(!bp->b_error); in the
transaction case in xfs_trans_get_buf_map() that would have caught
this if log recovery used transactions....

This patch firstly changes the inode readahead failure to set -EIO
on the buffer, and secondly changes xfs_buf_get_map() to never
return a buffer with an error state set so this first change doesn't
cause unexpected log recovery failures.

Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
[ luis: backported to 3.16:
  - file rename: fs/xfs/libxfs/xfs_inode_buf.c -> fs/xfs/xfs_inode_buf.c
  - adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 fs/xfs/xfs_buf.c       |  7 +++++++
 fs/xfs/xfs_inode_buf.c | 12 +++++++-----
 2 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index 7a34a1ae6552..7d988a50c353 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -607,6 +607,13 @@ found:
 		}
 	}
 
+	/*
+	 * Clear b_error if this is a lookup from a caller that doesn't expect
+	 * valid data to be found in the buffer.
+	 */
+	if (!(flags & XBF_READ))
+		xfs_buf_ioerror(bp, 0);
+
 	XFS_STATS_INC(xb_get);
 	trace_xfs_buf_get(bp, flags, _RET_IP_);
 	return bp;
diff --git a/fs/xfs/xfs_inode_buf.c b/fs/xfs/xfs_inode_buf.c
index cb35ae41d4a1..fdc04bd2fdf7 100644
--- a/fs/xfs/xfs_inode_buf.c
+++ b/fs/xfs/xfs_inode_buf.c
@@ -66,11 +66,12 @@ xfs_inobp_check(
  * has not had the inode cores stamped into it. Hence for readahead, the buffer
  * may be potentially invalid.
  *
- * If the readahead buffer is invalid, we don't want to mark it with an error,
- * but we do want to clear the DONE status of the buffer so that a followup read
- * will re-read it from disk. This will ensure that we don't get an unnecessary
- * warnings during log recovery and we don't get unnecssary panics on debug
- * kernels.
+ * If the readahead buffer is invalid, we need to mark it with an error and
+ * clear the DONE status of the buffer so that a followup read will re-read it
+ * from disk. We don't report the error otherwise to avoid warnings during log
+ * recovery and we don't get unnecssary panics on debug kernels. We use EIO here
+ * because all we want to do is say readahead failed; there is no-one to report
+ * the error to, so this will distinguish it from a non-ra verifier failure.
  */
 static void
 xfs_inode_buf_verify(
@@ -98,6 +99,7 @@ xfs_inode_buf_verify(
 						XFS_RANDOM_ITOBP_INOTOBP))) {
 			if (readahead) {
 				bp->b_flags &= ~XBF_DONE;
+				xfs_buf_ioerror(bp, -EIO);
 				return;
 			}
 

[toc] | [prev] | [next] | [standalone]

#1326202 — [PATCH 3.16.y-ckt 109/180] scripts/bloat-o-meter: fix python3 syntax error

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>

commit 72214a24a7677d4c7501eecc9517ed681b5f2db2 upstream.

In Python3+ print is a function so the old syntax is not correct
anymore:

  $ ./scripts/bloat-o-meter vmlinux.o vmlinux.o.old
    File "./scripts/bloat-o-meter", line 61
      print "add/remove: %s/%s grow/shrink: %s/%s up/down: %s/%s (%s)" % \
                                                                     ^
  SyntaxError: invalid syntax

Fix by calling print as a function.

Tested on python 2.7.11, 3.5.1

Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 scripts/bloat-o-meter | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/scripts/bloat-o-meter b/scripts/bloat-o-meter
index 549d0ab8c662..dabd2a4cb4e5 100755
--- a/scripts/bloat-o-meter
+++ b/scripts/bloat-o-meter
@@ -56,8 +56,8 @@ for name in common:
 delta.sort()
 delta.reverse()
 
-print "add/remove: %s/%s grow/shrink: %s/%s up/down: %s/%s (%s)" % \
-      (add, remove, grow, shrink, up, -down, up-down)
-print "%-40s %7s %7s %+7s" % ("function", "old", "new", "delta")
+print("add/remove: %s/%s grow/shrink: %s/%s up/down: %s/%s (%s)" % \
+      (add, remove, grow, shrink, up, -down, up-down))
+print("%-40s %7s %7s %+7s" % ("function", "old", "new", "delta"))
 for d, n in delta:
-    if d: print "%-40s %7s %7s %+7d" % (n, old.get(n,"-"), new.get(n,"-"), d)
+    if d: print("%-40s %7s %7s %+7d" % (n, old.get(n,"-"), new.get(n,"-"), d))

[toc] | [prev] | [next] | [standalone]

#1326206 — [PATCH 3.16.y-ckt 068/180] wlcore/wl12xx: spi: fix NULL pointer dereference (Oops)

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Uri Mashiach <uri.mashiach@compulab.co.il>

commit e47301b06d5a65678690f04c2248fd181db1e59a upstream.

