Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1362479 > unrolled thread

[3.16.y-ckt stable] Linux 3.16.7-ckt26 stable review

Back to article view | Back to linux.kernel

Contents

  [3.16.y-ckt stable] Linux 3.16.7-ckt26 stable review Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 137/142] efi: Do variable name validation tests in utf8 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 138/142] efi: Make our variable validation list include the guid Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 094/142] ALSA: hdspm: Fix wrong boolean ctl value accesses Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 100/142] USB: serial: option: add support for Quectel UC20 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 132/142] AIO: properly check iovec sizes Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 009/142] s390/dasd: fix refcount for PAV reassignment Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 135/142] lib/ucs2_string: Add ucs2 -> utf8 helper functions Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 142/142] tracing: Fix check for cpu online when event is disabled Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 065/142] ipv4: fix memory leaks in ip_cmsg_send() callers Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 023/142] ext4: fix crashes in dioread_nolock mode Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 022/142] ext4: fix bh->b_state corruption Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 027/142] nfs: fix nfs_size_to_loff_t Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 098/142] USB: cp210x: Add ID for Parrot NMEA GPS Flight Recorder Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 136/142] efi: Use ucs2_as_utf8 in efivarfs instead of open coding a bad version Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 067/142] pppoe: fix reference counting in PPPoE proxy Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 128/142] net: moxa: fix an error code Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 095/142] ALSA: hdspm: Fix zero-division Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 066/142] qmi_wwan: add "4G LTE usb-modem U901" Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 063/142] net:Add sysctl_max_skb_frags Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 001/142] Revert "firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6" Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 139/142] efi: Make efivarfs entries immutable by default Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 024/142] kernel/resource.c: fix muxed resource handling in __request_region() Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 026/142] crypto: {blk,giv}cipher: Set has_setkey Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 115/142] can: gs_usb: fixed disconnect bug by removing erroneous use of kfree() Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 084/142] libata: Align ata_device's id on a cacheline Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 107/142] MIPS: traps: Fix SIGFPE information leak from `do_ov' and `do_trap_or_bp' Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 124/142] tcp: convert cached rtt from usec to jiffies when feeding initial rto Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 125/142] net/mlx4_core: Allow resetting VF admin mac to zero Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 120/142] Revert "drm/radeon: call hpd_irq_event on resume" Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 114/142] mac80211: minstrel_ht: set default tx aggregation timeout to 0 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 119/142] target: Drop incorrect ABORT_TASK put for completed commands Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 108/142] ubi: Fix out of bounds write in volume update code Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 118/142] ASoC: wm_adsp: Fix enum ctl accesses in a wrong type Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 105/142] PM / sleep / x86: Fix crash on graph trace through x86 suspend Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 122/142] KVM: VMX: disable PEBS before a guest entry Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 109/142] gpio: rcar: Add Runtime PM handling for interrupts Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 130/142] ext4: iterate over buffer heads correctly in move_extent_per_page() Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 101/142] ALSA: seq: oss: Don't drain at closing a client Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 092/142] Fix cifs_uniqueid_to_ino_t() function for s390x Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 110/142] IB/core: Use GRH when the path hop-limit > 0 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 104/142] drm/radeon/pm: update current crtc info after setting the powerstate Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 102/142] drm/ast: Fix incorrect register check for DRAM width Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 103/142] USB: qcserial: add Sierra Wireless EM74xx device ID Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 129/142] cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 106/142] ALSA: hda - Fix mic issues on Acer Aspire E1-472 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 127/142] ipv6: re-enable fragment header matching in ipv6_find_hdr Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 126/142] mld, igmp: Fix reserved tailroom calculation Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 112/142] cfg80211/wext: fix message ordering Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 116/142] ASoC: wm8958: Fix enum ctl accesses in a wrong type Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 090/142] cifs: fix out-of-bounds access in lease parsing Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 123/142] Revert "drm/radeon/pm: adjust display configuration after powerstate" Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 121/142] KVM: PPC: Book3S HV: Sanitize special-purpose register values on guest exit Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 113/142] mac80211: fix use of uninitialised values in RX aggregation Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 117/142] ASoC: wm8994: Fix enum ctl accesses in a wrong type Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 111/142] wext: fix message delay/ordering Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 099/142] USB: serial: option: add support for Telit LE922 PID 0x1045 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 071/142] target: Fix LUN_RESET active TMR descriptor handling Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 070/142] sctp: Fix port hash table size computation Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 079/142] usb: chipidea: otg: change workqueue ci_otg as freezable Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 077/142] libata: fix HDIO_GET_32BIT ioctl Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 072/142] target: Fix LUN_RESET active I/O handling for ACK_KREF Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 083/142] iommu/amd: Fix boot warning when device 00:00.0 is not iommu covered Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 082/142] Fix directory hardlinks from deleted directories Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 081/142] jffs2: Fix page lock / f->sem deadlock Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 087/142] ALSA: rawmidi: Fix ioctls X32 ABI Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 089/142] ALSA: timer: Fix ioctls for X32 ABI Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 091/142] CIFS: Fix SMB2+ interim response processing for read requests Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 073/142] target: Fix TAS handling for multi-session se_node_acls Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 069/142] rtnl: RTM_GETNETCONF: fix wrong return value Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 085/142] vfio: fix ioctl error handling Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 080/142] Revert "jffs2: Fix lock acquisition order bug in jffs2_write_begin" Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 068/142] route: check and remove route cache when we get route Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 086/142] ALSA: ctl: Fix ioctls for X32 ABI Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 025/142] x86/entry/compat: Add missing CLAC to entry_INT80_32 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 076/142] Revert "drm/radeon: hold reference to fences in radeon_sa_bo_new" Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 078/142] [media] adv7604: fix tx 5v detect regression Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 074/142] target: Fix remote-port TMR ABORT + se_cmd fabric stop Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 075/142] target: Fix race with SCF_SEND_DELAYED_TAS handling Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 088/142] ALSA: timer: Fix broken compat timer user status ioctl Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 064/142] tg3: Fix for tg3 transmit queue 0 timed out when too many gso_segs Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 046/142] ALSA: hda - Fix headset support and noise on HP EliteBook 755 G2 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 054/142] net/mlx4_en: Count HW buffer overrun only once Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 045/142] KVM: x86: MMU: fix ubsan index-out-of-range warning Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 055/142] net/mlx4_en: Choose time-stamping shift value according to HW frequency Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 060/142] tcp: fix NULL deref in tcp_v4_send_ack() Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 040/142] sunrpc/cache: fix off-by-one in qword_get() Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 059/142] net: dp83640: Fix tx timestamp overflow handling. Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 033/142] USB: option: add support for SIM7100E Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 049/142] ARM: dts: kirkwood: use unique machine name for ds112 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 058/142] af_iucv: Validate socket address length in iucv_sock_bind() Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 056/142] net/mlx4_en: Avoid changing dev->features directly in run-time Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 044/142] ALSA: hda - Fixing background noise on Dell Inspiron 3162 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 050/142] bonding: Fix ARP monitor validation Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 032/142] NFSv4: Fix a dentry leak on alias use Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 057/142] unix_diag: fix incorrect sign extension in unix_lookup_by_ino Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 035/142] USB: option: add "4G LTE usb-modem U901" Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 062/142] net/ipv6: add sysctl option accept_ra_min_hop_limit Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
      Re: [PATCH 3.16.y-ckt 062/142] net/ipv6: add sysctl option  accept_ra_min_hop_limit Luis Henriques <luis.henriques@canonical.com> - 2016-03-24 11:20 +0100
    [PATCH 3.16.y-ckt 034/142] USB: cp210x: add IDs for GE B650V3 and B850V3 boards Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 048/142] do_last(): don't let a bogus return value from ->open() et.al. to confuse us Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 047/142] hpfs: don't truncate the file when delete fails Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 052/142] af_unix: Guard against other == sk in unix_dgram_sendmsg Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 028/142] xen/pciback: Check PF instead of VF for PCI_COMMAND_MEMORY Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 038/142] can: ems_usb: Fix possible tx overflow Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 043/142] libceph: don't bail early from try_read() when skipping a message Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 042/142] tracing: Fix showing function event in available_events Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 051/142] af_unix: Don't set err in unix_stream_read_generic unless there was an error Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 036/142] hwmon: (ads1015) Handle negative conversion values correctly Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 053/142] net: phy: bcm7xxx: Fix shadow mode 2 disabling Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 041/142] KVM: async_pf: do not warn on page allocation failures Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 061/142] ipv6/udp: use sticky pktinfo egress ifindex on connect() Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 039/142] drm/radeon/pm: adjust display configuration after powerstate Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 021/142] drm/qxl: use kmalloc_array to alloc reloc_info in qxl_process_single_command Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 037/142] drivers: android: correct the size of struct binder_uintptr_t for BC_DEAD_BINDER_DONE Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 014/142] ALSA: seq: Drop superfluous error/debug messages after malloc failures Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 006/142] drm/i915: fix error path in intel_setup_gmbus() Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 030/142] xen/pcifront: Fix mysterious crashes when NUMA locality information was extracted. Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 004/142] drm/i915/dsi: don't pass arbitrary data to sideband Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 005/142] powerpc: Fix dedotify for binutils >= 2.26 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 031/142] usb: dwc3: Fix assignment of EP transfer resources Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 012/142] ext4: don't read blocks from disk after extents being swapped Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 013/142] bio: return EINTR if copying to user space got interrupted Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 017/142] tracepoints: Do not trace when cpu is offline Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 019/142] ALSA: seq: Fix double port list deletion Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 003/142] drm/i915/dsi: defend gpio table against out of bounds access Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 002/142] iommu/vt-d: Fix 64-bit accesses to 32-bit DMAR_GSTS_REG Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 018/142] tracing: Fix freak link error caused by branch tracer Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 029/142] xen/pciback: Save the number of MSI-X entries to be copied later. Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 020/142] drm/radeon: use post-decrement in error handling Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 007/142] cifs: fix erroneous return value Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 016/142] dmaengine: dw: disable BLOCK IRQs for non-cyclic xfer Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 011/142] ext4: fix potential integer overflow Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 010/142] scsi: fix soft lockup in scsi_remove_target() on module removal Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 015/142] ALSA: seq: Fix leak of pool buffer at concurrent writes Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100

Page 3 of 7 — ← Prev page 1 2 [3] 4 5 6 7  Next page →

#1362528 — [PATCH 3.16.y-ckt 110/142] IB/core: Use GRH when the path hop-limit > 0

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Or Gerlitz <ogerlitz@mellanox.com>

commit 11d8d645343efba0c975aefe7c2cf3b33c836c75 upstream.

