Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1352081 > unrolled thread

[4.2.y-ckt stable] Linux 4.2.8-ckt5 stable review

Started byKamal Mostafa <kamal@canonical.com>
First post2016-03-08 00:00 +0100
Last post2016-03-08 02:00 +0100
Articles 20 on this page of 231 — 1 participant

Back to article view | Back to linux.kernel


Contents

  [4.2.y-ckt stable] Linux 4.2.8-ckt5 stable review Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:00 +0100
    [PATCH 4.2.y-ckt 034/273] libata: disable forced PORTS_IMPL for >= AHCI 1.3 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:00 +0100
    [PATCH 4.2.y-ckt 264/273] net: phy: bcm7xxx: Fix shadow mode 2 disabling Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 259/273] ARM: dts: kirkwood: use unique machine name for ds112 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 256/273] af_unix: Don't set err in unix_stream_read_generic unless there was an error Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 247/273] l2tp: Fix error creating L2TP tunnels Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 253/273] net/mlx4_core: Do not BUG_ON during reset when PCI is offline Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 262/273] [media] exynos4-is: fix a format string bug Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 249/273] route: check and remove route cache when we get route Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 269/273] net: phy: Fix phy_mac_interrupt() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 270/273] net: phy: Avoid polling PHY with PHY_IGNORE_INTERRUPTS Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 268/273] s390/oprofile: fix address range for asynchronous stack Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 271/273] net: phy: bcm7xxx: Fix 40nm EPHY features Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 255/273] batman-adv: Avoid endless loop in bat-on-bat netdevice check Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 267/273] net: phy: bcm7xxx: Fix bcm7xxx_config_init() check Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 238/273] net: Copy inner L3 and L4 headers as unaligned on GRE TEB Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 243/273] qmi_wwan: add "4G LTE usb-modem U901" Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 273/273] IB/IPoIB: Do not set skb truesize since using one linearskb Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 246/273] net/mlx4_en: Avoid changing dev->features directly in run-time Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 251/273] unix_diag: fix incorrect sign extension in unix_lookup_by_ino Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 250/273] rtnl: RTM_GETNETCONF: fix wrong return value Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 254/273] s390/perf_event: fix address range for asynchronous stack Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 266/273] bonding: don't use stale speed and duplex information Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 245/273] net/mlx4_en: Choose time-stamping shift value according to HW frequency Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 242/273] af_unix: Guard against other == sk in unix_dgram_sendmsg Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 239/273] bpf: fix branch offset adjustment on backjumps after patching ctx expansion Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 261/273] MAINTAINERS: Remove stale entry for BCM33xx chips Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 265/273] writeback: initialize inode members that track writeback history Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 257/273] netlink: not trim skb for mmaped socket when dump Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 248/273] pppoe: fix reference counting in PPPoE proxy Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 263/273] net/mlx4_core: Fix potential corruption in counters database Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 252/273] sctp: Fix port hash table size computation Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 260/273] s390/stacktrace: fix address ranges for asynchronous and panic stack Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 258/273] Input: xpad - remove unused function Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 272/273] netfilter: nfnetlink: correctly validate length of batch messages Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 244/273] net/mlx4_en: Count HW buffer overrun only once Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
    [PATCH 4.2.y-ckt 225/273] tipc: fix connection abort during subscription cancel Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
      Re: [PATCH 4.2.y-ckt 225/273] tipc: fix connection abort during  subscription cancel Kamal Mostafa <kamal@canonical.com> - 2016-03-10 19:00 +0100
    [PATCH 4.2.y-ckt 131/273] ALSA: timer: Fix race between stop and interrupt Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
    [PATCH 4.2.y-ckt 222/273] af_unix: fix struct pid memory leak Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
    [PATCH 4.2.y-ckt 240/273] bonding: Fix ARP monitor validation Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
    [PATCH 4.2.y-ckt 223/273] pptp: fix illegal memory access caused by multiple bind()s Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
    [PATCH 4.2.y-ckt 241/273] ipv4: fix memory leaks in ip_cmsg_send() callers Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
    [PATCH 4.2.y-ckt 224/273] sctp: allow setting SCTP_SACK_IMMEDIATELY by the application Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
    [PATCH 4.2.y-ckt 221/273] tcp: fix NULL deref in tcp_v4_send_ack() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
    [PATCH 4.2.y-ckt 176/273] x86/mm: Fix vmalloc_fault() to handle large pages properly Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
    [PATCH 4.2.y-ckt 172/273] x86/uaccess/64: Handle the caching of 4-byte nocache copies properly in __copy_user_nocache() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
    [PATCH 4.2.y-ckt 232/273] ipv6: fix a lockdep splat Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
    [PATCH 4.2.y-ckt 231/273] ipv6: addrconf: Fix recursive spin lock call Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
    [PATCH 4.2.y-ckt 228/273] ipv6: enforce flowi6_oif usage in ip6_dst_lookup_tail() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
    [PATCH 4.2.y-ckt 227/273] tcp: beware of alignments in tcp_get_info() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
    [PATCH 4.2.y-ckt 229/273] ipv6/udp: use sticky pktinfo egress ifindex on connect() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
    [PATCH 4.2.y-ckt 219/273] af_iucv: Validate socket address length in iucv_sock_bind() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
    [PATCH 4.2.y-ckt 226/273] switchdev: Require RTNL mutex to be held when sending FDB notifications Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
    [PATCH 4.2.y-ckt 237/273] flow_dissector: Fix unaligned access in __skb_flow_dissector when used by eth_get_headlen Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
    [PATCH 4.2.y-ckt 171/273] x86/uaccess/64: Make the __copy_user_nocache() assembly code more readable Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
    [PATCH 4.2.y-ckt 233/273] unix: correctly track in-flight fds in sending process user_struct Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
    [PATCH 4.2.y-ckt 230/273] net/ipv6: add sysctl option accept_ra_min_hop_limit Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
    [PATCH 4.2.y-ckt 190/273] drivers: android: correct the size of struct binder_uintptr_t for BC_DEAD_BINDER_DONE Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 215/273] do_last(): don't let a bogus return value from ->open() et.al. to confuse us Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 193/273] s390/compat: correct restore of high gprs on signal return Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 199/273] ARCv2: SMP: Emulate IPI to self using software triggered interrupt Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 197/273] sunrpc/cache: fix off-by-one in qword_get() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 191/273] can: ems_usb: Fix possible tx overflow Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 205/273] ALSA: hda - Fixing background noise on Dell Inspiron 3162 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 201/273] KVM: async_pf: do not warn on page allocation failures Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 203/273] libceph: don't bail early from try_read() when skipping a message Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 220/273] net: dp83640: Fix tx timestamp overflow handling. Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 210/273] ALSA: hda - Loop interrupt handling until really cleared Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 213/273] ocfs2: unlock inode if deleting inode from orphan fails Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 207/273] ALSA: hda/realtek - Support Dell headset mode for ALC225 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 218/273] do_last(): ELOOP failure exit should be done after leaving RCU mode Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 202/273] tracing: Fix showing function event in available_events Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 211/273] x86/mpx: Fix off-by-one comparison with nr_registers Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 208/273] ALSA: hda - Fixup speaker pass-through control for nid 0x14 on ALC225 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 204/273] libceph: use the right footer size when skipping a message Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 209/273] ALSA: hda - Fix headset support and noise on HP EliteBook 755 G2 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 192/273] dm: fix dm_rq_target_io leak on faults with .request_fn DM w/ blk-mq paths Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 217/273] should_follow_link(): validate ->d_seq after having decided to follow Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 212/273] mm: thp: fix SMP race condition between THP page fault and MADV_DONTNEED Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 206/273] KVM: x86: MMU: fix ubsan index-out-of-range warning Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 216/273] namei: ->d_inode of a pinned dentry is stable only for positives Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 214/273] hpfs: don't truncate the file when delete fails Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 200/273] KVM: x86: fix missed hardware breakpoints Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 198/273] KVM: arm/arm64: vgic: Ensure bitmaps are long enough Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
    [PATCH 4.2.y-ckt 155/273] iwlwifi: mvm: don't allow sched scans without matches to be started Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 174/273] powerpc/ioda: Set "read" permission when "write" is set Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 149/273] btrfs: properly set the termination value of ctx->pos in readdir Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 185/273] ext4: fix bh->b_state corruption Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 178/273] USB: option: add support for SIM7100E Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 153/273] ext4: don't read blocks from disk after extents being swapped Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 163/273] dmaengine: dw: disable BLOCK IRQs for non-cyclic xfer Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 164/273] tracepoints: Do not trace when cpu is offline Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 173/273] usb: dwc3: Fix assignment of EP transfer resources Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 182/273] ipc: convert invalid scenarios to use WARN_ON Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 165/273] tracing: Fix freak link error caused by branch tracer Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 160/273] xen/pcifront: Fix mysterious crashes when NUMA locality information was extracted. Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 179/273] USB: cp210x: add IDs for GE B650V3 and B850V3 boards Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 162/273] ALSA: hda - Cancel probe work instead of flush at remove Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 184/273] hwmon: (ads1015) Handle negative conversion values correctly Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 183/273] ipc/shm: handle removed segments gracefully in shm_mmap() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 151/273] scsi: fix soft lockup in scsi_remove_target() on module removal Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 152/273] ext4: fix potential integer overflow Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 154/273] bio: return EINTR if copying to user space got interrupted Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 180/273] USB: option: add "4G LTE usb-modem U901" Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 150/273] irqchip/gic-v3-its: Fix double ICC_EOIR write for LPI in EOImode==1 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 181/273] mm: fix regression in remap_file_pages() emulation Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 169/273] drm/qxl: use kmalloc_array to alloc reloc_info in qxl_process_single_command Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 168/273] drm/radeon: use post-decrement in error handling Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 177/273] ALSA: pcm: Fix rwsem deadlock for non-atomic PCM stream Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 161/273] ALSA: seq: Fix leak of pool buffer at concurrent writes Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 157/273] powerpc/powernv: Fix stale PE primary bus Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 175/273] NFSv4: Fix a dentry leak on alias use Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 166/273] ALSA: seq: Fix double port list deletion Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 167/273] drm/amdgpu: use post-decrement in error handling Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
    [PATCH 4.2.y-ckt 126/273] powerpc: Fix dedotify for binutils >= 2.26 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
    [PATCH 4.2.y-ckt 148/273] ARM: 8519/1: ICST: try other dividends than 1 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
    [PATCH 4.2.y-ckt 122/273] klist: fix starting point removed bug in klist iterators Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
    [PATCH 4.2.y-ckt 138/273] drm/i915: fix error path in intel_setup_gmbus() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
    [PATCH 4.2.y-ckt 130/273] nfs: fix nfs_size_to_loff_t Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
    [PATCH 4.2.y-ckt 147/273] s390/dasd: fix refcount for PAV reassignment Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
    [PATCH 4.2.y-ckt 124/273] drm/i915/dsi: defend gpio table against out of bounds access Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
    [PATCH 4.2.y-ckt 015/273] x86/entry/compat: Add missing CLAC to entry_INT80_32 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
    [PATCH 4.2.y-ckt 123/273] ALSA: dummy: Implement timer backend switching more safely Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
    [PATCH 4.2.y-ckt 132/273] ALSA: hda - Fix bad dereference of jack object Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
    [PATCH 4.2.y-ckt 144/273] drm/amdgpu: fix issue with overlapping userptrs Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
    [PATCH 4.2.y-ckt 128/273] ARM: 8517/1: ICST: avoid arithmetic overflow in icst_hz() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
    [PATCH 4.2.y-ckt 125/273] drm/i915/dsi: don't pass arbitrary data to sideband Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
    [PATCH 4.2.y-ckt 143/273] drm/radeon: hold reference to fences in radeon_sa_bo_new Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
    [PATCH 4.2.y-ckt 136/273] phy: twl4030-usb: Fix unbalanced pm_runtime_enable on module reload Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
    [PATCH 4.2.y-ckt 115/273] target: Fix race with SCF_SEND_DELAYED_TAS handling Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
    [PATCH 4.2.y-ckt 140/273] workqueue: handle NUMA_NO_NODE for unbound pool_workqueue lookup Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
    [PATCH 4.2.y-ckt 137/273] drm/i915/skl: Don't skip mst encoders in skl_ddi_pll_select() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
    [PATCH 4.2.y-ckt 127/273] ALSA: timer: Fix wrong instance passed to slave callbacks Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
    [PATCH 4.2.y-ckt 134/273] phy: core: fix wrong err handle for phy_power_on Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
    [PATCH 4.2.y-ckt 135/273] phy: twl4030-usb: Relase usb phy on unload Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
    [PATCH 4.2.y-ckt 145/273] cifs: fix erroneous return value Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
    [PATCH 4.2.y-ckt 039/273] ARM: dts: at91: sama5d4 xplained: fix phy0 IRQ type Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:10 +0100
    [PATCH 4.2.y-ckt 108/273] ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:10 +0100
    [PATCH 4.2.y-ckt 113/273] crypto: atmel-sha - fix atmel_sha_remove() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:10 +0100
    [PATCH 4.2.y-ckt 121/273] ALSA: hda - Fix speaker output from VAIO AiO machines Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:10 +0100
    [PATCH 4.2.y-ckt 117/273] serial: omap: Prevent DoS using unprivileged ioctl(TIOCSRS485) Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:10 +0100
    [PATCH 4.2.y-ckt 120/273] pty: make sure super_block is still valid in final /dev/tty close Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:10 +0100
    [PATCH 4.2.y-ckt 112/273] crypto: algif_skcipher - Do not set MAY_BACKLOG on the async path Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:30 +0100
    [PATCH 4.2.y-ckt 104/273] Revert "ALSA: hda - Fix noise on Gigabyte Z170X mobo" Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:30 +0100
    [PATCH 4.2.y-ckt 110/273] radix-tree: fix oops after radix_tree_iter_retry Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:30 +0100
    [PATCH 4.2.y-ckt 111/273] crypto: user - lock crypto_alg_list on alg dump Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:30 +0100
    [PATCH 4.2.y-ckt 109/273] mm: replace vma_lock_anon_vma with anon_vma_lock_read/write Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:30 +0100
    [PATCH 4.2.y-ckt 114/273] crypto: marvell/cesa - fix test in mv_cesa_dev_dma_init() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:30 +0100
    [PATCH 4.2.y-ckt 107/273] mm, vmstat: fix wrong WQ sleep when memory reclaim doesn't make any progress Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:30 +0100
    [PATCH 4.2.y-ckt 090/273] target: Fix TAS handling for multi-session se_node_acls Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 103/273] ALSA: hda - Fix static checker warning in patch_hdmi.c Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 068/273] drm/amdgpu: pull topaz gmc bits into gmc_v7 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 085/273] usb: xhci: apply XHCI_PME_STUCK_QUIRK to Intel Broxton-M platforms Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 070/273] modules: fix modparam async_probe request Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 102/273] drm/dp/mst: deallocate payload on port destruction Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 073/273] ALSA: rawmidi: Make snd_rawmidi_transmit() race-free Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 087/273] target: Invoke release_cmd() callback without holding a spinlock Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 074/273] ALSA: rawmidi: Fix race at copying & updating the position Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 080/273] Btrfs: fix invalid page accesses in extent_same (dedup) ioctl Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 071/273] module: wrapper for symbol name. Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 065/273] drm/amdgpu: move gmc7 support out of CIK dependency Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 098/273] drm: fix missing reference counting decrease Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 069/273] drm/amdgpu: drop topaz support from gmc8 module Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 064/273] ASoC: dpcm: fix the BE state on hw_free Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 066/273] drm/amdgpu: iceland use CI based MC IP Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 076/273] drivers/scsi/sg.c: mark VMA as VM_IO to prevent migration Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 096/273] scsi_dh_rdac: always retry MODE SELECT on command lock violation Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 061/273] drm: add helper to check for wc memory support Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 095/273] Btrfs: fix hang on extent buffer lock caused by the inode_paths ioctl Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 083/273] usb: xhci: add a quirk bit for ssic port unused Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 072/273] ALSA: hda - Add fixup for Mac Mini 7,1 model Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 084/273] usb: xhci: set SSIC port unused only if xhci_suspend succeeds Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 089/273] target: Fix LUN_RESET active TMR descriptor handling Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 101/273] drm/dp/mst: Reverse order of MST enable and clearing VC payload table. Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 075/273] ALSA: seq: Fix lockdep warnings due to double mutex locks Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 093/273] [media] saa7134-alsa: Only frees registered sound cards Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 088/273] target: Fix LUN_RESET active I/O handling for ACK_KREF Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 106/273] dump_stack: avoid potential deadlocks Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 100/273] drm/dp/mst: Calculate MST PBN with 31.32 fixed point Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 105/273] target: Fix remote-port TMR ABORT + se_cmd fabric stop Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 092/273] ALSA: timer: Fix leftover link at closing Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 097/273] SCSI: Add Marvell Console to VPD blacklist Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 094/273] ARM: nomadik: fix up SD/MMC DT settings Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 099/273] drm: Add drm_fixp_from_fraction and drm_fixp2int_ceil Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 067/273] drm/amdgpu: The VI specific EXE bit should only apply to GMC v8.0 above Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
    [PATCH 4.2.y-ckt 026/273] ARM: OMAP2+: Fix wait_dll_lock_timed for rodata Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 032/273] PCI/AER: Flush workqueue on device remove to avoid use-after-free Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 046/273] ALSA: usb-audio: Add quirk for Microsoft LifeCam HD-6000 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 058/273] libata: fix sff host state machine locking while polling Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 033/273] ARM: dts: Fix wl12xx missing clocks that cause hangs Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 037/273] ARM: dts: at91: sama5d4: fix instance id of DBGU Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 036/273] rfkill: fix rfkill_fop_read wait_event usage Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 049/273] iio: inkern: fix a NULL dereference on error Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 042/273] spi: atmel: fix gpio chip-select in case of non-DT platform Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 043/273] drm/i915/dp: fall back to 18 bpp when sink capability is unknown Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 044/273] ALSA: usb-audio: Fix OPPO HA-1 vendor ID Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 012/273] Revert "workqueue: make sure delayed work run in local cpu" Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 041/273] Input: vmmouse - fix absolute device registration Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 028/273] ARM: OMAP2+: Fix save_secure_ram_context for rodata Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 056/273] ALSA: timer: Code cleanup Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 055/273] ALSA: seq: Fix yet another races among ALSA timer accesses Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 062/273] drm/radeon: mask out WC from BO on unsupported arches Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 045/273] ALSA: usb-audio: Add native DSD support for PS Audio NuWave DAC Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 060/273] cputime: Prevent 32bit overflow in time[val|spec]_to_cputime() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 053/273] ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 027/273] ARM: OMAP2+: Fix l2dis_3630 for rodata Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 047/273] target: Fix WRITE_SAME/DISCARD conversion to linux 512b sectors Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 048/273] crypto: algif_hash - wait for crypto_ahash_init() to complete Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 051/273] intel_scu_ipcutil: underflow in scu_reg_access() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 035/273] mac80211: Requeue work after scan complete for all VIF types. Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 063/273] drm/amdgpu: mask out WC from BO on unsupported arches Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 025/273] cgroup: make sure a parent css isn't offlined before its children Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 023/273] ASoC: rt5645: fix the shift bit of IN1 boost Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 054/273] ALSA: pcm: Fix potential deadlock in OSS emulation Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 052/273] ALSA: seq: Fix race at closing in virmidi driver Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 057/273] ALSA: timer: Fix link corruption due to double start or stop Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 050/273] iio: pressure: mpl115: fix temperature offset sign Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 040/273] crypto: shash - Fix has_key setting Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
    [PATCH 4.2.y-ckt 009/273] EVM: Use crypto_memneq() for digest comparisons Kamal Mostafa <kamal@canonical.com> - 2016-03-08 02:00 +0100
    [PATCH 4.2.y-ckt 010/273] ALSA: usb-audio: avoid freeing umidi object twice Kamal Mostafa <kamal@canonical.com> - 2016-03-08 02:00 +0100
    [PATCH 4.2.y-ckt 022/273] iio:adc:ti_am335x_adc Fix buffered mode by identifying as software buffer. Kamal Mostafa <kamal@canonical.com> - 2016-03-08 02:00 +0100
    [PATCH 4.2.y-ckt 017/273] iio: add IIO_TRIGGER dependency to STK8BA50 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 02:00 +0100
    [PATCH 4.2.y-ckt 013/273] drm/vmwgfx: Fix an fb unlocking bug Kamal Mostafa <kamal@canonical.com> - 2016-03-08 02:00 +0100
    [PATCH 4.2.y-ckt 016/273] iio-light: Use a signed return type for ltr501_match_samp_freq() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 02:00 +0100
    [PATCH 4.2.y-ckt 024/273] ARCv2: STAR 9000950267: Handle return from intr to Delay Slot #2 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 02:00 +0100
    [PATCH 4.2.y-ckt 020/273] iommu/vt-d: Fix 64-bit accesses to 32-bit DMAR_GSTS_REG Kamal Mostafa <kamal@canonical.com> - 2016-03-08 02:00 +0100
    [PATCH 4.2.y-ckt 018/273] iio: add HAS_IOMEM dependency to VF610_ADC Kamal Mostafa <kamal@canonical.com> - 2016-03-08 02:00 +0100
    [PATCH 4.2.y-ckt 019/273] iio: dac: mcp4725: set iio name property in sysfs Kamal Mostafa <kamal@canonical.com> - 2016-03-08 02:00 +0100
    [PATCH 4.2.y-ckt 021/273] iio: light: acpi-als: Report data as processed Kamal Mostafa <kamal@canonical.com> - 2016-03-08 02:00 +0100
    [PATCH 4.2.y-ckt 011/273] vmstat: explicitly schedule per-cpu work on the CPU we need it to run on Kamal Mostafa <kamal@canonical.com> - 2016-03-08 02:00 +0100