Fix the below Oops when trying to modprobe wlcore_spi.
The oops occurs because the wl1271_power_{off,on}()
function doesn't check the power() function pointer.

[   23.401447] Unable to handle kernel NULL pointer dereference at
virtual address 00000000
[   23.409954] pgd = c0004000
[   23.412922] [00000000] *pgd=00000000
[   23.416693] Internal error: Oops: 80000007 [#1] SMP ARM
[   23.422168] Modules linked in: wl12xx wlcore mac80211 cfg80211
musb_dsps musb_hdrc usbcore usb_common snd_soc_simple_card evdev joydev
omap_rng wlcore_spi snd_soc_tlv320aic23_i2c rng_core snd_soc_tlv320aic23
c_can_platform c_can can_dev snd_soc_davinci_mcasp snd_soc_edma
snd_soc_omap omap_wdt musb_am335x cpufreq_dt thermal_sys hwmon
[   23.453253] CPU: 0 PID: 36 Comm: kworker/0:2 Not tainted
4.2.0-00002-g951efee-dirty #233
[   23.461720] Hardware name: Generic AM33XX (Flattened Device Tree)
[   23.468123] Workqueue: events request_firmware_work_func
[   23.473690] task: de32efc0 ti: de4ee000 task.ti: de4ee000
[   23.479341] PC is at 0x0
[   23.482112] LR is at wl12xx_set_power_on+0x28/0x124 [wlcore]
[   23.488074] pc : [<00000000>]    lr : [<bf2581f0>]    psr: 60000013
[   23.488074] sp : de4efe50  ip : 00000002  fp : 00000000
[   23.500162] r10: de7cdd00  r9 : dc848800  r8 : bf27af00
[   23.505663] r7 : bf27a1a8  r6 : dcbd8a80  r5 : dce0e2e0  r4 :
dce0d2e0
[   23.512536] r3 : 00000000  r2 : 00000000  r1 : 00000001  r0 :
dc848810
[   23.519412] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM
Segment kernel
[   23.527109] Control: 10c5387d  Table: 9cb78019  DAC: 00000015
[   23.533160] Process kworker/0:2 (pid: 36, stack limit = 0xde4ee218)
[   23.539760] Stack: (0xde4efe50 to 0xde4f0000)

[...]

[   23.665030] [<bf2581f0>] (wl12xx_set_power_on [wlcore]) from
[<bf25f7ac>] (wlcore_nvs_cb+0x118/0xa4c [wlcore])
[   23.675604] [<bf25f7ac>] (wlcore_nvs_cb [wlcore]) from [<c04387ec>]
(request_firmware_work_func+0x30/0x58)
[   23.685784] [<c04387ec>] (request_firmware_work_func) from
[<c0058e2c>] (process_one_work+0x1b4/0x4b4)
[   23.695591] [<c0058e2c>] (process_one_work) from [<c0059168>]
(worker_thread+0x3c/0x4a4)
[   23.704124] [<c0059168>] (worker_thread) from [<c005ee68>]
(kthread+0xd4/0xf0)
[   23.711747] [<c005ee68>] (kthread) from [<c000f598>]
(ret_from_fork+0x14/0x3c)
[   23.719357] Code: bad PC value
[   23.722760] ---[ end trace 981be8510db9b3a9 ]---

Prevent oops by validationg power() pointer value before
calling the function.

Signed-off-by: Uri Mashiach <uri.mashiach@compulab.co.il>
Acked-by: Igor Grinberg <grinberg@compulab.co.il>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/net/wireless/ti/wlcore/io.h | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/ti/wlcore/io.h b/drivers/net/wireless/ti/wlcore/io.h
index 0305729d0986..10cf3747694d 100644
--- a/drivers/net/wireless/ti/wlcore/io.h
+++ b/drivers/net/wireless/ti/wlcore/io.h
@@ -207,19 +207,23 @@ static inline int __must_check wlcore_write_reg(struct wl1271 *wl, int reg,
 
 static inline void wl1271_power_off(struct wl1271 *wl)
 {
-	int ret;
+	int ret = 0;
 
 	if (!test_bit(WL1271_FLAG_GPIO_POWER, &wl->flags))
 		return;
 
-	ret = wl->if_ops->power(wl->dev, false);
+	if (wl->if_ops->power)
+		ret = wl->if_ops->power(wl->dev, false);
 	if (!ret)
 		clear_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
 }
 
 static inline int wl1271_power_on(struct wl1271 *wl)
 {
-	int ret = wl->if_ops->power(wl->dev, true);
+	int ret = 0;
+
+	if (wl->if_ops->power)
+		ret = wl->if_ops->power(wl->dev, true);
 	if (ret == 0)
 		set_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
 

[toc] | [prev] | [next] | [standalone]

Page 6 of 9 — ← Prev page 1 2 3 4 5 [6] 7 8 9  Next page →

Back to top | Article view | linux.kernel

csiph-web