According to IBTA spec v1.3 section 12.7.19, QPs should use GRH when
the path returned by the SA has hop-limit > 0. Currently, we do that
only for the > 1 case, fix that.

Fixes: 6d969a471ba1 ('IB/sa: Add ib_init_ah_from_path()')
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Reviewed-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/infiniband/core/sa_query.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index 233eaf541f55..3ca38f9ad26a 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -542,7 +542,7 @@ int ib_init_ah_from_path(struct ib_device *device, u8 port_num,
 
 	force_grh = rdma_port_get_link_layer(device, port_num) == IB_LINK_LAYER_ETHERNET;
 
-	if (rec->hop_limit > 1 || force_grh) {
+	if (rec->hop_limit > 0 || force_grh) {
 		ah_attr->ah_flags = IB_AH_GRH;
 		ah_attr->grh.dgid = rec->dgid;
 

[toc] | [prev] | [next] | [standalone]

#1362530 — [PATCH 3.16.y-ckt 104/142] drm/radeon/pm: update current crtc info after setting the powerstate

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Alex Deucher <alexander.deucher@amd.com>

commit 5e031d9fe8b0741f11d49667dfc3ebf5454121fd upstream.

On CI, we need to see if the number of crtcs changes to determine
whether or not we need to upload the mclk table again.  In practice
we don't currently upload the mclk table again after the initial load.
The only reason you would would be to add new states, e.g., for
arbitrary mclk setting which is not currently supported.

Acked-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/gpu/drm/radeon/radeon_pm.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 97e1a70df5a9..a05d569fa038 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -937,10 +937,6 @@ force:
 	/* update display watermarks based on new power state */
 	radeon_bandwidth_update(rdev);
 
-	rdev->pm.dpm.current_active_crtcs = rdev->pm.dpm.new_active_crtcs;
-	rdev->pm.dpm.current_active_crtc_count = rdev->pm.dpm.new_active_crtc_count;
-	rdev->pm.dpm.single_display = single_display;
-
 	/* wait for the rings to drain */
 	for (i = 0; i < RADEON_NUM_RINGS; i++) {
 		struct radeon_ring *ring = &rdev->ring[i];
@@ -959,6 +955,10 @@ force:
 	/* update displays */
 	radeon_dpm_display_configuration_changed(rdev);
 
+	rdev->pm.dpm.current_active_crtcs = rdev->pm.dpm.new_active_crtcs;
+	rdev->pm.dpm.current_active_crtc_count = rdev->pm.dpm.new_active_crtc_count;
+	rdev->pm.dpm.single_display = single_display;
+
 	if (rdev->asic->dpm.force_performance_level) {
 		if (rdev->pm.dpm.thermal_active) {
 			enum radeon_dpm_forced_level level = rdev->pm.dpm.forced_level;

[toc] | [prev] | [next] | [standalone]

#1362531 — [PATCH 3.16.y-ckt 102/142] drm/ast: Fix incorrect register check for DRAM width

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Timothy Pearson <tpearson@raptorengineeringinc.com>

commit 2d02b8bdba322b527c5f5168ce1ca10c2d982a78 upstream.

During DRAM initialization on certain ASpeed devices, an incorrect
bit (bit 10) was checked in the "SDRAM Bus Width Status" register
to determine DRAM width.

Query bit 6 instead in accordance with the Aspeed AST2050 datasheet v1.05.

Signed-off-by: Timothy Pearson <tpearson@raptorengineeringinc.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/gpu/drm/ast/ast_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
index 0dfefbf929a3..cb6d626dad02 100644
--- a/drivers/gpu/drm/ast/ast_main.c
+++ b/drivers/gpu/drm/ast/ast_main.c
@@ -182,7 +182,7 @@ static int ast_get_dram_info(struct drm_device *dev)
 	} while (ast_read32(ast, 0x10000) != 0x01);
 	data = ast_read32(ast, 0x10004);
 
-	if (data & 0x400)
+	if (data & 0x40)
 		ast->dram_bus_width = 16;
 	else
 		ast->dram_bus_width = 32;

[toc] | [prev] | [next] | [standalone]

#1362532 — [PATCH 3.16.y-ckt 103/142] USB: qcserial: add Sierra Wireless EM74xx device ID

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>

commit 04fdbc825ffc02fb098964b92de802fff44e73fd upstream.

The MC74xx and EM74xx modules use different IDs by default, according
to the Lenovo EM7455 driver for Windows.

Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/usb/serial/qcserial.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index f1eb03eed5cf..f0a2ad15a992 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -155,8 +155,10 @@ static const struct usb_device_id id_table[] = {
 	{DEVICE_SWI(0x1199, 0x9056)},	/* Sierra Wireless Modem */
 	{DEVICE_SWI(0x1199, 0x9060)},	/* Sierra Wireless Modem */
 	{DEVICE_SWI(0x1199, 0x9061)},	/* Sierra Wireless Modem */
-	{DEVICE_SWI(0x1199, 0x9070)},	/* Sierra Wireless MC74xx/EM74xx */
-	{DEVICE_SWI(0x1199, 0x9071)},	/* Sierra Wireless MC74xx/EM74xx */
+	{DEVICE_SWI(0x1199, 0x9070)},	/* Sierra Wireless MC74xx */
+	{DEVICE_SWI(0x1199, 0x9071)},	/* Sierra Wireless MC74xx */
+	{DEVICE_SWI(0x1199, 0x9078)},	/* Sierra Wireless EM74xx */
+	{DEVICE_SWI(0x1199, 0x9079)},	/* Sierra Wireless EM74xx */
 	{DEVICE_SWI(0x413c, 0x81a2)},	/* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */
 	{DEVICE_SWI(0x413c, 0x81a3)},	/* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */
 	{DEVICE_SWI(0x413c, 0x81a4)},	/* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */

[toc] | [prev] | [next] | [standalone]

#1362534 — [PATCH 3.16.y-ckt 129/142] cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>

commit 4d06dd537f95683aba3651098ae288b7cbff8274 upstream.

usbnet_link_change will call schedule_work and should be
avoided if bind is failing. Otherwise we will end up with
scheduled work referring to a netdev which has gone away.

Instead of making the call conditional, we can just defer
it to usbnet_probe, using the driver_info flag made for
this purpose.

Fixes: 8a34b0ae8778 ("usbnet: cdc_ncm: apply usbnet_link_change")
Reported-by: Andrey Konovalov <andreyknvl@gmail.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ luis: backported to 3.16:
  - cdc_ncm_bind_common() takes only 3 args in 3.16
  - adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/net/usb/cdc_ncm.c | 21 +++++----------------
 1 file changed, 5 insertions(+), 16 deletions(-)

diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 8067b8fbb0ee..b7b3ed5f666c 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -948,23 +948,11 @@ EXPORT_SYMBOL_GPL(cdc_ncm_select_altsetting);
 
 static int cdc_ncm_bind(struct usbnet *dev, struct usb_interface *intf)
 {
-	int ret;
-
 	/* MBIM backwards compatible function? */
 	if (cdc_ncm_select_altsetting(intf) != CDC_NCM_COMM_ALTSETTING_NCM)
 		return -ENODEV;
 
-	/* The NCM data altsetting is fixed */
-	ret = cdc_ncm_bind_common(dev, intf, CDC_NCM_DATA_ALTSETTING_NCM);
-
-	/*
-	 * We should get an event when network connection is "connected" or
-	 * "disconnected". Set network connection in "disconnected" state
-	 * (carrier is OFF) during attach, so the IP network stack does not
-	 * start IPv6 negotiation and more.
-	 */
-	usbnet_link_change(dev, 0, 0);
-	return ret;
+	return cdc_ncm_bind_common(dev, intf, CDC_NCM_DATA_ALTSETTING_NCM);
 }
 
 static void cdc_ncm_align_tail(struct sk_buff *skb, size_t modulus, size_t remainder, size_t max)
@@ -1506,7 +1494,8 @@ static void cdc_ncm_status(struct usbnet *dev, struct urb *urb)
 
 static const struct driver_info cdc_ncm_info = {
 	.description = "CDC NCM",
-	.flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET,
+	.flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET
+			| FLAG_LINK_INTR,
 	.bind = cdc_ncm_bind,
 	.unbind = cdc_ncm_unbind,
 	.manage_power = usbnet_manage_power,
@@ -1519,7 +1508,7 @@ static const struct driver_info cdc_ncm_info = {
 static const struct driver_info wwan_info = {
 	.description = "Mobile Broadband Network Device",
 	.flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET
-			| FLAG_WWAN,
+			| FLAG_LINK_INTR | FLAG_WWAN,
 	.bind = cdc_ncm_bind,
 	.unbind = cdc_ncm_unbind,
 	.manage_power = usbnet_manage_power,
@@ -1532,7 +1521,7 @@ static const struct driver_info wwan_info = {
 static const struct driver_info wwan_noarp_info = {
 	.description = "Mobile Broadband Network Device (NO ARP)",
 	.flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET
-			| FLAG_WWAN | FLAG_NOARP,
+			| FLAG_LINK_INTR | FLAG_WWAN | FLAG_NOARP,
 	.bind = cdc_ncm_bind,
 	.unbind = cdc_ncm_unbind,
 	.manage_power = usbnet_manage_power,

[toc] | [prev] | [next] | [standalone]

#1362535 — [PATCH 3.16.y-ckt 106/142] ALSA: hda - Fix mic issues on Acer Aspire E1-472

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Simon South <simon@simonsouth.com>

commit 02322ac9dee9aff8d8862e8d6660ebe102f492ea upstream.