Page 10 of 12 — ← Prev page 1 … 8 9 [10] 11 12  Next page →


#1352459 — [PATCH 4.2.y-ckt 105/273] target: Fix remote-port TMR ABORT + se_cmd fabric stop

FromKamal Mostafa <kamal@canonical.com>
Date2016-03-08 01:40 +0100
Subject[PATCH 4.2.y-ckt 105/273] target: Fix remote-port TMR ABORT + se_cmd fabric stop
Message-ID<radQV-1N3-81@gated-at.bofh.it>
In reply to#1352081
4.2.8-ckt5 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Nicholas Bellinger <nab@linux-iscsi.org>

commit 0f4a943168f31d29a1701908931acaba518b131a upstream.

To address the bug where fabric driver level shutdown
of se_cmd occurs at the same time when TMR CMD_T_ABORTED
is happening resulting in a -1 ->cmd_kref, this patch
adds a CMD_T_FABRIC_STOP bit that is used to determine
when TMR + driver I_T nexus shutdown is happening
concurrently.

It changes target_sess_cmd_list_set_waiting() to obtain
se_cmd->cmd_kref + set CMD_T_FABRIC_STOP, and drop local
reference in target_wait_for_sess_cmds() and invoke extra
target_put_sess_cmd() during Task Aborted Status (TAS)
when necessary.

Also, it adds a new target_wait_free_cmd() wrapper around
transport_wait_for_tasks() for the special case within
transport_generic_free_cmd() to set CMD_T_FABRIC_STOP,
and is now aware of CMD_T_ABORTED + CMD_T_TAS status
bits to know when an extra transport_put_cmd() during
TAS is required.

Note transport_generic_free_cmd() is expected to block on
cmd->cmd_wait_comp in order to follow what iscsi-target
expects during iscsi_conn context se_cmd shutdown.

Cc: Quinn Tran <quinn.tran@qlogic.com>
Cc: Himanshu Madhani <himanshu.madhani@qlogic.com>
Cc: Sagi Grimberg <sagig@mellanox.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Hannes Reinecke <hare@suse.de>
Cc: Andy Grover <agrover@redhat.com>
Cc: Mike Christie <mchristi@redhat.com>
Signed-off-by: Nicholas Bellinger <nab@daterainc.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/target/target_core_tmr.c       |  54 ++++++++----
 drivers/target/target_core_transport.c | 145 +++++++++++++++++++++++++--------
 include/target/target_core_base.h      |   2 +
 3 files changed, 150 insertions(+), 51 deletions(-)

diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
index 0e137f6..88029cc 100644
--- a/drivers/target/target_core_tmr.c
+++ b/drivers/target/target_core_tmr.c
@@ -75,16 +75,18 @@ void core_tmr_release_req(struct se_tmr_req *tmr)
 	kfree(tmr);
 }
 
-static void core_tmr_handle_tas_abort(
-	struct se_session *tmr_sess,
-	struct se_cmd *cmd,
-	int tas)
+static void core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas)
 {
-	bool remove = true;
+	unsigned long flags;
+	bool remove = true, send_tas;
 	/*
 	 * TASK ABORTED status (TAS) bit support
 	 */
-	if (tmr_sess && tmr_sess != cmd->se_sess && tas) {
+	spin_lock_irqsave(&cmd->t_state_lock, flags);
+	send_tas = (cmd->transport_state & CMD_T_TAS);
+	spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+
+	if (send_tas) {
 		remove = false;
 		transport_send_task_abort(cmd);
 	}
@@ -107,7 +109,8 @@ static int target_check_cdb_and_preempt(struct list_head *list,
 	return 1;
 }
 
-static bool __target_check_io_state(struct se_cmd *se_cmd)
+static bool __target_check_io_state(struct se_cmd *se_cmd,
+				    struct se_session *tmr_sess, int tas)
 {
 	struct se_session *sess = se_cmd->se_sess;
 
@@ -115,21 +118,32 @@ static bool __target_check_io_state(struct se_cmd *se_cmd)
 	WARN_ON_ONCE(!irqs_disabled());
 	/*
 	 * If command already reached CMD_T_COMPLETE state within
-	 * target_complete_cmd(), this se_cmd has been passed to
-	 * fabric driver and will not be aborted.
+	 * target_complete_cmd() or CMD_T_FABRIC_STOP due to shutdown,
+	 * this se_cmd has been passed to fabric driver and will
+	 * not be aborted.
 	 *
 	 * Otherwise, obtain a local se_cmd->cmd_kref now for TMR
 	 * ABORT_TASK + LUN_RESET for CMD_T_ABORTED processing as
 	 * long as se_cmd->cmd_kref is still active unless zero.
 	 */
 	spin_lock(&se_cmd->t_state_lock);
-	if (se_cmd->transport_state & CMD_T_COMPLETE) {
-		pr_debug("Attempted to abort io tag: %llu already complete,"
+	if (se_cmd->transport_state & (CMD_T_COMPLETE | CMD_T_FABRIC_STOP)) {
+		pr_debug("Attempted to abort io tag: %llu already complete or"
+			" fabric stop, skipping\n", se_cmd->tag);
+		spin_unlock(&se_cmd->t_state_lock);
+		return false;
+	}
+	if (sess->sess_tearing_down || se_cmd->cmd_wait_set) {
+		pr_debug("Attempted to abort io tag: %llu already shutdown,"
 			" skipping\n", se_cmd->tag);
 		spin_unlock(&se_cmd->t_state_lock);
 		return false;
 	}
 	se_cmd->transport_state |= CMD_T_ABORTED;
+
+	if ((tmr_sess != se_cmd->se_sess) && tas)
+		se_cmd->transport_state |= CMD_T_TAS;
+
 	spin_unlock(&se_cmd->t_state_lock);
 
 	return kref_get_unless_zero(&se_cmd->cmd_kref);
@@ -161,7 +175,7 @@ void core_tmr_abort_task(
 		printk("ABORT_TASK: Found referenced %s task_tag: %llu\n",
 			se_cmd->se_tfo->get_fabric_name(), ref_tag);
 
-		if (!__target_check_io_state(se_cmd)) {
+		if (!__target_check_io_state(se_cmd, se_sess, 0)) {
 			spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
 			target_put_sess_cmd(se_cmd);
 			goto out;
@@ -230,7 +244,8 @@ static void core_tmr_drain_tmr_list(
 
 		spin_lock(&sess->sess_cmd_lock);
 		spin_lock(&cmd->t_state_lock);
-		if (!(cmd->transport_state & CMD_T_ACTIVE)) {
+		if (!(cmd->transport_state & CMD_T_ACTIVE) ||
+		     (cmd->transport_state & CMD_T_FABRIC_STOP)) {
 			spin_unlock(&cmd->t_state_lock);
 			spin_unlock(&sess->sess_cmd_lock);
 			continue;
@@ -240,15 +255,22 @@ static void core_tmr_drain_tmr_list(
 			spin_unlock(&sess->sess_cmd_lock);
 			continue;
 		}
+		if (sess->sess_tearing_down || cmd->cmd_wait_set) {
+			spin_unlock(&cmd->t_state_lock);
+			spin_unlock(&sess->sess_cmd_lock);
+			continue;
+		}
 		cmd->transport_state |= CMD_T_ABORTED;
 		spin_unlock(&cmd->t_state_lock);
 
 		rc = kref_get_unless_zero(&cmd->cmd_kref);
-		spin_unlock(&sess->sess_cmd_lock);
 		if (!rc) {
 			printk("LUN_RESET TMR: non-zero kref_get_unless_zero\n");
+			spin_unlock(&sess->sess_cmd_lock);
 			continue;
 		}
+		spin_unlock(&sess->sess_cmd_lock);
+
 		list_move_tail(&tmr_p->tmr_list, &drain_tmr_list);
 	}
 	spin_unlock_irqrestore(&dev->se_tmr_lock, flags);
@@ -325,7 +347,7 @@ static void core_tmr_drain_state_list(
 			continue;
 
 		spin_lock(&sess->sess_cmd_lock);
-		rc = __target_check_io_state(cmd);
+		rc = __target_check_io_state(cmd, tmr_sess, tas);
 		spin_unlock(&sess->sess_cmd_lock);
 		if (!rc)
 			continue;
@@ -364,7 +386,7 @@ static void core_tmr_drain_state_list(
 		cancel_work_sync(&cmd->work);
 		transport_wait_for_tasks(cmd);
 
-		core_tmr_handle_tas_abort(tmr_sess, cmd, tas);
+		core_tmr_handle_tas_abort(cmd, tas);
 		target_put_sess_cmd(cmd);
 	}
 }
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 2e89168..2819f5c 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -2381,18 +2381,33 @@ static void transport_write_pending_qf(struct se_cmd *cmd)
 	}
 }
 
+static bool
+__transport_wait_for_tasks(struct se_cmd *, bool, bool *, bool *,
+			   unsigned long *flags);
+
+static void target_wait_free_cmd(struct se_cmd *cmd, bool *aborted, bool *tas)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&cmd->t_state_lock, flags);
+	__transport_wait_for_tasks(cmd, true, aborted, tas, &flags);
+	spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+}
+
 int transport_generic_free_cmd(struct se_cmd *cmd, int wait_for_tasks)
 {
 	int ret = 0;
+	bool aborted = false, tas = false;
 
 	if (!(cmd->se_cmd_flags & SCF_SE_LUN_CMD)) {
 		if (wait_for_tasks && (cmd->se_cmd_flags & SCF_SCSI_TMR_CDB))
-			transport_wait_for_tasks(cmd);
+			target_wait_free_cmd(cmd, &aborted, &tas);
 
-		ret = transport_put_cmd(cmd);
+		if (!aborted || tas)
+			ret = transport_put_cmd(cmd);
 	} else {
 		if (wait_for_tasks)
-			transport_wait_for_tasks(cmd);
+			target_wait_free_cmd(cmd, &aborted, &tas);
 		/*
 		 * Handle WRITE failure case where transport_generic_new_cmd()
 		 * has already added se_cmd to state_list, but fabric has
@@ -2404,7 +2419,20 @@ int transport_generic_free_cmd(struct se_cmd *cmd, int wait_for_tasks)
 		if (cmd->se_lun)
 			transport_lun_remove_cmd(cmd);
 
-		ret = transport_put_cmd(cmd);
+		if (!aborted || tas)
+			ret = transport_put_cmd(cmd);
+	}
+	/*
+	 * If the task has been internally aborted due to TMR ABORT_TASK
+	 * or LUN_RESET, target_core_tmr.c is responsible for performing
+	 * the remaining calls to target_put_sess_cmd(), and not the
+	 * callers of this function.
+	 */
+	if (aborted) {
+		pr_debug("Detected CMD_T_ABORTED for ITT: %llu\n", cmd->tag);
+		wait_for_completion(&cmd->cmd_wait_comp);
+		cmd->se_tfo->release_cmd(cmd);
+		ret = 1;
 	}
 	return ret;
 }
@@ -2459,6 +2487,7 @@ static void target_release_cmd_kref(struct kref *kref)
 	struct se_cmd *se_cmd = container_of(kref, struct se_cmd, cmd_kref);
 	struct se_session *se_sess = se_cmd->se_sess;
 	unsigned long flags;
+	bool fabric_stop;
 
 	spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
 	if (list_empty(&se_cmd->se_cmd_list)) {
@@ -2467,13 +2496,19 @@ static void target_release_cmd_kref(struct kref *kref)
 		se_cmd->se_tfo->release_cmd(se_cmd);
 		return;
 	}
-	if (se_sess->sess_tearing_down && se_cmd->cmd_wait_set) {
+
+	spin_lock(&se_cmd->t_state_lock);
+	fabric_stop = (se_cmd->transport_state & CMD_T_FABRIC_STOP);
+	spin_unlock(&se_cmd->t_state_lock);
+
+	if (se_cmd->cmd_wait_set || fabric_stop) {
+		list_del_init(&se_cmd->se_cmd_list);
 		spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
 		target_free_cmd_mem(se_cmd);
 		complete(&se_cmd->cmd_wait_comp);
 		return;
 	}
-	list_del(&se_cmd->se_cmd_list);
+	list_del_init(&se_cmd->se_cmd_list);
 	spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
 
 	target_free_cmd_mem(se_cmd);
@@ -2505,6 +2540,7 @@ void target_sess_cmd_list_set_waiting(struct se_session *se_sess)
 {
 	struct se_cmd *se_cmd;
 	unsigned long flags;
+	int rc;
 
 	spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
 	if (se_sess->sess_tearing_down) {
@@ -2514,8 +2550,15 @@ void target_sess_cmd_list_set_waiting(struct se_session *se_sess)
 	se_sess->sess_tearing_down = 1;
 	list_splice_init(&se_sess->sess_cmd_list, &se_sess->sess_wait_list);
 
-	list_for_each_entry(se_cmd, &se_sess->sess_wait_list, se_cmd_list)
-		se_cmd->cmd_wait_set = 1;
+	list_for_each_entry(se_cmd, &se_sess->sess_wait_list, se_cmd_list) {
+		rc = kref_get_unless_zero(&se_cmd->cmd_kref);
+		if (rc) {
+			se_cmd->cmd_wait_set = 1;
+			spin_lock(&se_cmd->t_state_lock);
+			se_cmd->transport_state |= CMD_T_FABRIC_STOP;
+			spin_unlock(&se_cmd->t_state_lock);
+		}
+	}
 
 	spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
 }
@@ -2528,15 +2571,25 @@ void target_wait_for_sess_cmds(struct se_session *se_sess)
 {
 	struct se_cmd *se_cmd, *tmp_cmd;
 	unsigned long flags;
+	bool tas;
 
 	list_for_each_entry_safe(se_cmd, tmp_cmd,
 				&se_sess->sess_wait_list, se_cmd_list) {
-		list_del(&se_cmd->se_cmd_list);
+		list_del_init(&se_cmd->se_cmd_list);
 
 		pr_debug("Waiting for se_cmd: %p t_state: %d, fabric state:"
 			" %d\n", se_cmd, se_cmd->t_state,
 			se_cmd->se_tfo->get_cmd_state(se_cmd));
 