This patch applies the microphone-related fix created for the Acer
Aspire E1-572 to the E1-472 as well, as it uses the same Realtek ALC282
CODEC and demonstrates the same issues.

This patch allows an external, headset microphone to be used and limits
the gain on the (quite noisy) internal microphone.

Signed-off-by: Simon South <simon@simonsouth.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 sound/pci/hda/patch_realtek.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 437688036c2a..d7e12d704196 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4853,6 +4853,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1025, 0x0740, "Acer AO725", ALC271_FIXUP_HP_GATE_MIC_JACK),
 	SND_PCI_QUIRK(0x1025, 0x0742, "Acer AO756", ALC271_FIXUP_HP_GATE_MIC_JACK),
 	SND_PCI_QUIRK_VENDOR(0x1025, "Acer Aspire", ALC271_FIXUP_DMIC),
+	SND_PCI_QUIRK(0x1025, 0x0762, "Acer Aspire E1-472", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572),
 	SND_PCI_QUIRK(0x1025, 0x0775, "Acer Aspire E1-572", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572),
 	SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK),
 	SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),

[toc] | [prev] | [next] | [standalone]

#1362536 — [PATCH 3.16.y-ckt 127/142] ipv6: re-enable fragment header matching in ipv6_find_hdr

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Florian Westphal <fw@strlen.de>

commit 5d150a985520bbe3cb2aa1ceef24a7e32f20c15f upstream.

When ipv6_find_hdr is used to find a fragment header
(caller specifies target NEXTHDR_FRAGMENT) we erronously return
-ENOENT for all fragments with nonzero offset.

Before commit 9195bb8e381d, when target was specified, we did not
enter the exthdr walk loop as nexthdr == target so this used to work.

Now we do (so we can skip empty route headers). When we then stumble upon
a frag with nonzero frag_off we must return -ENOENT ("header not found")
only if the caller did not specifically request NEXTHDR_FRAGMENT.

This allows nfables exthdr expression to match ipv6 fragments, e.g. via

nft add rule ip6 filter input frag frag-off gt 0

Fixes: 9195bb8e381d ("ipv6: improve ipv6_find_hdr() to skip empty routing headers")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 net/ipv6/exthdrs_core.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
index 8af3eb57f438..c7c8f71d0d48 100644
--- a/net/ipv6/exthdrs_core.c
+++ b/net/ipv6/exthdrs_core.c
@@ -257,7 +257,11 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
 						*fragoff = _frag_off;
 					return hp->nexthdr;
 				}
-				return -ENOENT;
+				if (!found)
+					return -ENOENT;
+				if (fragoff)
+					*fragoff = _frag_off;
+				break;
 			}
 			hdrlen = 8;
 		} else if (nexthdr == NEXTHDR_AUTH) {

[toc] | [prev] | [next] | [standalone]

#1362537 — [PATCH 3.16.y-ckt 126/142] mld, igmp: Fix reserved tailroom calculation

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Benjamin Poirier <bpoirier@suse.com>

commit 1837b2e2bcd23137766555a63867e649c0b637f0 upstream.

The current reserved_tailroom calculation fails to take hlen and tlen into
account.

skb:
[__hlen__|__data____________|__tlen___|__extra__]
^                                               ^
head                                            skb_end_offset

In this representation, hlen + data + tlen is the size passed to alloc_skb.
"extra" is the extra space made available in __alloc_skb because of
rounding up by kmalloc. We can reorder the representation like so:

[__hlen__|__data____________|__extra__|__tlen___]
^                                               ^
head                                            skb_end_offset

The maximum space available for ip headers and payload without
fragmentation is min(mtu, data + extra). Therefore,
reserved_tailroom
= data + extra + tlen - min(mtu, data + extra)
= skb_end_offset - hlen - min(mtu, skb_end_offset - hlen - tlen)
= skb_tailroom - min(mtu, skb_tailroom - tlen) ; after skb_reserve(hlen)

Compare the second line to the current expression:
reserved_tailroom = skb_end_offset - min(mtu, skb_end_offset)
and we can see that hlen and tlen are not taken into account.

The min() in the third line can be expanded into:
if mtu < skb_tailroom - tlen:
	reserved_tailroom = skb_tailroom - mtu
else:
	reserved_tailroom = tlen

Depending on hlen, tlen, mtu and the number of multicast address records,
the current code may output skbs that have less tailroom than
dev->needed_tailroom or it may output more skbs than needed because not all
space available is used.

Fixes: 4c672e4b ("ipv6: mld: fix add_grhead skb_over_panic for devs with large MTUs")
Signed-off-by: Benjamin Poirier <bpoirier@suse.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 include/linux/skbuff.h | 24 ++++++++++++++++++++++++
 net/ipv4/igmp.c        |  3 +--
 net/ipv6/mcast.c       |  3 +--
 3 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index c046cb92172e..629f519224ee 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1671,6 +1671,30 @@ static inline void skb_reserve(struct sk_buff *skb, int len)
 	skb->tail += len;
 }
 
+/**
+ *	skb_tailroom_reserve - adjust reserved_tailroom
+ *	@skb: buffer to alter
+ *	@mtu: maximum amount of headlen permitted
+ *	@needed_tailroom: minimum amount of reserved_tailroom
+ *
+ *	Set reserved_tailroom so that headlen can be as large as possible but
+ *	not larger than mtu and tailroom cannot be smaller than
+ *	needed_tailroom.
+ *	The required headroom should already have been reserved before using
+ *	this function.
+ */
+static inline void skb_tailroom_reserve(struct sk_buff *skb, unsigned int mtu,
+					unsigned int needed_tailroom)
+{
+	SKB_LINEAR_ASSERT(skb);
+	if (mtu < skb_tailroom(skb) - needed_tailroom)
+		/* use at most mtu */
+		skb->reserved_tailroom = skb_tailroom(skb) - mtu;
+	else
+		/* use up to all available space */
+		skb->reserved_tailroom = needed_tailroom;
+}
+
 static inline void skb_reset_inner_headers(struct sk_buff *skb)
 {
 	skb->inner_mac_header = skb->mac_header;
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 719c3d707327..727447c17954 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -352,9 +352,8 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, unsigned int mtu)
 	skb_dst_set(skb, &rt->dst);
 	skb->dev = dev;
 
-	skb->reserved_tailroom = skb_end_offset(skb) -
-				 min(mtu, skb_end_offset(skb));
 	skb_reserve(skb, hlen);
+	skb_tailroom_reserve(skb, mtu, tlen);
 
 	skb_reset_network_header(skb);
 	pip = ip_hdr(skb);
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index e33349701050..ad84e7dec433 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1571,9 +1571,8 @@ static struct sk_buff *mld_newpack(struct inet6_dev *idev, unsigned int mtu)
 		return NULL;
 
 	skb->priority = TC_PRIO_CONTROL;
-	skb->reserved_tailroom = skb_end_offset(skb) -
-				 min(mtu, skb_end_offset(skb));
 	skb_reserve(skb, hlen);
+	skb_tailroom_reserve(skb, mtu, tlen);
 
 	if (__ipv6_get_lladdr(idev, &addr_buf, IFA_F_TENTATIVE)) {
 		/* <draft-ietf-magma-mld-source-05.txt>:

[toc] | [prev] | [next] | [standalone]

#1362538 — [PATCH 3.16.y-ckt 112/142] cfg80211/wext: fix message ordering

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Johannes Berg <johannes.berg@intel.com>

commit cb150b9d23be6ee7f3a0fff29784f1c5b5ac514d upstream.

Since cfg80211 frequently takes actions from its netdev notifier
call, wireless extensions messages could still be ordered badly
since the wext netdev notifier, since wext is built into the
kernel, runs before the cfg80211 netdev notifier. For example,
the following can happen:

5: wlan1: <BROADCAST,MULTICAST> mtu 1500 qdisc mq state DOWN group default
    link/ether 02:00:00:00:01:00 brd ff:ff:ff:ff:ff:ff
5: wlan1: <BROADCAST,MULTICAST,UP>
    link/ether

when setting the interface down causes the wext message.