+		spin_lock_irqsave(&se_cmd->t_state_lock, flags);
+		tas = (se_cmd->transport_state & CMD_T_TAS);
+		spin_unlock_irqrestore(&se_cmd->t_state_lock, flags);
+
+		if (!target_put_sess_cmd(se_cmd)) {
+			if (tas)
+				target_put_sess_cmd(se_cmd);
+		}
+
 		wait_for_completion(&se_cmd->cmd_wait_comp);
 		pr_debug("After cmd_wait_comp: se_cmd: %p t_state: %d"
 			" fabric state: %d\n", se_cmd, se_cmd->t_state,
@@ -2558,53 +2611,75 @@ void transport_clear_lun_ref(struct se_lun *lun)
 	wait_for_completion(&lun->lun_ref_comp);
 }
 
-/**
- * transport_wait_for_tasks - wait for completion to occur
- * @cmd:	command to wait
- *
- * Called from frontend fabric context to wait for storage engine
- * to pause and/or release frontend generated struct se_cmd.
- */
-bool transport_wait_for_tasks(struct se_cmd *cmd)
+static bool
+__transport_wait_for_tasks(struct se_cmd *cmd, bool fabric_stop,
+			   bool *aborted, bool *tas, unsigned long *flags)
+	__releases(&cmd->t_state_lock)
+	__acquires(&cmd->t_state_lock)
 {
-	unsigned long flags;
 
-	spin_lock_irqsave(&cmd->t_state_lock, flags);
+	assert_spin_locked(&cmd->t_state_lock);
+	WARN_ON_ONCE(!irqs_disabled());
+
+	if (fabric_stop)
+		cmd->transport_state |= CMD_T_FABRIC_STOP;
+
+	if (cmd->transport_state & CMD_T_ABORTED)
+		*aborted = true;
+
+	if (cmd->transport_state & CMD_T_TAS)
+		*tas = true;
+
 	if (!(cmd->se_cmd_flags & SCF_SE_LUN_CMD) &&
-	    !(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB)) {
-		spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+	    !(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB))
 		return false;
-	}
 
 	if (!(cmd->se_cmd_flags & SCF_SUPPORTED_SAM_OPCODE) &&
-	    !(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB)) {
-		spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+	    !(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB))
 		return false;
-	}
 
-	if (!(cmd->transport_state & CMD_T_ACTIVE)) {
-		spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+	if (!(cmd->transport_state & CMD_T_ACTIVE))
+		return false;
+
+	if (fabric_stop && *aborted)
 		return false;
-	}
 
 	cmd->transport_state |= CMD_T_STOP;
 
-	pr_debug("wait_for_tasks: Stopping %p ITT: 0x%08llx i_state: %d, t_state: %d, CMD_T_STOP\n",
-		cmd, cmd->tag, cmd->se_tfo->get_cmd_state(cmd), cmd->t_state);
+	pr_debug("wait_for_tasks: Stopping %p ITT: 0x%08llx i_state: %d,"
+		 " t_state: %d, CMD_T_STOP\n", cmd, cmd->tag,
+		 cmd->se_tfo->get_cmd_state(cmd), cmd->t_state);
 
-	spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+	spin_unlock_irqrestore(&cmd->t_state_lock, *flags);
 
 	wait_for_completion(&cmd->t_transport_stop_comp);
 
-	spin_lock_irqsave(&cmd->t_state_lock, flags);
+	spin_lock_irqsave(&cmd->t_state_lock, *flags);
 	cmd->transport_state &= ~(CMD_T_ACTIVE | CMD_T_STOP);
 
-	pr_debug("wait_for_tasks: Stopped wait_for_completion(&cmd->t_transport_stop_comp) for ITT: 0x%08llx\n",
-		cmd->tag);
+	pr_debug("wait_for_tasks: Stopped wait_for_completion(&cmd->"
+		 "t_transport_stop_comp) for ITT: 0x%08llx\n", cmd->tag);
 
+	return true;
+}
+
+/**
+ * transport_wait_for_tasks - wait for completion to occur
+ * @cmd:	command to wait
+ *
+ * Called from frontend fabric context to wait for storage engine
+ * to pause and/or release frontend generated struct se_cmd.
+ */
+bool transport_wait_for_tasks(struct se_cmd *cmd)
+{
+	unsigned long flags;
+	bool ret, aborted = false, tas = false;
+
+	spin_lock_irqsave(&cmd->t_state_lock, flags);
+	ret = __transport_wait_for_tasks(cmd, false, &aborted, &tas, &flags);
 	spin_unlock_irqrestore(&cmd->t_state_lock, flags);
 
-	return true;
+	return ret;
 }
 EXPORT_SYMBOL(transport_wait_for_tasks);
 
diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
index deb9cba..19b6c16 100644
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -497,6 +497,8 @@ struct se_cmd {
 #define CMD_T_DEV_ACTIVE	(1 << 7)
 #define CMD_T_REQUEST_STOP	(1 << 8)
 #define CMD_T_BUSY		(1 << 9)
+#define CMD_T_TAS		(1 << 10)
+#define CMD_T_FABRIC_STOP	(1 << 11)
 	spinlock_t		t_state_lock;
 	struct completion	t_transport_stop_comp;
 
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]


#1352460 — [PATCH 4.2.y-ckt 092/273] ALSA: timer: Fix leftover link at closing

FromKamal Mostafa <kamal@canonical.com>
Date2016-03-08 01:40 +0100
Subject[PATCH 4.2.y-ckt 092/273] ALSA: timer: Fix leftover link at closing
Message-ID<radQV-1N3-83@gated-at.bofh.it>
In reply to#1352081
4.2.8-ckt5 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Takashi Iwai <tiwai@suse.de>

commit 094fd3be87b0f102589e2d5c3fa5d06b7e20496d upstream.

In ALSA timer core, the active timer instance is managed in
active_list linked list.  Each element is added / removed dynamically
at timer start, stop and in timer interrupt.  The problem is that
snd_timer_interrupt() has a thinko and leaves the element in
active_list when it's the last opened element.  This eventually leads
to list corruption or use-after-free error.

This hasn't been revealed because we used to delete the list forcibly
in snd_timer_stop() in the past.  However, the recent fix avoids the
double-stop behavior (in commit [f784beb75ce8: ALSA: timer: Fix link
corruption due to double start or stop]), and this leak hits reality.

This patch fixes the link management in snd_timer_interrupt().  Now it
simply unlinks no matter which stream is.

BugLink: http://lkml.kernel.org/r/CACT4Y+Yy2aukHP-EDp8-ziNqNNmb-NTf=jDWXMP7jB8HDa2vng@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 sound/core/timer.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/core/timer.c b/sound/core/timer.c
index a8b415d..a011b67 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -744,8 +744,8 @@ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left)
 			ti->cticks = ti->ticks;
 		} else {
 			ti->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
-			if (--timer->running)
-				list_del_init(&ti->active_list);
+			--timer->running;
+			list_del_init(&ti->active_list);
 		}
 		if ((timer->hw.flags & SNDRV_TIMER_HW_TASKLET) ||
 		    (ti->flags & SNDRV_TIMER_IFLG_FAST))
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]


#1352461 — [PATCH 4.2.y-ckt 097/273] SCSI: Add Marvell Console to VPD blacklist

FromKamal Mostafa <kamal@canonical.com>
Date2016-03-08 01:40 +0100
Subject[PATCH 4.2.y-ckt 097/273] SCSI: Add Marvell Console to VPD blacklist
Message-ID<radQV-1N3-79@gated-at.bofh.it>
In reply to#1352081
4.2.8-ckt5 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Mika Westerberg <mika.westerberg@linux.intel.com>

commit 82c43310508eb19eb41fe7862e89afeb74030b84 upstream.

I have a Marvell 88SE9230 SATA Controller that has some sort of
integrated console SCSI device attached to one of the ports.

  ata14: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
  ata14.00: ATAPI: MARVELL VIRTUALL, 1.09, max UDMA/66
  ata14.00: configured for UDMA/66
  scsi 13:0:0:0: Processor         Marvell  Console 1.01 PQ: 0 ANSI: 5

Sending it VPD INQUIRY command seem to always fail with following error:

  ata14.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x6
  ata14.00: irq_stat 0x40000001
  ata14.00: cmd a0/01:00:00:00:01/00:00:00:00:00/a0 tag 2 dma 16640 in
            Inquiry 12 01 00 00 ff 00res 00/00:00:00:00:00/00:00:00:00:00/00 Emask 0x3 (HSM violation)
  ata14: hard resetting link

This has been minor annoyance (only error printed on dmesg) until commit
09e2b0b14690 ("scsi: rescan VPD attributes") added call to scsi_attach_vpd()
in scsi_rescan_device(). The commit causes the system to splat out
following errors continuously without ever reaching the UI:

  ata14.00: configured for UDMA/66
  ata14: EH complete
  ata14.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x6
  ata14.00: irq_stat 0x40000001
  ata14.00: cmd a0/01:00:00:00:01/00:00:00:00:00/a0 tag 6 dma 16640 in
            Inquiry 12 01 00 00 ff 00res 00/00:00:00:00:00/00:00:00:00:00/00 Emask 0x3 (HSM violation)
  ata14: hard resetting link
  ata14: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
  ata14.00: configured for UDMA/66
  ata14: EH complete
  ata14.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x6
  ata14.00: irq_stat 0x40000001
  ata14.00: cmd a0/01:00:00:00:01/00:00:00:00:00/a0 tag 7 dma 16640 in
            Inquiry 12 01 00 00 ff 00res 00/00:00:00:00:00/00:00:00:00:00/00 Emask 0x3 (HSM violation)

Without in-depth understanding of SCSI layer and the Marvell controller,
I suspect this happens because when the link goes down (because of an
error) we schedule scsi_rescan_device() which again fails to read VPD
data... ad infinitum.

Since VPD data cannot be read from the device anyway we prevent the SCSI
layer from even trying by blacklisting the device. This gets away the
error and the system starts up normally.

[mkp: Widened the match to all revisions of this device]

Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Reported-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Reported-by: Alexander Duyck <alexander.duyck@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/scsi/scsi_devinfo.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index 64ed88a..ac418e7 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -205,6 +205,7 @@ static struct {
 	{"Intel", "Multi-Flex", NULL, BLIST_NO_RSOC},
 	{"iRiver", "iFP Mass Driver", NULL, BLIST_NOT_LOCKABLE | BLIST_INQUIRY_36},
 	{"LASOUND", "CDX7405", "3.10", BLIST_MAX5LUN | BLIST_SINGLELUN},
+	{"Marvell", "Console", NULL, BLIST_SKIP_VPD_PAGES},
 	{"MATSHITA", "PD-1", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
 	{"MATSHITA", "DMC-LC5", NULL, BLIST_NOT_LOCKABLE | BLIST_INQUIRY_36},
 	{"MATSHITA", "DMC-LC40", NULL, BLIST_NOT_LOCKABLE | BLIST_INQUIRY_36},
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]


#1352462 — [PATCH 4.2.y-ckt 094/273] ARM: nomadik: fix up SD/MMC DT settings

FromKamal Mostafa <kamal@canonical.com>
Date2016-03-08 01:40 +0100
Subject[PATCH 4.2.y-ckt 094/273] ARM: nomadik: fix up SD/MMC DT settings
Message-ID<radQV-1N3-85@gated-at.bofh.it>
In reply to#1352081
4.2.8-ckt5 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Linus Walleij <linus.walleij@linaro.org>

commit 418d5516568b3fdbc4e7b53677dd78aed8514565 upstream.

The DTSI file for the Nomadik does not properly specify how the
PL180 levelshifter is connected: the Nomadik actually needs all
the five st,sig-dir-* flags set to properly control all lines out.

Further this board supports full power cycling of the card, and
since this variant has no hardware clock gating, it needs a
ridiculously low frequency setting to keep up with the ever
overflowing FIFO.

The pin configuration set-up is a bit of a mystery, because of
course these pins are a mix of inputs and outputs. However the
reference implementation sets all pins to "output" with
unspecified initial value, so let's do that here as well.

Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/arm/boot/dts/ste-nomadik-stn8815.dtsi | 37 ++++++++++++++++--------------
 1 file changed, 20 insertions(+), 17 deletions(-)

diff --git a/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi b/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi
index ef794a3..0e1a1c2 100644
--- a/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi
+++ b/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi
@@ -122,22 +122,14 @@
 			};
 			mmcsd_default_mode: mmcsd_default {
 				mmcsd_default_cfg1 {
-					/* MCCLK */
-					pins = "GPIO8_B10";
-					ste,output = <0>;
-				};
-				mmcsd_default_cfg2 {
-					/* MCCMDDIR, MCDAT0DIR, MCDAT31DIR, MCDATDIR2 */
-					pins = "GPIO10_C11", "GPIO15_A12",
-					"GPIO16_C13", "GPIO23_D15";
-					ste,output = <1>;
-				};
-				mmcsd_default_cfg3 {
-					/* MCCMD, MCDAT3-0, MCMSFBCLK */
-					pins = "GPIO9_A10", "GPIO11_B11",
-					"GPIO12_A11", "GPIO13_C12",
-					"GPIO14_B12", "GPIO24_C15";
-					ste,input = <1>;
+					/*
+					 * MCCLK, MCCMDDIR, MCDAT0DIR, MCDAT31DIR, MCDATDIR2
+					 * MCCMD, MCDAT3-0, MCMSFBCLK
+					 */
+					pins = "GPIO8_B10", "GPIO9_A10", "GPIO10_C11", "GPIO11_B11",
+					       "GPIO12_A11", "GPIO13_C12", "GPIO14_B12", "GPIO15_A12",
+					       "GPIO16_C13", "GPIO23_D15", "GPIO24_C15";
+					ste,output = <2>;
 				};
 			};
 		};
@@ -804,10 +796,21 @@
 			clock-names = "mclk", "apb_pclk";
 			interrupt-parent = <&vica>;
 			interrupts = <22>;
-			max-frequency = <48000000>;
+			max-frequency = <400000>;
 			bus-width = <4>;
 			cap-mmc-highspeed;
 			cap-sd-highspeed;
+			full-pwr-cycle;
+			/*
+			 * The STw4811 circuit used with the Nomadik strictly
+			 * requires that all of these signal direction pins be
+			 * routed and used for its 4-bit levelshifter.
+			 */
+			st,sig-dir-dat0;
+			st,sig-dir-dat2;
+			st,sig-dir-dat31;
+			st,sig-dir-cmd;
+			st,sig-pin-fbclk;
 			pinctrl-names = "default";
 			pinctrl-0 = <&mmcsd_default_mux>, <&mmcsd_default_mode>;
 			vmmc-supply = <&vmmc_regulator>;
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]


#1352463 — [PATCH 4.2.y-ckt 099/273] drm: Add drm_fixp_from_fraction and drm_fixp2int_ceil

FromKamal Mostafa <kamal@canonical.com>
Date2016-03-08 01:40 +0100
Subject[PATCH 4.2.y-ckt 099/273] drm: Add drm_fixp_from_fraction and drm_fixp2int_ceil
Message-ID<radQV-1N3-89@gated-at.bofh.it>
In reply to#1352081
4.2.8-ckt5 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Harry Wentland <harry.wentland@amd.com>

commit 64566b5e767f9bc3161055ca1b443a51afb52aad upstream.

drm_fixp_from_fraction allows us to create a fixed point directly
from a fraction, rather than creating fixed point values and dividing
later. This avoids overflow of our 64 bit value for large numbers.

drm_fixp2int_ceil allows us to return the ceiling of our fixed point
value.

[airlied: squash Jordan's fix]
32-bit-build-fix: Jordan Lazare <Jordan.Lazare@amd.com>
Signed-off-by: Harry Wentland <harry.wentland@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 include/drm/drm_fixed.h | 53 +++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 51 insertions(+), 2 deletions(-)

diff --git a/include/drm/drm_fixed.h b/include/drm/drm_fixed.h
index d639049..553210c 100644
--- a/include/drm/drm_fixed.h
+++ b/include/drm/drm_fixed.h
@@ -73,18 +73,28 @@ static inline u32 dfixed_div(fixed20_12 A, fixed20_12 B)
 #define DRM_FIXED_ONE		(1ULL << DRM_FIXED_POINT)
 #define DRM_FIXED_DECIMAL_MASK	(DRM_FIXED_ONE - 1)
 #define DRM_FIXED_DIGITS_MASK	(~DRM_FIXED_DECIMAL_MASK)
+#define DRM_FIXED_EPSILON	1LL
+#define DRM_FIXED_ALMOST_ONE	(DRM_FIXED_ONE - DRM_FIXED_EPSILON)
 
 static inline s64 drm_int2fixp(int a)
 {
 	return ((s64)a) << DRM_FIXED_POINT;
 }
 
-static inline int drm_fixp2int(int64_t a)
+static inline int drm_fixp2int(s64 a)
 {
 	return ((s64)a) >> DRM_FIXED_POINT;
 }
 
-static inline unsigned drm_fixp_msbset(int64_t a)
+static inline int drm_fixp2int_ceil(s64 a)
+{
+	if (a > 0)
+		return drm_fixp2int(a + DRM_FIXED_ALMOST_ONE);
+	else
+		return drm_fixp2int(a - DRM_FIXED_ALMOST_ONE);
+}
+
+static inline unsigned drm_fixp_msbset(s64 a)
 {
 	unsigned shift, sign = (a >> 63) & 1;
 
@@ -136,6 +146,45 @@ static inline s64 drm_fixp_div(s64 a, s64 b)
 	return result;
 }
 
+static inline s64 drm_fixp_from_fraction(s64 a, s64 b)
+{
+	s64 res;
+	bool a_neg = a < 0;
+	bool b_neg = b < 0;
+	u64 a_abs = a_neg ? -a : a;
+	u64 b_abs = b_neg ? -b : b;
+	u64 rem;
+
+	/* determine integer part */
+	u64 res_abs  = div64_u64_rem(a_abs, b_abs, &rem);
+
+	/* determine fractional part */
+	{
+		u32 i = DRM_FIXED_POINT;
+
+		do {
+			rem <<= 1;
+			res_abs <<= 1;
+			if (rem >= b_abs) {
+				res_abs |= 1;
+				rem -= b_abs;
+			}
+		} while (--i != 0);
+	}
+
+	/* round up LSB */
+	{
+		u64 summand = (rem << 1) >= b_abs;
+
+		res_abs += summand;
+	}
+
+	res = (s64) res_abs;
+	if (a_neg ^ b_neg)
+		res = -res;
+	return res;
+}
+
 static inline s64 drm_fixp_exp(s64 x)
 {
 	s64 tolerance = div64_s64(DRM_FIXED_ONE, 1000000);
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]


#1352465 — [PATCH 4.2.y-ckt 067/273] drm/amdgpu: The VI specific EXE bit should only apply to GMC v8.0 above

FromKamal Mostafa <kamal@canonical.com>
Date2016-03-08 01:40 +0100
Subject[PATCH 4.2.y-ckt 067/273] drm/amdgpu: The VI specific EXE bit should only apply to GMC v8.0 above
Message-ID<radQV-1N3-93@gated-at.bofh.it>
In reply to#1352081
4.2.8-ckt5 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Ken Wang <Qingqing.Wang@amd.com>

commit 8f3c162961fc2d92ec73a66496aab69eb2e19c36 upstream.

Reviewed-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Ken Wang <Qingqing.Wang@amd.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index dd3415d..beaa2fa 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -803,7 +803,7 @@ uint32_t amdgpu_ttm_tt_pte_flags(struct amdgpu_device *adev, struct ttm_tt *ttm,
 	if (!ttm || ttm->caching_state == tt_cached)
 		flags |= AMDGPU_PTE_SNOOPED;
 
-	if (adev->asic_type >= CHIP_TOPAZ)
+	if (adev->asic_type >= CHIP_TONGA)
 		flags |= AMDGPU_PTE_EXECUTABLE;
 
 	flags |= AMDGPU_PTE_READABLE;
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]


#1352466 — [PATCH 4.2.y-ckt 026/273] ARM: OMAP2+: Fix wait_dll_lock_timed for rodata

FromKamal Mostafa <kamal@canonical.com>
Date2016-03-08 01:50 +0100
Subject[PATCH 4.2.y-ckt 026/273] ARM: OMAP2+: Fix wait_dll_lock_timed for rodata
Message-ID<rae0x-1QO-1@gated-at.bofh.it>
In reply to#1352081
4.2.8-ckt5 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Tony Lindgren <tony@atomide.com>

commit d9db59103305eb5ec2a86369f32063e9921b6ac5 upstream.

We don't want to be writing to .text so it can be set rodata.
Fix error "Unable to handle kernel paging request at virtual address
c012396c" in wait_dll_lock_timed if CONFIG_DEBUG_RODATA is selected.

As these counters are for debugging only and unused, we can just
remove them.

Cc: Kees Cook <keescook@chromium.org>
Cc: Laura Abbott <labbott@redhat.com>
Cc: Nishanth Menon <nm@ti.com>
Cc: Richard Woodruff <r-woodruff2@ti.com>
Cc: Russell King <linux@arm.linux.org.uk>
Cc: Tero Kristo <t-kristo@ti.com>
Acked-by: Nicolas Pitre <nico@linaro.org>
Fixes: 1e6b48116a95 ("ARM: mm: allow non-text sections to be
non-executable")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/arm/mach-omap2/sleep34xx.S | 22 ----------------------
 1 file changed, 22 deletions(-)

diff --git a/arch/arm/mach-omap2/sleep34xx.S b/arch/arm/mach-omap2/sleep34xx.S
index eafd120..787cfda 100644
--- a/arch/arm/mach-omap2/sleep34xx.S
+++ b/arch/arm/mach-omap2/sleep34xx.S
@@ -289,12 +289,6 @@ wait_sdrc_ready:
 	bic	r5, r5, #0x40
 	str	r5, [r4]
 
-/*
- * PC-relative stores lead to undefined behaviour in Thumb-2: use a r7 as a
- * base instead.
- * Be careful not to clobber r7 when maintaing this code.
- */
-
 is_dll_in_lock_mode:
 	/* Is dll in lock mode? */
 	ldr	r4, sdrc_dlla_ctrl
@@ -302,11 +296,7 @@ is_dll_in_lock_mode:
 	tst	r5, #0x4
 	bne	exit_nonoff_modes	@ Return if locked
 	/* wait till dll locks */
-	adr	r7, kick_counter
 wait_dll_lock_timed:
-	ldr	r4, wait_dll_lock_counter
-	add	r4, r4, #1
-	str	r4, [r7, #wait_dll_lock_counter - kick_counter]
 	ldr	r4, sdrc_dlla_status
 	/* Wait 20uS for lock */
 	mov	r6, #8
@@ -330,9 +320,6 @@ kick_dll:
 	orr	r6, r6, #(1<<3)		@ enable dll
 	str	r6, [r4]
 	dsb
-	ldr	r4, kick_counter
-	add	r4, r4, #1
-	str	r4, [r7]		@ kick_counter
 	b	wait_dll_lock_timed
 
 exit_nonoff_modes:
@@ -360,15 +347,6 @@ sdrc_dlla_status:
 	.word	SDRC_DLLA_STATUS_V
 sdrc_dlla_ctrl:
 	.word	SDRC_DLLA_CTRL_V
-	/*
-	 * When exporting to userspace while the counters are in SRAM,
-	 * these 2 words need to be at the end to facilitate retrival!
-	 */
-kick_counter:
-	.word	0
-wait_dll_lock_counter:
-	.word	0
-
 ENTRY(omap3_do_wfi_sz)
 	.word	. - omap3_do_wfi
 
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]


#1352467 — [PATCH 4.2.y-ckt 032/273] PCI/AER: Flush workqueue on device remove to avoid use-after-free

FromKamal Mostafa <kamal@canonical.com>
Date2016-03-08 01:50 +0100
Subject[PATCH 4.2.y-ckt 032/273] PCI/AER: Flush workqueue on device remove to avoid use-after-free
Message-ID<rae0x-1QO-3@gated-at.bofh.it>
In reply to#1352081
4.2.8-ckt5 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>

commit 4ae2182b1e3407de369f8c5d799543b7db74221b upstream.