To also fix this, export the wireless_nlevent_flush() function
and also call it from the cfg80211 notifier.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 include/net/iw_handler.h | 6 ++++++
 net/wireless/core.c      | 2 ++
 net/wireless/wext-core.c | 3 ++-
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/include/net/iw_handler.h b/include/net/iw_handler.h
index a830b01baba4..e8aa72eaded5 100644
--- a/include/net/iw_handler.h
+++ b/include/net/iw_handler.h
@@ -439,6 +439,12 @@ int dev_get_wireless_info(char *buffer, char **start, off_t offset, int length);
 /* Send a single event to user space */
 void wireless_send_event(struct net_device *dev, unsigned int cmd,
 			 union iwreq_data *wrqu, const char *extra);
+#ifdef CONFIG_WEXT_CORE
+/* flush all previous wext events - if work is done from netdev notifiers */
+void wireless_nlevent_flush(void);
+#else
+static inline void wireless_nlevent_flush(void) {}
+#endif
 
 /* We may need a function to send a stream of events to user space.
  * More on that later... */
diff --git a/net/wireless/core.c b/net/wireless/core.c
index a1c40654dd9b..59bc2ff8cfc5 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -1048,6 +1048,8 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
 		return NOTIFY_DONE;
 	}
 
+	wireless_nlevent_flush();
+
 	return NOTIFY_OK;
 }
 
diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index 87dd619fb2e9..b50ee5d622e1 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -342,7 +342,7 @@ static const int compat_event_type_size[] = {
 
 /* IW event code */
 
-static void wireless_nlevent_flush(void)
+void wireless_nlevent_flush(void)
 {
 	struct sk_buff *skb;
 	struct net *net;
@@ -355,6 +355,7 @@ static void wireless_nlevent_flush(void)
 				    GFP_KERNEL);
 	}
 }
+EXPORT_SYMBOL_GPL(wireless_nlevent_flush);
 
 static int wext_netdev_notifier_call(struct notifier_block *nb,
 				     unsigned long state, void *ptr)

[toc] | [prev] | [next] | [standalone]

#1362539 — [PATCH 3.16.y-ckt 116/142] ASoC: wm8958: Fix enum ctl accesses in a wrong type

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Takashi Iwai <tiwai@suse.de>

commit d0784829ae3b0beeb69b476f017d5c8a2eb95198 upstream.

"MBC Mode", "VSS Mode", "VSS HPF Mode" and "Enhanced EQ Mode" ctls in
wm8958 codec driver are enum, while the current driver accesses
wrongly via value.integer.value[].  They have to be via
value.enumerated.item[] instead.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 sound/soc/codecs/wm8958-dsp2.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/sound/soc/codecs/wm8958-dsp2.c b/sound/soc/codecs/wm8958-dsp2.c
index b2ebb104d879..418a768e670c 100644
--- a/sound/soc/codecs/wm8958-dsp2.c
+++ b/sound/soc/codecs/wm8958-dsp2.c
@@ -459,7 +459,7 @@ static int wm8958_put_mbc_enum(struct snd_kcontrol *kcontrol,
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
 	struct wm8994 *control = wm8994->wm8994;
-	int value = ucontrol->value.integer.value[0];
+	int value = ucontrol->value.enumerated.item[0];
 	int reg;
 
 	/* Don't allow on the fly reconfiguration */
@@ -549,7 +549,7 @@ static int wm8958_put_vss_enum(struct snd_kcontrol *kcontrol,
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
 	struct wm8994 *control = wm8994->wm8994;
-	int value = ucontrol->value.integer.value[0];
+	int value = ucontrol->value.enumerated.item[0];
 	int reg;
 
 	/* Don't allow on the fly reconfiguration */
@@ -582,7 +582,7 @@ static int wm8958_put_vss_hpf_enum(struct snd_kcontrol *kcontrol,
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
 	struct wm8994 *control = wm8994->wm8994;
-	int value = ucontrol->value.integer.value[0];
+	int value = ucontrol->value.enumerated.item[0];
 	int reg;
 
 	/* Don't allow on the fly reconfiguration */
@@ -749,7 +749,7 @@ static int wm8958_put_enh_eq_enum(struct snd_kcontrol *kcontrol,
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
 	struct wm8994 *control = wm8994->wm8994;
-	int value = ucontrol->value.integer.value[0];
+	int value = ucontrol->value.enumerated.item[0];
 	int reg;
 
 	/* Don't allow on the fly reconfiguration */

[toc] | [prev] | [next] | [standalone]

#1362540 — [PATCH 3.16.y-ckt 090/142] cifs: fix out-of-bounds access in lease parsing

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Justin Maggard <jmaggard10@gmail.com>

commit deb7deff2f00bdbbcb3d560dad2a89ef37df837d upstream.

When opening a file, SMB2_open() attempts to parse the lease state from the
SMB2 CREATE Response.  However, the parsing code was not careful to ensure
that the create contexts are not empty or invalid, which can lead to out-
of-bounds memory access.  This can be seen easily by trying
to read a file from a OSX 10.11 SMB3 server.  Here is sample crash output:

BUG: unable to handle kernel paging request at ffff8800a1a77cc6
IP: [<ffffffff8828a734>] SMB2_open+0x804/0x960
PGD 8f77067 PUD 0
Oops: 0000 [#1] SMP
Modules linked in:
CPU: 3 PID: 2876 Comm: cp Not tainted 4.5.0-rc3.x86_64.1+ #14
Hardware name: NETGEAR ReadyNAS 314          /ReadyNAS 314          , BIOS 4.6.5 10/11/2012
task: ffff880073cdc080 ti: ffff88005b31c000 task.ti: ffff88005b31c000
RIP: 0010:[<ffffffff8828a734>]  [<ffffffff8828a734>] SMB2_open+0x804/0x960
RSP: 0018:ffff88005b31fa08  EFLAGS: 00010282
RAX: 0000000000000015 RBX: 0000000000000000 RCX: 0000000000000006
RDX: 0000000000000000 RSI: 0000000000000246 RDI: ffff88007eb8c8b0
RBP: ffff88005b31fad8 R08: 666666203d206363 R09: 6131613030383866
R10: 3030383866666666 R11: 00000000000002b0 R12: ffff8800660fd800
R13: ffff8800a1a77cc2 R14: 00000000424d53fe R15: ffff88005f5a28c0
FS:  00007f7c8a2897c0(0000) GS:ffff88007eb80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: ffff8800a1a77cc6 CR3: 000000005b281000 CR4: 00000000000006e0
Stack:
 ffff88005b31fa70 ffffffff88278789 00000000000001d3 ffff88005f5a2a80
 ffffffff00000003 ffff88005d029d00 ffff88006fde05a0 0000000000000000
 ffff88005b31fc78 ffff88006fde0780 ffff88005b31fb2f 0000000100000fe0
Call Trace:
 [<ffffffff88278789>] ? cifsConvertToUTF16+0x159/0x2d0
 [<ffffffff8828cf68>] smb2_open_file+0x98/0x210
 [<ffffffff8811e80c>] ? __kmalloc+0x1c/0xe0
 [<ffffffff882685f4>] cifs_open+0x2a4/0x720
 [<ffffffff88122cef>] do_dentry_open+0x1ff/0x310
 [<ffffffff88268350>] ? cifsFileInfo_get+0x30/0x30
 [<ffffffff88123d92>] vfs_open+0x52/0x60
 [<ffffffff88131dd0>] path_openat+0x170/0xf70
 [<ffffffff88097d48>] ? remove_wait_queue+0x48/0x50
 [<ffffffff88133a29>] do_filp_open+0x79/0xd0
 [<ffffffff8813f2ca>] ? __alloc_fd+0x3a/0x170
 [<ffffffff881240c4>] do_sys_open+0x114/0x1e0
 [<ffffffff881241a9>] SyS_open+0x19/0x20
 [<ffffffff8896e257>] entry_SYSCALL_64_fastpath+0x12/0x6a
Code: 4d 8d 6c 07 04 31 c0 4c 89 ee e8 47 6f e5 ff 31 c9 41 89 ce 44 89 f1 48 c7 c7 28 b1 bd 88 31 c0 49 01 cd 4c 89 ee e8 2b 6f e5 ff <45> 0f b7 75 04 48 c7 c7 31 b1 bd 88 31 c0 4d 01 ee 4c 89 f6 e8
RIP  [<ffffffff8828a734>] SMB2_open+0x804/0x960
 RSP <ffff88005b31fa08>
CR2: ffff8800a1a77cc6
---[ end trace d9f69ba64feee469 ]---

Signed-off-by: Justin Maggard <jmaggard@netgear.com>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 fs/cifs/smb2pdu.c | 24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 87077559a0ab..c83a5a2fac70 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1012,21 +1012,25 @@ parse_lease_state(struct TCP_Server_Info *server, struct smb2_create_rsp *rsp,
 {
 	char *data_offset;
 	struct create_context *cc;
-	unsigned int next = 0;
+	unsigned int next;
+	unsigned int remaining;
 	char *name;
 
 	data_offset = (char *)rsp + 4 + le32_to_cpu(rsp->CreateContextsOffset);
+	remaining = le32_to_cpu(rsp->CreateContextsLength);
 	cc = (struct create_context *)data_offset;
-	do {
-		cc = (struct create_context *)((char *)cc + next);
+	while (remaining >= sizeof(struct create_context)) {
 		name = le16_to_cpu(cc->NameOffset) + (char *)cc;
-		if (le16_to_cpu(cc->NameLength) != 4 ||
-		    strncmp(name, "RqLs", 4)) {
-			next = le32_to_cpu(cc->Next);
-			continue;
-		}
-		return server->ops->parse_lease_buf(cc, epoch);
-	} while (next != 0);
+		if (le16_to_cpu(cc->NameLength) == 4 &&
+		    strncmp(name, "RqLs", 4) == 0)
+			return server->ops->parse_lease_buf(cc, epoch);
+
+		next = le32_to_cpu(cc->Next);
+		if (!next)
+			break;
+		remaining -= next;
+		cc = (struct create_context *)((char *)cc + next);
+	}
 
 	return 0;
 }

[toc] | [prev] | [next] | [standalone]

#1362542 — [PATCH 3.16.y-ckt 123/142] Revert "drm/radeon/pm: adjust display configuration after powerstate"

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Alex Deucher <alexander.deucher@amd.com>

commit d74e766e1916d0e09b86e4b5b9d0f819628fd546 upstream.