A Root Port's AER structure (rpc) contains a queue of events.  aer_irq()
enqueues AER status information and schedules aer_isr() to dequeue and
process it.  When we remove a device, aer_remove() waits for the queue to
be empty, then frees the rpc struct.

But aer_isr() references the rpc struct after dequeueing and possibly
emptying the queue, which can cause a use-after-free error as in the
following scenario with two threads, aer_isr() on the left and a
concurrent aer_remove() on the right:

  Thread A                      Thread B
  --------                      --------
  aer_irq():
    rpc->prod_idx++
                                aer_remove():
                                  wait_event(rpc->prod_idx == rpc->cons_idx)
                                  # now blocked until queue becomes empty
  aer_isr():                      # ...
    rpc->cons_idx++               # unblocked because queue is now empty
    ...                           kfree(rpc)
    mutex_unlock(&rpc->rpc_mutex)

To prevent this problem, use flush_work() to wait until the last scheduled
instance of aer_isr() has completed before freeing the rpc struct in
aer_remove().

I reproduced this use-after-free by flashing a device FPGA and
re-enumerating the bus to find the new device.  With SLUB debug, this
crashes with 0x6b bytes (POISON_FREE, the use-after-free magic number) in
GPR25:

  pcieport 0000:00:00.0: AER: Multiple Corrected error received: id=0000
  Unable to handle kernel paging request for data at address 0x27ef9e3e
  Workqueue: events aer_isr
  GPR24: dd6aa000 6b6b6b6b 605f8378 605f8360 d99b12c0 604fc674 606b1704 d99b12c0
  NIP [602f5328] pci_walk_bus+0xd4/0x104

[bhelgaas: changelog, stable tag]
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/pci/pcie/aer/aerdrv.c      | 4 +---
 drivers/pci/pcie/aer/aerdrv.h      | 1 -
 drivers/pci/pcie/aer/aerdrv_core.c | 2 --
 3 files changed, 1 insertion(+), 6 deletions(-)

diff --git a/drivers/pci/pcie/aer/aerdrv.c b/drivers/pci/pcie/aer/aerdrv.c
index 0bf82a2..48d21e0 100644
--- a/drivers/pci/pcie/aer/aerdrv.c
+++ b/drivers/pci/pcie/aer/aerdrv.c
@@ -262,7 +262,6 @@ static struct aer_rpc *aer_alloc_rpc(struct pcie_device *dev)
 	rpc->rpd = dev;
 	INIT_WORK(&rpc->dpc_handler, aer_isr);
 	mutex_init(&rpc->rpc_mutex);
-	init_waitqueue_head(&rpc->wait_release);
 
 	/* Use PCIe bus function to store rpc into PCIe device */
 	set_service_data(dev, rpc);
@@ -285,8 +284,7 @@ static void aer_remove(struct pcie_device *dev)
 		if (rpc->isr)
 			free_irq(dev->irq, dev);
 
-		wait_event(rpc->wait_release, rpc->prod_idx == rpc->cons_idx);
-
+		flush_work(&rpc->dpc_handler);
 		aer_disable_rootport(rpc);
 		kfree(rpc);
 		set_service_data(dev, NULL);
diff --git a/drivers/pci/pcie/aer/aerdrv.h b/drivers/pci/pcie/aer/aerdrv.h
index 84420b7..945c939 100644
--- a/drivers/pci/pcie/aer/aerdrv.h
+++ b/drivers/pci/pcie/aer/aerdrv.h
@@ -72,7 +72,6 @@ struct aer_rpc {
 					 * recovery on the same
 					 * root port hierarchy
 					 */
-	wait_queue_head_t wait_release;
 };
 
 struct aer_broadcast_data {
diff --git a/drivers/pci/pcie/aer/aerdrv_core.c b/drivers/pci/pcie/aer/aerdrv_core.c
index 9803e3d..dc16106 100644
--- a/drivers/pci/pcie/aer/aerdrv_core.c
+++ b/drivers/pci/pcie/aer/aerdrv_core.c
@@ -783,8 +783,6 @@ void aer_isr(struct work_struct *work)
 	while (get_e_source(rpc, &e_src))
 		aer_isr_one_error(p_device, &e_src);
 	mutex_unlock(&rpc->rpc_mutex);
-
-	wake_up(&rpc->wait_release);
 }
 
 /**
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]


#1352468 — [PATCH 4.2.y-ckt 046/273] ALSA: usb-audio: Add quirk for Microsoft LifeCam HD-6000

FromKamal Mostafa <kamal@canonical.com>
Date2016-03-08 01:50 +0100
Subject[PATCH 4.2.y-ckt 046/273] ALSA: usb-audio: Add quirk for Microsoft LifeCam HD-6000
Message-ID<rae0y-1QO-9@gated-at.bofh.it>
In reply to#1352081
4.2.8-ckt5 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Lev Lybin <lev.lybin@gmail.com>

commit 1b3c993a699bed282e47c3f7c49d539c331dae04 upstream.

Microsoft LifeCam HD-6000 (045e:076f) requires the similar quirk for
avoiding the stall due to the invalid sample rate reads.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=111491
Signed-off-by: Lev Lybin <lev.lybin@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 sound/usb/quirks.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index c611078..37d8aba 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1118,6 +1118,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
 	switch (chip->usb_id) {
 	case USB_ID(0x045E, 0x075D): /* MS Lifecam Cinema  */
 	case USB_ID(0x045E, 0x076D): /* MS Lifecam HD-5000 */
+	case USB_ID(0x045E, 0x076F): /* MS Lifecam HD-6000 */
 	case USB_ID(0x045E, 0x0772): /* MS Lifecam Studio */
 	case USB_ID(0x045E, 0x0779): /* MS Lifecam HD-3000 */
 	case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]


#1352469 — [PATCH 4.2.y-ckt 058/273] libata: fix sff host state machine locking while polling

FromKamal Mostafa <kamal@canonical.com>
Date2016-03-08 01:50 +0100
Subject[PATCH 4.2.y-ckt 058/273] libata: fix sff host state machine locking while polling
Message-ID<rae0y-1QO-5@gated-at.bofh.it>
In reply to#1352081
4.2.8-ckt5 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Tejun Heo <tj@kernel.org>

commit 8eee1d3ed5b6fc8e14389567c9a6f53f82bb7224 upstream.

The bulk of ATA host state machine is implemented by
ata_sff_hsm_move().  The function is called from either the interrupt
handler or, if polling, a work item.  Unlike from the interrupt path,
the polling path calls the function without holding the host lock and
ata_sff_hsm_move() selectively grabs the lock.

This is completely broken.  If an IRQ triggers while polling is in
progress, the two can easily race and end up accessing the hardware
and updating state machine state at the same time.  This can put the
state machine in an illegal state and lead to a crash like the
following.

  kernel BUG at drivers/ata/libata-sff.c:1302!
  invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN
  Modules linked in:
  CPU: 1 PID: 10679 Comm: syz-executor Not tainted 4.5.0-rc1+ #300
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
  task: ffff88002bd00000 ti: ffff88002e048000 task.ti: ffff88002e048000
  RIP: 0010:[<ffffffff83a83409>]  [<ffffffff83a83409>] ata_sff_hsm_move+0x619/0x1c60
  ...
  Call Trace:
   <IRQ>
   [<ffffffff83a84c31>] __ata_sff_port_intr+0x1e1/0x3a0 drivers/ata/libata-sff.c:1584
   [<ffffffff83a85611>] ata_bmdma_port_intr+0x71/0x400 drivers/ata/libata-sff.c:2877
   [<     inline     >] __ata_sff_interrupt drivers/ata/libata-sff.c:1629
   [<ffffffff83a85bf3>] ata_bmdma_interrupt+0x253/0x580 drivers/ata/libata-sff.c:2902
   [<ffffffff81479f98>] handle_irq_event_percpu+0x108/0x7e0 kernel/irq/handle.c:157
   [<ffffffff8147a717>] handle_irq_event+0xa7/0x140 kernel/irq/handle.c:205
   [<ffffffff81484573>] handle_edge_irq+0x1e3/0x8d0 kernel/irq/chip.c:623
   [<     inline     >] generic_handle_irq_desc include/linux/irqdesc.h:146
   [<ffffffff811a92bc>] handle_irq+0x10c/0x2a0 arch/x86/kernel/irq_64.c:78
   [<ffffffff811a7e4d>] do_IRQ+0x7d/0x1a0 arch/x86/kernel/irq.c:240
   [<ffffffff86653d4c>] common_interrupt+0x8c/0x8c arch/x86/entry/entry_64.S:520
   <EOI>
   [<     inline     >] rcu_lock_acquire include/linux/rcupdate.h:490
   [<     inline     >] rcu_read_lock include/linux/rcupdate.h:874
   [<ffffffff8164b4a1>] filemap_map_pages+0x131/0xba0 mm/filemap.c:2145
   [<     inline     >] do_fault_around mm/memory.c:2943
   [<     inline     >] do_read_fault mm/memory.c:2962
   [<     inline     >] do_fault mm/memory.c:3133
   [<     inline     >] handle_pte_fault mm/memory.c:3308
   [<     inline     >] __handle_mm_fault mm/memory.c:3418
   [<ffffffff816efb16>] handle_mm_fault+0x2516/0x49a0 mm/memory.c:3447
   [<ffffffff8127dc16>] __do_page_fault+0x376/0x960 arch/x86/mm/fault.c:1238
   [<ffffffff8127e358>] trace_do_page_fault+0xe8/0x420 arch/x86/mm/fault.c:1331
   [<ffffffff8126f514>] do_async_page_fault+0x14/0xd0 arch/x86/kernel/kvm.c:264
   [<ffffffff86655578>] async_page_fault+0x28/0x30 arch/x86/entry/entry_64.S:986

Fix it by ensuring that the polling path is holding the host lock
before entering ata_sff_hsm_move() so that all hardware accesses and
state updates are performed under the host lock.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-and-tested-by: Dmitry Vyukov <dvyukov@google.com>
Link: http://lkml.kernel.org/g/CACT4Y+b_JsOxJu2EZyEf+mOXORc_zid5V1-pLZSroJVxyWdSpw@mail.gmail.com
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/ata/libata-sff.c | 32 +++++++++++---------------------
 1 file changed, 11 insertions(+), 21 deletions(-)

diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index cdf6215..7dbba38 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -997,12 +997,9 @@ static inline int ata_hsm_ok_in_wq(struct ata_port *ap,
 static void ata_hsm_qc_complete(struct ata_queued_cmd *qc, int in_wq)
 {
 	struct ata_port *ap = qc->ap;
-	unsigned long flags;
 
 	if (ap->ops->error_handler) {
 		if (in_wq) {
-			spin_lock_irqsave(ap->lock, flags);
-
 			/* EH might have kicked in while host lock is
 			 * released.
 			 */
@@ -1014,8 +1011,6 @@ static void ata_hsm_qc_complete(struct ata_queued_cmd *qc, int in_wq)
 				} else
 					ata_port_freeze(ap);
 			}
-
-			spin_unlock_irqrestore(ap->lock, flags);
 		} else {
 			if (likely(!(qc->err_mask & AC_ERR_HSM)))
 				ata_qc_complete(qc);
@@ -1024,10 +1019,8 @@ static void ata_hsm_qc_complete(struct ata_queued_cmd *qc, int in_wq)
 		}
 	} else {
 		if (in_wq) {
-			spin_lock_irqsave(ap->lock, flags);
 			ata_sff_irq_on(ap);
 			ata_qc_complete(qc);
-			spin_unlock_irqrestore(ap->lock, flags);
 		} else
 			ata_qc_complete(qc);
 	}
@@ -1048,9 +1041,10 @@ int ata_sff_hsm_move(struct ata_port *ap, struct ata_queued_cmd *qc,
 {
 	struct ata_link *link = qc->dev->link;
 	struct ata_eh_info *ehi = &link->eh_info;
-	unsigned long flags = 0;
 	int poll_next;
 
+	lockdep_assert_held(ap->lock);
+
 	WARN_ON_ONCE((qc->flags & ATA_QCFLAG_ACTIVE) == 0);
 
 	/* Make sure ata_sff_qc_issue() does not throw things
@@ -1112,14 +1106,6 @@ fsm_start:
 			}
 		}
 
-		/* Send the CDB (atapi) or the first data block (ata pio out).
-		 * During the state transition, interrupt handler shouldn't
-		 * be invoked before the data transfer is complete and
-		 * hsm_task_state is changed. Hence, the following locking.
-		 */
-		if (in_wq)
-			spin_lock_irqsave(ap->lock, flags);
-
 		if (qc->tf.protocol == ATA_PROT_PIO) {
 			/* PIO data out protocol.
 			 * send first data block.
@@ -1135,9 +1121,6 @@ fsm_start:
 			/* send CDB */
 			atapi_send_cdb(ap, qc);
 
-		if (in_wq)
-			spin_unlock_irqrestore(ap->lock, flags);
-
 		/* if polling, ata_sff_pio_task() handles the rest.
 		 * otherwise, interrupt handler takes over from here.
 		 */
@@ -1361,12 +1344,14 @@ static void ata_sff_pio_task(struct work_struct *work)
 	u8 status;
 	int poll_next;
 
+	spin_lock_irq(ap->lock);
+
 	BUG_ON(ap->sff_pio_task_link == NULL);
 	/* qc can be NULL if timeout occurred */
 	qc = ata_qc_from_tag(ap, link->active_tag);
 	if (!qc) {
 		ap->sff_pio_task_link = NULL;
-		return;
+		goto out_unlock;
 	}
 
 fsm_start:
@@ -1381,11 +1366,14 @@ fsm_start:
 	 */
 	status = ata_sff_busy_wait(ap, ATA_BUSY, 5);
 	if (status & ATA_BUSY) {
+		spin_unlock_irq(ap->lock);
 		ata_msleep(ap, 2);
+		spin_lock_irq(ap->lock);
+
 		status = ata_sff_busy_wait(ap, ATA_BUSY, 10);
 		if (status & ATA_BUSY) {
 			ata_sff_queue_pio_task(link, ATA_SHORT_PAUSE);
-			return;
+			goto out_unlock;
 		}
 	}
 
@@ -1402,6 +1390,8 @@ fsm_start:
 	 */
 	if (poll_next)
 		goto fsm_start;
+out_unlock:
+	spin_unlock_irq(ap->lock);
 }
 
 /**
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]


#1352470 — [PATCH 4.2.y-ckt 033/273] ARM: dts: Fix wl12xx missing clocks that cause hangs

FromKamal Mostafa <kamal@canonical.com>
Date2016-03-08 01:50 +0100
Subject[PATCH 4.2.y-ckt 033/273] ARM: dts: Fix wl12xx missing clocks that cause hangs
Message-ID<rae0y-1QO-7@gated-at.bofh.it>
In reply to#1352081
4.2.8-ckt5 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Adam Ford <aford173@gmail.com>

commit 0ea24daae053a9ba65d2f3eb20523002c1a8af38 upstream.

The tcxo-clock-frequency binding is listed as optional,
but without it the wl12xx used on the torpedo + wireless
may hang.  Scanning also appears broken without this patch.

Signed-off-by: Adam Ford <aford173@gmail.com>
Fixes: 687c27676151 ("ARM: dts: Add minimal support for LogicPD
Torpedo DM3730 devkit")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/arm/boot/dts/logicpd-torpedo-som.dtsi | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
index 36387b1..80f6c78 100644
--- a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
+++ b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
@@ -122,6 +122,7 @@
 		interrupt-parent = <&gpio5>;
 		interrupts = <24 IRQ_TYPE_LEVEL_HIGH>; /* gpio 152 */
 		ref-clock-frequency = <26000000>;
+		tcxo-clock-frequency = <26000000>;
 	};
 };
 
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]


#1352471 — [PATCH 4.2.y-ckt 037/273] ARM: dts: at91: sama5d4: fix instance id of DBGU

FromKamal Mostafa <kamal@canonical.com>
Date2016-03-08 01:50 +0100
Subject[PATCH 4.2.y-ckt 037/273] ARM: dts: at91: sama5d4: fix instance id of DBGU
Message-ID<rae0y-1QO-11@gated-at.bofh.it>
In reply to#1352081
4.2.8-ckt5 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Mohamed Jamsheeth Hajanajubudeen

commit 929e883f2bfdf68d4bd3aec43912e956417005c7 upstream.

Change instance id of DBGU to 45.

Signed-off-by: Mohamed Jamsheeth Hajanajubudeen <mohamedjamsheeth.hajanajubudeen@atmel.com>
Fixes: 7c661394c56c ("ARM: at91: dt: add device tree file for SAMA5D4 SoC")
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/arm/boot/dts/sama5d4.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/sama5d4.dtsi b/arch/arm/boot/dts/sama5d4.dtsi
index 1ba10e4..0069613 100644
--- a/arch/arm/boot/dts/sama5d4.dtsi
+++ b/arch/arm/boot/dts/sama5d4.dtsi
@@ -1334,7 +1334,7 @@
 			dbgu: serial@fc069000 {
 				compatible = "atmel,at91sam9260-dbgu", "atmel,at91sam9260-usart";
 				reg = <0xfc069000 0x200>;
-				interrupts = <2 IRQ_TYPE_LEVEL_HIGH 7>;
+				interrupts = <45 IRQ_TYPE_LEVEL_HIGH 7>;
 				pinctrl-names = "default";
 				pinctrl-0 = <&pinctrl_dbgu>;
 				clocks = <&dbgu_clk>;
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]


#1352472 — [PATCH 4.2.y-ckt 036/273] rfkill: fix rfkill_fop_read wait_event usage

FromKamal Mostafa <kamal@canonical.com>
Date2016-03-08 01:50 +0100
Subject[PATCH 4.2.y-ckt 036/273] rfkill: fix rfkill_fop_read wait_event usage
Message-ID<rae0y-1QO-13@gated-at.bofh.it>
In reply to#1352081
4.2.8-ckt5 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Johannes Berg <johannes.berg@intel.com>

commit 6736fde9672ff6717ac576e9bba2fd5f3dfec822 upstream.

The code within wait_event_interruptible() is called with
!TASK_RUNNING, so mustn't call any functions that can sleep,
like mutex_lock().

Since we re-check the list_empty() in a loop after the wait,
it's safe to simply use list_empty() without locking.

This bug has existed forever, but was only discovered now
because all userspace implementations, including the default
'rfkill' tool, use poll() or select() to get a readable fd
before attempting to read.

Fixes: c64fb01627e24 ("rfkill: create useful userspace interface")
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 net/rfkill/core.c | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index 31b5c63..c20ea1b 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -1087,17 +1087,6 @@ static unsigned int rfkill_fop_poll(struct file *file, poll_table *wait)
 	return res;
 }
 
-static bool rfkill_readable(struct rfkill_data *data)
-{
-	bool r;
-
-	mutex_lock(&data->mtx);
-	r = !list_empty(&data->events);
-	mutex_unlock(&data->mtx);
-
-	return r;
-}
-
 static ssize_t rfkill_fop_read(struct file *file, char __user *buf,
 			       size_t count, loff_t *pos)
 {
@@ -1114,8 +1103,11 @@ static ssize_t rfkill_fop_read(struct file *file, char __user *buf,
 			goto out;
 		}
 		mutex_unlock(&data->mtx);
+		/* since we re-check and it just compares pointers,
+		 * using !list_empty() without locking isn't a problem
+		 */
 		ret = wait_event_interruptible(data->read_wait,
-					       rfkill_readable(data));
+					       !list_empty(&data->events));
 		mutex_lock(&data->mtx);
 
 		if (ret)
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]


#1352473 — [PATCH 4.2.y-ckt 049/273] iio: inkern: fix a NULL dereference on error

FromKamal Mostafa <kamal@canonical.com>
Date2016-03-08 01:50 +0100
Subject[PATCH 4.2.y-ckt 049/273] iio: inkern: fix a NULL dereference on error
Message-ID<rae0y-1QO-15@gated-at.bofh.it>
In reply to#1352081
4.2.8-ckt5 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Dan Carpenter <dan.carpenter@oracle.com>

commit d81dac3c1c5295c61b15293074ac2bd3254e1875 upstream.

In twl4030_bci_probe() there are some failure paths where we call
iio_channel_release() with a NULL pointer.  (Apparently, that driver can
opperate without a valid channel pointer).  Let's fix it by adding a
NULL check in iio_channel_release().

Fixes: 2202e1fc5a29 ('drivers: power: twl4030_charger: fix link problems when building as module')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/iio/inkern.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
index c8bad3c..217e930 100644
--- a/drivers/iio/inkern.c
+++ b/drivers/iio/inkern.c
@@ -351,6 +351,8 @@ EXPORT_SYMBOL_GPL(iio_channel_get);
 
 void iio_channel_release(struct iio_channel *channel)
 {
+	if (!channel)
+		return;
 	iio_device_put(channel->indio_dev);
 	kfree(channel);
 }
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]


#1352474 — [PATCH 4.2.y-ckt 042/273] spi: atmel: fix gpio chip-select in case of non-DT platform

FromKamal Mostafa <kamal@canonical.com>
Date2016-03-08 01:50 +0100
Subject[PATCH 4.2.y-ckt 042/273] spi: atmel: fix gpio chip-select in case of non-DT platform
Message-ID<rae0y-1QO-17@gated-at.bofh.it>
In reply to#1352081
4.2.8-ckt5 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Cyrille Pitchen <cyrille.pitchen@atmel.com>

commit 70f340df24518d36eeaefb6652d492f250115c19 upstream.

The non-DT platform that uses this driver (actually the AVR32) was taking a bad
branch for determining if the IP would use gpio for CS.
Adding the presence of DT as a condition fixes this issue.

Fixes: 4820303480a1 ("spi: atmel: add support for the internal chip-select of the spi controller")
Reported-by: Mans Rullgard <mans@mansr.com>
Signed-off-by: Cyrille Pitchen <cyrille.pitchen@atmel.com>
[nicolas.ferre@atmel.com: extract from ml discussion]
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Tested-by: Mans Rullgard <mans@mansr.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/spi/spi-atmel.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index a89ea0d..da85f8eb 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -1581,6 +1581,7 @@ static int atmel_spi_probe(struct platform_device *pdev)
 
 	as->use_cs_gpios = true;
 	if (atmel_spi_is_v2(as) &&
+	    pdev->dev.of_node &&
 	    !of_get_property(pdev->dev.of_node, "cs-gpios", NULL)) {
 		as->use_cs_gpios = false;
 		master->num_chipselect = 4;
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]


#1352475 — [PATCH 4.2.y-ckt 043/273] drm/i915/dp: fall back to 18 bpp when sink capability is unknown

FromKamal Mostafa <kamal@canonical.com>
Date2016-03-08 01:50 +0100
Subject[PATCH 4.2.y-ckt 043/273] drm/i915/dp: fall back to 18 bpp when sink capability is unknown
Message-ID<rae0y-1QO-19@gated-at.bofh.it>
In reply to#1352081
4.2.8-ckt5 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Jani Nikula <jani.nikula@intel.com>

commit 5efd407674068dede403551bea3b0b134c32513a upstream.

Per DP spec, the source device should fall back to 18 bpp, VESA range
RGB when the sink capability is unknown. Fix the color depth
clamping. 18 bpp color depth should ensure full color range in automatic
mode.