This reverts commit 39d4275058baf53e89203407bf3841ff2c74fa32.

This caused a regression on some older hardware.

bug:
https://bugzilla.kernel.org/show_bug.cgi?id=113891

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/gpu/drm/radeon/radeon_pm.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index a05d569fa038..afd4adaf9f2d 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -936,6 +936,8 @@ force:
 
 	/* update display watermarks based on new power state */
 	radeon_bandwidth_update(rdev);
+	/* update displays */
+	radeon_dpm_display_configuration_changed(rdev);
 
 	/* wait for the rings to drain */
 	for (i = 0; i < RADEON_NUM_RINGS; i++) {
@@ -952,9 +954,6 @@ force:
 
 	radeon_dpm_post_set_power_state(rdev);
 
-	/* update displays */
-	radeon_dpm_display_configuration_changed(rdev);
-
 	rdev->pm.dpm.current_active_crtcs = rdev->pm.dpm.new_active_crtcs;
 	rdev->pm.dpm.current_active_crtc_count = rdev->pm.dpm.new_active_crtc_count;
 	rdev->pm.dpm.single_display = single_display;

[toc] | [prev] | [next] | [standalone]

#1362543 — [PATCH 3.16.y-ckt 121/142] KVM: PPC: Book3S HV: Sanitize special-purpose register values on guest exit

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Paul Mackerras <paulus@samba.org>

commit ccec44563b18a0ce90e2d4f332784b3cb25c8e9c upstream.

Thomas Huth discovered that a guest could cause a hard hang of a
host CPU by setting the Instruction Authority Mask Register (IAMR)
to a suitable value.  It turns out that this is because when the
code was added to context-switch the new special-purpose registers
(SPRs) that were added in POWER8, we forgot to add code to ensure
that they were restored to a sane value on guest exit.

This adds code to set those registers where a bad value could
compromise the execution of the host kernel to a suitable neutral
value on guest exit.

Fixes: b005255e12a3
Reported-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 arch/powerpc/kvm/book3s_hv_rmhandlers.S | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index 6fafff75f24a..f3197994b733 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -1280,6 +1280,20 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
 	std	r6, VCPU_ACOP(r9)
 	stw	r7, VCPU_GUEST_PID(r9)
 	std	r8, VCPU_WORT(r9)
+	/*
+	 * Restore various registers to 0, where non-zero values
+	 * set by the guest could disrupt the host.
+	 */
+	li	r0, 0
+	mtspr	SPRN_IAMR, r0
+	mtspr	SPRN_CIABR, r0
+	mtspr	SPRN_DAWRX, r0
+	mtspr	SPRN_TCSCR, r0
+	mtspr	SPRN_WORT, r0
+	/* Set MMCRS to 1<<31 to freeze and disable the SPMC counters */
+	li	r0, 1
+	sldi	r0, r0, 31
+	mtspr	SPRN_MMCRS, r0
 8:
 
 	/* Save and reset AMR and UAMOR before turning on the MMU */

[toc] | [prev] | [next] | [standalone]

#1362546 — [PATCH 3.16.y-ckt 113/142] mac80211: fix use of uninitialised values in RX aggregation

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Chris Bainbridge <chris.bainbridge@gmail.com>

commit f39ea2690bd61efec97622c48323f40ed6e16317 upstream.

Use kzalloc instead of kmalloc for struct tid_ampdu_rx to
initialize the "removed" field (all others are initialized
manually). That fixes:

UBSAN: Undefined behaviour in net/mac80211/rx.c:932:29
load of value 2 is not a valid value for type '_Bool'
CPU: 3 PID: 1134 Comm: kworker/u16:7 Not tainted 4.5.0-rc1+ #265
Workqueue: phy0 rt2x00usb_work_rxdone
 0000000000000004 ffff880254a7ba50 ffffffff8181d866 0000000000000007
 ffff880254a7ba78 ffff880254a7ba68 ffffffff8188422d ffffffff8379b500
 ffff880254a7bab8 ffffffff81884747 0000000000000202 0000000348620032
Call Trace:
 [<ffffffff8181d866>] dump_stack+0x45/0x5f
 [<ffffffff8188422d>] ubsan_epilogue+0xd/0x40
 [<ffffffff81884747>] __ubsan_handle_load_invalid_value+0x67/0x70
 [<ffffffff82227b4d>] ieee80211_sta_reorder_release.isra.16+0x5ed/0x730
 [<ffffffff8222ca14>] ieee80211_prepare_and_rx_handle+0xd04/0x1c00
 [<ffffffff8222db03>] __ieee80211_rx_handle_packet+0x1f3/0x750
 [<ffffffff8222e4a7>] ieee80211_rx_napi+0x447/0x990

While at it, convert to use sizeof(*tid_agg_rx) instead.

Fixes: 788211d81bfdf ("mac80211: fix RX A-MPDU session reorder timer deletion")
Signed-off-by: Chris Bainbridge <chris.bainbridge@gmail.com>
[reword commit message, use sizeof(*tid_agg_rx)]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 net/mac80211/agg-rx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 9608c6e65887..07706bec2e3a 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -294,7 +294,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
 	}
 
 	/* prepare A-MPDU MLME for Rx aggregation */
-	tid_agg_rx = kmalloc(sizeof(struct tid_ampdu_rx), GFP_KERNEL);
+	tid_agg_rx = kzalloc(sizeof(*tid_agg_rx), GFP_KERNEL);
 	if (!tid_agg_rx)
 		goto end;
 

[toc] | [prev] | [next] | [standalone]

#1362547 — [PATCH 3.16.y-ckt 117/142] ASoC: wm8994: Fix enum ctl accesses in a wrong type

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Takashi Iwai <tiwai@suse.de>

commit 8019c0b37cd5a87107808300a496388b777225bf upstream.

The DRC Mode like "AIF1DRC1 Mode" and EQ Mode like "AIF1.1 EQ Mode" in
wm8994 codec driver are enum ctls, while the current driver accesses
wrongly via value.integer.value[].  They have to be via
value.enumerated.item[] instead.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 sound/soc/codecs/wm8994.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index d54c10e4fa90..e1bb8b036909 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -360,7 +360,7 @@ static int wm8994_put_drc_enum(struct snd_kcontrol *kcontrol,
 	struct wm8994 *control = wm8994->wm8994;
 	struct wm8994_pdata *pdata = &control->pdata;
 	int drc = wm8994_get_drc(kcontrol->id.name);
-	int value = ucontrol->value.integer.value[0];
+	int value = ucontrol->value.enumerated.item[0];
 
 	if (drc < 0)
 		return drc;
@@ -467,7 +467,7 @@ static int wm8994_put_retune_mobile_enum(struct snd_kcontrol *kcontrol,
 	struct wm8994 *control = wm8994->wm8994;
 	struct wm8994_pdata *pdata = &control->pdata;
 	int block = wm8994_get_retune_mobile_block(kcontrol->id.name);
-	int value = ucontrol->value.integer.value[0];
+	int value = ucontrol->value.enumerated.item[0];
 
 	if (block < 0)
 		return block;

[toc] | [prev] | [next] | [standalone]

#1362548 — [PATCH 3.16.y-ckt 111/142] wext: fix message delay/ordering

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Johannes Berg <johannes.berg@intel.com>

commit 8bf862739a7786ae72409220914df960a0aa80d8 upstream.

Beniamino reported that he was getting an RTM_NEWLINK message for a
given interface, after the RTM_DELLINK for it. It turns out that the
message is a wireless extensions message, which was sent because the
interface had been connected and disconnection while it was deleted
caused a wext message.

For its netlink messages, wext uses RTM_NEWLINK, but the message is
without all the regular rtnetlink attributes, so "ip monitor link"
prints just rudimentary information:

5: wlan1: <BROADCAST,MULTICAST> mtu 1500 qdisc mq state DOWN group default
    link/ether 02:00:00:00:01:00 brd ff:ff:ff:ff:ff:ff
Deleted 5: wlan1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default
    link/ether 02:00:00:00:01:00 brd ff:ff:ff:ff:ff:ff
5: wlan1: <BROADCAST,MULTICAST,UP>
    link/ether
(from my hwsim reproduction)

This can cause userspace to get confused since it doesn't expect an
RTM_NEWLINK message after RTM_DELLINK.

The reason for this is that wext schedules a worker to send out the
messages, and the scheduling delay can cause the messages to get out
to userspace in different order.

To fix this, have wext register a netdevice notifier and flush out
any pending messages when netdevice state changes. This fixes any
ordering whenever the original message wasn't sent by a notifier
itself.

Reported-by: Beniamino Galvani <bgalvani@redhat.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 net/wireless/wext-core.c | 51 +++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 40 insertions(+), 11 deletions(-)

diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index c8717c1d082e..87dd619fb2e9 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -342,6 +342,39 @@ static const int compat_event_type_size[] = {
 
 /* IW event code */
 
+static void wireless_nlevent_flush(void)
+{
+	struct sk_buff *skb;
+	struct net *net;
+
+	ASSERT_RTNL();
+
+	for_each_net(net) {
+		while ((skb = skb_dequeue(&net->wext_nlevents)))
+			rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL,
+				    GFP_KERNEL);
+	}
+}
+
+static int wext_netdev_notifier_call(struct notifier_block *nb,
+				     unsigned long state, void *ptr)
+{
+	/*
+	 * When a netdev changes state in any way, flush all pending messages
+	 * to avoid them going out in a strange order, e.g. RTM_NEWLINK after
+	 * RTM_DELLINK, or with IFF_UP after without IFF_UP during dev_close()
+	 * or similar - all of which could otherwise happen due to delays from
+	 * schedule_work().
+	 */
+	wireless_nlevent_flush();
+
+	return NOTIFY_OK;
+}
+
+static struct notifier_block wext_netdev_notifier = {
+	.notifier_call = wext_netdev_notifier_call,
+};
+
 static int __net_init wext_pernet_init(struct net *net)
 {
 	skb_queue_head_init(&net->wext_nlevents);
@@ -360,7 +393,12 @@ static struct pernet_operations wext_pernet_ops = {
 
 static int __init wireless_nlevent_init(void)
 {
-	return register_pernet_subsys(&wext_pernet_ops);
+	int err = register_pernet_subsys(&wext_pernet_ops);
+
+	if (err)
+		return err;
+
+	return register_netdevice_notifier(&wext_netdev_notifier);
 }
 
 subsys_initcall(wireless_nlevent_init);
@@ -368,17 +406,8 @@ subsys_initcall(wireless_nlevent_init);
 /* Process events generated by the wireless layer or the driver. */
 static void wireless_nlevent_process(struct work_struct *work)
 {
-	struct sk_buff *skb;
-	struct net *net;
-
 	rtnl_lock();
-
-	for_each_net(net) {
-		while ((skb = skb_dequeue(&net->wext_nlevents)))
-			rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL,
-				    GFP_KERNEL);
-	}
-
+	wireless_nlevent_flush();
 	rtnl_unlock();
 }
 

[toc] | [prev] | [next] | [standalone]

#1362549 — [PATCH 3.16.y-ckt 099/142] USB: serial: option: add support for Telit LE922 PID 0x1045

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Daniele Palmas <dnlplm@gmail.com>

commit 5deef5551c77e488922cc4bf4bc76df63be650d0 upstream.

This patch adds support for 0x1045 PID of Telit LE922.

Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/usb/serial/option.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 46305ca6158e..b5839df3e4a1 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -273,6 +273,7 @@ static void option_instat_callback(struct urb *urb);
 #define TELIT_PRODUCT_UE910_V2			0x1012
 #define TELIT_PRODUCT_LE922_USBCFG0		0x1042
 #define TELIT_PRODUCT_LE922_USBCFG3		0x1043
+#define TELIT_PRODUCT_LE922_USBCFG5		0x1045
 #define TELIT_PRODUCT_LE920			0x1200
 #define TELIT_PRODUCT_LE910			0x1201
 
@@ -1202,6 +1203,8 @@ static const struct usb_device_id option_ids[] = {
 		.driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG3),
 		.driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG5, 0xff),
+		.driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
 		.driver_info = (kernel_ulong_t)&telit_le910_blacklist },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),

[toc] | [prev] | [next] | [standalone]

#1362550 — [PATCH 3.16.y-ckt 071/142] target: Fix LUN_RESET active TMR descriptor handling

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Nicholas Bellinger <nab@linux-iscsi.org>

commit a6d9bb1c9605cd4f44e2d8290dc4d0e88f20292d upstream.

This patch fixes a NULL pointer se_cmd->cmd_kref < 0
refcount bug during TMR LUN_RESET with active TMRs,
triggered during se_cmd + se_tmr_req descriptor
shutdown + release via core_tmr_drain_tmr_list().

To address this bug, go ahead and obtain a local
kref_get_unless_zero(&se_cmd->cmd_kref) for active I/O
to set CMD_T_ABORTED, and transport_wait_for_tasks()
followed by the final target_put_sess_cmd() to drop
the local ->cmd_kref.

Also add two new checks within target_tmr_work() to
avoid CMD_T_ABORTED -> TFO->queue_tm_rsp() callbacks
ahead of invoking the backend -> fabric put in
transport_cmd_check_stop_to_fabric().

For good measure, also change core_tmr_release_req()
to use list_del_init() ahead of se_tmr_req memory
free.

Reviewed-by: Quinn Tran <quinn.tran@qlogic.com>
Cc: Himanshu Madhani <himanshu.madhani@qlogic.com>
Cc: Sagi Grimberg <sagig@mellanox.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Hannes Reinecke <hare@suse.de>
Cc: Andy Grover <agrover@redhat.com>
Cc: Mike Christie <mchristi@redhat.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
[ luis: backported to 3.16: used Nicholas' backport to 3.14 ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/target/target_core_tmr.c       | 22 +++++++++++++++++++++-
 drivers/target/target_core_transport.c | 17 +++++++++++++++++
 2 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
index f7cd95e8111a..1b74be036149 100644
--- a/drivers/target/target_core_tmr.c
+++ b/drivers/target/target_core_tmr.c
@@ -76,7 +76,7 @@ void core_tmr_release_req(
 	}
 
 	spin_lock_irqsave(&dev->se_tmr_lock, flags);
-	list_del(&tmr->tmr_list);
+	list_del_init(&tmr->tmr_list);
 	spin_unlock_irqrestore(&dev->se_tmr_lock, flags);
 
 	kfree(tmr);
@@ -181,9 +181,11 @@ static void core_tmr_drain_tmr_list(
 	struct list_head *preempt_and_abort_list)
 {
 	LIST_HEAD(drain_tmr_list);
+	struct se_session *sess;
 	struct se_tmr_req *tmr_p, *tmr_pp;
 	struct se_cmd *cmd;
 	unsigned long flags;
+	bool rc;
 	/*
 	 * Release all pending and outgoing TMRs aside from the received
 	 * LUN_RESET tmr..
@@ -209,17 +211,31 @@ static void core_tmr_drain_tmr_list(
 		if (target_check_cdb_and_preempt(preempt_and_abort_list, cmd))
 			continue;
 
+		sess = cmd->se_sess;
+		if (WARN_ON_ONCE(!sess))
+			continue;
+
+		spin_lock(&sess->sess_cmd_lock);
 		spin_lock(&cmd->t_state_lock);
 		if (!(cmd->transport_state & CMD_T_ACTIVE)) {
 			spin_unlock(&cmd->t_state_lock);
+			spin_unlock(&sess->sess_cmd_lock);
 			continue;
 		}
 		if (cmd->t_state == TRANSPORT_ISTATE_PROCESSING) {
 			spin_unlock(&cmd->t_state_lock);
+			spin_unlock(&sess->sess_cmd_lock);
 			continue;
 		}
+		cmd->transport_state |= CMD_T_ABORTED;
 		spin_unlock(&cmd->t_state_lock);
 
+		rc = kref_get_unless_zero(&cmd->cmd_kref);
+		spin_unlock(&sess->sess_cmd_lock);
+		if (!rc) {
+			printk("LUN_RESET TMR: non-zero kref_get_unless_zero\n");
+			continue;
+		}
 		list_move_tail(&tmr_p->tmr_list, &drain_tmr_list);
 	}
 	spin_unlock_irqrestore(&dev->se_tmr_lock, flags);
@@ -233,7 +249,11 @@ static void core_tmr_drain_tmr_list(
 			(preempt_and_abort_list) ? "Preempt" : "", tmr_p,
 			tmr_p->function, tmr_p->response, cmd->t_state);
 
+		cancel_work_sync(&cmd->work);
+		transport_wait_for_tasks(cmd);
+
 		transport_cmd_finish_abort(cmd, 1);
+		target_put_sess_cmd(cmd->se_sess, cmd);
 	}
 }
 
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 9eeeb78bf604..4e0b86685369 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -2951,8 +2951,17 @@ static void target_tmr_work(struct work_struct *work)
 	struct se_cmd *cmd = container_of(work, struct se_cmd, work);
 	struct se_device *dev = cmd->se_dev;
 	struct se_tmr_req *tmr = cmd->se_tmr_req;
+	unsigned long flags;
 	int ret;
 
+	spin_lock_irqsave(&cmd->t_state_lock, flags);
+	if (cmd->transport_state & CMD_T_ABORTED) {
+		tmr->response = TMR_FUNCTION_REJECTED;
+		spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+		goto check_stop;
+	}
+	spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+
 	switch (tmr->function) {
 	case TMR_ABORT_TASK:
 		core_tmr_abort_task(dev, tmr, cmd->se_sess);
@@ -2980,9 +2989,17 @@ static void target_tmr_work(struct work_struct *work)
 		break;
 	}
 
+	spin_lock_irqsave(&cmd->t_state_lock, flags);
+	if (cmd->transport_state & CMD_T_ABORTED) {
+		spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+		goto check_stop;
+	}
 	cmd->t_state = TRANSPORT_ISTATE_PROCESSING;
+	spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+
 	cmd->se_tfo->queue_tm_rsp(cmd);
 
+check_stop:
 	transport_cmd_check_stop_to_fabric(cmd);
 }
 

[toc] | [prev] | [next] | [standalone]

#1362553 — [PATCH 3.16.y-ckt 070/142] sctp: Fix port hash table size computation

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Neil Horman <nhorman@tuxdriver.com>

commit d9749fb5942f51555dc9ce1ac0dbb1806960a975 upstream.