The clamping has been HDMI specific since its introduction in

commit 996a2239f93b03c5972923f04b097f65565c5bed
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Fri Apr 19 11:24:34 2013 +0200

    drm/i915: Disable high-bpc on pre-1.4 EDID screens

Reported-and-tested-by: Dihan Wickremasuriya <nayomal@gmail.com>
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=105331
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1452695720-7076-1-git-send-email-jani.nikula@intel.com
(cherry picked from commit 013dd9e038723bbd2aa67be51847384b75be8253)
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/gpu/drm/i915/intel_display.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 8bd37dd..7063016 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -11413,11 +11413,21 @@ connected_sink_compute_bpp(struct intel_connector *connector,
 		pipe_config->pipe_bpp = connector->base.display_info.bpc*3;
 	}
 
-	/* Clamp bpp to 8 on screens without EDID 1.4 */
-	if (connector->base.display_info.bpc == 0 && bpp > 24) {
-		DRM_DEBUG_KMS("clamping display bpp (was %d) to default limit of 24\n",
-			      bpp);
-		pipe_config->pipe_bpp = 24;
+	/* Clamp bpp to default limit on screens without EDID 1.4 */
+	if (connector->base.display_info.bpc == 0) {
+		int type = connector->base.connector_type;
+		int clamp_bpp = 24;
+
+		/* Fall back to 18 bpp when DP sink capability is unknown. */
+		if (type == DRM_MODE_CONNECTOR_DisplayPort ||
+		    type == DRM_MODE_CONNECTOR_eDP)
+			clamp_bpp = 18;
+
+		if (bpp > clamp_bpp) {
+			DRM_DEBUG_KMS("clamping display bpp (was %d) to default limit of %d\n",
+				      bpp, clamp_bpp);
+			pipe_config->pipe_bpp = clamp_bpp;
+		}
 	}
 }
 
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]


#1352476 — [PATCH 4.2.y-ckt 044/273] ALSA: usb-audio: Fix OPPO HA-1 vendor ID

FromKamal Mostafa <kamal@canonical.com>
Date2016-03-08 01:50 +0100
Subject[PATCH 4.2.y-ckt 044/273] ALSA: usb-audio: Fix OPPO HA-1 vendor ID
Message-ID<rae0y-1QO-21@gated-at.bofh.it>
In reply to#1352081
4.2.8-ckt5 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Jurgen Kramer <gtmkramer@xs4all.nl>

commit 5327d6ba975042fd3da50ac6e94d1e9551ebeaec upstream.

In my patch adding native DSD support for the Oppo HA-1, the wrong vendor ID got
through. This patch fixes the vendor ID and aligns the comment.

Fixes: a4eae3a506ea ('ALSA: usb: Add native DSD support for Oppo HA-1')
Signed-off-by: Jurgen Kramer <gtmkramer@xs4all.nl>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 sound/usb/quirks.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 5585cfd..d7c7bcd 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1278,7 +1278,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
 	case USB_ID(0x20b1, 0x3008): /* iFi Audio micro/nano iDSD */
 	case USB_ID(0x20b1, 0x2008): /* Matrix Audio X-Sabre */
 	case USB_ID(0x20b1, 0x300a): /* Matrix Audio Mini-i Pro */
-	case USB_ID(0x22d8, 0x0416): /* OPPO HA-1*/
+	case USB_ID(0x22d9, 0x0416): /* OPPO HA-1 */
 		if (fp->altsetting == 2)
 			return SNDRV_PCM_FMTBIT_DSD_U32_BE;
 		break;
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]


#1352477 — [PATCH 4.2.y-ckt 012/273] Revert "workqueue: make sure delayed work run in local cpu"

FromKamal Mostafa <kamal@canonical.com>
Date2016-03-08 01:50 +0100
Subject[PATCH 4.2.y-ckt 012/273] Revert "workqueue: make sure delayed work run in local cpu"
Message-ID<rae0y-1QO-23@gated-at.bofh.it>
In reply to#1352081
4.2.8-ckt5 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Tejun Heo <tj@kernel.org>

commit 041bd12e272c53a35c54c13875839bcb98c999ce upstream.

This reverts commit 874bbfe600a660cba9c776b3957b1ce393151b76.

Workqueue used to implicity guarantee that work items queued without
explicit CPU specified are put on the local CPU.  Recent changes in
timer broke the guarantee and led to vmstat breakage which was fixed
by 176bed1de5bf ("vmstat: explicitly schedule per-cpu work on the CPU
we need it to run on").

vmstat is the most likely to expose the issue and it's quite possible
that there are other similar problems which are a lot more difficult
to trigger.  As a preventive measure, 874bbfe600a6 ("workqueue: make
sure delayed work run in local cpu") was applied to restore the local
CPU guarnatee.  Unfortunately, the change exposed a bug in timer code
which got fixed by 22b886dd1018 ("timers: Use proper base migration in
add_timer_on()").  Due to code restructuring, the commit couldn't be
backported beyond certain point and stable kernels which only had
874bbfe600a6 started crashing.

The local CPU guarantee was accidental more than anything else and we
want to get rid of it anyway.  As, with the vmstat case fixed,
874bbfe600a6 is causing more problems than it's fixing, it has been
decided to take the chance and officially break the guarantee by
reverting the commit.  A debug feature will be added to force foreign
CPU assignment to expose cases relying on the guarantee and fixes for
the individual cases will be backported to stable as necessary.

Signed-off-by: Tejun Heo <tj@kernel.org>
Fixes: 874bbfe600a6 ("workqueue: make sure delayed work run in local cpu")
Link: http://lkml.kernel.org/g/20160120211926.GJ10810@quack.suse.cz
Cc: Mike Galbraith <umgwanakikbuti@gmail.com>
Cc: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
Cc: Daniel Bilik <daniel.bilik@neosystem.cz>
Cc: Jan Kara <jack@suse.cz>
Cc: Shaohua Li <shli@fb.com>
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: Ben Hutchings <ben@decadent.org.uk>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Daniel Bilik <daniel.bilik@neosystem.cz>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Michal Hocko <mhocko@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 kernel/workqueue.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 1de0f5fab..a413acb 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1458,13 +1458,13 @@ static void __queue_delayed_work(int cpu, struct workqueue_struct *wq,
 	timer_stats_timer_set_start_info(&dwork->timer);
 
 	dwork->wq = wq;
-	/* timer isn't guaranteed to run in this cpu, record earlier */
-	if (cpu == WORK_CPU_UNBOUND)
-		cpu = raw_smp_processor_id();
 	dwork->cpu = cpu;
 	timer->expires = jiffies + delay;
 
-	add_timer_on(timer, cpu);
+	if (unlikely(cpu != WORK_CPU_UNBOUND))
+		add_timer_on(timer, cpu);
+	else
+		add_timer(timer);
 }
 
 /**
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]


#1352478 — [PATCH 4.2.y-ckt 041/273] Input: vmmouse - fix absolute device registration

FromKamal Mostafa <kamal@canonical.com>
Date2016-03-08 01:50 +0100
Subject[PATCH 4.2.y-ckt 041/273] Input: vmmouse - fix absolute device registration
Message-ID<rae0y-1QO-25@gated-at.bofh.it>
In reply to#1352081
4.2.8-ckt5 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>

commit d4f1b06d685d11ebdaccf11c0db1cb3c78736862 upstream.

We should set device's capabilities first, and then register it,
otherwise various handlers already present in the kernel will not be
able to connect to the device.

Reported-by: Lauri Kasanen <cand@gmx.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/input/mouse/vmmouse.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/input/mouse/vmmouse.c b/drivers/input/mouse/vmmouse.c
index e272f06..a3f0f5a 100644
--- a/drivers/input/mouse/vmmouse.c
+++ b/drivers/input/mouse/vmmouse.c
@@ -458,8 +458,6 @@ int vmmouse_init(struct psmouse *psmouse)
 	priv->abs_dev = abs_dev;
 	psmouse->private = priv;
 
-	input_set_capability(rel_dev, EV_REL, REL_WHEEL);
-
 	/* Set up and register absolute device */
 	snprintf(priv->phys, sizeof(priv->phys), "%s/input1",
 		 psmouse->ps2dev.serio->phys);
@@ -475,10 +473,6 @@ int vmmouse_init(struct psmouse *psmouse)
 	abs_dev->id.version = psmouse->model;
 	abs_dev->dev.parent = &psmouse->ps2dev.serio->dev;
 
-	error = input_register_device(priv->abs_dev);
-	if (error)
-		goto init_fail;
-
 	/* Set absolute device capabilities */
 	input_set_capability(abs_dev, EV_KEY, BTN_LEFT);
 	input_set_capability(abs_dev, EV_KEY, BTN_RIGHT);
@@ -488,6 +482,13 @@ int vmmouse_init(struct psmouse *psmouse)
 	input_set_abs_params(abs_dev, ABS_X, 0, VMMOUSE_MAX_X, 0, 0);
 	input_set_abs_params(abs_dev, ABS_Y, 0, VMMOUSE_MAX_Y, 0, 0);
 
+	error = input_register_device(priv->abs_dev);
+	if (error)
+		goto init_fail;
+
+	/* Add wheel capability to the relative device */
+	input_set_capability(rel_dev, EV_REL, REL_WHEEL);
+
 	psmouse->protocol_handler = vmmouse_process_byte;
 	psmouse->disconnect = vmmouse_disconnect;
 	psmouse->reconnect = vmmouse_reconnect;
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]


#1352479 — [PATCH 4.2.y-ckt 028/273] ARM: OMAP2+: Fix save_secure_ram_context for rodata

FromKamal Mostafa <kamal@canonical.com>
Date2016-03-08 01:50 +0100
Subject[PATCH 4.2.y-ckt 028/273] ARM: OMAP2+: Fix save_secure_ram_context for rodata
Message-ID<rae0y-1QO-27@gated-at.bofh.it>
In reply to#1352081
4.2.8-ckt5 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Tony Lindgren <tony@atomide.com>

commit a5311d4d13df80bd71a9e47f9ecaf327f478fab1 upstream.

We don't want to write to .text and we can move save_secure_ram_context
into .data as it all gets copied into SRAM anyways.

Cc: Kees Cook <keescook@chromium.org>
Cc: Laura Abbott <labbott@redhat.com>
Cc: Nishanth Menon <nm@ti.com>
Cc: Richard Woodruff <r-woodruff2@ti.com>
Cc: Russell King <linux@arm.linux.org.uk>
Cc: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Cc: Tero Kristo <t-kristo@ti.com>
Acked-by: Nicolas Pitre <nico@linaro.org>
Fixes: 1e6b48116a95 ("ARM: mm: allow non-text sections to be
non-executable")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/arm/mach-omap2/sleep34xx.S | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mach-omap2/sleep34xx.S b/arch/arm/mach-omap2/sleep34xx.S
index 5659d96..8e2a7ac 100644
--- a/arch/arm/mach-omap2/sleep34xx.S
+++ b/arch/arm/mach-omap2/sleep34xx.S
@@ -92,8 +92,12 @@ ENTRY(enable_omap3630_toggle_l2_on_restore)
 	ldmfd	sp!, {pc}	@ restore regs and return
 ENDPROC(enable_omap3630_toggle_l2_on_restore)
 
-	.text
-/* Function to call rom code to save secure ram context */
+/*
+ * Function to call rom code to save secure ram context. This gets
+ * relocated to SRAM, so it can be all in .data section. Otherwise
+ * we need to initialize api_params separately.
+ */
+	.data
 	.align	3
 ENTRY(save_secure_ram_context)
 	stmfd	sp!, {r4 - r11, lr}	@ save registers on stack
@@ -127,6 +131,8 @@ ENDPROC(save_secure_ram_context)
 ENTRY(save_secure_ram_context_sz)
 	.word	. - save_secure_ram_context
 
+	.text
+
 /*
  * ======================
  * == Idle entry point ==
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]


Page 10 of 12 — ← Prev page 1 … 8 9 [10] 11 12  Next page →

Back to top | Article view | linux.kernel


csiph-web