Dmitry Vyukov noted recently that the sctp_port_hashtable had an error in
its size computation, observing that the current method never guaranteed
that the hashsize (measured in number of entries) would be a power of two,
which the input hash function for that table requires.  The root cause of
the problem is that two values need to be computed (one, the allocation
order of the storage requries, as passed to __get_free_pages, and two the
number of entries for the hash table).  Both need to be ^2, but for
different reasons, and the existing code is simply computing one order
value, and using it as the basis for both, which is wrong (i.e. it assumes
that ((1<<order)*PAGE_SIZE)/sizeof(bucket) is still ^2 when its not).

To fix this, we change the logic slightly.  We start by computing a goal
allocation order (which is limited by the maximum size hash table we want
to support.  Then we attempt to allocate that size table, decreasing the
order until a successful allocation is made.  Then, with the resultant
successful order we compute the number of buckets that hash table supports,
which we then round down to the nearest power of two, giving us the number
of entries the table actually supports.

I've tested this locally here, using non-debug and spinlock-debug kernels,
and the number of entries in the hashtable consistently work out to be
powers of two in all cases.

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
CC: Dmitry Vyukov <dvyukov@google.com>
CC: Vladislav Yasevich <vyasevich@gmail.com>
CC: "David S. Miller" <davem@davemloft.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 net/sctp/protocol.c | 47 ++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 38 insertions(+), 9 deletions(-)

diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index e30c2091a4e1..c143f74a25b9 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -60,6 +60,8 @@
 #include <net/inet_common.h>
 #include <net/inet_ecn.h>
 
+#define MAX_SCTP_PORT_HASH_ENTRIES (64 * 1024)
+
 /* Global data structures. */
 struct sctp_globals sctp_globals __read_mostly;
 
@@ -1332,6 +1334,8 @@ static __init int sctp_init(void)
 	unsigned long limit;
 	int max_share;
 	int order;
+	int num_entries;
+	int max_entry_order;
 
 	BUILD_BUG_ON(sizeof(struct sctp_ulpevent) >
 		     sizeof(((struct sk_buff *) 0)->cb));
@@ -1385,14 +1389,24 @@ static __init int sctp_init(void)
 
 	/* Size and allocate the association hash table.
 	 * The methodology is similar to that of the tcp hash tables.
+	 * Though not identical.  Start by getting a goal size
 	 */
 	if (totalram_pages >= (128 * 1024))
 		goal = totalram_pages >> (22 - PAGE_SHIFT);
 	else
 		goal = totalram_pages >> (24 - PAGE_SHIFT);
 
-	for (order = 0; (1UL << order) < goal; order++)
-		;
+	/* Then compute the page order for said goal */
+	order = get_order(goal);
+
+	/* Now compute the required page order for the maximum sized table we
+	 * want to create
+	 */
+	max_entry_order = get_order(MAX_SCTP_PORT_HASH_ENTRIES *
+				    sizeof(struct sctp_bind_hashbucket));
+
+	/* Limit the page order by that maximum hash table size */
+	order = min(order, max_entry_order);
 
 	do {
 		sctp_assoc_hashsize = (1UL << order) * PAGE_SIZE /
@@ -1426,27 +1440,42 @@ static __init int sctp_init(void)
 		INIT_HLIST_HEAD(&sctp_ep_hashtable[i].chain);
 	}
 
-	/* Allocate and initialize the SCTP port hash table.  */
+	/* Allocate and initialize the SCTP port hash table.
+	 * Note that order is initalized to start at the max sized
+	 * table we want to support.  If we can't get that many pages
+	 * reduce the order and try again
+	 */
 	do {
-		sctp_port_hashsize = (1UL << order) * PAGE_SIZE /
-					sizeof(struct sctp_bind_hashbucket);
-		if ((sctp_port_hashsize > (64 * 1024)) && order > 0)
-			continue;
 		sctp_port_hashtable = (struct sctp_bind_hashbucket *)
 			__get_free_pages(GFP_ATOMIC|__GFP_NOWARN, order);
 	} while (!sctp_port_hashtable && --order > 0);
+
 	if (!sctp_port_hashtable) {
 		pr_err("Failed bind hash alloc\n");
 		status = -ENOMEM;
 		goto err_bhash_alloc;
 	}
+
+	/* Now compute the number of entries that will fit in the
+	 * port hash space we allocated
+	 */
+	num_entries = (1UL << order) * PAGE_SIZE /
+		      sizeof(struct sctp_bind_hashbucket);
+
+	/* And finish by rounding it down to the nearest power of two
+	 * this wastes some memory of course, but its needed because
+	 * the hash function operates based on the assumption that
+	 * that the number of entries is a power of two
+	 */
+	sctp_port_hashsize = rounddown_pow_of_two(num_entries);
+
 	for (i = 0; i < sctp_port_hashsize; i++) {
 		spin_lock_init(&sctp_port_hashtable[i].lock);
 		INIT_HLIST_HEAD(&sctp_port_hashtable[i].chain);
 	}
 
-	pr_info("Hash tables configured (established %d bind %d)\n",
-		sctp_assoc_hashsize, sctp_port_hashsize);
+	pr_info("Hash tables configured (established %d bind %d/%d)\n",
+		sctp_assoc_hashsize, sctp_port_hashsize, num_entries);
 
 	sctp_sysctl_register();
 

[toc] | [prev] | [next] | [standalone]

#1362554 — [PATCH 3.16.y-ckt 079/142] usb: chipidea: otg: change workqueue ci_otg as freezable

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Peter Chen <peter.chen@nxp.com>

commit d144dfea8af7108f613139623e63952ed7e69c0c upstream.

If we use USB ID pin as wakeup source, and there is a USB block
device on this USB OTG (ID) cable, the system will be deadlock
after system resume.

The root cause for this problem is: the workqueue ci_otg may try
to remove hcd before the driver resume has finished, and hcd will
disconnect the device on it, then, it will call device_release_driver,
and holds the device lock "dev->mutex", but it is never unlocked since
it waits workqueue writeback to run to flush the block information, but
the workqueue writeback is freezable, it is not thawed before driver
resume has finished.

When the driver (device: sd 0:0:0:0:) resume goes to dpm_complete, it
tries to get its device lock "dev->mutex", but it can't get it forever,
then the deadlock occurs. Below call stacks show the situation.

So, in order to fix this problem, we need to change workqueue ci_otg
as freezable, then the work item in this workqueue will be run after
driver's resume, this workqueue will not be blocked forever like above
case since the workqueue writeback has been thawed too.

Tested at: i.mx6qdl-sabresd and i.mx6sx-sdb.

[  555.178869] kworker/u2:13   D c07de74c     0   826      2 0x00000000
[  555.185310] Workqueue: ci_otg ci_otg_work
[  555.189353] Backtrace:
[  555.191849] [<c07de4fc>] (__schedule) from [<c07dec6c>] (schedule+0x48/0xa0)
[  555.198912]  r10:ee471ba0 r9:00000000 r8:00000000 r7:00000002 r6:ee470000 r5:ee471ba4
[  555.206867]  r4:ee470000
[  555.209453] [<c07dec24>] (schedule) from [<c07e2fc4>] (schedule_timeout+0x15c/0x1e0)
[  555.217212]  r4:7fffffff r3:edc2b000
[  555.220862] [<c07e2e68>] (schedule_timeout) from [<c07df6c8>] (wait_for_common+0x94/0x144)
[  555.229140]  r8:00000000 r7:00000002 r6:ee470000 r5:ee471ba4 r4:7fffffff
[  555.235980] [<c07df634>] (wait_for_common) from [<c07df790>] (wait_for_completion+0x18/0x1c)
[  555.244430]  r10:00000001 r9:c0b5563c r8:c0042e48 r7:ef086000 r6:eea4372c r5:ef131b00
[  555.252383]  r4:00000000
[  555.254970] [<c07df778>] (wait_for_completion) from [<c0043cb8>] (flush_work+0x19c/0x234)
[  555.263177] [<c0043b1c>] (flush_work) from [<c0043fac>] (flush_delayed_work+0x48/0x4c)
[  555.271106]  r8:ed5b5000 r7:c0b38a3c r6:eea439cc r5:eea4372c r4:eea4372c
[  555.277958] [<c0043f64>] (flush_delayed_work) from [<c00eae18>] (bdi_unregister+0x84/0xec)
[  555.286236]  r4:eea43520 r3:20000153
[  555.289885] [<c00ead94>] (bdi_unregister) from [<c02c2154>] (blk_cleanup_queue+0x180/0x29c)
[  555.298250]  r5:eea43808 r4:eea43400
[  555.301909] [<c02c1fd4>] (blk_cleanup_queue) from [<c0417914>] (__scsi_remove_device+0x48/0xb8)
[  555.310623]  r7:00000000 r6:20000153 r5:ededa950 r4:ededa800
[  555.316403] [<c04178cc>] (__scsi_remove_device) from [<c0415e90>] (scsi_forget_host+0x64/0x68)
[  555.325028]  r5:ededa800 r4:ed5b5000
[  555.328689] [<c0415e2c>] (scsi_forget_host) from [<c0409828>] (scsi_remove_host+0x78/0x104)
[  555.337054]  r5:ed5b5068 r4:ed5b5000
[  555.340709] [<c04097b0>] (scsi_remove_host) from [<c04cdfcc>] (usb_stor_disconnect+0x50/0xb4)
[  555.349247]  r6:ed5b56e4 r5:ed5b5818 r4:ed5b5690 r3:00000008
[  555.355025] [<c04cdf7c>] (usb_stor_disconnect) from [<c04b3bc8>] (usb_unbind_interface+0x78/0x25c)
[  555.363997]  r8:c13919b4 r7:edd3c000 r6:edd3c020 r5:ee551c68 r4:ee551c00 r3:c04cdf7c
[  555.371892] [<c04b3b50>] (usb_unbind_interface) from [<c03dc248>] (__device_release_driver+0x8c/0x118)
[  555.381213]  r10:00000001 r9:edd90c00 r8:c13919b4 r7:ee551c68 r6:c0b546e0 r5:c0b5563c
[  555.389167]  r4:edd3c020
[  555.391752] [<c03dc1bc>] (__device_release_driver) from [<c03dc2fc>] (device_release_driver+0x28/0x34)
[  555.401071]  r5:edd3c020 r4:edd3c054
[  555.404721] [<c03dc2d4>] (device_release_driver) from [<c03db304>] (bus_remove_device+0xe0/0x110)
[  555.413607]  r5:edd3c020 r4:ef17f04c
[  555.417253] [<c03db224>] (bus_remove_device) from [<c03d8128>] (device_del+0x114/0x21c)
[  555.425270]  r6:edd3c028 r5:edd3c020 r4:ee551c00 r3:00000000
[  555.431045] [<c03d8014>] (device_del) from [<c04b1560>] (usb_disable_device+0xa4/0x1e8)
[  555.439061]  r8:edd3c000 r7:eded8000 r6:00000000 r5:00000001 r4:ee551c00
[  555.445906] [<c04b14bc>] (usb_disable_device) from [<c04a8e54>] (usb_disconnect+0x74/0x224)
[  555.454271]  r9:edd90c00 r8:ee551000 r7:ee551c68 r6:ee551c9c r5:ee551c00 r4:00000001
[  555.462156] [<c04a8de0>] (usb_disconnect) from [<c04a8fb8>] (usb_disconnect+0x1d8/0x224)
[  555.470259]  r10:00000001 r9:edd90000 r8:ee471e2c r7:ee551468 r6:ee55149c r5:ee551400
[  555.478213]  r4:00000001
[  555.480797] [<c04a8de0>] (usb_disconnect) from [<c04ae5ec>] (usb_remove_hcd+0xa0/0x1ac)
[  555.488813]  r10:00000001 r9:ee471eb0 r8:00000000 r7:ef3d9500 r6:eded810c r5:eded80b0
[  555.496765]  r4:eded8000
[  555.499351] [<c04ae54c>] (usb_remove_hcd) from [<c04d4158>] (host_stop+0x28/0x64)
[  555.506847]  r6:eeb50010 r5:eded8000 r4:eeb51010
[  555.511563] [<c04d4130>] (host_stop) from [<c04d09b8>] (ci_otg_work+0xc4/0x124)
[  555.518885]  r6:00000001 r5:eeb50010 r4:eeb502a0 r3:c04d4130
[  555.524665] [<c04d08f4>] (ci_otg_work) from [<c00454f0>] (process_one_work+0x194/0x420)
[  555.532682]  r6:ef086000 r5:eeb502a0 r4:edc44480
[  555.537393] [<c004535c>] (process_one_work) from [<c00457b0>] (worker_thread+0x34/0x514)
[  555.545496]  r10:edc44480 r9:ef086000 r8:c0b1a100 r7:ef086034 r6:00000088 r5:edc44498
[  555.553450]  r4:ef086000
[  555.556032] [<c004577c>] (worker_thread) from [<c004bab4>] (kthread+0xdc/0xf8)
[  555.563268]  r10:00000000 r9:00000000 r8:00000000 r7:c004577c r6:edc44480 r5:eddc15c0
[  555.571221]  r4:00000000
[  555.573804] [<c004b9d8>] (kthread) from [<c000fef0>] (ret_from_fork+0x14/0x24)
[  555.581040]  r7:00000000 r6:00000000 r5:c004b9d8 r4:eddc15c0

[  553.429383] sh              D c07de74c     0   694    691 0x00000000
[  553.435801] Backtrace:
[  553.438295] [<c07de4fc>] (__schedule) from [<c07dec6c>] (schedule+0x48/0xa0)
[  553.445358]  r10:edd3c054 r9:edd3c078 r8:edddbd50 r7:edcbbc00 r6:c1377c34 r5:60000153
[  553.453313]  r4:eddda000
[  553.455896] [<c07dec24>] (schedule) from [<c07deff8>] (schedule_preempt_disabled+0x10/0x14)
[  553.464261]  r4:edd3c058 r3:0000000a
[  553.467910] [<c07defe8>] (schedule_preempt_disabled) from [<c07e0bbc>] (mutex_lock_nested+0x1a0/0x3e8)
[  553.477254] [<c07e0a1c>] (mutex_lock_nested) from [<c03e927c>] (dpm_complete+0xc0/0x1b0)
[  553.485358]  r10:00561408 r9:edd3c054 r8:c0b4863c r7:edddbd90 r6:c0b485d8 r5:edd3c020
[  553.493313]  r4:edd3c0d0
[  553.495896] [<c03e91bc>] (dpm_complete) from [<c03e9388>] (dpm_resume_end+0x1c/0x20)
[  553.503652]  r9:00000000 r8:c0b1a9d0 r7:c1334ec0 r6:c1334edc r5:00000003 r4:00000010
[  553.511544] [<c03e936c>] (dpm_resume_end) from [<c0079894>] (suspend_devices_and_enter+0x158/0x504)
[  553.520604]  r4:00000000 r3:c1334efc
[  553.524250] [<c007973c>] (suspend_devices_and_enter) from [<c0079e74>] (pm_suspend+0x234/0x2cc)
[  553.532961]  r10:00561408 r9:ed6b7300 r8:00000004 r7:c1334eec r6:00000000 r5:c1334ee8
[  553.540914]  r4:00000003
[  553.543493] [<c0079c40>] (pm_suspend) from [<c0078a6c>] (state_store+0x6c/0xc0)

[  555.703684] 7 locks held by kworker/u2:13/826:
[  555.708140]  #0:  ("%s""ci_otg"){++++.+}, at: [<c0045484>] process_one_work+0x128/0x420
[  555.716277]  #1:  ((&ci->work)){+.+.+.}, at: [<c0045484>] process_one_work+0x128/0x420
[  555.724317]  #2:  (usb_bus_list_lock){+.+.+.}, at: [<c04ae5e4>] usb_remove_hcd+0x98/0x1ac
[  555.732626]  #3:  (&dev->mutex){......}, at: [<c04a8e28>] usb_disconnect+0x48/0x224
[  555.740403]  #4:  (&dev->mutex){......}, at: [<c04a8e28>] usb_disconnect+0x48/0x224
[  555.748179]  #5:  (&dev->mutex){......}, at: [<c03dc2f4>] device_release_driver+0x20/0x34
[  555.756487]  #6:  (&shost->scan_mutex){+.+.+.}, at: [<c04097d0>] scsi_remove_host+0x20/0x104

Cc: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/usb/chipidea/otg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/chipidea/otg.c b/drivers/usb/chipidea/otg.c
index a048b08b9d4d..92f169ca520e 100644
--- a/drivers/usb/chipidea/otg.c
+++ b/drivers/usb/chipidea/otg.c
@@ -116,7 +116,7 @@ static void ci_otg_work(struct work_struct *work)
 int ci_hdrc_otg_init(struct ci_hdrc *ci)
 {
 	INIT_WORK(&ci->work, ci_otg_work);
-	ci->wq = create_singlethread_workqueue("ci_otg");
+	ci->wq = create_freezable_workqueue("ci_otg");
 	if (!ci->wq) {
 		dev_err(ci->dev, "can't create workqueue\n");
 		return -ENODEV;

[toc] | [prev] | [next] | [standalone]

Page 3 of 7 — ← Prev page 1 2 [3] 4 5 6 7  Next page →

Back to top | Article view | linux.kernel

csiph-web